Edit tour

Windows Analysis Report
mtuXDnH1Di.exe

Overview

General Information

Sample name:	mtuXDnH1Di.exe renamed because original name is a hash value
Original sample name:	475c13ae1d446c61824315961e5838916ac4a3f28bc441aa8a2b39b81383ea4a.exe
Analysis ID:	1488113
MD5:	e4b47c06b5eed80fb44cfea757525634
SHA1:	78b5133cd84e3d89ebca4b36f33273df6e70c3f4
SHA256:	475c13ae1d446c61824315961e5838916ac4a3f28bc441aa8a2b39b81383ea4a
Tags:	exe
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to resolve many domain names, but no domain seems valid

Connects to many different domains

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Executes massive DNS lookups (> 100)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

mtuXDnH1Di.exe (PID: 2064 cmdline: "C:\Users\user\Desktop\mtuXDnH1Di.exe" MD5: E4B47C06B5EED80FB44CFEA757525634)

qbf30bzbv7f7qnhdav.exe (PID: 5064 cmdline: "C:\whfkpbh\qbf30bzbv7f7qnhdav.exe" MD5: E4B47C06B5EED80FB44CFEA757525634)

idtpqzltyfy.exe (PID: 7276 cmdline: "C:\whfkpbh\idtpqzltyfy.exe" MD5: E4B47C06B5EED80FB44CFEA757525634)

idtpqzltyfy.exe (PID: 3452 cmdline: C:\whfkpbh\idtpqzltyfy.exe MD5: E4B47C06B5EED80FB44CFEA757525634)

amdrhfskpcu.exe (PID: 7240 cmdline: wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe" MD5: E4B47C06B5EED80FB44CFEA757525634)

idtpqzltyfy.exe (PID: 7912 cmdline: "c:\whfkpbh\idtpqzltyfy.exe" MD5: E4B47C06B5EED80FB44CFEA757525634)

amdrhfskpcu.exe (PID: 7944 cmdline: wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe" MD5: E4B47C06B5EED80FB44CFEA757525634)

svchost.exe (PID: 7208 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7616 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k LocalService -s W32Time, CommandLine: C:\Windows\system32\svchost.exe -k LocalService -s W32Time, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\system32\svchost.exe -k LocalService -s W32Time, ProcessId: 7208, ProcessName: svchost.exe

Snort Signatures

Suricata Signatures

ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses - Source IP: 1.1.1.1 - Destination IP: 192.168.2.7

Timestamp:	2024-08-05T16:24:59.509195+0200
SID:	2018316
Source Port:	53
Destination Port:	60261
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.7 - Destination IP: 35.164.78.200

Timestamp:	2024-08-05T16:23:03.262802+0200
SID:	2815568
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.7 - Destination IP: 3.33.130.190

Timestamp:	2024-08-05T16:23:00.468164+0200
SID:	2815568
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses - Source IP: 1.1.1.1 - Destination IP: 192.168.2.7

Timestamp:	2024-08-05T16:23:27.903814+0200
SID:	2018316
Source Port:	53
Destination Port:	62372
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.7 - Destination IP: 3.33.130.190

Timestamp:	2024-08-05T16:24:18.320810+0200
SID:	2815568
Source Port:	59623
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses - Source IP: 1.1.1.1 - Destination IP: 192.168.2.7

Timestamp:	2024-08-05T16:23:16.089201+0200
SID:	2018316
Source Port:	53
Destination Port:	65063
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 34.246.200.160 - Destination IP: 192.168.2.7

Timestamp:	2024-08-05T16:23:07.857815+0200
SID:	2037771
Source Port:	80
Destination Port:	49702
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.7 - Destination IP: 34.246.200.160

Timestamp:	2024-08-05T16:23:07.848514+0200
SID:	2815568
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 54.244.188.177 - Destination IP: 192.168.2.7

Timestamp:	2024-08-05T16:23:21.358671+0200
SID:	2037771
Source Port:	80
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.7 - Destination IP: 85.13.130.3

Timestamp:	2024-08-05T16:23:13.975372+0200
SID:	2815568
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.7 - Destination IP: 35.164.78.200

Timestamp:	2024-08-05T16:24:48.786301+0200
SID:	2815568
Source Port:	59624
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 35.164.78.200 - Destination IP: 192.168.2.7

Timestamp:	2024-08-05T16:23:03.286503+0200
SID:	2037771
Source Port:	80
Destination Port:	49701
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 35.164.78.200 - Destination IP: 192.168.2.7

Timestamp:	2024-08-05T16:24:48.791817+0200
SID:	2037771
Source Port:	80
Destination Port:	59624
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mtuXDnH1Di.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\whfkpbh\idtpqzltyfy.exe	Avira: detection malicious, Label: TR/Nivdort.Gen2
Source: C:\whfkpbh\amdrhfskpcu.exe	Avira: detection malicious, Label: TR/Nivdort.Gen2
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Avira: detection malicious, Label: TR/Nivdort.Gen2

Multi AV Scanner detection for dropped file

Source: C:\whfkpbh\amdrhfskpcu.exe	ReversingLabs: Detection: 92%
Source: C:\whfkpbh\idtpqzltyfy.exe	ReversingLabs: Detection: 92%
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: mtuXDnH1Di.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\whfkpbh\idtpqzltyfy.exe	Joe Sandbox ML: detected
Source: C:\whfkpbh\amdrhfskpcu.exe	Joe Sandbox ML: detected
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: mtuXDnH1Di.exe

Joe Sandbox ML: detected

Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009E0920 GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,	2_2_009E0920
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00150920 GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,	3_2_00150920
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00150920 GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,	11_2_00150920

Source: mtuXDnH1Di.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: mtuXDnH1Di.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EE9580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EE9580
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009F9580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_009F9580
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00169580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00169580
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A59580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	5_2_00A59580
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00169580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00169580
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00169580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_00169580
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CF9580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	12_2_00CF9580

Networking

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: smokesystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadylaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadybranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womannorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadysystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemansystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencequarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencereceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokegeneral.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokequarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experienceconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summersystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partysystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partybranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencefriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightnorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightinclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightgeneral.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experienceneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadytrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fighttrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokebelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencebelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencebranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokenorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokehonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womantrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: watertrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokeneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadybelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencesystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knowntrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokereceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyinclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summertrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partytrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fighthonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: begintrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokeclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smoketrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemantrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partynorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshfriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womangeneral.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokeinclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followtrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womaninclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencetrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughttrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughthonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencelaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencehonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshtrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencefancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberfriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanfriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womansystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokebranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyneither.net replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 171

Source: global traffic

DNS traffic detected: number of DNS queries: 171

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtbranch.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanbelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partybelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membertrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: crowdtrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtsystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: watersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanhonor.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: freshfancy.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: alreadyfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: followfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net

Source: Joe Sandbox View	IP Address: 188.225.40.227 188.225.40.227
Source: Joe Sandbox View	IP Address: 34.246.200.160 34.246.200.160

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00EE0D80 socket,setsockopt,gethostbyname,inet_ntoa,inet_addr,htons,connect,send,recv,recv,closesocket,

0_2_00EE0D80

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtbranch.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanbelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partybelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membertrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: crowdtrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtsystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: watersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanhonor.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: freshfancy.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: alreadyfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: followfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: womanclear.net
Source: global traffic	DNS traffic detected: DNS query: smokeclear.net
Source: global traffic	DNS traffic detected: DNS query: womangeneral.net
Source: global traffic	DNS traffic detected: DNS query: smokegeneral.net
Source: global traffic	DNS traffic detected: DNS query: womaninclude.net
Source: global traffic	DNS traffic detected: DNS query: smokeinclude.net
Source: global traffic	DNS traffic detected: DNS query: womannorth.net
Source: global traffic	DNS traffic detected: DNS query: smokenorth.net
Source: global traffic	DNS traffic detected: DNS query: partyclear.net
Source: global traffic	DNS traffic detected: DNS query: fightclear.net
Source: global traffic	DNS traffic detected: DNS query: partygeneral.net
Source: global traffic	DNS traffic detected: DNS query: fightgeneral.net
Source: global traffic	DNS traffic detected: DNS query: partyinclude.net
Source: global traffic	DNS traffic detected: DNS query: fightinclude.net
Source: global traffic	DNS traffic detected: DNS query: partynorth.net
Source: global traffic	DNS traffic detected: DNS query: fightnorth.net
Source: global traffic	DNS traffic detected: DNS query: freshbranch.net
Source: global traffic	DNS traffic detected: DNS query: experiencebranch.net
Source: global traffic	DNS traffic detected: DNS query: freshbelieve.net
Source: global traffic	DNS traffic detected: DNS query: experiencebelieve.net
Source: global traffic	DNS traffic detected: DNS query: freshreceive.net
Source: global traffic	DNS traffic detected: DNS query: experiencereceive.net
Source: global traffic	DNS traffic detected: DNS query: freshquarter.net
Source: global traffic	DNS traffic detected: DNS query: experiencequarter.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanbranch.net
Source: global traffic	DNS traffic detected: DNS query: alreadybranch.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanbelieve.net
Source: global traffic	DNS traffic detected: DNS query: alreadybelieve.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanreceive.net
Source: global traffic	DNS traffic detected: DNS query: alreadyreceive.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanquarter.net
Source: global traffic	DNS traffic detected: DNS query: alreadyquarter.net
Source: global traffic	DNS traffic detected: DNS query: followbranch.net
Source: global traffic	DNS traffic detected: DNS query: memberbranch.net
Source: global traffic	DNS traffic detected: DNS query: followbelieve.net
Source: global traffic	DNS traffic detected: DNS query: memberbelieve.net
Source: global traffic	DNS traffic detected: DNS query: followreceive.net
Source: global traffic	DNS traffic detected: DNS query: memberreceive.net
Source: global traffic	DNS traffic detected: DNS query: followquarter.net
Source: global traffic	DNS traffic detected: DNS query: memberquarter.net
Source: global traffic	DNS traffic detected: DNS query: beginbranch.net
Source: global traffic	DNS traffic detected: DNS query: knownbranch.net
Source: global traffic	DNS traffic detected: DNS query: beginbelieve.net
Source: global traffic	DNS traffic detected: DNS query: knownbelieve.net
Source: global traffic	DNS traffic detected: DNS query: beginreceive.net
Source: global traffic	DNS traffic detected: DNS query: knownreceive.net
Source: global traffic	DNS traffic detected: DNS query: beginquarter.net
Source: global traffic	DNS traffic detected: DNS query: knownquarter.net
Source: global traffic	DNS traffic detected: DNS query: summerbranch.net
Source: global traffic	DNS traffic detected: DNS query: crowdbranch.net
Source: global traffic	DNS traffic detected: DNS query: summerbelieve.net
Source: global traffic	DNS traffic detected: DNS query: crowdbelieve.net
Source: global traffic	DNS traffic detected: DNS query: summerreceive.net
Source: global traffic	DNS traffic detected: DNS query: crowdreceive.net
Source: global traffic	DNS traffic detected: DNS query: summerquarter.net
Source: global traffic	DNS traffic detected: DNS query: crowdquarter.net
Source: global traffic	DNS traffic detected: DNS query: thoughtbranch.net
Source: global traffic	DNS traffic detected: DNS query: waterbranch.net
Source: global traffic	DNS traffic detected: DNS query: thoughtbelieve.net
Source: global traffic	DNS traffic detected: DNS query: waterbelieve.net
Source: global traffic	DNS traffic detected: DNS query: thoughtreceive.net
Source: global traffic	DNS traffic detected: DNS query: waterreceive.net
Source: global traffic	DNS traffic detected: DNS query: thoughtquarter.net
Source: global traffic	DNS traffic detected: DNS query: waterquarter.net
Source: global traffic	DNS traffic detected: DNS query: womanbranch.net
Source: global traffic	DNS traffic detected: DNS query: smokebranch.net
Source: global traffic	DNS traffic detected: DNS query: womanbelieve.net
Source: global traffic	DNS traffic detected: DNS query: smokebelieve.net
Source: global traffic	DNS traffic detected: DNS query: womanreceive.net
Source: global traffic	DNS traffic detected: DNS query: smokereceive.net
Source: global traffic	DNS traffic detected: DNS query: womanquarter.net
Source: global traffic	DNS traffic detected: DNS query: smokequarter.net
Source: global traffic	DNS traffic detected: DNS query: partybranch.net
Source: global traffic	DNS traffic detected: DNS query: fightbranch.net
Source: global traffic	DNS traffic detected: DNS query: partybelieve.net
Source: global traffic	DNS traffic detected: DNS query: fightbelieve.net
Source: global traffic	DNS traffic detected: DNS query: partyreceive.net
Source: global traffic	DNS traffic detected: DNS query: fightreceive.net
Source: global traffic	DNS traffic detected: DNS query: partyquarter.net
Source: global traffic	DNS traffic detected: DNS query: fightquarter.net
Source: global traffic	DNS traffic detected: DNS query: freshhonor.net
Source: global traffic	DNS traffic detected: DNS query: experiencehonor.net
Source: global traffic	DNS traffic detected: DNS query: freshneither.net
Source: global traffic	DNS traffic detected: DNS query: experienceneither.net
Source: global traffic	DNS traffic detected: DNS query: freshsystem.net
Source: global traffic	DNS traffic detected: DNS query: experiencesystem.net
Source: global traffic	DNS traffic detected: DNS query: freshtrust.net
Source: global traffic	DNS traffic detected: DNS query: experiencetrust.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanhonor.net
Source: global traffic	DNS traffic detected: DNS query: alreadyhonor.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanneither.net
Source: global traffic	DNS traffic detected: DNS query: alreadyneither.net
Source: global traffic	DNS traffic detected: DNS query: gentlemansystem.net
Source: global traffic	DNS traffic detected: DNS query: alreadysystem.net
Source: global traffic	DNS traffic detected: DNS query: gentlemantrust.net
Source: global traffic	DNS traffic detected: DNS query: alreadytrust.net
Source: global traffic	DNS traffic detected: DNS query: followhonor.net
Source: global traffic	DNS traffic detected: DNS query: memberhonor.net
Source: global traffic	DNS traffic detected: DNS query: followneither.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Mon, 05 Aug 2024 14:23:09 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 05 Aug 2024 14:23:17 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 14:23:23 GMTServer: Apache/2.4.61 (Unix)Content-Length: 196Content-Type: text/html; charset=iso-8859-1Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Source: idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fasthosts.co.uk/
Source: idtpqzltyfy.exe, 00000003.00000002.2069906189.0000000001F6D000.00000004.00000010.00020000.00000000.sdmp, idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://followfriend.net/index.php
Source: idtpqzltyfy.exe, 00000003.00000002.2069906189.0000000001F6D000.00000004.00000010.00020000.00000000.sdmp, idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_par
Source: idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fasthosts.co.uk/domain-names/search/?domain=$
Source: idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fasthosts.co.uk/get-online?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_
Source: idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-199510482-1

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	File created: C:\Windows\whfkpbh\	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	File created: C:\Windows\whfkpbh\euwvjohdxkkj	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	File created: C:\Windows\whfkpbh\euwvjohdxkkj	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	File created: C:\Windows\whfkpbh\euwvjohdxkkj	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe	File created: C:\Windows\whfkpbh\euwvjohdxkkj	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	File created: C:\Windows\whfkpbh\euwvjohdxkkj	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	File created: C:\Windows\whfkpbh\euwvjohdxkkj	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe	File created: C:\Windows\whfkpbh\euwvjohdxkkj	Jump to behavior

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

File deleted: C:\Windows\whfkpbh\euwvjohdxkkj

Jump to behavior

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EC7A04	0_2_00EC7A04
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00ED5200	0_2_00ED5200
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00ED30F0	0_2_00ED30F0
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EDA0A6	0_2_00EDA0A6
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EC1490	0_2_00EC1490
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EE55E0	0_2_00EE55E0
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EDE1C0	0_2_00EDE1C0
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EE0D80	0_2_00EE0D80
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EDF160	0_2_00EDF160
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00ECE550	0_2_00ECE550
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EDA930	0_2_00EDA930
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EF5930	0_2_00EF5930
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EE66E7	0_2_00EE66E7
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EE4EA0	0_2_00EE4EA0
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EE22A0	0_2_00EE22A0
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EF0A90	0_2_00EF0A90
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EE6A7B	0_2_00EE6A7B
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EF0220	0_2_00EF0220
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00ED97B0	0_2_00ED97B0
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00ECD760	0_2_00ECD760
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00ECF330	0_2_00ECF330
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EEE70B	0_2_00EEE70B
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EE9B00	0_2_00EE9B00
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009EA930	2_2_009EA930
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009D7A04	2_2_009D7A04
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009E5200	2_2_009E5200
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009F9B00	2_2_009F9B00
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009D1490	2_2_009D1490
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009EA0A6	2_2_009EA0A6
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009E30F0	2_2_009E30F0
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009F0D80	2_2_009F0D80
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009EE1C0	2_2_009EE1C0
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009F55E0	2_2_009F55E0
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_00A05930	2_2_00A05930
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009DE550	2_2_009DE550
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009EF160	2_2_009EF160
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_00A00A90	2_2_00A00A90
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009F4EA0	2_2_009F4EA0
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009F22A0	2_2_009F22A0
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009F66E7	2_2_009F66E7
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_00A00220	2_2_00A00220
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009F6A7B	2_2_009F6A7B
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009E97B0	2_2_009E97B0
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009FE70B	2_2_009FE70B
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009DF330	2_2_009DF330
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009DD760	2_2_009DD760
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0015A930	3_2_0015A930
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00160D80	3_2_00160D80
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00147A04	3_2_00147A04
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00155200	3_2_00155200
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_001622A0	3_2_001622A0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00169B00	3_2_00169B00
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00141490	3_2_00141490
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0015A0A6	3_2_0015A0A6
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_001530F0	3_2_001530F0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00175930	3_2_00175930
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0014E550	3_2_0014E550
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0015F160	3_2_0015F160
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0015E1C0	3_2_0015E1C0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_001655E0	3_2_001655E0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00170220	3_2_00170220
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00166A7B	3_2_00166A7B
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00170A90	3_2_00170A90
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00164EA0	3_2_00164EA0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_001666E7	3_2_001666E7
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0016E70C	3_2_0016E70C
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0014F330	3_2_0014F330
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0014D760	3_2_0014D760
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_001597B0	3_2_001597B0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A45200	5_2_00A45200
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A37A04	5_2_00A37A04
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A4A0A6	5_2_00A4A0A6
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A31490	5_2_00A31490
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A430F0	5_2_00A430F0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A50D80	5_2_00A50D80
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A555E0	5_2_00A555E0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A4E1C0	5_2_00A4E1C0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A4A930	5_2_00A4A930
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A65930	5_2_00A65930
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A4F160	5_2_00A4F160
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A3E550	5_2_00A3E550
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A54EA0	5_2_00A54EA0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A522A0	5_2_00A522A0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A60A90	5_2_00A60A90
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A566E7	5_2_00A566E7
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A60220	5_2_00A60220
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A56A7B	5_2_00A56A7B
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A497B0	5_2_00A497B0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A5E726	5_2_00A5E726
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A3F330	5_2_00A3F330
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A59B00	5_2_00A59B00
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A3D760	5_2_00A3D760
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00147A04	6_2_00147A04
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00155200	6_2_00155200
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00141490	6_2_00141490
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0015A0A6	6_2_0015A0A6
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_001530F0	6_2_001530F0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0015A930	6_2_0015A930
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00175930	6_2_00175930
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0014E550	6_2_0014E550
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0015F160	6_2_0015F160
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00160D80	6_2_00160D80
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0015E1C0	6_2_0015E1C0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_001655E0	6_2_001655E0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00170220	6_2_00170220
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00166A7B	6_2_00166A7B
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00170A90	6_2_00170A90
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00164EA0	6_2_00164EA0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_001622A0	6_2_001622A0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_001666E7	6_2_001666E7
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00169B00	6_2_00169B00
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0016E70C	6_2_0016E70C
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0014F330	6_2_0014F330
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0014D760	6_2_0014D760
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_001597B0	6_2_001597B0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0015A930	11_2_0015A930
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00160D80	11_2_00160D80
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00147A04	11_2_00147A04
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00155200	11_2_00155200
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_001622A0	11_2_001622A0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00169B00	11_2_00169B00
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00141490	11_2_00141490
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0015A0A6	11_2_0015A0A6
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_001530F0	11_2_001530F0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00175930	11_2_00175930
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0014E550	11_2_0014E550
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0015F160	11_2_0015F160
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0015E1C0	11_2_0015E1C0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_001655E0	11_2_001655E0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00170220	11_2_00170220
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00166A7B	11_2_00166A7B
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00170A90	11_2_00170A90
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00164EA0	11_2_00164EA0
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_001666E7	11_2_001666E7
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0016E70C	11_2_0016E70C
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0014F330	11_2_0014F330
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0014D760	11_2_0014D760
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_001597B0	11_2_001597B0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CD7A04	12_2_00CD7A04
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CE5200	12_2_00CE5200
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CE30F0	12_2_00CE30F0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CD1490	12_2_00CD1490
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CEA0A6	12_2_00CEA0A6
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CEE1C0	12_2_00CEE1C0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CF55E0	12_2_00CF55E0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CF0D80	12_2_00CF0D80
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CDE550	12_2_00CDE550
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CEF160	12_2_00CEF160
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00D05930	12_2_00D05930
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CEA930	12_2_00CEA930
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CF66E7	12_2_00CF66E7
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00D00A90	12_2_00D00A90
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CF4EA0	12_2_00CF4EA0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CF22A0	12_2_00CF22A0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CF6A7B	12_2_00CF6A7B
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00D00220	12_2_00D00220
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CE97B0	12_2_00CE97B0
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CDD760	12_2_00CDD760
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CFE70C	12_2_00CFE70C
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CF9B00	12_2_00CF9B00
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CDF330	12_2_00CDF330

Source: mtuXDnH1Di.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal88.troj.winEXE@14/5@215/12

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	0_2_00ED0500
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	2_2_009E0500
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	3_2_00150500
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	5_2_00A40500
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	6_2_00150500
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	11_2_00150500
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	12_2_00CE0500

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00ED2120 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00ED2120

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00ED0500 OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

0_2_00ED0500

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00ECC660 StartServiceCtrlDispatcherA,	0_2_00ECC660
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009DC660 StartServiceCtrlDispatcherA,	2_2_009DC660
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0014C660 StartServiceCtrlDispatcherA,	3_2_0014C660
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A3C660 StartServiceCtrlDispatcherA,	5_2_00A3C660
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0014C660 StartServiceCtrlDispatcherA,	6_2_0014C660
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0014C660 StartServiceCtrlDispatcherA,	11_2_0014C660
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CDC660 StartServiceCtrlDispatcherA,	12_2_00CDC660

Source: C:\whfkpbh\amdrhfskpcu.exe

Mutant created: NULL

Source: mtuXDnH1Di.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mtuXDnH1Di.exe

ReversingLabs: Detection: 92%

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

File read: C:\Users\user\Desktop\mtuXDnH1Di.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\mtuXDnH1Di.exe "C:\Users\user\Desktop\mtuXDnH1Di.exe"
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Process created: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe "C:\whfkpbh\qbf30bzbv7f7qnhdav.exe"
Source: unknown	Process created: C:\whfkpbh\idtpqzltyfy.exe C:\whfkpbh\idtpqzltyfy.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\whfkpbh\idtpqzltyfy.exe	Process created: C:\whfkpbh\amdrhfskpcu.exe wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe"
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Process created: C:\whfkpbh\idtpqzltyfy.exe "C:\whfkpbh\idtpqzltyfy.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\whfkpbh\amdrhfskpcu.exe	Process created: C:\whfkpbh\idtpqzltyfy.exe "c:\whfkpbh\idtpqzltyfy.exe"
Source: C:\whfkpbh\idtpqzltyfy.exe	Process created: C:\whfkpbh\amdrhfskpcu.exe wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe"
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Process created: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe "C:\whfkpbh\qbf30bzbv7f7qnhdav.exe"	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Process created: C:\whfkpbh\idtpqzltyfy.exe "C:\whfkpbh\idtpqzltyfy.exe"	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Process created: C:\whfkpbh\amdrhfskpcu.exe wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe"	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe	Process created: C:\whfkpbh\idtpqzltyfy.exe "c:\whfkpbh\idtpqzltyfy.exe"	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Process created: C:\whfkpbh\amdrhfskpcu.exe wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe"	Jump to behavior

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: mtuXDnH1Di.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00EDA930 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

0_2_00EDA930

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EEE45B push 00000003h; iretd	0_2_00EEE45F
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EECE6F pushad ; ret	0_2_00EECE70
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EECE6A pushad ; ret	0_2_00EECE6B
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009FE45B push 00000003h; iretd	2_2_009FE45F
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009FCE6F pushad ; ret	2_2_009FCE70
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0016E45B push 00000003h; iretd	3_2_0016E45F
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0016CE6F pushad ; ret	3_2_0016CE70
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_0016CE6A pushad ; ret	3_2_0016CE6B
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A5E45B push 00000003h; iretd	5_2_00A5E45F
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A5CE6F pushad ; ret	5_2_00A5CE70
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A5CE6A pushad ; ret	5_2_00A5CE6B
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0016E45B push 00000003h; iretd	6_2_0016E45F
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0016CE6F pushad ; ret	6_2_0016CE70
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_0016CE6A pushad ; ret	6_2_0016CE6B
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0016E45B push 00000003h; iretd	11_2_0016E45F
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0016CE6F pushad ; ret	11_2_0016CE70
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_0016CE6A pushad ; ret	11_2_0016CE6B
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CFE45B push 00000003h; iretd	12_2_00CFE45F
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CFCE6F pushad ; ret	12_2_00CFCE70
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CFCE6A pushad ; ret	12_2_00CFCE6B

Source: mtuXDnH1Di.exe	Static PE information: section name: .text entropy: 6.86562473291782
Source: qbf30bzbv7f7qnhdav.exe.0.dr	Static PE information: section name: .text entropy: 6.86562473291782
Source: idtpqzltyfy.exe.2.dr	Static PE information: section name: .text entropy: 6.86562473291782
Source: amdrhfskpcu.exe.3.dr	Static PE information: section name: .text entropy: 6.86562473291782

Source: C:\whfkpbh\idtpqzltyfy.exe	File created: C:\whfkpbh\amdrhfskpcu.exe	Jump to dropped file
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	File created: C:\whfkpbh\idtpqzltyfy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	File created: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00ED0500 OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

0_2_00ED0500

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	0_2_00ECAF20
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	2_2_009DAF20
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	3_2_0014AF20
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	5_2_00A3AF20
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	6_2_0014AF20
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	11_2_0014AF20
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	12_2_00CDAF20

Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,	2_2_009EA930
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,	3_2_0015A930
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,	11_2_0015A930

Source: C:\whfkpbh\amdrhfskpcu.exe	Window / User API: threadDelayed 656	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe	Window / User API: threadDelayed 1220	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Window / User API: threadDelayed 365	Jump to behavior

Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_2-11326
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-11289
Source: C:\whfkpbh\amdrhfskpcu.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_5-11374
Source: C:\whfkpbh\idtpqzltyfy.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_3-11264

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-9791
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_2-10024
Source: C:\whfkpbh\idtpqzltyfy.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_3-10273
Source: C:\whfkpbh\amdrhfskpcu.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_5-9834

Source: C:\whfkpbh\amdrhfskpcu.exe TID: 7244	Thread sleep count: 656 > 30	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe TID: 7244	Thread sleep time: -656000s >= -30000s	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe TID: 7244	Thread sleep count: 1220 > 30	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe TID: 7244	Thread sleep time: -1220000s >= -30000s	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe TID: 7916	Thread sleep count: 365 > 30	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe TID: 7916	Thread sleep time: -18250000s >= -30000s	Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe TID: 7916	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe TID: 7948	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\whfkpbh\amdrhfskpcu.exe TID: 7948	Thread sleep time: -44000s >= -30000s	Jump to behavior

Source: C:\whfkpbh\idtpqzltyfy.exe	Last function: Thread delayed
Source: C:\whfkpbh\idtpqzltyfy.exe	Last function: Thread delayed
Source: C:\whfkpbh\idtpqzltyfy.exe	Last function: Thread delayed
Source: C:\whfkpbh\amdrhfskpcu.exe	Last function: Thread delayed
Source: C:\whfkpbh\amdrhfskpcu.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	Code function: 0_2_00EE9580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EE9580
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	Code function: 2_2_009F9580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_009F9580
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 3_2_00169580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00169580
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 5_2_00A59580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	5_2_00A59580
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 6_2_00169580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00169580
Source: C:\whfkpbh\idtpqzltyfy.exe	Code function: 11_2_00169580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_00169580
Source: C:\whfkpbh\amdrhfskpcu.exe	Code function: 12_2_00CF9580 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	12_2_00CF9580

Source: C:\whfkpbh\idtpqzltyfy.exe	Thread delayed: delay time: 50000			Jump to behavior
Source: C:\whfkpbh\idtpqzltyfy.exe	Thread delayed: delay time: 50000			Jump to behavior

Source: idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: idtpqzltyfy.exe, 0000000B.00000002.2532750642.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: qbf30bzbv7f7qnhdav.exe, 00000002.00000002.1323006933.000000000129E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2532468063.0000021D46824000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	API call chain: ExitProcess graph end node	graph_0-9573
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	API call chain: ExitProcess graph end node	graph_0-9567
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	API call chain: ExitProcess graph end node	graph_0-9585
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	API call chain: ExitProcess graph end node	graph_0-9528
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	API call chain: ExitProcess graph end node	graph_0-9931
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	API call chain: ExitProcess graph end node	graph_0-10308
Source: C:\Users\user\Desktop\mtuXDnH1Di.exe	API call chain: ExitProcess graph end node	graph_0-9514
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	API call chain: ExitProcess graph end node	graph_2-9636
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	API call chain: ExitProcess graph end node	graph_2-9619
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	API call chain: ExitProcess graph end node	graph_2-9601
Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	API call chain: ExitProcess graph end node	graph_2-9652
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_3-9574
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_3-9550
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_3-9563
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_3-9495
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_3-9509
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_3-9534
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_3-9483
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node	graph_5-9623
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node	graph_5-9994
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node	graph_5-9650
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node	graph_5-9587
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node	graph_5-9574
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node	graph_5-9435
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node	graph_5-9606
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_6-9593
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_6-9951
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_6-9583
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_6-9609
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_6-9548
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node	graph_6-9565
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\idtpqzltyfy.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node
Source: C:\whfkpbh\amdrhfskpcu.exe	API call chain: ExitProcess graph end node

Source: C:\whfkpbh\idtpqzltyfy.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00EDA930 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

0_2_00EDA930

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00ECE2C0 GetProcessHeap,RtlAllocateHeap,

0_2_00ECE2C0

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00ECB7A0 AllocateAndInitializeSid,CheckTokenMembership,

0_2_00ECB7A0

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00EF50E0 GetSystemTime,GetTickCount,

0_2_00EF50E0

Source: C:\Users\user\Desktop\mtuXDnH1Di.exe

Code function: 0_2_00ED5200 GetVersionExA,CreateDirectoryA,DeleteFileA,RemoveDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,GetTempPathA,CreateDirectoryA,GetTempPathA,SetFileAttributesA,

0_2_00ED5200

Source: C:\whfkpbh\qbf30bzbv7f7qnhdav.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Service Execution	14 Windows Service	14 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Service Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	4 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
mtuXDnH1Di.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
mtuXDnH1Di.exe	100%	Avira	TR/Nivdort.Gen2
mtuXDnH1Di.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\whfkpbh\idtpqzltyfy.exe	100%	Avira	TR/Nivdort.Gen2
C:\whfkpbh\amdrhfskpcu.exe	100%	Avira	TR/Nivdort.Gen2
C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	100%	Avira	TR/Nivdort.Gen2
C:\whfkpbh\idtpqzltyfy.exe	100%	Joe Sandbox ML
C:\whfkpbh\amdrhfskpcu.exe	100%	Joe Sandbox ML
C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	100%	Joe Sandbox ML
C:\whfkpbh\amdrhfskpcu.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
C:\whfkpbh\idtpqzltyfy.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
C:\whfkpbh\qbf30bzbv7f7qnhdav.exe	92%	ReversingLabs	Win32.Spyware.Nivdort

Source	Detection	Scanner	Label
https://www.fasthosts.co.uk/get-online?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_	0%	Avira URL Cloud	safe
https://www.fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_par	0%	Avira URL Cloud	safe
https://fasthosts.co.uk/	0%	Avira URL Cloud	safe
https://followfriend.net/index.php	0%	Avira URL Cloud	safe
https://www.fasthosts.co.uk/domain-names/search/?domain=$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
crowdtrust.net	170.187.200.48	true	false	unknown
watersystem.net	64.190.63.222	true	false	unknown
thoughtsystem.net	213.171.195.105	true	false	unknown
membersystem.net	85.13.130.3	true	false	unknown
partygeneral.net	3.33.130.190	true	false	unknown
womanbelieve.net	15.197.142.173	true	false	unknown
womanhonor.net	54.244.188.177	true	false	unknown
membertrust.net	3.33.130.190	true	false	unknown
memberreceive.net	35.164.78.200	true	false	unknown
followfriend.net	188.225.40.227	true	false	unknown
partybelieve.net	15.197.192.55	true	false	unknown
freshfancy.net	81.169.145.88	true	false	unknown
alreadyfriend.net	15.197.192.55	true	false	unknown
thoughtbranch.net	34.246.200.160	true	false	unknown
beginhonor.net	unknown	unknown	true	unknown
memberlaughter.net	unknown	unknown	true	unknown
freshneither.net	unknown	unknown	true	unknown
thoughtneither.net	unknown	unknown	true	unknown
experiencefancy.net	unknown	unknown	true	unknown
followconsider.net	unknown	unknown	true	unknown
alreadyhonor.net	unknown	unknown	true	unknown
fighttrust.net	unknown	unknown	true	unknown
knownsystem.net	unknown	unknown	true	unknown
gentlemanhonor.net	unknown	unknown	true	unknown
memberfriend.net	unknown	unknown	true	unknown
freshtrust.net	unknown	unknown	true	unknown
experiencetrust.net	unknown	unknown	true	unknown
alreadybelieve.net	unknown	unknown	true	unknown
partyclear.net	unknown	unknown	true	unknown
waterquarter.net	unknown	unknown	true	unknown
fightbranch.net	unknown	unknown	true	unknown
knownlaughter.net	unknown	unknown	true	unknown
followtrust.net	unknown	unknown	true	unknown
experiencebelieve.net	unknown	unknown	true	unknown
summerhonor.net	unknown	unknown	true	unknown
thoughttrust.net	unknown	unknown	true	unknown
freshhonor.net	unknown	unknown	true	unknown
followfancy.net	unknown	unknown	true	unknown
freshfriend.net	unknown	unknown	true	unknown
freshconsider.net	unknown	unknown	true	unknown
summerquarter.net	unknown	unknown	true	unknown
gentlemantrust.net	unknown	unknown	true	unknown
fightinclude.net	unknown	unknown	true	unknown
gentlemanlaughter.net	unknown	unknown	true	unknown
memberbelieve.net	unknown	unknown	true	unknown
alreadylaughter.net	unknown	unknown	true	unknown
summerreceive.net	unknown	unknown	true	unknown
smokequarter.net	unknown	unknown	true	unknown
experiencesystem.net	unknown	unknown	true	unknown
thoughthonor.net	unknown	unknown	true	unknown
followbelieve.net	unknown	unknown	true	unknown
knowntrust.net	unknown	unknown	true	unknown
partybranch.net	unknown	unknown	true	unknown
crowdneither.net	unknown	unknown	true	unknown
womaninclude.net	unknown	unknown	true	unknown
smokebelieve.net	unknown	unknown	true	unknown
fightnorth.net	unknown	unknown	true	unknown
gentlemanneither.net	unknown	unknown	true	unknown
followquarter.net	unknown	unknown	true	unknown
knownhonor.net	unknown	unknown	true	unknown
womantrust.net	unknown	unknown	true	unknown
memberquarter.net	unknown	unknown	true	unknown
experiencefriend.net	unknown	unknown	true	unknown
waterbranch.net	unknown	unknown	true	unknown
smoketrust.net	unknown	unknown	true	unknown
gentlemanreceive.net	unknown	unknown	true	unknown
fightsystem.net	unknown	unknown	true	unknown
memberfancy.net	unknown	unknown	true	unknown
crowdhonor.net	unknown	unknown	true	unknown
summerbelieve.net	unknown	unknown	true	unknown
womanbranch.net	unknown	unknown	true	unknown
crowdbranch.net	unknown	unknown	true	unknown
beginbranch.net	unknown	unknown	true	unknown
experiencehonor.net	unknown	unknown	true	unknown
waterreceive.net	unknown	unknown	true	unknown
gentlemansystem.net	unknown	unknown	true	unknown
crowdsystem.net	unknown	unknown	true	unknown
knownbelieve.net	unknown	unknown	true	unknown
knownquarter.net	unknown	unknown	true	unknown
beginsystem.net	unknown	unknown	true	unknown
followsystem.net	unknown	unknown	true	unknown
crowdreceive.net	unknown	unknown	true	unknown
alreadyquarter.net	unknown	unknown	true	unknown
beginquarter.net	unknown	unknown	true	unknown
freshbelieve.net	unknown	unknown	true	unknown
alreadyconsider.net	unknown	unknown	true	unknown
alreadytrust.net	unknown	unknown	true	unknown
freshquarter.net	unknown	unknown	true	unknown
gentlemanfriend.net	unknown	unknown	true	unknown
beginbelieve.net	unknown	unknown	true	unknown
memberhonor.net	unknown	unknown	true	unknown
summersystem.net	unknown	unknown	true	unknown
partyquarter.net	unknown	unknown	true	unknown
alreadyfancy.net	unknown	unknown	true	unknown
fightneither.net	unknown	unknown	true	unknown
alreadybranch.net	unknown	unknown	true	unknown
partynorth.net	unknown	unknown	true	unknown
womangeneral.net	unknown	unknown	true	unknown
thoughtreceive.net	unknown	unknown	true	unknown
smokegeneral.net	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fasthosts.co.uk/	idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fasthosts.co.uk/domain-names/search/?domain=$	idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://followfriend.net/index.php	idtpqzltyfy.exe, 00000003.00000002.2069906189.0000000001F6D000.00000004.00000010.00020000.00000000.sdmp, idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fasthosts.co.uk/get-online?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_	idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_par	idtpqzltyfy.exe, 00000003.00000002.2069906189.0000000001F6D000.00000004.00000010.00020000.00000000.sdmp, idtpqzltyfy.exe, 00000003.00000002.2069414973.000000000113A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.225.40.227	followfriend.net	Russian Federation	9123	TIMEWEB-ASRU	false
34.246.200.160	thoughtbranch.net	United States	16509	AMAZON-02US	false
35.164.78.200	memberreceive.net	United States	16509	AMAZON-02US	false
15.197.142.173	womanbelieve.net	United States	7430	TANDEMUS	false
64.190.63.222	watersystem.net	United States	11696	NBS11696US	false
85.13.130.3	membersystem.net	Germany	34788	NMM-ASD-02742FriedersdorfHauptstrasse68DE	false
170.187.200.48	crowdtrust.net	United States	7018	ATT-INTERNET4US	false
54.244.188.177	womanhonor.net	United States	16509	AMAZON-02US	false
15.197.192.55	partybelieve.net	United States	7430	TANDEMUS	false
3.33.130.190	partygeneral.net	United States	8987	AMAZONEXPANSIONGB	false
213.171.195.105	thoughtsystem.net	United Kingdom	8560	ONEANDONE-ASBrauerstrasse48DE	false
81.169.145.88	freshfancy.net	Germany	6724	STRATOSTRATOAGDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488113
Start date and time:	2024-08-05 16:21:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mtuXDnH1Di.exe renamed because original name is a hash value
Original Sample Name:	475c13ae1d446c61824315961e5838916ac4a3f28bc441aa8a2b39b81383ea4a.exe
Detection:	MAL
Classification:	mal88.troj.winEXE@14/5@215/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 82 Number of non-executed functions: 88
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 40.119.148.38
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: mtuXDnH1Di.exe

Simulations

Behavior and APIs

Time	Type	Description
11:45:33	API Interceptor	1858x Sleep call for process: amdrhfskpcu.exe modified
11:46:18	API Interceptor	428x Sleep call for process: idtpqzltyfy.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.225.40.227	BeR96suzTx.exe	Get hash	malicious	FormBook	Browse	www.skazhiraku.net/itq4/?ATvHA=k2MpXHpX2FlDSbL&m8=xx/ELnNnKvtlLUNVhX4h3nTX7+vGZrU3iKsqjiSQXnXFY1tr2Fuuzh2bLYvRiJP5MpAf
	Rh3zHXGC0W.exe	Get hash	malicious	FormBook	Browse	www.ikra-prem.space/g8kn/?3f=SObGRIQc2SXqBOlWxSNvpO1BE/+cxQu6skH9Iz/5ZN4shibJkSmH+F/+6dh/KvA+GdhZXNtYOg==&s2J=v6Ah24bh4tF
	doc88.exe	Get hash	malicious	FormBook	Browse	www.skazhiraku.net/itq4/?BJ=xx/ELnNnKvtlLUNVhX4h3nTX7+vGZrU3iKsqjiSQXnXFY1tr2Fuuzh2bLbPBtofBSMpY&k6Apv=4hB0VF
	p6le0wM39E.exe	Get hash	malicious	DCRat	Browse	cq80904.tmweb.ru/vmHttpdefaultDb.php?K5Glm1IjUwWQCq0Uioy42v=MLZsFTiDn8Em9rir7K7wImpq3&EXQnpxYJ4aMICQvs=R7D0m961u58njgszmOLxASR&0xIfyHrB=3XszmcYUw52afU&3fe0eef725958b7929a02603a5aa73a2=f84fad6cd29a3006db8b86eab6e3e434&36f380f5a045f0456c7866159c7edf74=AZ4YzM3YjZzgDNxkzM5UzMhNTNmVTNhNjN0MmZ4EmN4gzYmVjN4kTZ&K5Glm1IjUwWQCq0Uioy42v=MLZsFTiDn8Em9rir7K7wImpq3&EXQnpxYJ4aMICQvs=R7D0m961u58njgszmOLxASR&0xIfyHrB=3XszmcYUw52afU
	UYAfvxRha7.exe	Get hash	malicious	DCRat	Browse	cq80904.tmweb.ru/vmHttpdefaultDb.php?wNx8559dK63E8kRo7N3gYQ=50VYeNDsGBfOUR3suNfn4yWU&3fe0eef725958b7929a02603a5aa73a2=f84fad6cd29a3006db8b86eab6e3e434&36f380f5a045f0456c7866159c7edf74=AZ1MGNjVWZkZTMmRGOmRjNiZWMlNzYiNGZwEmY2UjNlRGZyMmZyQWM&wNx8559dK63E8kRo7N3gYQ=50VYeNDsGBfOUR3suNfn4yWU
34.246.200.160	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	thoughtbranch.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	thoughtbranch.net/index.php
	7sAylAXBOb.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	7sAylAXBOb.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	5a5O0c0oJP.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	5a5O0c0oJP.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	Jla3M8Fe16.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
35.164.78.200	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	memberreceive.net/index.php
35.164.78.200	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	memberreceive.net/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
membertrust.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
membertrust.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
watersystem.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
watersystem.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
memberreceive.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	35.164.78.200
memberreceive.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	35.164.78.200
partybelieve.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	15.197.192.55
partybelieve.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	15.197.192.55
crowdtrust.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
crowdtrust.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
thoughtsystem.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	213.171.195.105
thoughtsystem.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	213.171.195.105
womanbelieve.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	15.197.142.173
womanbelieve.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	15.197.142.173
womanhonor.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
womanhonor.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
partygeneral.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
partygeneral.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
membersystem.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
membersystem.net	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Exv453QQIX.exe	Get hash	malicious	FormBook	Browse	76.223.105.230
	OneDriveSetup.exe	Get hash	malicious	ZTrat	Browse	3.126.224.214
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	76.223.67.189
	http://verizonwireless-employmentvalidation.com	Get hash	malicious	Unknown	Browse	3.124.93.206
	UjCrfOAkJJiZyZh.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	75.2.115.196
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	.exe	Get hash	malicious	Unknown	Browse	52.42.85.34
	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	35.165.37.251
	https://logicalisuk.my.salesforce.com/setup/emailverif?oid=00D3z000001dzz1&k=Cj4KNQoPMDBEM3owMDAwMDFkenoxEg8wMkczejAwMDAwMFdWOE4aDzAwNTN6MDAwMDBCdWh6dSAFGN_3tJGSMhIQI3v2gs0Smh5HbrrPi2pb3BoMcA-pPOdt_d3-rPC6InFa7HDV_iW9LDPj8xH7hSk3un-1pgfjZvlK5Tv9PNw3ZrbyGYfST1J6GqYfWaKhB7o4-QA7gl67FLrZibn5D9yjxqT_I5lQp1_GTYo4JMlLKQM4byvWuZajquUzFQE2W0EVG_exs3QFRWcL3FGdq-ebSw%3D%3D	Get hash	malicious	Unknown	Browse	99.81.213.111
TIMEWEB-ASRU	Runtime Broker.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	r6KYedz4VQ.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	Gz3zPqMdtn.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	cnGgzU2rkd.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	https://diigo.com/0wzrly?ID=QtERFQmXrhNlWxfeW9PbYZfS3+Email=ambre.boyon@gerflor.com	Get hash	malicious	Unknown	Browse	188.225.39.170
	5F6Ny9UaKt.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	LisectAVT_2403002C_62.dll	Get hash	malicious	Emotet	Browse	188.225.32.231
	qqMLbietPf.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	Reference ID6f5f047b6cdf41716e164ec64879e463.eml	Get hash	malicious	HTMLPhisher	Browse	185.114.245.110
	https://sites.google.com/view/dcnoterialsecu/accueil	Get hash	malicious	Unknown	Browse	92.53.96.121
AMAZON-02US	Exv453QQIX.exe	Get hash	malicious	FormBook	Browse	76.223.105.230
	OneDriveSetup.exe	Get hash	malicious	ZTrat	Browse	3.126.224.214
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	76.223.67.189
	http://verizonwireless-employmentvalidation.com	Get hash	malicious	Unknown	Browse	3.124.93.206
	UjCrfOAkJJiZyZh.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	75.2.115.196
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	.exe	Get hash	malicious	Unknown	Browse	52.42.85.34
	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	35.165.37.251
	https://logicalisuk.my.salesforce.com/setup/emailverif?oid=00D3z000001dzz1&k=Cj4KNQoPMDBEM3owMDAwMDFkenoxEg8wMkczejAwMDAwMFdWOE4aDzAwNTN6MDAwMDBCdWh6dSAFGN_3tJGSMhIQI3v2gs0Smh5HbrrPi2pb3BoMcA-pPOdt_d3-rPC6InFa7HDV_iW9LDPj8xH7hSk3un-1pgfjZvlK5Tv9PNw3ZrbyGYfST1J6GqYfWaKhB7o4-QA7gl67FLrZibn5D9yjxqT_I5lQp1_GTYo4JMlLKQM4byvWuZajquUzFQE2W0EVG_exs3QFRWcL3FGdq-ebSw%3D%3D	Get hash	malicious	Unknown	Browse	99.81.213.111
TANDEMUS	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	15.197.192.55
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	15.197.192.55
	https://berobv.nl/	Get hash	malicious	Unknown	Browse	15.197.193.217
	https://myallsouth.com/privacy-policy/	Get hash	malicious	Unknown	Browse	15.197.193.217
	http://www.gouv-link.com/reglement	Get hash	malicious	Unknown	Browse	15.197.130.221
	https://heyflow.id/new-document-share-with-you	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	QLLafoDdqv.exe	Get hash	malicious	FormBook	Browse	15.197.172.60
	https://www.globalepic.co.kr/view.php?ud=202408011057515744edd3030223_29	Get hash	malicious	Unknown	Browse	15.197.193.217
	http://telstra-103141.weeblysite.com/	Get hash	malicious	Unknown	Browse	15.197.193.217
	http://telstra-107250.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217

Process:	C:\Users\user\Desktop\mtuXDnH1Di.exe
File Type:	data
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:zon:8
MD5:	68678699ABEA681A3BEF7BC9C04AA0DB
SHA1:	645AEBCE823CBFA211ECD2FA4878A586CC4ABE8E
SHA-256:	10F46E566F4A87C8973338326C4C0E497E0920983CCFE6BA82F734B5A00C3C64
SHA-512:	7D197C701C93120144A167E7AF27009583D56D80DF9861DE0897C4E16A45AE12B94457EA048D4D4C3978E6EF32EED3B49185356B201E282B955C8FD80713ED94
Malicious:	false
Reputation:	low
Preview:	..dd..b

C:\whfkpbh\amdrhfskpcu.exe

Download File

Process:	C:\whfkpbh\idtpqzltyfy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	279552
Entropy (8bit):	7.1352696053252345
Encrypted:	false
SSDEEP:	6144:TLg1drHvFTdNWJDRm03jJGxoyApQU/waqElD:Te5RTWr/TJpZ/h
MD5:	E4B47C06B5EED80FB44CFEA757525634
SHA1:	78B5133CD84E3D89EBCA4B36F33273DF6E70C3F4
SHA-256:	475C13AE1D446C61824315961E5838916AC4A3F28BC441AA8A2B39B81383EA4A
SHA-512:	BEF0195A513A28E7C9868BCA359A4F1726C9F8D15204B743C0E2467E6F6C68A67994E737C82997FEF0C2BB9DCFC206100A0A52E756D286FBAF1E56D2E04E7843
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2f..S...S...S....s..S...S..S.......S.......S.......S..Rich.S..........................PE..L....0.V.................R...........E.......p....@..........................`............@....................................P....................................................................................p...............................text....Q.......R.................. ..`.rdata..(I...p...J...V..............@..@.data...,...........................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\whfkpbh\euwvjohdxkkj

Download File

Process:	C:\Users\user\Desktop\mtuXDnH1Di.exe
File Type:	data
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:zon:8
MD5:	68678699ABEA681A3BEF7BC9C04AA0DB
SHA1:	645AEBCE823CBFA211ECD2FA4878A586CC4ABE8E
SHA-256:	10F46E566F4A87C8973338326C4C0E497E0920983CCFE6BA82F734B5A00C3C64
SHA-512:	7D197C701C93120144A167E7AF27009583D56D80DF9861DE0897C4E16A45AE12B94457EA048D4D4C3978E6EF32EED3B49185356B201E282B955C8FD80713ED94
Malicious:	false
Reputation:	low
Preview:	..dd..b

C:\whfkpbh\idtpqzltyfy.exe

Download File

Process:	C:\whfkpbh\qbf30bzbv7f7qnhdav.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	279552
Entropy (8bit):	7.1352696053252345
Encrypted:	false
SSDEEP:	6144:TLg1drHvFTdNWJDRm03jJGxoyApQU/waqElD:Te5RTWr/TJpZ/h
MD5:	E4B47C06B5EED80FB44CFEA757525634
SHA1:	78B5133CD84E3D89EBCA4B36F33273DF6E70C3F4
SHA-256:	475C13AE1D446C61824315961E5838916AC4A3F28BC441AA8A2B39B81383EA4A
SHA-512:	BEF0195A513A28E7C9868BCA359A4F1726C9F8D15204B743C0E2467E6F6C68A67994E737C82997FEF0C2BB9DCFC206100A0A52E756D286FBAF1E56D2E04E7843
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2f..S...S...S....s..S...S..S.......S.......S.......S..Rich.S..........................PE..L....0.V.................R...........E.......p....@..........................`............@....................................P....................................................................................p...............................text....Q.......R.................. ..`.rdata..(I...p...J...V..............@..@.data...,...........................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\whfkpbh\qbf30bzbv7f7qnhdav.exe

Download File

Process:	C:\Users\user\Desktop\mtuXDnH1Di.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	279552
Entropy (8bit):	7.1352696053252345
Encrypted:	false
SSDEEP:	6144:TLg1drHvFTdNWJDRm03jJGxoyApQU/waqElD:Te5RTWr/TJpZ/h
MD5:	E4B47C06B5EED80FB44CFEA757525634
SHA1:	78B5133CD84E3D89EBCA4B36F33273DF6E70C3F4
SHA-256:	475C13AE1D446C61824315961E5838916AC4A3F28BC441AA8A2B39B81383EA4A
SHA-512:	BEF0195A513A28E7C9868BCA359A4F1726C9F8D15204B743C0E2467E6F6C68A67994E737C82997FEF0C2BB9DCFC206100A0A52E756D286FBAF1E56D2E04E7843
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2f..S...S...S....s..S...S..S.......S.......S.......S..Rich.S..........................PE..L....0.V.................R...........E.......p....@..........................`............@....................................P....................................................................................p...............................text....Q.......R.................. ..`.rdata..(I...p...J...V..............@..@.data...,...........................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.1352696053252345
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mtuXDnH1Di.exe
File size:	279'552 bytes
MD5:	e4b47c06b5eed80fb44cfea757525634
SHA1:	78b5133cd84e3d89ebca4b36f33273df6e70c3f4
SHA256:	475c13ae1d446c61824315961e5838916ac4a3f28bc441aa8a2b39b81383ea4a
SHA512:	bef0195a513a28e7c9868bca359a4f1726c9f8d15204b743c0e2467e6f6c68a67994e737c82997fef0c2bb9dcfc206100a0a52e756d286fbaf1e56d2e04e7843
SSDEEP:	6144:TLg1drHvFTdNWJDRm03jJGxoyApQU/waqElD:Te5RTWr/TJpZ/h
TLSH:	98549D44CD39512ACC968EFE4ABB37B2F45E587567E915C3438431C424602F8FABA78B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2f..S...S...S....s..S...S...S.......S.......S.......S..Rich.S..........................PE..L....0.V.................R.........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x424590
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x568930F7 [Sun Jan 3 14:32:23 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	6f0f6728fed938390cd1a7b493280d77

Entrypoint Preview

Instruction
mov eax, dword ptr [0043F75Ch]
sar eax, 07h
sub eax, 0E724248h
and eax, 638AD6B6h
cmp eax, D4FE12C8h
je 00007FBADCDE5E96h
movzx ecx, word ptr [00473A94h]
or ecx, 9A29B7C6h
mov word ptr [00473A94h], cx
call 00007FBADCDE1ED3h
mov edx, dword ptr [0043F5C4h]
not edx
sub edx, 2D98DF04h
xor edx, 86D84936h
cmp edx, D7ABF1EFh
je 00007FBADCDE5E8Ch
add dword ptr [0044A8A4h], 24D523FCh
push esi
call 00007FBADCDF1677h
mov eax, dword ptr [00445EB0h]
sub eax, 13C02B78h
push 00437190h
mov dword ptr [00447688h], eax
inc dword ptr [00445EB0h]
push 00437188h
call 00007FBADCDDAC83h
fld dword ptr [0047ACD4h]
fadd qword ptr [0045F648h]
add esp, 08h
fld qword ptr [0044FAB0h]
fld qword ptr [00459DF0h]
fsubp st(2), st(0)
fsubrp st(1), st(0)
fstp qword ptr [0044FAB0h]
call 00007FBADCDF2EA9h
fld dword ptr [0047D39Ch]
mov esi, eax
fmul dword ptr [00486544h]
fld dword ptr [0047A424h]
fcomip st(0), st(1)
fstp st(0)
jbe 00007FBADCDE5E99h
dec dword ptr [00000000h]

Rich Headers

Programming Language:

[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b0e0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8b000	0x9ca4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x37000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x351ea	0x35200	b8a604ad7d1ad7d6f5659a8bfca32505	False	0.6966911764705882	data	6.86562473291782	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x37000	0x4928	0x4a00	9fa4f015e03b624e77fc713f54352d1c	False	0.8504539695945946	COM executable for DOS	7.1602946748436205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x4ef2c	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x8b000	0xa012	0xa200	a9d11539c5aa2bd739792d7ebff48b74	False	0.6754195601851852	data	6.7897361685185675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	SetTextCharacterExtra, SetSystemPaletteUse, GetTextCharsetInfo, GetTextCharset, GetMapMode, GetTextColor, SetTextJustification, GetCurrentObject, GetMetaRgn, GetClipRgn, GetFontUnicodeRanges, GetTextCharacterExtra, GetSystemPaletteUse, GetFontLanguageInfo, GetStretchBltMode, GetPolyFillMode, GetObjectType, GetRandomRgn, SetTextAlign, GetNearestPaletteIndex, GetTextAlign, GetPixelFormat, GetDCBrushColor, GetBkColor, GetNearestColor, SetPixel
USER32.dll	EndPaint, GetCursor, GetDlgItem, GetMenuItemCount, SetWindowTextA, GetPropA, SendMessageA, MoveWindow, GetWindowDC, SetFocus, IsWindowUnicode, WindowFromDC, GetDC, LoadIconA, GetQueueStatus, EnableWindow, GetKeyboardType, EndDialog, GetDlgItemInt, GetInputState, CallWindowProcA, GetMenu, PostMessageA, GetMenuItemID, IsWindowEnabled, SetDlgItemTextA, GetWindowContextHelpId, CheckDlgButton, GetScrollPos, DrawTextA, GetForegroundWindow, RemovePropA, GetMenuState, BeginPaint, GetWindowLongA, ShowWindow, GetMenuContextHelpId
KERNEL32.dll	HeapAlloc, GetStdHandle, GlobalAlloc, GetModuleHandleA, GetCurrentThreadId, GetTickCount, GetLastError, GlobalSize, IsDebuggerPresent, GlobalFlags, MoveFileA, GlobalHandle, SizeofResource, IsProcessorFeaturePresent, LocalFlags, GetProcAddress, GetDriveTypeA, GetCurrentProcessId, GetFileTime, GetCurrentProcess, FlushFileBuffers, SetFilePointer, WriteFile, LockResource, GetFileType, CloseHandle, GetVersion, QueryPerformanceCounter, LoadResource, FindResourceA, DeleteFileA, GetProcessHeap

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-05T16:24:59.509195+0200	UDP	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	53	60261	1.1.1.1	192.168.2.7
2024-08-05T16:23:03.262802+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49701	80	192.168.2.7	35.164.78.200
2024-08-05T16:23:00.468164+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49700	80	192.168.2.7	3.33.130.190
2024-08-05T16:23:27.903814+0200	UDP	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	53	62372	1.1.1.1	192.168.2.7
2024-08-05T16:24:18.320810+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	59623	80	192.168.2.7	3.33.130.190
2024-08-05T16:23:16.089201+0200	UDP	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	53	65063	1.1.1.1	192.168.2.7
2024-08-05T16:23:07.857815+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49702	34.246.200.160	192.168.2.7
2024-08-05T16:23:07.848514+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49702	80	192.168.2.7	34.246.200.160
2024-08-05T16:23:21.358671+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49715	54.244.188.177	192.168.2.7
2024-08-05T16:23:13.975372+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49708	80	192.168.2.7	85.13.130.3
2024-08-05T16:24:48.786301+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	59624	80	192.168.2.7	35.164.78.200
2024-08-05T16:23:03.286503+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49701	35.164.78.200	192.168.2.7
2024-08-05T16:24:48.791817+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	59624	35.164.78.200	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 16:23:00.003330946 CEST	49700	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:00.011713982 CEST	80	49700	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:00.011903048 CEST	49700	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:00.012031078 CEST	49700	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:00.017030001 CEST	80	49700	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:00.467889071 CEST	80	49700	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:00.468163967 CEST	49700	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:00.468492985 CEST	80	49700	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:00.468573093 CEST	49700	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:00.474752903 CEST	80	49700	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:02.490242004 CEST	49701	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:23:02.497309923 CEST	80	49701	35.164.78.200	192.168.2.7
Aug 5, 2024 16:23:02.497425079 CEST	49701	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:23:02.497464895 CEST	49701	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:23:02.502305984 CEST	80	49701	35.164.78.200	192.168.2.7
Aug 5, 2024 16:23:03.262451887 CEST	80	49701	35.164.78.200	192.168.2.7
Aug 5, 2024 16:23:03.262646914 CEST	80	49701	35.164.78.200	192.168.2.7
Aug 5, 2024 16:23:03.262801886 CEST	49701	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:23:03.281527042 CEST	49701	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:23:03.286503077 CEST	80	49701	35.164.78.200	192.168.2.7
Aug 5, 2024 16:23:07.082170963 CEST	49702	80	192.168.2.7	34.246.200.160
Aug 5, 2024 16:23:07.088511944 CEST	80	49702	34.246.200.160	192.168.2.7
Aug 5, 2024 16:23:07.088696003 CEST	49702	80	192.168.2.7	34.246.200.160
Aug 5, 2024 16:23:07.088696003 CEST	49702	80	192.168.2.7	34.246.200.160
Aug 5, 2024 16:23:07.095143080 CEST	80	49702	34.246.200.160	192.168.2.7
Aug 5, 2024 16:23:07.847978115 CEST	80	49702	34.246.200.160	192.168.2.7
Aug 5, 2024 16:23:07.848292112 CEST	80	49702	34.246.200.160	192.168.2.7
Aug 5, 2024 16:23:07.848514080 CEST	49702	80	192.168.2.7	34.246.200.160
Aug 5, 2024 16:23:07.848514080 CEST	49702	80	192.168.2.7	34.246.200.160
Aug 5, 2024 16:23:07.857815027 CEST	80	49702	34.246.200.160	192.168.2.7
Aug 5, 2024 16:23:08.690298080 CEST	49703	80	192.168.2.7	15.197.142.173
Aug 5, 2024 16:23:08.695185900 CEST	80	49703	15.197.142.173	192.168.2.7
Aug 5, 2024 16:23:08.695266008 CEST	49703	80	192.168.2.7	15.197.142.173
Aug 5, 2024 16:23:08.695300102 CEST	49703	80	192.168.2.7	15.197.142.173
Aug 5, 2024 16:23:08.700143099 CEST	80	49703	15.197.142.173	192.168.2.7
Aug 5, 2024 16:23:09.183926105 CEST	80	49703	15.197.142.173	192.168.2.7
Aug 5, 2024 16:23:09.184087992 CEST	49703	80	192.168.2.7	15.197.142.173
Aug 5, 2024 16:23:09.185036898 CEST	80	49703	15.197.142.173	192.168.2.7
Aug 5, 2024 16:23:09.185087919 CEST	49703	80	192.168.2.7	15.197.142.173
Aug 5, 2024 16:23:09.189647913 CEST	80	49703	15.197.142.173	192.168.2.7
Aug 5, 2024 16:23:09.592803001 CEST	49704	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:09.597723007 CEST	80	49704	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:09.597918987 CEST	49704	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:09.598023891 CEST	49704	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:09.602919102 CEST	80	49704	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:10.119362116 CEST	80	49704	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:10.119513988 CEST	80	49704	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:10.119585991 CEST	49704	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:10.120306969 CEST	49704	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:10.124830008 CEST	80	49704	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:13.313822985 CEST	49708	80	192.168.2.7	85.13.130.3
Aug 5, 2024 16:23:13.324901104 CEST	80	49708	85.13.130.3	192.168.2.7
Aug 5, 2024 16:23:13.325017929 CEST	49708	80	192.168.2.7	85.13.130.3
Aug 5, 2024 16:23:13.325212002 CEST	49708	80	192.168.2.7	85.13.130.3
Aug 5, 2024 16:23:13.330817938 CEST	80	49708	85.13.130.3	192.168.2.7
Aug 5, 2024 16:23:13.975238085 CEST	80	49708	85.13.130.3	192.168.2.7
Aug 5, 2024 16:23:13.975256920 CEST	80	49708	85.13.130.3	192.168.2.7
Aug 5, 2024 16:23:13.975372076 CEST	49708	80	192.168.2.7	85.13.130.3
Aug 5, 2024 16:23:13.977924109 CEST	49708	80	192.168.2.7	85.13.130.3
Aug 5, 2024 16:23:13.984775066 CEST	80	49708	85.13.130.3	192.168.2.7
Aug 5, 2024 16:23:14.254503965 CEST	49709	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:14.259618998 CEST	80	49709	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:14.259712934 CEST	49709	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:14.259835958 CEST	49709	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:14.264890909 CEST	80	49709	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:14.771369934 CEST	80	49709	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:14.772214890 CEST	80	49709	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:14.774360895 CEST	49709	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:14.776906967 CEST	49709	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:23:14.783245087 CEST	80	49709	3.33.130.190	192.168.2.7
Aug 5, 2024 16:23:16.594660997 CEST	49712	80	192.168.2.7	170.187.200.48
Aug 5, 2024 16:23:16.599700928 CEST	80	49712	170.187.200.48	192.168.2.7
Aug 5, 2024 16:23:16.599788904 CEST	49712	80	192.168.2.7	170.187.200.48
Aug 5, 2024 16:23:16.599848986 CEST	49712	80	192.168.2.7	170.187.200.48
Aug 5, 2024 16:23:16.604943991 CEST	80	49712	170.187.200.48	192.168.2.7
Aug 5, 2024 16:23:17.110980034 CEST	80	49712	170.187.200.48	192.168.2.7
Aug 5, 2024 16:23:17.111160040 CEST	80	49712	170.187.200.48	192.168.2.7
Aug 5, 2024 16:23:17.111236095 CEST	49712	80	192.168.2.7	170.187.200.48
Aug 5, 2024 16:23:17.111284018 CEST	49712	80	192.168.2.7	170.187.200.48
Aug 5, 2024 16:23:17.116209984 CEST	80	49712	170.187.200.48	192.168.2.7
Aug 5, 2024 16:23:17.750214100 CEST	49713	80	192.168.2.7	213.171.195.105
Aug 5, 2024 16:23:17.755048990 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:17.755119085 CEST	49713	80	192.168.2.7	213.171.195.105
Aug 5, 2024 16:23:17.755304098 CEST	49713	80	192.168.2.7	213.171.195.105
Aug 5, 2024 16:23:17.760118961 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:18.628709078 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:18.628727913 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:18.628766060 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:18.628777981 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:18.628788948 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:18.628818035 CEST	49713	80	192.168.2.7	213.171.195.105
Aug 5, 2024 16:23:18.628858089 CEST	49713	80	192.168.2.7	213.171.195.105
Aug 5, 2024 16:23:18.629002094 CEST	49713	80	192.168.2.7	213.171.195.105
Aug 5, 2024 16:23:18.631206989 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:18.631252050 CEST	49713	80	192.168.2.7	213.171.195.105
Aug 5, 2024 16:23:18.633377075 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:18.633435965 CEST	49713	80	192.168.2.7	213.171.195.105
Aug 5, 2024 16:23:18.634927034 CEST	80	49713	213.171.195.105	192.168.2.7
Aug 5, 2024 16:23:18.665146112 CEST	49714	80	192.168.2.7	64.190.63.222
Aug 5, 2024 16:23:18.674597979 CEST	80	49714	64.190.63.222	192.168.2.7
Aug 5, 2024 16:23:18.674680948 CEST	49714	80	192.168.2.7	64.190.63.222
Aug 5, 2024 16:23:18.674741983 CEST	49714	80	192.168.2.7	64.190.63.222
Aug 5, 2024 16:23:18.681945086 CEST	80	49714	64.190.63.222	192.168.2.7
Aug 5, 2024 16:23:19.359216928 CEST	80	49714	64.190.63.222	192.168.2.7
Aug 5, 2024 16:23:19.359422922 CEST	80	49714	64.190.63.222	192.168.2.7
Aug 5, 2024 16:23:19.359484911 CEST	49714	80	192.168.2.7	64.190.63.222
Aug 5, 2024 16:23:19.359519005 CEST	49714	80	192.168.2.7	64.190.63.222
Aug 5, 2024 16:23:19.364831924 CEST	80	49714	64.190.63.222	192.168.2.7
Aug 5, 2024 16:23:20.533049107 CEST	49715	80	192.168.2.7	54.244.188.177
Aug 5, 2024 16:23:20.542155027 CEST	80	49715	54.244.188.177	192.168.2.7
Aug 5, 2024 16:23:20.542252064 CEST	49715	80	192.168.2.7	54.244.188.177
Aug 5, 2024 16:23:20.542334080 CEST	49715	80	192.168.2.7	54.244.188.177
Aug 5, 2024 16:23:20.549489975 CEST	80	49715	54.244.188.177	192.168.2.7
Aug 5, 2024 16:23:21.353359938 CEST	80	49715	54.244.188.177	192.168.2.7
Aug 5, 2024 16:23:21.353450060 CEST	80	49715	54.244.188.177	192.168.2.7
Aug 5, 2024 16:23:21.353598118 CEST	49715	80	192.168.2.7	54.244.188.177
Aug 5, 2024 16:23:21.353634119 CEST	49715	80	192.168.2.7	54.244.188.177
Aug 5, 2024 16:23:21.358670950 CEST	80	49715	54.244.188.177	192.168.2.7
Aug 5, 2024 16:23:22.883011103 CEST	49716	80	192.168.2.7	81.169.145.88
Aug 5, 2024 16:23:22.892601013 CEST	80	49716	81.169.145.88	192.168.2.7
Aug 5, 2024 16:23:22.892690897 CEST	49716	80	192.168.2.7	81.169.145.88
Aug 5, 2024 16:23:22.892755985 CEST	49716	80	192.168.2.7	81.169.145.88
Aug 5, 2024 16:23:22.897691011 CEST	80	49716	81.169.145.88	192.168.2.7
Aug 5, 2024 16:23:23.542732000 CEST	80	49716	81.169.145.88	192.168.2.7
Aug 5, 2024 16:23:23.542943001 CEST	49716	80	192.168.2.7	81.169.145.88
Aug 5, 2024 16:23:23.543235064 CEST	80	49716	81.169.145.88	192.168.2.7
Aug 5, 2024 16:23:23.543292999 CEST	49716	80	192.168.2.7	81.169.145.88
Aug 5, 2024 16:23:23.547940016 CEST	80	49716	81.169.145.88	192.168.2.7
Aug 5, 2024 16:23:25.604696989 CEST	49717	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:25.609764099 CEST	80	49717	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:25.609869957 CEST	49717	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:25.609951019 CEST	49717	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:25.614748955 CEST	80	49717	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:26.152344942 CEST	80	49717	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:26.152359962 CEST	80	49717	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:26.152488947 CEST	49717	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:26.152559996 CEST	49717	80	192.168.2.7	15.197.192.55
Aug 5, 2024 16:23:26.160790920 CEST	80	49717	15.197.192.55	192.168.2.7
Aug 5, 2024 16:23:26.943135023 CEST	49718	80	192.168.2.7	188.225.40.227
Aug 5, 2024 16:23:26.948126078 CEST	80	49718	188.225.40.227	192.168.2.7
Aug 5, 2024 16:23:26.948220968 CEST	49718	80	192.168.2.7	188.225.40.227
Aug 5, 2024 16:23:26.948259115 CEST	49718	80	192.168.2.7	188.225.40.227
Aug 5, 2024 16:23:26.955096960 CEST	80	49718	188.225.40.227	192.168.2.7
Aug 5, 2024 16:23:27.646753073 CEST	80	49718	188.225.40.227	192.168.2.7
Aug 5, 2024 16:23:27.646975994 CEST	49718	80	192.168.2.7	188.225.40.227
Aug 5, 2024 16:23:27.648046970 CEST	80	49718	188.225.40.227	192.168.2.7
Aug 5, 2024 16:23:27.648243904 CEST	49718	80	192.168.2.7	188.225.40.227
Aug 5, 2024 16:23:27.652918100 CEST	80	49718	188.225.40.227	192.168.2.7
Aug 5, 2024 16:24:17.743669987 CEST	59623	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:24:17.780210018 CEST	80	59623	3.33.130.190	192.168.2.7
Aug 5, 2024 16:24:17.780306101 CEST	59623	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:24:17.780365944 CEST	59623	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:24:17.785518885 CEST	80	59623	3.33.130.190	192.168.2.7
Aug 5, 2024 16:24:18.320534945 CEST	80	59623	3.33.130.190	192.168.2.7
Aug 5, 2024 16:24:18.320739031 CEST	80	59623	3.33.130.190	192.168.2.7
Aug 5, 2024 16:24:18.320810080 CEST	59623	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:24:18.320839882 CEST	59623	80	192.168.2.7	3.33.130.190
Aug 5, 2024 16:24:18.325735092 CEST	80	59623	3.33.130.190	192.168.2.7
Aug 5, 2024 16:24:48.047780037 CEST	59624	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:24:48.053183079 CEST	80	59624	35.164.78.200	192.168.2.7
Aug 5, 2024 16:24:48.053263903 CEST	59624	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:24:48.053297043 CEST	59624	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:24:48.059143066 CEST	80	59624	35.164.78.200	192.168.2.7
Aug 5, 2024 16:24:48.786004066 CEST	80	59624	35.164.78.200	192.168.2.7
Aug 5, 2024 16:24:48.786231041 CEST	80	59624	35.164.78.200	192.168.2.7
Aug 5, 2024 16:24:48.786300898 CEST	59624	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:24:48.786475897 CEST	59624	80	192.168.2.7	35.164.78.200
Aug 5, 2024 16:24:48.791816950 CEST	80	59624	35.164.78.200	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 16:22:56.747797012 CEST	59709	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:58.827097893 CEST	55017	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.072036982 CEST	53	55017	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.073581934 CEST	51934	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.314816952 CEST	53	51934	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.317177057 CEST	58757	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.488140106 CEST	53	58757	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.489187002 CEST	57900	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.501302004 CEST	53	57900	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.502075911 CEST	59206	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.515988111 CEST	53	59206	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.516791105 CEST	64188	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.528374910 CEST	53	64188	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.529134989 CEST	61322	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.768841028 CEST	53	61322	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.769958973 CEST	53612	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.780859947 CEST	53	53612	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.781807899 CEST	64835	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.797418118 CEST	53	64835	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.798938036 CEST	53131	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.818885088 CEST	53	53131	1.1.1.1	192.168.2.7
Aug 5, 2024 16:22:59.819806099 CEST	60895	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:22:59.994450092 CEST	53	60895	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.468913078 CEST	52868	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.481833935 CEST	53	52868	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.482680082 CEST	63268	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.494982958 CEST	53	63268	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.495657921 CEST	56009	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.507364988 CEST	53	56009	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.508002043 CEST	63889	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.518084049 CEST	53	63889	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.518887043 CEST	61278	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.768618107 CEST	53	61278	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.769462109 CEST	62757	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.781193972 CEST	53	62757	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.781996965 CEST	53075	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.793140888 CEST	53	53075	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.793869019 CEST	54646	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.804402113 CEST	53	54646	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.805071115 CEST	55442	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.817480087 CEST	53	55442	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.818147898 CEST	59430	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.829871893 CEST	53	59430	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.844660997 CEST	54571	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.857202053 CEST	53	54571	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.873730898 CEST	61706	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:00.884138107 CEST	53	61706	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:00.885044098 CEST	56498	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.125931978 CEST	53	56498	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.126734018 CEST	65313	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.139688969 CEST	53	65313	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.140727043 CEST	54121	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.151774883 CEST	53	54121	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.152507067 CEST	59727	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.166131020 CEST	53	59727	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.167009115 CEST	52231	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.179567099 CEST	53	52231	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.180201054 CEST	54779	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.191646099 CEST	53	54779	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.192198038 CEST	54088	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.204541922 CEST	53	54088	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.206293106 CEST	64851	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.446283102 CEST	53	64851	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.447448015 CEST	57662	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.459589958 CEST	53	57662	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.460310936 CEST	53661	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.474405050 CEST	53	53661	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.475070000 CEST	55073	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.486325979 CEST	53	55073	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.488322973 CEST	60773	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.733985901 CEST	53	60773	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.734870911 CEST	59044	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:01.987286091 CEST	53	59044	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:01.988740921 CEST	63624	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:02.155164003 CEST	53	63624	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:02.156263113 CEST	55575	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:02.489639044 CEST	53	55575	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:03.282030106 CEST	58324	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:03.294171095 CEST	53	58324	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:03.295202971 CEST	53276	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:03.306982040 CEST	53	53276	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:03.315262079 CEST	60354	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:03.327703953 CEST	53	60354	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:03.337171078 CEST	57028	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:03.603338003 CEST	53	57028	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:03.604362011 CEST	61365	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:04.608788967 CEST	61365	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:04.834971905 CEST	53	61365	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:04.835983992 CEST	50387	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:04.840406895 CEST	53	61365	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:04.846358061 CEST	53	50387	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:04.847100973 CEST	59669	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:05.089771986 CEST	53	59669	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:05.090862989 CEST	65100	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:05.340581894 CEST	53	65100	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:05.341633081 CEST	56171	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:05.584233999 CEST	53	56171	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:05.585297108 CEST	56200	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:05.597199917 CEST	53	56200	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:05.597881079 CEST	51235	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:05.839589119 CEST	53	51235	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:05.840672970 CEST	52352	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:05.852792978 CEST	53	52352	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:05.853703976 CEST	56450	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:05.865334988 CEST	53	56450	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:05.866008997 CEST	52399	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:06.115442991 CEST	53	52399	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:06.116499901 CEST	58005	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:06.127631903 CEST	53	58005	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:06.128492117 CEST	58733	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:06.490065098 CEST	53	58733	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:06.490979910 CEST	63848	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:06.734385967 CEST	53	63848	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:06.735596895 CEST	64852	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:06.746968031 CEST	53	64852	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:06.747950077 CEST	62289	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:07.081515074 CEST	53	62289	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:07.849172115 CEST	62881	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:07.865104914 CEST	53	62881	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:07.865964890 CEST	49421	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:07.879404068 CEST	53	49421	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:07.887386084 CEST	49279	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:08.140649080 CEST	53	49279	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:08.141685009 CEST	50559	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:08.153228998 CEST	53	50559	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:08.154092073 CEST	61386	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:08.167778015 CEST	53	61386	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:08.168565035 CEST	55794	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:08.408706903 CEST	53	55794	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:08.409615040 CEST	50674	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:08.422204971 CEST	53	50674	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:08.423027039 CEST	52979	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:08.434189081 CEST	53	52979	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:08.434900999 CEST	55272	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:08.676603079 CEST	53	55272	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:08.677520990 CEST	62955	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:08.689861059 CEST	53	62955	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:09.184705973 CEST	56242	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:09.345818043 CEST	53	56242	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:09.346751928 CEST	59792	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:09.357867956 CEST	53	59792	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:09.358485937 CEST	54101	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:09.368531942 CEST	53	54101	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:09.369172096 CEST	56835	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:09.381783962 CEST	53	56835	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:09.382386923 CEST	56259	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:09.393115044 CEST	53	56259	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:09.394016981 CEST	54638	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:09.403856039 CEST	53	54638	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:09.404695988 CEST	62152	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:09.415358067 CEST	53	62152	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:09.415920019 CEST	55233	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:09.591981888 CEST	53	55233	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:10.120335102 CEST	53006	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:10.131587029 CEST	53	53006	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:10.132428885 CEST	58328	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:10.144226074 CEST	53	58328	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:10.144993067 CEST	60958	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:11.140019894 CEST	60958	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:11.333298922 CEST	53	60958	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:11.338663101 CEST	54640	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:11.339821100 CEST	53	60958	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:11.584297895 CEST	53	54640	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:11.585304022 CEST	58620	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:11.595113039 CEST	53	58620	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:11.596183062 CEST	58069	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:11.607228041 CEST	53	58069	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:11.608077049 CEST	51967	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:11.619980097 CEST	53	51967	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:11.620794058 CEST	51618	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:11.869426966 CEST	53	51618	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:11.870515108 CEST	52611	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:11.881941080 CEST	53	52611	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:11.882783890 CEST	64310	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.123236895 CEST	53	64310	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.124109030 CEST	61816	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.136425018 CEST	53	61816	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.137336016 CEST	64727	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.148866892 CEST	53	64727	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.149853945 CEST	62879	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.387614965 CEST	53	62879	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.388535023 CEST	55461	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.403403044 CEST	53	55461	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.404055119 CEST	58337	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.416208982 CEST	53	58337	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.419003010 CEST	56045	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.669958115 CEST	53	56045	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.670917988 CEST	54304	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.690047026 CEST	53	54304	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.690764904 CEST	60713	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.703558922 CEST	53	60713	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.704890013 CEST	50763	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.715862989 CEST	53	50763	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.716545105 CEST	53985	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.955599070 CEST	53	53985	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.956458092 CEST	60154	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.972373962 CEST	53	60154	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.973203897 CEST	64376	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.985363007 CEST	53	64376	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.986319065 CEST	61437	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:12.998255014 CEST	53	61437	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:12.999150991 CEST	59730	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:13.018498898 CEST	53	59730	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:13.019520044 CEST	63224	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:13.264501095 CEST	53	63224	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:13.265332937 CEST	59003	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:13.277185917 CEST	53	59003	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:13.278017044 CEST	55778	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:13.313076973 CEST	53	55778	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:13.982986927 CEST	49944	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:14.233246088 CEST	53	49944	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:14.234230995 CEST	49282	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:14.253881931 CEST	53	49282	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:14.778151989 CEST	53669	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:15.023370981 CEST	53	53669	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:15.024501085 CEST	49433	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:15.035974026 CEST	53	49433	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:15.036873102 CEST	57744	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:15.286478043 CEST	53	57744	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:15.287492990 CEST	60749	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:15.529511929 CEST	53	60749	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:15.530410051 CEST	54801	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:15.543267012 CEST	53	54801	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:15.543965101 CEST	57065	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:15.786616087 CEST	53	57065	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:15.788389921 CEST	50453	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:15.800870895 CEST	53	50453	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:15.802088022 CEST	50446	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:15.817239046 CEST	53	50446	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:15.818175077 CEST	57552	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:15.832911968 CEST	53	57552	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:15.833758116 CEST	52985	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:16.076066017 CEST	53	52985	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:16.076986074 CEST	65063	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:16.089200974 CEST	53	65063	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:16.089977026 CEST	57998	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:16.105436087 CEST	53	57998	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:16.106254101 CEST	55385	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:16.116499901 CEST	53	55385	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:16.118916988 CEST	59470	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:16.128622055 CEST	53	59470	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:16.135863066 CEST	49456	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:16.147651911 CEST	53	49456	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:16.148502111 CEST	62441	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:16.594046116 CEST	53	62441	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:17.111905098 CEST	57978	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:17.131805897 CEST	53	57978	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:17.132673979 CEST	56358	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:17.151833057 CEST	53	56358	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:17.155555010 CEST	60463	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:17.166604042 CEST	53	60463	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:17.176980972 CEST	60706	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:17.492526054 CEST	53	60706	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:17.493551970 CEST	62344	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:17.749679089 CEST	53	62344	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:18.629637957 CEST	56435	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:18.664453030 CEST	53	56435	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:19.360114098 CEST	58990	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:19.603269100 CEST	53	58990	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:19.604113102 CEST	51384	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:20.041341066 CEST	53	51384	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:20.042613983 CEST	56555	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:20.532397985 CEST	53	56555	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:21.354139090 CEST	62743	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:21.594518900 CEST	53	62743	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:21.599212885 CEST	60564	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:21.612550020 CEST	53	60564	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:21.615145922 CEST	50429	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:21.626259089 CEST	53	50429	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:21.626872063 CEST	55407	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:21.800091982 CEST	53	55407	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:21.801013947 CEST	53573	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.050182104 CEST	53	53573	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.051450968 CEST	59932	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.062438965 CEST	53	59932	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.063122034 CEST	50482	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.307908058 CEST	53	50482	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.308860064 CEST	54875	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.318873882 CEST	53	54875	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.321954966 CEST	58294	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.333545923 CEST	53	58294	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.334274054 CEST	50062	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.348253965 CEST	53	50062	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.349205017 CEST	64033	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.364134073 CEST	53	64033	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.364785910 CEST	52262	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.527837992 CEST	53	52262	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.528754950 CEST	54859	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.563729048 CEST	53	54859	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.564809084 CEST	53985	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.575617075 CEST	53	53985	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.576502085 CEST	49870	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.586731911 CEST	53	49870	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.587383986 CEST	51640	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.602020025 CEST	53	51640	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.602730989 CEST	63049	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.852274895 CEST	53	63049	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:22.853321075 CEST	53093	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:22.882518053 CEST	53	53093	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:23.543642044 CEST	61996	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:23.785722971 CEST	53	61996	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:23.786580086 CEST	55028	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:24.031197071 CEST	53	55028	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:24.032265902 CEST	51140	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:24.276823997 CEST	53	51140	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:24.278073072 CEST	61061	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:24.289036989 CEST	53	61061	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:24.289673090 CEST	56103	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:24.538819075 CEST	53	56103	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:24.539998055 CEST	51263	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:24.549678087 CEST	53	51263	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:24.550476074 CEST	50575	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:24.718214989 CEST	53	50575	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:24.729669094 CEST	50928	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:24.981952906 CEST	53	50928	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:24.982945919 CEST	55446	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:24.994797945 CEST	53	55446	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:24.995552063 CEST	49739	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:25.008431911 CEST	53	49739	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:25.009118080 CEST	60530	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:25.019424915 CEST	53	60530	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:25.019994974 CEST	61774	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:25.272799015 CEST	53	61774	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:25.274055004 CEST	53846	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:25.603921890 CEST	53	53846	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:26.153218985 CEST	50711	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:26.173346996 CEST	53	50711	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:26.174304962 CEST	56194	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:26.184062004 CEST	53	56194	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:26.184897900 CEST	51827	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:26.427146912 CEST	53	51827	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:26.428072929 CEST	52298	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:26.439620018 CEST	53	52298	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:26.448745012 CEST	64729	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:26.458301067 CEST	53	64729	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:26.460000992 CEST	51249	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:26.470509052 CEST	53	51249	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:26.473237991 CEST	50123	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:26.942564964 CEST	53	50123	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:27.647510052 CEST	49566	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:27.891237020 CEST	53	49566	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:27.892193079 CEST	62372	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:27.903814077 CEST	53	62372	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:27.904778004 CEST	52650	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:23:27.914954901 CEST	53	52650	1.1.1.1	192.168.2.7
Aug 5, 2024 16:23:45.178628922 CEST	53	50058	162.159.36.2	192.168.2.7
Aug 5, 2024 16:23:46.033658028 CEST	53	51844	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:19.329459906 CEST	57563	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:19.342288017 CEST	53	57563	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:20.344276905 CEST	59894	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:20.593597889 CEST	53	59894	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:21.609978914 CEST	56723	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:21.624454021 CEST	53	56723	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:22.641103029 CEST	51859	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:22.656313896 CEST	53	51859	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:23.672787905 CEST	62063	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:23.691430092 CEST	53	62063	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:24.703435898 CEST	51973	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:24.714538097 CEST	53	51973	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:25.719153881 CEST	57065	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:25.730051994 CEST	53	57065	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:26.734932899 CEST	55499	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:26.745863914 CEST	53	55499	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:27.750502110 CEST	59649	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:27.762432098 CEST	53	59649	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:28.766252041 CEST	56028	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:29.008287907 CEST	53	56028	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:30.016100883 CEST	54120	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:30.028261900 CEST	53	54120	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:31.033252954 CEST	52810	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:31.274490118 CEST	53	52810	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:32.281800985 CEST	52456	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:32.644752026 CEST	53	52456	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:33.656968117 CEST	59715	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:33.900650978 CEST	53	59715	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:34.907303095 CEST	62067	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:34.919079065 CEST	53	62067	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:35.922257900 CEST	63101	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:36.160528898 CEST	53	63101	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:37.172446966 CEST	54422	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:37.414206982 CEST	53	54422	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:38.422349930 CEST	62141	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:38.432774067 CEST	53	62141	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:39.438189983 CEST	57175	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:39.679007053 CEST	53	57175	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:40.688630104 CEST	59852	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:40.700752974 CEST	53	59852	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:41.703542948 CEST	61875	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:41.714907885 CEST	53	61875	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:42.719425917 CEST	51934	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:42.730444908 CEST	53	51934	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:43.734996080 CEST	55229	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:43.746114969 CEST	53	55229	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:44.753750086 CEST	59474	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:44.764403105 CEST	53	59474	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:45.766043901 CEST	49274	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:45.778937101 CEST	53	49274	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:46.781923056 CEST	55332	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:47.033505917 CEST	53	55332	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:49.797646046 CEST	61974	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:49.808259010 CEST	53	61974	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:50.813277960 CEST	58451	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:50.952276945 CEST	53	58451	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:51.969788074 CEST	57834	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:51.980510950 CEST	53	57834	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:52.985311985 CEST	55428	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:52.995425940 CEST	53	55428	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:53.978466034 CEST	53414	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:54.220349073 CEST	53	53414	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:55.157414913 CEST	56887	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:55.169265985 CEST	53	56887	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:56.079106092 CEST	52806	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:56.089919090 CEST	53	52806	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:56.969827890 CEST	64907	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:56.982188940 CEST	53	64907	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:57.828845024 CEST	49917	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:58.484996080 CEST	53	49917	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:59.438075066 CEST	57899	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:59.447949886 CEST	53	57899	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:59.448775053 CEST	54739	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:59.459800959 CEST	53	54739	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:59.460437059 CEST	59384	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:59.473557949 CEST	53	59384	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:59.474095106 CEST	60113	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:59.484698057 CEST	53	60113	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:59.485200882 CEST	61701	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:59.497405052 CEST	53	61701	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:59.497925997 CEST	60261	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:59.509195089 CEST	53	60261	1.1.1.1	192.168.2.7
Aug 5, 2024 16:24:59.509829044 CEST	54697	53	192.168.2.7	1.1.1.1
Aug 5, 2024 16:24:59.670346975 CEST	53	54697	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 16:22:56.747797012 CEST	192.168.2.7	1.1.1.1	0xf93d	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:58.827097893 CEST	192.168.2.7	1.1.1.1	0x910a	Standard query (0)	womanclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.073581934 CEST	192.168.2.7	1.1.1.1	0x7047	Standard query (0)	smokeclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.317177057 CEST	192.168.2.7	1.1.1.1	0x94ad	Standard query (0)	womangeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.489187002 CEST	192.168.2.7	1.1.1.1	0xeb47	Standard query (0)	smokegeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.502075911 CEST	192.168.2.7	1.1.1.1	0xdbbe	Standard query (0)	womaninclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.516791105 CEST	192.168.2.7	1.1.1.1	0x6697	Standard query (0)	smokeinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.529134989 CEST	192.168.2.7	1.1.1.1	0x6e1b	Standard query (0)	womannorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.769958973 CEST	192.168.2.7	1.1.1.1	0xd2ba	Standard query (0)	smokenorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.781807899 CEST	192.168.2.7	1.1.1.1	0x4731	Standard query (0)	partyclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.798938036 CEST	192.168.2.7	1.1.1.1	0x3847	Standard query (0)	fightclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.819806099 CEST	192.168.2.7	1.1.1.1	0x3ec1	Standard query (0)	partygeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.468913078 CEST	192.168.2.7	1.1.1.1	0x820b	Standard query (0)	fightgeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.482680082 CEST	192.168.2.7	1.1.1.1	0x99fe	Standard query (0)	partyinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.495657921 CEST	192.168.2.7	1.1.1.1	0xd8b1	Standard query (0)	fightinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.508002043 CEST	192.168.2.7	1.1.1.1	0x5209	Standard query (0)	partynorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.518887043 CEST	192.168.2.7	1.1.1.1	0x2d7a	Standard query (0)	fightnorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.769462109 CEST	192.168.2.7	1.1.1.1	0x5f2a	Standard query (0)	freshbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.781996965 CEST	192.168.2.7	1.1.1.1	0xc9c9	Standard query (0)	experiencebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.793869019 CEST	192.168.2.7	1.1.1.1	0x16d1	Standard query (0)	freshbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.805071115 CEST	192.168.2.7	1.1.1.1	0x5f15	Standard query (0)	experiencebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.818147898 CEST	192.168.2.7	1.1.1.1	0x1ee3	Standard query (0)	freshreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.844660997 CEST	192.168.2.7	1.1.1.1	0x37b4	Standard query (0)	experiencereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.873730898 CEST	192.168.2.7	1.1.1.1	0xa4ab	Standard query (0)	freshquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.885044098 CEST	192.168.2.7	1.1.1.1	0x6fcd	Standard query (0)	experiencequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.126734018 CEST	192.168.2.7	1.1.1.1	0xccac	Standard query (0)	gentlemanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.140727043 CEST	192.168.2.7	1.1.1.1	0xe403	Standard query (0)	alreadybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.152507067 CEST	192.168.2.7	1.1.1.1	0xdaef	Standard query (0)	gentlemanbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.167009115 CEST	192.168.2.7	1.1.1.1	0x677b	Standard query (0)	alreadybelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.180201054 CEST	192.168.2.7	1.1.1.1	0x39fa	Standard query (0)	gentlemanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.192198038 CEST	192.168.2.7	1.1.1.1	0x2c0b	Standard query (0)	alreadyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.206293106 CEST	192.168.2.7	1.1.1.1	0x4b02	Standard query (0)	gentlemanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.447448015 CEST	192.168.2.7	1.1.1.1	0x2644	Standard query (0)	alreadyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.460310936 CEST	192.168.2.7	1.1.1.1	0x4cba	Standard query (0)	followbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.475070000 CEST	192.168.2.7	1.1.1.1	0xeb68	Standard query (0)	memberbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.488322973 CEST	192.168.2.7	1.1.1.1	0x2bb8	Standard query (0)	followbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.734870911 CEST	192.168.2.7	1.1.1.1	0x8529	Standard query (0)	memberbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.988740921 CEST	192.168.2.7	1.1.1.1	0x6965	Standard query (0)	followreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:02.156263113 CEST	192.168.2.7	1.1.1.1	0xa408	Standard query (0)	memberreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:03.282030106 CEST	192.168.2.7	1.1.1.1	0x6b64	Standard query (0)	followquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:03.295202971 CEST	192.168.2.7	1.1.1.1	0xe563	Standard query (0)	memberquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:03.315262079 CEST	192.168.2.7	1.1.1.1	0x1065	Standard query (0)	beginbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:03.337171078 CEST	192.168.2.7	1.1.1.1	0x4e44	Standard query (0)	knownbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:03.604362011 CEST	192.168.2.7	1.1.1.1	0x94c	Standard query (0)	beginbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:04.608788967 CEST	192.168.2.7	1.1.1.1	0x94c	Standard query (0)	beginbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:04.835983992 CEST	192.168.2.7	1.1.1.1	0xa61b	Standard query (0)	knownbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:04.847100973 CEST	192.168.2.7	1.1.1.1	0x60b4	Standard query (0)	beginreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.090862989 CEST	192.168.2.7	1.1.1.1	0xc3b8	Standard query (0)	knownreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.341633081 CEST	192.168.2.7	1.1.1.1	0x9190	Standard query (0)	beginquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.585297108 CEST	192.168.2.7	1.1.1.1	0xa3ce	Standard query (0)	knownquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.597881079 CEST	192.168.2.7	1.1.1.1	0x2466	Standard query (0)	summerbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.840672970 CEST	192.168.2.7	1.1.1.1	0x95d6	Standard query (0)	crowdbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.853703976 CEST	192.168.2.7	1.1.1.1	0xaa58	Standard query (0)	summerbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.866008997 CEST	192.168.2.7	1.1.1.1	0x812	Standard query (0)	crowdbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.116499901 CEST	192.168.2.7	1.1.1.1	0xe050	Standard query (0)	summerreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.128492117 CEST	192.168.2.7	1.1.1.1	0xec85	Standard query (0)	crowdreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.490979910 CEST	192.168.2.7	1.1.1.1	0xaf40	Standard query (0)	summerquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.735596895 CEST	192.168.2.7	1.1.1.1	0xd1e9	Standard query (0)	crowdquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.747950077 CEST	192.168.2.7	1.1.1.1	0xefe4	Standard query (0)	thoughtbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:07.849172115 CEST	192.168.2.7	1.1.1.1	0xa031	Standard query (0)	waterbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:07.865964890 CEST	192.168.2.7	1.1.1.1	0x3d40	Standard query (0)	thoughtbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:07.887386084 CEST	192.168.2.7	1.1.1.1	0xf352	Standard query (0)	waterbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.141685009 CEST	192.168.2.7	1.1.1.1	0x1e49	Standard query (0)	thoughtreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.154092073 CEST	192.168.2.7	1.1.1.1	0x29ec	Standard query (0)	waterreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.168565035 CEST	192.168.2.7	1.1.1.1	0xbcd1	Standard query (0)	thoughtquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.409615040 CEST	192.168.2.7	1.1.1.1	0xd06c	Standard query (0)	waterquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.423027039 CEST	192.168.2.7	1.1.1.1	0xe8dd	Standard query (0)	womanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.434900999 CEST	192.168.2.7	1.1.1.1	0x31e5	Standard query (0)	smokebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.677520990 CEST	192.168.2.7	1.1.1.1	0xfc2f	Standard query (0)	womanbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.184705973 CEST	192.168.2.7	1.1.1.1	0x3e92	Standard query (0)	smokebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.346751928 CEST	192.168.2.7	1.1.1.1	0x8bb3	Standard query (0)	womanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.358485937 CEST	192.168.2.7	1.1.1.1	0x852a	Standard query (0)	smokereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.369172096 CEST	192.168.2.7	1.1.1.1	0x43f9	Standard query (0)	womanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.382386923 CEST	192.168.2.7	1.1.1.1	0x6394	Standard query (0)	smokequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.394016981 CEST	192.168.2.7	1.1.1.1	0x684d	Standard query (0)	partybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.404695988 CEST	192.168.2.7	1.1.1.1	0x5ee0	Standard query (0)	fightbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.415920019 CEST	192.168.2.7	1.1.1.1	0xd087	Standard query (0)	partybelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:10.120335102 CEST	192.168.2.7	1.1.1.1	0xc6a6	Standard query (0)	fightbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:10.132428885 CEST	192.168.2.7	1.1.1.1	0xf832	Standard query (0)	partyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:10.144993067 CEST	192.168.2.7	1.1.1.1	0x480e	Standard query (0)	fightreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.140019894 CEST	192.168.2.7	1.1.1.1	0x480e	Standard query (0)	fightreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.338663101 CEST	192.168.2.7	1.1.1.1	0x42b2	Standard query (0)	partyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.585304022 CEST	192.168.2.7	1.1.1.1	0x2855	Standard query (0)	fightquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.596183062 CEST	192.168.2.7	1.1.1.1	0x970	Standard query (0)	freshhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.608077049 CEST	192.168.2.7	1.1.1.1	0xdcd4	Standard query (0)	experiencehonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.620794058 CEST	192.168.2.7	1.1.1.1	0xa235	Standard query (0)	freshneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.870515108 CEST	192.168.2.7	1.1.1.1	0x6e26	Standard query (0)	experienceneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.882783890 CEST	192.168.2.7	1.1.1.1	0x862b	Standard query (0)	freshsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.124109030 CEST	192.168.2.7	1.1.1.1	0x7de3	Standard query (0)	experiencesystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.137336016 CEST	192.168.2.7	1.1.1.1	0x13c0	Standard query (0)	freshtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.149853945 CEST	192.168.2.7	1.1.1.1	0xf617	Standard query (0)	experiencetrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.388535023 CEST	192.168.2.7	1.1.1.1	0x4524	Standard query (0)	gentlemanhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.404055119 CEST	192.168.2.7	1.1.1.1	0xd3bb	Standard query (0)	alreadyhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.419003010 CEST	192.168.2.7	1.1.1.1	0x1557	Standard query (0)	gentlemanneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.670917988 CEST	192.168.2.7	1.1.1.1	0x92f4	Standard query (0)	alreadyneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.690764904 CEST	192.168.2.7	1.1.1.1	0xcebf	Standard query (0)	gentlemansystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.704890013 CEST	192.168.2.7	1.1.1.1	0xc33e	Standard query (0)	alreadysystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.716545105 CEST	192.168.2.7	1.1.1.1	0x4832	Standard query (0)	gentlemantrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.956458092 CEST	192.168.2.7	1.1.1.1	0x1bb4	Standard query (0)	alreadytrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.973203897 CEST	192.168.2.7	1.1.1.1	0x86a9	Standard query (0)	followhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.986319065 CEST	192.168.2.7	1.1.1.1	0x41c2	Standard query (0)	memberhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.999150991 CEST	192.168.2.7	1.1.1.1	0x11c7	Standard query (0)	followneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:13.019520044 CEST	192.168.2.7	1.1.1.1	0x64ac	Standard query (0)	memberneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:13.265332937 CEST	192.168.2.7	1.1.1.1	0xaa11	Standard query (0)	followsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:13.278017044 CEST	192.168.2.7	1.1.1.1	0x8b99	Standard query (0)	membersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:13.982986927 CEST	192.168.2.7	1.1.1.1	0x8c56	Standard query (0)	followtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:14.234230995 CEST	192.168.2.7	1.1.1.1	0x145c	Standard query (0)	membertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:14.778151989 CEST	192.168.2.7	1.1.1.1	0x38b6	Standard query (0)	beginhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.024501085 CEST	192.168.2.7	1.1.1.1	0x72f7	Standard query (0)	knownhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.036873102 CEST	192.168.2.7	1.1.1.1	0xc9ad	Standard query (0)	beginneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.287492990 CEST	192.168.2.7	1.1.1.1	0xca5e	Standard query (0)	knownneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.530410051 CEST	192.168.2.7	1.1.1.1	0x37cf	Standard query (0)	beginsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.543965101 CEST	192.168.2.7	1.1.1.1	0xc5b0	Standard query (0)	knownsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.788389921 CEST	192.168.2.7	1.1.1.1	0x382	Standard query (0)	begintrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.802088022 CEST	192.168.2.7	1.1.1.1	0x5ad0	Standard query (0)	knowntrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.818175077 CEST	192.168.2.7	1.1.1.1	0xc6f	Standard query (0)	summerhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.833758116 CEST	192.168.2.7	1.1.1.1	0x4b9b	Standard query (0)	crowdhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.076986074 CEST	192.168.2.7	1.1.1.1	0x676f	Standard query (0)	summerneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.089977026 CEST	192.168.2.7	1.1.1.1	0xc2a4	Standard query (0)	crowdneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.106254101 CEST	192.168.2.7	1.1.1.1	0x3455	Standard query (0)	summersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.118916988 CEST	192.168.2.7	1.1.1.1	0x9f3d	Standard query (0)	crowdsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.135863066 CEST	192.168.2.7	1.1.1.1	0x6058	Standard query (0)	summertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.148502111 CEST	192.168.2.7	1.1.1.1	0xbb52	Standard query (0)	crowdtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.111905098 CEST	192.168.2.7	1.1.1.1	0xfa40	Standard query (0)	thoughthonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.132673979 CEST	192.168.2.7	1.1.1.1	0x8b28	Standard query (0)	waterhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.155555010 CEST	192.168.2.7	1.1.1.1	0x5995	Standard query (0)	thoughtneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.176980972 CEST	192.168.2.7	1.1.1.1	0x205f	Standard query (0)	waterneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.493551970 CEST	192.168.2.7	1.1.1.1	0xcd7	Standard query (0)	thoughtsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:18.629637957 CEST	192.168.2.7	1.1.1.1	0x9eff	Standard query (0)	watersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:19.360114098 CEST	192.168.2.7	1.1.1.1	0x2cb9	Standard query (0)	thoughttrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:19.604113102 CEST	192.168.2.7	1.1.1.1	0xb6c1	Standard query (0)	watertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:20.042613983 CEST	192.168.2.7	1.1.1.1	0xdcbf	Standard query (0)	womanhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:21.354139090 CEST	192.168.2.7	1.1.1.1	0x5909	Standard query (0)	smokehonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:21.599212885 CEST	192.168.2.7	1.1.1.1	0x4ad2	Standard query (0)	womanneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:21.615145922 CEST	192.168.2.7	1.1.1.1	0x391	Standard query (0)	smokeneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:21.626872063 CEST	192.168.2.7	1.1.1.1	0x4709	Standard query (0)	womansystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:21.801013947 CEST	192.168.2.7	1.1.1.1	0xe1bb	Standard query (0)	smokesystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.051450968 CEST	192.168.2.7	1.1.1.1	0xd725	Standard query (0)	womantrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.063122034 CEST	192.168.2.7	1.1.1.1	0x581b	Standard query (0)	smoketrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.308860064 CEST	192.168.2.7	1.1.1.1	0xc380	Standard query (0)	partyhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.321954966 CEST	192.168.2.7	1.1.1.1	0xaee2	Standard query (0)	fighthonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.334274054 CEST	192.168.2.7	1.1.1.1	0x94a9	Standard query (0)	partyneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.349205017 CEST	192.168.2.7	1.1.1.1	0xfd7b	Standard query (0)	fightneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.364785910 CEST	192.168.2.7	1.1.1.1	0xf73b	Standard query (0)	partysystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.528754950 CEST	192.168.2.7	1.1.1.1	0xc7a9	Standard query (0)	fightsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.564809084 CEST	192.168.2.7	1.1.1.1	0x4c8b	Standard query (0)	partytrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.576502085 CEST	192.168.2.7	1.1.1.1	0x68dc	Standard query (0)	fighttrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.587383986 CEST	192.168.2.7	1.1.1.1	0x5cb1	Standard query (0)	freshlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.602730989 CEST	192.168.2.7	1.1.1.1	0x2b38	Standard query (0)	experiencelaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.853321075 CEST	192.168.2.7	1.1.1.1	0x6bce	Standard query (0)	freshfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:23.543642044 CEST	192.168.2.7	1.1.1.1	0xca35	Standard query (0)	experiencefancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:23.786580086 CEST	192.168.2.7	1.1.1.1	0x3aff	Standard query (0)	freshconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.032265902 CEST	192.168.2.7	1.1.1.1	0xcd72	Standard query (0)	experienceconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.278073072 CEST	192.168.2.7	1.1.1.1	0xf72f	Standard query (0)	freshfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.289673090 CEST	192.168.2.7	1.1.1.1	0xa8f4	Standard query (0)	experiencefriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.539998055 CEST	192.168.2.7	1.1.1.1	0x2a4c	Standard query (0)	gentlemanlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.550476074 CEST	192.168.2.7	1.1.1.1	0xdebe	Standard query (0)	alreadylaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.729669094 CEST	192.168.2.7	1.1.1.1	0xa304	Standard query (0)	gentlemanfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.982945919 CEST	192.168.2.7	1.1.1.1	0xad30	Standard query (0)	alreadyfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.995552063 CEST	192.168.2.7	1.1.1.1	0x4323	Standard query (0)	gentlemanconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:25.009118080 CEST	192.168.2.7	1.1.1.1	0xb373	Standard query (0)	alreadyconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:25.019994974 CEST	192.168.2.7	1.1.1.1	0x1406	Standard query (0)	gentlemanfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:25.274055004 CEST	192.168.2.7	1.1.1.1	0xce48	Standard query (0)	alreadyfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.153218985 CEST	192.168.2.7	1.1.1.1	0xcccf	Standard query (0)	followlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.174304962 CEST	192.168.2.7	1.1.1.1	0x5336	Standard query (0)	memberlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.184897900 CEST	192.168.2.7	1.1.1.1	0x7589	Standard query (0)	followfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.428072929 CEST	192.168.2.7	1.1.1.1	0xe3c1	Standard query (0)	memberfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.448745012 CEST	192.168.2.7	1.1.1.1	0x88cb	Standard query (0)	followconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.460000992 CEST	192.168.2.7	1.1.1.1	0x75b7	Standard query (0)	memberconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.473237991 CEST	192.168.2.7	1.1.1.1	0xbdad	Standard query (0)	followfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:27.647510052 CEST	192.168.2.7	1.1.1.1	0x1fb5	Standard query (0)	memberfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:27.892193079 CEST	192.168.2.7	1.1.1.1	0x33bd	Standard query (0)	beginlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:27.904778004 CEST	192.168.2.7	1.1.1.1	0xf139	Standard query (0)	knownlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:19.329459906 CEST	192.168.2.7	1.1.1.1	0x5c47	Standard query (0)	fightgeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:20.344276905 CEST	192.168.2.7	1.1.1.1	0x83c2	Standard query (0)	partyinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:21.609978914 CEST	192.168.2.7	1.1.1.1	0xafd8	Standard query (0)	fightinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:22.641103029 CEST	192.168.2.7	1.1.1.1	0x7ea5	Standard query (0)	partynorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:23.672787905 CEST	192.168.2.7	1.1.1.1	0xf4d0	Standard query (0)	fightnorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:24.703435898 CEST	192.168.2.7	1.1.1.1	0xaf5c	Standard query (0)	freshbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:25.719153881 CEST	192.168.2.7	1.1.1.1	0xd700	Standard query (0)	experiencebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:26.734932899 CEST	192.168.2.7	1.1.1.1	0xe137	Standard query (0)	freshbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:27.750502110 CEST	192.168.2.7	1.1.1.1	0x66f0	Standard query (0)	experiencebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:28.766252041 CEST	192.168.2.7	1.1.1.1	0xdb1a	Standard query (0)	freshreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:30.016100883 CEST	192.168.2.7	1.1.1.1	0xc187	Standard query (0)	experiencereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:31.033252954 CEST	192.168.2.7	1.1.1.1	0x5c0c	Standard query (0)	freshquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:32.281800985 CEST	192.168.2.7	1.1.1.1	0x2692	Standard query (0)	experiencequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:33.656968117 CEST	192.168.2.7	1.1.1.1	0x51d1	Standard query (0)	gentlemanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:34.907303095 CEST	192.168.2.7	1.1.1.1	0xaa78	Standard query (0)	alreadybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:35.922257900 CEST	192.168.2.7	1.1.1.1	0xb06a	Standard query (0)	gentlemanbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:37.172446966 CEST	192.168.2.7	1.1.1.1	0x9d5c	Standard query (0)	alreadybelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:38.422349930 CEST	192.168.2.7	1.1.1.1	0x82e4	Standard query (0)	gentlemanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:39.438189983 CEST	192.168.2.7	1.1.1.1	0x2386	Standard query (0)	alreadyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:40.688630104 CEST	192.168.2.7	1.1.1.1	0xe78f	Standard query (0)	gentlemanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:41.703542948 CEST	192.168.2.7	1.1.1.1	0xcf58	Standard query (0)	alreadyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:42.719425917 CEST	192.168.2.7	1.1.1.1	0x2d4f	Standard query (0)	followbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:43.734996080 CEST	192.168.2.7	1.1.1.1	0x3267	Standard query (0)	memberbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:44.753750086 CEST	192.168.2.7	1.1.1.1	0x3987	Standard query (0)	followbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:45.766043901 CEST	192.168.2.7	1.1.1.1	0x560d	Standard query (0)	memberbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:46.781923056 CEST	192.168.2.7	1.1.1.1	0xc023	Standard query (0)	followreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:49.797646046 CEST	192.168.2.7	1.1.1.1	0x4a36	Standard query (0)	followquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:50.813277960 CEST	192.168.2.7	1.1.1.1	0x56e9	Standard query (0)	memberquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:51.969788074 CEST	192.168.2.7	1.1.1.1	0x4074	Standard query (0)	beginbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:52.985311985 CEST	192.168.2.7	1.1.1.1	0x53e1	Standard query (0)	knownbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:53.978466034 CEST	192.168.2.7	1.1.1.1	0xc849	Standard query (0)	beginbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:55.157414913 CEST	192.168.2.7	1.1.1.1	0x4c7e	Standard query (0)	knownbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:56.079106092 CEST	192.168.2.7	1.1.1.1	0x1fb0	Standard query (0)	beginreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:56.969827890 CEST	192.168.2.7	1.1.1.1	0xeab3	Standard query (0)	knownreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:57.828845024 CEST	192.168.2.7	1.1.1.1	0x1b9e	Standard query (0)	beginquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.438075066 CEST	192.168.2.7	1.1.1.1	0x29ba	Standard query (0)	knownquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.448775053 CEST	192.168.2.7	1.1.1.1	0xddac	Standard query (0)	summerbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.460437059 CEST	192.168.2.7	1.1.1.1	0x1534	Standard query (0)	crowdbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.474095106 CEST	192.168.2.7	1.1.1.1	0xac3c	Standard query (0)	summerbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.485200882 CEST	192.168.2.7	1.1.1.1	0x3733	Standard query (0)	crowdbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.497925997 CEST	192.168.2.7	1.1.1.1	0x720a	Standard query (0)	summerreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.509829044 CEST	192.168.2.7	1.1.1.1	0xa86c	Standard query (0)	crowdreceive.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 16:22:56.758208036 CEST	1.1.1.1	192.168.2.7	0xf93d	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 16:22:59.072036982 CEST	1.1.1.1	192.168.2.7	0x910a	Name error (3)	womanclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.314816952 CEST	1.1.1.1	192.168.2.7	0x7047	Name error (3)	smokeclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.488140106 CEST	1.1.1.1	192.168.2.7	0x94ad	Name error (3)	womangeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.501302004 CEST	1.1.1.1	192.168.2.7	0xeb47	Name error (3)	smokegeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.515988111 CEST	1.1.1.1	192.168.2.7	0xdbbe	Name error (3)	womaninclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.528374910 CEST	1.1.1.1	192.168.2.7	0x6697	Name error (3)	smokeinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.768841028 CEST	1.1.1.1	192.168.2.7	0x6e1b	Name error (3)	womannorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.780859947 CEST	1.1.1.1	192.168.2.7	0xd2ba	Name error (3)	smokenorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.797418118 CEST	1.1.1.1	192.168.2.7	0x4731	Name error (3)	partyclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.818885088 CEST	1.1.1.1	192.168.2.7	0x3847	Name error (3)	fightclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.994450092 CEST	1.1.1.1	192.168.2.7	0x3ec1	No error (0)	partygeneral.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:22:59.994450092 CEST	1.1.1.1	192.168.2.7	0x3ec1	No error (0)	partygeneral.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.481833935 CEST	1.1.1.1	192.168.2.7	0x820b	Name error (3)	fightgeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.494982958 CEST	1.1.1.1	192.168.2.7	0x99fe	Name error (3)	partyinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.507364988 CEST	1.1.1.1	192.168.2.7	0xd8b1	Name error (3)	fightinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.518084049 CEST	1.1.1.1	192.168.2.7	0x5209	Name error (3)	partynorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.768618107 CEST	1.1.1.1	192.168.2.7	0x2d7a	Name error (3)	fightnorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.781193972 CEST	1.1.1.1	192.168.2.7	0x5f2a	Name error (3)	freshbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.793140888 CEST	1.1.1.1	192.168.2.7	0xc9c9	Name error (3)	experiencebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.804402113 CEST	1.1.1.1	192.168.2.7	0x16d1	Name error (3)	freshbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.817480087 CEST	1.1.1.1	192.168.2.7	0x5f15	Name error (3)	experiencebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.829871893 CEST	1.1.1.1	192.168.2.7	0x1ee3	Name error (3)	freshreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.857202053 CEST	1.1.1.1	192.168.2.7	0x37b4	Name error (3)	experiencereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:00.884138107 CEST	1.1.1.1	192.168.2.7	0xa4ab	Name error (3)	freshquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.125931978 CEST	1.1.1.1	192.168.2.7	0x6fcd	Name error (3)	experiencequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.139688969 CEST	1.1.1.1	192.168.2.7	0xccac	Name error (3)	gentlemanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.151774883 CEST	1.1.1.1	192.168.2.7	0xe403	Name error (3)	alreadybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.166131020 CEST	1.1.1.1	192.168.2.7	0xdaef	Name error (3)	gentlemanbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.179567099 CEST	1.1.1.1	192.168.2.7	0x677b	Name error (3)	alreadybelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.191646099 CEST	1.1.1.1	192.168.2.7	0x39fa	Name error (3)	gentlemanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.204541922 CEST	1.1.1.1	192.168.2.7	0x2c0b	Name error (3)	alreadyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.446283102 CEST	1.1.1.1	192.168.2.7	0x4b02	Name error (3)	gentlemanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.459589958 CEST	1.1.1.1	192.168.2.7	0x2644	Name error (3)	alreadyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.474405050 CEST	1.1.1.1	192.168.2.7	0x4cba	Name error (3)	followbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.486325979 CEST	1.1.1.1	192.168.2.7	0xeb68	Name error (3)	memberbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.733985901 CEST	1.1.1.1	192.168.2.7	0x2bb8	Name error (3)	followbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:01.987286091 CEST	1.1.1.1	192.168.2.7	0x8529	Name error (3)	memberbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:02.155164003 CEST	1.1.1.1	192.168.2.7	0x6965	Name error (3)	followreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:02.489639044 CEST	1.1.1.1	192.168.2.7	0xa408	No error (0)	memberreceive.net		35.164.78.200	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:03.294171095 CEST	1.1.1.1	192.168.2.7	0x6b64	Name error (3)	followquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:03.306982040 CEST	1.1.1.1	192.168.2.7	0xe563	Name error (3)	memberquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:03.327703953 CEST	1.1.1.1	192.168.2.7	0x1065	Name error (3)	beginbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:03.603338003 CEST	1.1.1.1	192.168.2.7	0x4e44	Name error (3)	knownbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:04.834971905 CEST	1.1.1.1	192.168.2.7	0x94c	Name error (3)	beginbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:04.840406895 CEST	1.1.1.1	192.168.2.7	0x94c	Name error (3)	beginbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:04.846358061 CEST	1.1.1.1	192.168.2.7	0xa61b	Name error (3)	knownbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.089771986 CEST	1.1.1.1	192.168.2.7	0x60b4	Name error (3)	beginreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.340581894 CEST	1.1.1.1	192.168.2.7	0xc3b8	Name error (3)	knownreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.584233999 CEST	1.1.1.1	192.168.2.7	0x9190	Name error (3)	beginquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.597199917 CEST	1.1.1.1	192.168.2.7	0xa3ce	Name error (3)	knownquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.839589119 CEST	1.1.1.1	192.168.2.7	0x2466	Name error (3)	summerbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.852792978 CEST	1.1.1.1	192.168.2.7	0x95d6	Name error (3)	crowdbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:05.865334988 CEST	1.1.1.1	192.168.2.7	0xaa58	Name error (3)	summerbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.115442991 CEST	1.1.1.1	192.168.2.7	0x812	Name error (3)	crowdbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.127631903 CEST	1.1.1.1	192.168.2.7	0xe050	Name error (3)	summerreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.490065098 CEST	1.1.1.1	192.168.2.7	0xec85	Name error (3)	crowdreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.734385967 CEST	1.1.1.1	192.168.2.7	0xaf40	Name error (3)	summerquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:06.746968031 CEST	1.1.1.1	192.168.2.7	0xd1e9	Name error (3)	crowdquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:07.081515074 CEST	1.1.1.1	192.168.2.7	0xefe4	No error (0)	thoughtbranch.net		34.246.200.160	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:07.865104914 CEST	1.1.1.1	192.168.2.7	0xa031	Name error (3)	waterbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:07.879404068 CEST	1.1.1.1	192.168.2.7	0x3d40	Name error (3)	thoughtbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.140649080 CEST	1.1.1.1	192.168.2.7	0xf352	Name error (3)	waterbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.153228998 CEST	1.1.1.1	192.168.2.7	0x1e49	Name error (3)	thoughtreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.167778015 CEST	1.1.1.1	192.168.2.7	0x29ec	Name error (3)	waterreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.408706903 CEST	1.1.1.1	192.168.2.7	0xbcd1	Name error (3)	thoughtquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.422204971 CEST	1.1.1.1	192.168.2.7	0xd06c	Name error (3)	waterquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.434189081 CEST	1.1.1.1	192.168.2.7	0xe8dd	Name error (3)	womanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.676603079 CEST	1.1.1.1	192.168.2.7	0x31e5	Name error (3)	smokebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.689861059 CEST	1.1.1.1	192.168.2.7	0xfc2f	No error (0)	womanbelieve.net		15.197.142.173	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:08.689861059 CEST	1.1.1.1	192.168.2.7	0xfc2f	No error (0)	womanbelieve.net		3.33.152.147	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.345818043 CEST	1.1.1.1	192.168.2.7	0x3e92	Name error (3)	smokebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.357867956 CEST	1.1.1.1	192.168.2.7	0x8bb3	Name error (3)	womanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.368531942 CEST	1.1.1.1	192.168.2.7	0x852a	Name error (3)	smokereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.381783962 CEST	1.1.1.1	192.168.2.7	0x43f9	Name error (3)	womanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.393115044 CEST	1.1.1.1	192.168.2.7	0x6394	Name error (3)	smokequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.403856039 CEST	1.1.1.1	192.168.2.7	0x684d	Name error (3)	partybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.415358067 CEST	1.1.1.1	192.168.2.7	0x5ee0	Name error (3)	fightbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:09.591981888 CEST	1.1.1.1	192.168.2.7	0xd087	No error (0)	partybelieve.net		15.197.192.55	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:10.131587029 CEST	1.1.1.1	192.168.2.7	0xc6a6	Name error (3)	fightbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:10.144226074 CEST	1.1.1.1	192.168.2.7	0xf832	Name error (3)	partyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.333298922 CEST	1.1.1.1	192.168.2.7	0x480e	Name error (3)	fightreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.339821100 CEST	1.1.1.1	192.168.2.7	0x480e	Name error (3)	fightreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.584297895 CEST	1.1.1.1	192.168.2.7	0x42b2	Name error (3)	partyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.595113039 CEST	1.1.1.1	192.168.2.7	0x2855	Name error (3)	fightquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.607228041 CEST	1.1.1.1	192.168.2.7	0x970	Name error (3)	freshhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.619980097 CEST	1.1.1.1	192.168.2.7	0xdcd4	Name error (3)	experiencehonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.869426966 CEST	1.1.1.1	192.168.2.7	0xa235	Name error (3)	freshneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:11.881941080 CEST	1.1.1.1	192.168.2.7	0x6e26	Name error (3)	experienceneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.123236895 CEST	1.1.1.1	192.168.2.7	0x862b	Name error (3)	freshsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.136425018 CEST	1.1.1.1	192.168.2.7	0x7de3	Name error (3)	experiencesystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.148866892 CEST	1.1.1.1	192.168.2.7	0x13c0	Name error (3)	freshtrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.387614965 CEST	1.1.1.1	192.168.2.7	0xf617	Name error (3)	experiencetrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.403403044 CEST	1.1.1.1	192.168.2.7	0x4524	Name error (3)	gentlemanhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.416208982 CEST	1.1.1.1	192.168.2.7	0xd3bb	Name error (3)	alreadyhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.669958115 CEST	1.1.1.1	192.168.2.7	0x1557	Name error (3)	gentlemanneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.690047026 CEST	1.1.1.1	192.168.2.7	0x92f4	Name error (3)	alreadyneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.703558922 CEST	1.1.1.1	192.168.2.7	0xcebf	Name error (3)	gentlemansystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.715862989 CEST	1.1.1.1	192.168.2.7	0xc33e	Name error (3)	alreadysystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.955599070 CEST	1.1.1.1	192.168.2.7	0x4832	Name error (3)	gentlemantrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.972373962 CEST	1.1.1.1	192.168.2.7	0x1bb4	Name error (3)	alreadytrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.985363007 CEST	1.1.1.1	192.168.2.7	0x86a9	Name error (3)	followhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:12.998255014 CEST	1.1.1.1	192.168.2.7	0x41c2	Name error (3)	memberhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:13.018498898 CEST	1.1.1.1	192.168.2.7	0x11c7	Name error (3)	followneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:13.264501095 CEST	1.1.1.1	192.168.2.7	0x64ac	Name error (3)	memberneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:13.277185917 CEST	1.1.1.1	192.168.2.7	0xaa11	Name error (3)	followsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:13.313076973 CEST	1.1.1.1	192.168.2.7	0x8b99	No error (0)	membersystem.net		85.13.130.3	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:14.233246088 CEST	1.1.1.1	192.168.2.7	0x8c56	Name error (3)	followtrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:14.253881931 CEST	1.1.1.1	192.168.2.7	0x145c	No error (0)	membertrust.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:14.253881931 CEST	1.1.1.1	192.168.2.7	0x145c	No error (0)	membertrust.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.023370981 CEST	1.1.1.1	192.168.2.7	0x38b6	Name error (3)	beginhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.035974026 CEST	1.1.1.1	192.168.2.7	0x72f7	Name error (3)	knownhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.286478043 CEST	1.1.1.1	192.168.2.7	0xc9ad	Name error (3)	beginneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.529511929 CEST	1.1.1.1	192.168.2.7	0xca5e	Name error (3)	knownneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.543267012 CEST	1.1.1.1	192.168.2.7	0x37cf	Name error (3)	beginsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.786616087 CEST	1.1.1.1	192.168.2.7	0xc5b0	Name error (3)	knownsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.800870895 CEST	1.1.1.1	192.168.2.7	0x382	Name error (3)	begintrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.817239046 CEST	1.1.1.1	192.168.2.7	0x5ad0	Name error (3)	knowntrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:15.832911968 CEST	1.1.1.1	192.168.2.7	0xc6f	Name error (3)	summerhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.076066017 CEST	1.1.1.1	192.168.2.7	0x4b9b	Name error (3)	crowdhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.089200974 CEST	1.1.1.1	192.168.2.7	0x676f	Name error (3)	summerneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.105436087 CEST	1.1.1.1	192.168.2.7	0xc2a4	Name error (3)	crowdneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.116499901 CEST	1.1.1.1	192.168.2.7	0x3455	Name error (3)	summersystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.128622055 CEST	1.1.1.1	192.168.2.7	0x9f3d	Name error (3)	crowdsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.147651911 CEST	1.1.1.1	192.168.2.7	0x6058	Name error (3)	summertrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:16.594046116 CEST	1.1.1.1	192.168.2.7	0xbb52	No error (0)	crowdtrust.net		170.187.200.48	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.131805897 CEST	1.1.1.1	192.168.2.7	0xfa40	Name error (3)	thoughthonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.151833057 CEST	1.1.1.1	192.168.2.7	0x8b28	Name error (3)	waterhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.166604042 CEST	1.1.1.1	192.168.2.7	0x5995	Name error (3)	thoughtneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.492526054 CEST	1.1.1.1	192.168.2.7	0x205f	Name error (3)	waterneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:17.749679089 CEST	1.1.1.1	192.168.2.7	0xcd7	No error (0)	thoughtsystem.net		213.171.195.105	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:18.664453030 CEST	1.1.1.1	192.168.2.7	0x9eff	No error (0)	watersystem.net		64.190.63.222	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:19.603269100 CEST	1.1.1.1	192.168.2.7	0x2cb9	Name error (3)	thoughttrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:20.041341066 CEST	1.1.1.1	192.168.2.7	0xb6c1	Name error (3)	watertrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:20.532397985 CEST	1.1.1.1	192.168.2.7	0xdcbf	No error (0)	womanhonor.net		54.244.188.177	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:21.594518900 CEST	1.1.1.1	192.168.2.7	0x5909	Name error (3)	smokehonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:21.612550020 CEST	1.1.1.1	192.168.2.7	0x4ad2	Name error (3)	womanneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:21.626259089 CEST	1.1.1.1	192.168.2.7	0x391	Name error (3)	smokeneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:21.800091982 CEST	1.1.1.1	192.168.2.7	0x4709	Name error (3)	womansystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.050182104 CEST	1.1.1.1	192.168.2.7	0xe1bb	Name error (3)	smokesystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.062438965 CEST	1.1.1.1	192.168.2.7	0xd725	Name error (3)	womantrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.307908058 CEST	1.1.1.1	192.168.2.7	0x581b	Name error (3)	smoketrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.318873882 CEST	1.1.1.1	192.168.2.7	0xc380	Name error (3)	partyhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.333545923 CEST	1.1.1.1	192.168.2.7	0xaee2	Name error (3)	fighthonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.348253965 CEST	1.1.1.1	192.168.2.7	0x94a9	Name error (3)	partyneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.364134073 CEST	1.1.1.1	192.168.2.7	0xfd7b	Name error (3)	fightneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.527837992 CEST	1.1.1.1	192.168.2.7	0xf73b	Name error (3)	partysystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.575617075 CEST	1.1.1.1	192.168.2.7	0x4c8b	Name error (3)	partytrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.586731911 CEST	1.1.1.1	192.168.2.7	0x68dc	Name error (3)	fighttrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.602020025 CEST	1.1.1.1	192.168.2.7	0x5cb1	Name error (3)	freshlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.852274895 CEST	1.1.1.1	192.168.2.7	0x2b38	Name error (3)	experiencelaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:22.882518053 CEST	1.1.1.1	192.168.2.7	0x6bce	No error (0)	freshfancy.net		81.169.145.88	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:23.785722971 CEST	1.1.1.1	192.168.2.7	0xca35	Name error (3)	experiencefancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.031197071 CEST	1.1.1.1	192.168.2.7	0x3aff	Name error (3)	freshconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.276823997 CEST	1.1.1.1	192.168.2.7	0xcd72	Name error (3)	experienceconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.289036989 CEST	1.1.1.1	192.168.2.7	0xf72f	Name error (3)	freshfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.538819075 CEST	1.1.1.1	192.168.2.7	0xa8f4	Name error (3)	experiencefriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.549678087 CEST	1.1.1.1	192.168.2.7	0x2a4c	Name error (3)	gentlemanlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.718214989 CEST	1.1.1.1	192.168.2.7	0xdebe	Name error (3)	alreadylaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.981952906 CEST	1.1.1.1	192.168.2.7	0xa304	Name error (3)	gentlemanfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:24.994797945 CEST	1.1.1.1	192.168.2.7	0xad30	Name error (3)	alreadyfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:25.008431911 CEST	1.1.1.1	192.168.2.7	0x4323	Name error (3)	gentlemanconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:25.019424915 CEST	1.1.1.1	192.168.2.7	0xb373	Name error (3)	alreadyconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:25.272799015 CEST	1.1.1.1	192.168.2.7	0x1406	Name error (3)	gentlemanfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:25.603921890 CEST	1.1.1.1	192.168.2.7	0xce48	No error (0)	alreadyfriend.net		15.197.192.55	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.173346996 CEST	1.1.1.1	192.168.2.7	0xcccf	Name error (3)	followlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.184062004 CEST	1.1.1.1	192.168.2.7	0x5336	Name error (3)	memberlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.427146912 CEST	1.1.1.1	192.168.2.7	0x7589	Name error (3)	followfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.439620018 CEST	1.1.1.1	192.168.2.7	0xe3c1	Name error (3)	memberfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.458301067 CEST	1.1.1.1	192.168.2.7	0x88cb	Name error (3)	followconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.470509052 CEST	1.1.1.1	192.168.2.7	0x75b7	Name error (3)	memberconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:26.942564964 CEST	1.1.1.1	192.168.2.7	0xbdad	No error (0)	followfriend.net		188.225.40.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:27.891237020 CEST	1.1.1.1	192.168.2.7	0x1fb5	Name error (3)	memberfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:27.903814077 CEST	1.1.1.1	192.168.2.7	0x33bd	Name error (3)	beginlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:23:27.914954901 CEST	1.1.1.1	192.168.2.7	0xf139	Name error (3)	knownlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:19.342288017 CEST	1.1.1.1	192.168.2.7	0x5c47	Name error (3)	fightgeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:20.593597889 CEST	1.1.1.1	192.168.2.7	0x83c2	Name error (3)	partyinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:21.624454021 CEST	1.1.1.1	192.168.2.7	0xafd8	Name error (3)	fightinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:22.656313896 CEST	1.1.1.1	192.168.2.7	0x7ea5	Name error (3)	partynorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:23.691430092 CEST	1.1.1.1	192.168.2.7	0xf4d0	Name error (3)	fightnorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:24.714538097 CEST	1.1.1.1	192.168.2.7	0xaf5c	Name error (3)	freshbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:25.730051994 CEST	1.1.1.1	192.168.2.7	0xd700	Name error (3)	experiencebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:26.745863914 CEST	1.1.1.1	192.168.2.7	0xe137	Name error (3)	freshbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:27.762432098 CEST	1.1.1.1	192.168.2.7	0x66f0	Name error (3)	experiencebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:29.008287907 CEST	1.1.1.1	192.168.2.7	0xdb1a	Name error (3)	freshreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:30.028261900 CEST	1.1.1.1	192.168.2.7	0xc187	Name error (3)	experiencereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:31.274490118 CEST	1.1.1.1	192.168.2.7	0x5c0c	Name error (3)	freshquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:32.644752026 CEST	1.1.1.1	192.168.2.7	0x2692	Name error (3)	experiencequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:33.900650978 CEST	1.1.1.1	192.168.2.7	0x51d1	Name error (3)	gentlemanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:34.919079065 CEST	1.1.1.1	192.168.2.7	0xaa78	Name error (3)	alreadybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:36.160528898 CEST	1.1.1.1	192.168.2.7	0xb06a	Name error (3)	gentlemanbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:37.414206982 CEST	1.1.1.1	192.168.2.7	0x9d5c	Name error (3)	alreadybelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:38.432774067 CEST	1.1.1.1	192.168.2.7	0x82e4	Name error (3)	gentlemanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:39.679007053 CEST	1.1.1.1	192.168.2.7	0x2386	Name error (3)	alreadyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:40.700752974 CEST	1.1.1.1	192.168.2.7	0xe78f	Name error (3)	gentlemanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:41.714907885 CEST	1.1.1.1	192.168.2.7	0xcf58	Name error (3)	alreadyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:42.730444908 CEST	1.1.1.1	192.168.2.7	0x2d4f	Name error (3)	followbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:43.746114969 CEST	1.1.1.1	192.168.2.7	0x3267	Name error (3)	memberbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:44.764403105 CEST	1.1.1.1	192.168.2.7	0x3987	Name error (3)	followbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:45.778937101 CEST	1.1.1.1	192.168.2.7	0x560d	Name error (3)	memberbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:47.033505917 CEST	1.1.1.1	192.168.2.7	0xc023	Name error (3)	followreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:49.808259010 CEST	1.1.1.1	192.168.2.7	0x4a36	Name error (3)	followquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:50.952276945 CEST	1.1.1.1	192.168.2.7	0x56e9	Name error (3)	memberquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:51.980510950 CEST	1.1.1.1	192.168.2.7	0x4074	Name error (3)	beginbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:52.995425940 CEST	1.1.1.1	192.168.2.7	0x53e1	Name error (3)	knownbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:54.220349073 CEST	1.1.1.1	192.168.2.7	0xc849	Name error (3)	beginbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:55.169265985 CEST	1.1.1.1	192.168.2.7	0x4c7e	Name error (3)	knownbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:56.089919090 CEST	1.1.1.1	192.168.2.7	0x1fb0	Name error (3)	beginreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:56.982188940 CEST	1.1.1.1	192.168.2.7	0xeab3	Name error (3)	knownreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:58.484996080 CEST	1.1.1.1	192.168.2.7	0x1b9e	Name error (3)	beginquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.447949886 CEST	1.1.1.1	192.168.2.7	0x29ba	Name error (3)	knownquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.459800959 CEST	1.1.1.1	192.168.2.7	0xddac	Name error (3)	summerbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.473557949 CEST	1.1.1.1	192.168.2.7	0x1534	Name error (3)	crowdbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.484698057 CEST	1.1.1.1	192.168.2.7	0xac3c	Name error (3)	summerbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.497405052 CEST	1.1.1.1	192.168.2.7	0x3733	Name error (3)	crowdbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.509195089 CEST	1.1.1.1	192.168.2.7	0x720a	Name error (3)	summerreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:24:59.670346975 CEST	1.1.1.1	192.168.2.7	0xa86c	Name error (3)	crowdreceive.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

partygeneral.net

memberreceive.net

thoughtbranch.net

womanbelieve.net

partybelieve.net

membersystem.net

membertrust.net

crowdtrust.net

thoughtsystem.net

watersystem.net

womanhonor.net

freshfancy.net

alreadyfriend.net

followfriend.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	3.33.130.190	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:00.012031078 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partygeneral.net
Aug 5, 2024 16:23:00.467889071 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:23:00 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	35.164.78.200	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:02.497464895 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: memberreceive.net
Aug 5, 2024 16:23:03.262451887 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:23:03 GMT Content-Type: text/html Connection: close Set-Cookie: btst=210c7a536f0059a732bdffc00e0c9edb\|8.46.123.33\|1722867783\|1722867783\|0\|1\|0; path=/; domain=.memberreceive.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49702	34.246.200.160	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:07.088696003 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: thoughtbranch.net
Aug 5, 2024 16:23:07.847978115 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:23:07 GMT Content-Type: text/html Connection: close Set-Cookie: btst=efa534bb5cc2dc5e9eb4f651311bf733\|8.46.123.33\|1722867787\|1722867787\|0\|1\|0; path=/; domain=.thoughtbranch.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49703	15.197.142.173	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:08.695300102 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: womanbelieve.net
Aug 5, 2024 16:23:09.183926105 CEST	266	IN	HTTP/1.1 403 Forbidden Server: awselb/2.0 Date: Mon, 05 Aug 2024 14:23:09 GMT Content-Type: text/html Content-Length: 118 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49704	15.197.192.55	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:09.598023891 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partybelieve.net
Aug 5, 2024 16:23:10.119362116 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:23:10 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49708	85.13.130.3	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:13.325212002 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: membersystem.net
Aug 5, 2024 16:23:13.975238085 CEST	452	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 05 Aug 2024 14:23:13 GMT Server: Apache Location: https://all-inkl.com/index.php Content-Length: 238 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6c 6c 2d 69 6e 6b 6c 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://all-inkl.com/index.php">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49709	3.33.130.190	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:14.259835958 CEST	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: membertrust.net
Aug 5, 2024 16:23:14.771369934 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:23:14 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49712	170.187.200.48	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:16.599848986 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: crowdtrust.net
Aug 5, 2024 16:23:17.110980034 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 05 Aug 2024 14:23:17 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49713	213.171.195.105	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:17.755304098 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: thoughtsystem.net
Aug 5, 2024 16:23:18.628709078 CEST	1236	IN	HTTP/1.1 200 OK server: nginx/1.20.1 date: Mon, 05 Aug 2024 14:23:18 GMT content-type: text/html content-length: 2873 last-modified: Tue, 16 Jul 2024 11:33:23 GMT etag: "66965a83-b39" accept-ranges: bytes connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 44 6f 6d 61 69 6e 20 70 61 72 6b 69 6e 67 20 70 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 73 2f 63 73 73 2f 69 6e 64 65 78 2e 63 73 73 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 66 61 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Domain parking page</title> <link rel="stylesheet" href="/styles/css/index.css"> <link rel="shortcut icon" href="https://static.fasthosts.co.uk/icons/favicon.ico" type="image/x-icon" /> ... Global site tag (gtag.js) - Google Analytics --> <script async src="https://www.googletagmanager.com/gtag/js?id=UA-199510482-1"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-199510482-1'); </script> </head><body> <div class="container"> <nav class="logo"> <a href="https://fasthosts.co.uk/" rel="nofollow"> <img src="/assets/fasthosts-logo-secondary.svg" alt="Fasthosts"></img> </a> </nav> <main> <h2>Welcome to <span class="domain
Aug 5, 2024 16:23:18.628727913 CEST	1236	IN	Data Raw: 56 61 72 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 68 32 3e 0a 20 20 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 69 73 20 70 61 72 6b 65 64 20 66 6f 72 20 46 52 45 45 20 62 79 0a 20 20 20 20 20 20 20 Data Ascii: Var"></span></h2> <p> This domain name is parked for FREE by <strong><a href="https://fasthosts.co.uk/" rel="nofollow">fasthosts.co.uk</a></strong> </p> <div class="row"> <div class="card card--is-cta
Aug 5, 2024 16:23:18.628766060 CEST	448	IN	Data Raw: 66 61 73 74 68 6f 73 74 73 2e 63 6f 2e 75 6b 2f 63 6f 6e 74 61 63 74 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 64 6f 6d 61 69 6e 70 61 72 6b 69 6e 67 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 72 65 66 65 72 72 61 6c 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d Data Ascii: fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_parking_contact">Contact us</a> </main> </div> <script> const cleanHostname = document.location.hostname.indexOf("www.") && document.location.hos
Aug 5, 2024 16:23:18.628777981 CEST	187	IN	Data Raw: 61 22 29 2e 68 72 65 66 20 3d 20 60 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 73 74 68 6f 73 74 73 2e 63 6f 2e 75 6b 2f 64 6f 6d 61 69 6e 2d 6e 61 6d 65 73 2f 73 65 61 72 63 68 2f 3f 64 6f 6d 61 69 6e 3d 24 7b 63 6c 65 61 6e 48 6f 73 74 6e 61 6d Data Ascii: a").href = `https://www.fasthosts.co.uk/domain-names/search/?domain=${cleanHostname}&utm_source=domainparking&utm_medium=referral&utm_campaign=fh_parking_dac` </script></body></html>
Aug 5, 2024 16:23:18.633377075 CEST	1236	IN	HTTP/1.1 200 OK server: nginx/1.20.1 date: Mon, 05 Aug 2024 14:23:18 GMT content-type: text/html content-length: 2873 last-modified: Tue, 16 Jul 2024 11:33:23 GMT etag: "66965a83-b39" accept-ranges: bytes connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 44 6f 6d 61 69 6e 20 70 61 72 6b 69 6e 67 20 70 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 73 2f 63 73 73 2f 69 6e 64 65 78 2e 63 73 73 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 66 61 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Domain parking page</title> <link rel="stylesheet" href="/styles/css/index.css"> <link rel="shortcut icon" href="https://static.fasthosts.co.uk/icons/favicon.ico" type="image/x-icon" /> ... Global site tag (gtag.js) - Google Analytics --> <script async src="https://www.googletagmanager.com/gtag/js?id=UA-199510482-1"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-199510482-1'); </script> </head><body> <div class="container"> <nav class="logo"> <a href="https://fasthosts.co.uk/" rel="nofollow"> <img src="/assets/fasthosts-logo-secondary.svg" alt="Fasthosts"></img> </a> </nav> <main> <h2>Welcome to <span class="domain

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49714	64.190.63.222	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:18.674741983 CEST	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: watersystem.net
Aug 5, 2024 16:23:19.359216928 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49715	54.244.188.177	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:20.542334080 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: womanhonor.net
Aug 5, 2024 16:23:21.353359938 CEST	379	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:23:21 GMT Content-Type: text/html Connection: close Set-Cookie: btst=77f125e0628864a7c45e3434bce0ddf3\|8.46.123.33\|1722867801\|1722867801\|0\|1\|0; path=/; domain=.womanhonor.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49716	81.169.145.88	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:22.892755985 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: freshfancy.net
Aug 5, 2024 16:23:23.542732000 CEST	374	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 14:23:23 GMT Server: Apache/2.4.61 (Unix) Content-Length: 196 Content-Type: text/html; charset=iso-8859-1 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49717	15.197.192.55	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:25.609951019 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: alreadyfriend.net
Aug 5, 2024 16:23:26.152344942 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:23:26 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49718	188.225.40.227	80	3452	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:23:26.948259115 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: followfriend.net
Aug 5, 2024 16:23:27.646753073 CEST	373	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.1 Date: Mon, 05 Aug 2024 14:23:27 GMT Content-Type: text/html Content-Length: 169 Connection: close Location: https://followfriend.net/index.php Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.26.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	59623	3.33.130.190	80	7912	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:24:17.780365944 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partygeneral.net
Aug 5, 2024 16:24:18.320534945 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:24:18 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	59624	35.164.78.200	80	7912	C:\whfkpbh\idtpqzltyfy.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:24:48.053297043 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: memberreceive.net
Aug 5, 2024 16:24:48.786004066 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:24:48 GMT Content-Type: text/html Connection: close Set-Cookie: btst=c888f3a3f699a81491e3b3d2c6c0d945\|8.46.123.33\|1722867888\|1722867888\|0\|1\|0; path=/; domain=.memberreceive.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Target ID:	0
Start time:	10:22:53
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\mtuXDnH1Di.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\mtuXDnH1Di.exe"
Imagebase:	0xec0000
File size:	279'552 bytes
MD5 hash:	E4B47C06B5EED80FB44CFEA757525634
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:22:54
Start date:	05/08/2024
Path:	C:\whfkpbh\qbf30bzbv7f7qnhdav.exe
Wow64 process (32bit):	true
Commandline:	"C:\whfkpbh\qbf30bzbv7f7qnhdav.exe"
Imagebase:	0x9d0000
File size:	279'552 bytes
MD5 hash:	E4B47C06B5EED80FB44CFEA757525634
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:22:54
Start date:	05/08/2024
Path:	C:\whfkpbh\idtpqzltyfy.exe
Wow64 process (32bit):	true
Commandline:	C:\whfkpbh\idtpqzltyfy.exe
Imagebase:	0x140000
File size:	279'552 bytes
MD5 hash:	E4B47C06B5EED80FB44CFEA757525634
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:22:55
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	10:22:55
Start date:	05/08/2024
Path:	C:\whfkpbh\amdrhfskpcu.exe
Wow64 process (32bit):	true
Commandline:	wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe"
Imagebase:	0xa30000
File size:	279'552 bytes
MD5 hash:	E4B47C06B5EED80FB44CFEA757525634
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:22:56
Start date:	05/08/2024
Path:	C:\whfkpbh\idtpqzltyfy.exe
Wow64 process (32bit):	true
Commandline:	"C:\whfkpbh\idtpqzltyfy.exe"
Imagebase:	0x140000
File size:	279'552 bytes
MD5 hash:	E4B47C06B5EED80FB44CFEA757525634
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:45:45
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:46:17
Start date:	05/08/2024
Path:	C:\whfkpbh\idtpqzltyfy.exe
Wow64 process (32bit):	true
Commandline:	"c:\whfkpbh\idtpqzltyfy.exe"
Imagebase:	0x140000
File size:	279'552 bytes
MD5 hash:	E4B47C06B5EED80FB44CFEA757525634
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:46:18
Start date:	05/08/2024
Path:	C:\whfkpbh\amdrhfskpcu.exe
Wow64 process (32bit):	true
Commandline:	wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe"
Imagebase:	0xcd0000
File size:	279'552 bytes
MD5 hash:	E4B47C06B5EED80FB44CFEA757525634
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	46.6%
Total number of Nodes:	1706
Total number of Limit Nodes:	14

Executed Functions

Function 00EC7A04 Relevance: 60.1, APIs: 28, Strings: 5, Instructions: 2326sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 00EC83DA
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00EC8448
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00EC84DC
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00EC84F7
GetTickCount.KERNEL32 ref: 00EC8599

Part of subcall function 00ED5200: GetVersionExA.KERNEL32(00F4AE70), ref: 00ED52CC

Sleep.KERNEL32(00000D05), ref: 00EC8B70
Sleep.KERNEL32(000007D0), ref: 00EC8DAC
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00EC8E86
SetFileAttributesA.KERNEL32(?,00000080), ref: 00EC8E9F
CopyFileA.KERNEL32(?,?,00000000), ref: 00EC8EC3
SetFileAttributesA.KERNEL32(?,00000002), ref: 00EC912B
SetFileAttributesA.KERNEL32(?,00000080), ref: 00EC9186
GetCommandLineA.KERNEL32 ref: 00EC9265
GetModuleFileNameA.KERNEL32(00000000,?), ref: 00EC9370

Part of subcall function 00ECA4E0: lstrlen.KERNEL32(?), ref: 00ECA4FE

Part of subcall function 00ECD500: lstrlen.KERNEL32(?,?,00ECD630,?), ref: 00ECD523

MessageBoxA.USER32(00000000,00000004,00000005,?), ref: 00EC96D4
CloseHandle.KERNEL32(00000000), ref: 00EC9AC8
SetFileAttributesA.KERNEL32(?,00000080), ref: 00EC9AEC
CopyFileA.KERNEL32(?,?,00000000), ref: 00EC9B0C
SetFileAttributesA.KERNEL32(?,00000002), ref: 00EC9B3B
Sleep.KERNEL32(000003E8), ref: 00EC9C52
Sleep.KERNEL32(000003E8), ref: 00EC8CB2

Part of subcall function 00ECBBC0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00ECBC90
Part of subcall function 00ECBBC0: Process32First.KERNEL32(00000000,?), ref: 00ECBCE3

GetCommandLineA.KERNEL32 ref: 00EC86AE

Part of subcall function 00EC2800: ExitProcess.KERNEL32 ref: 00EC2842

Part of subcall function 00EF08B0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00EF0929
Part of subcall function 00EF08B0: __aulldiv.LIBCMT ref: 00EF0953

Sleep.KERNEL32(000007D0), ref: 00EC9E32
SetFileAttributesA.KERNEL32(00F0D800,00000080), ref: 00EC9E88
CopyFileA.KERNEL32(?,00F0D800,00000000), ref: 00EC9EA6
SetFileAttributesA.KERNEL32(00F0D800,00000002), ref: 00EC9EC5

Part of subcall function 00ED0500: OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00ED0537
Part of subcall function 00ED0500: CreateServiceA.ADVAPI32(00000000,015BFCE0,015BFCE0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00ED0596
Part of subcall function 00ED0500: ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00ED0615
Part of subcall function 00ED0500: StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00ED062A

CreateThread.KERNEL32(00000000,00000000,Function_000222A0,00000000,00000000,00000000), ref: 00ECA26A
Sleep.KERNEL32(0000C350), ref: 00ECA327

Strings

zS, xrefs: 00EC9CD7
@L, xrefs: 00EC7E24
C:\Users\user, xrefs: 00EC83D4
%Tmd, xrefs: 00EC8421
}en, xrefs: 00EC9856

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: File$Attributes$CreateSleep$CopyMutexService$CommandLineModuleNameTimelstrlen$ChangeCloseConfig2CountEnvironmentExitFirstHandleManagerMessageOpenProcessProcess32SnapshotStartSystemThreadTickToolhelp32VariableVersion__aulldiv
String ID: zS$%Tmd$C:\Users\user$@L$}en
API String ID: 2964372999-4230071128
Opcode ID: 0be5985b8fe799c8f1809fd632388080f1bc45ba70144bf09da8d2b30f7f602b
Instruction ID: 63fad7c220372febe3c93908021eb780faca9e1418d5aa322e1edbe151803368
Opcode Fuzzy Hash: 0be5985b8fe799c8f1809fd632388080f1bc45ba70144bf09da8d2b30f7f602b
Instruction Fuzzy Hash: 282366B5A0030DDFD304EF61FE8AA763BB6F795320B11401AE941A62B5EB719861FF41

Function 00ED5200 Relevance: 30.9, APIs: 12, Strings: 5, Instructions: 1106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00F4AE70), ref: 00ED52CC
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00ED549F
DeleteFileA.KERNELBASE(?), ref: 00ED56FE
RemoveDirectoryA.KERNELBASE(00000000), ref: 00ED5743
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00ED583A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00ED58F3
CreateDirectoryA.KERNEL32(?,00000000), ref: 00ED5D71
CreateDirectoryA.KERNEL32(?,00000000), ref: 00ED5E82
GetTempPathA.KERNEL32(00000104,?), ref: 00ED6029
CreateDirectoryA.KERNEL32(?,00000000), ref: 00ED61FF
GetTempPathA.KERNEL32(00000104,?), ref: 00ED63DE
SetFileAttributesA.KERNELBASE(?,00000002), ref: 00ED655F

Strings

C:\whfkpbh\, xrefs: 00ED5851, 00ED5D90, 00ED61A2, 00ED63F5
\, xrefs: 00ED6092
aE'P, xrefs: 00ED5BDE
C:\Users\user, xrefs: 00ED5B3A, 00ED5C6A
r9:, xrefs: 00ED6085

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\whfkpbh\$\$aE'P$r9:
API String ID: 1691758827-1166413814
Opcode ID: 925bb23051e8c471d6ebb5af2d26a76914bdfcd0091c4bed04c4f089a929a301
Instruction ID: abfcbe54bab54213d3814a72406be92ffaf4c5afe7be77e91e877da7650f0108
Opcode Fuzzy Hash: 925bb23051e8c471d6ebb5af2d26a76914bdfcd0091c4bed04c4f089a929a301
Instruction Fuzzy Hash: 2DA27AB6A0030DCFD704EF24FD86AB537B2F794320B11812AE941A62B5EB349856FF55

Function 00EE9580 Relevance: 7.7, APIs: 5, Instructions: 220
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8,00000001), ref: 00EE9679
FindFirstFileA.KERNELBASE(?,?), ref: 00EE97B8
DeleteFileA.KERNELBASE(?), ref: 00EE98A9
FindNextFileA.KERNELBASE(00000000,?), ref: 00EE98CB
FindClose.KERNEL32(00000000), ref: 00EE98E4

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: ac1e4c0ab9b9a831f95783fb47e694b7c0f9868916f5366c2f48237303551781
Instruction ID: 6950b8e73a50d5a6e940f58eec48b889bba21fdfee3a4a832c18852762fef3a6
Opcode Fuzzy Hash: ac1e4c0ab9b9a831f95783fb47e694b7c0f9868916f5366c2f48237303551781
Instruction Fuzzy Hash: 6E91647990030CCFC704DF65FD826A53BB2FBA5320B00851AE941E72B0EB749991EF91

Function 00ECB7A0 Relevance: 3.1, APIs: 2, Instructions: 89
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00ECB82B
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00ECB87D

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: AllocateCheckInitializeMembershipToken
String ID:
API String ID: 1663163955-0
Opcode ID: b99b2ea2c07c3505035aaa926b0df1d29582cfe75327581fdafaed6894d9bf2d
Instruction ID: ffba2ceb94bf1456ea7a13a27e2998c7e67abb3f18d5470507547d5549dffcda
Opcode Fuzzy Hash: b99b2ea2c07c3505035aaa926b0df1d29582cfe75327581fdafaed6894d9bf2d
Instruction Fuzzy Hash: A231FE7590534CEFD704CFA4EE999BA7BB8FB95300B00808EE802A72B0C7705949EB51

Function 00ECE2C0 Relevance: 3.0, APIs: 2, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00EF220A,02167FFC,?,?,?,?,00EE463C), ref: 00ECE2F8
RtlAllocateHeap.NTDLL(00000000,?,00EF220A,02167FFC,?,?,?,?,00EE463C), ref: 00ECE2FF

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 4c5f0027bc496a47bcb0fd545884c702094ba51f364c49c1d3fad905b4552f84
Instruction ID: 095c8ced1ab3ed5ad4d1d26c4e797ec5230e1cd480721d6be8fef5534ee31a56
Opcode Fuzzy Hash: 4c5f0027bc496a47bcb0fd545884c702094ba51f364c49c1d3fad905b4552f84
Instruction Fuzzy Hash: 7AE04F76104208AFC7089BA6EC49A6537E8FB45205B048049F909D6275CA31A595DB94

Function 00ECCA40 Relevance: 10.8, APIs: 7, Instructions: 345
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,?,00000000,00000003,00000000,00000000), ref: 00ECCB20
ReadFile.KERNELBASE(00000000,?,?,?,00000000), ref: 00ECCB5D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00ECCBBD
GetTickCount.KERNEL32 ref: 00ECCC1D
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00ECCED4
WriteFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00ECCF0E
CloseHandle.KERNEL32(00000000), ref: 00ECCF47

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: File$CloseCreate$ChangeCountFindHandleNotificationReadTickWrite
String ID:
API String ID: 688250028-0
Opcode ID: b4c73c3def3c56f82adf71cdd6bee5ade527732cead8f7bb7944cc57ca1fb739
Instruction ID: d7381e5fe44d67d26ce6bd28d4b4684cf117103207dbf4625dcd88b56cb23a3d
Opcode Fuzzy Hash: b4c73c3def3c56f82adf71cdd6bee5ade527732cead8f7bb7944cc57ca1fb739
Instruction Fuzzy Hash: 20E18875A0020CDFC304EF24FD45BB93BB6FB91720B204119E946A72F4E7315956EB95

Function 00EEFA80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 133
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,H,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00EEFBF1
CloseHandle.KERNEL32(H,?,?,?,?,?,00000000), ref: 00EEFC2F
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00EEFC58

Strings

H, xrefs: 00EEFBE0, 00EEFBE5
D, xrefs: 00EEFB8F
H, xrefs: 00EEFC1F, 00EEFC28

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D$H$H
API String ID: 2922976086-2225610527
Opcode ID: 4c2cdf287489fc7ec8188ebad2148146f7b569b55f5a440401a03c01a516566e
Instruction ID: ada8365f708f224c5d1746546e22edc7c151adcb40b97f0835fb39d4653d6145
Opcode Fuzzy Hash: 4c2cdf287489fc7ec8188ebad2148146f7b569b55f5a440401a03c01a516566e
Instruction Fuzzy Hash: 29513171A5121CDBD744DF64FC427B63BFAF748B21F04401AE806D62B4EBB49460EB85

Function 00ED1D90 Relevance: 4.7, APIs: 3, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EE3110: WaitForSingleObject.KERNEL32(?,00004E20,?,00ECD0F2,00000128), ref: 00EE31AD

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00ED1E7B

Part of subcall function 00EEFCC0: ReleaseMutex.KERNEL32(00ECD410,?,00ECD410,00000128), ref: 00EEFCE9

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: db32f4edd44b61ec1ef7aca3b032377dfac11f720570e56071b582ccdfd8a1c1
Instruction ID: 09f1c238c0a45821197997f9845d06eae46076ac11e72c56d52a2dfca07e9fbe
Opcode Fuzzy Hash: db32f4edd44b61ec1ef7aca3b032377dfac11f720570e56071b582ccdfd8a1c1
Instruction Fuzzy Hash: 3371413560120CDFD704CF65FC89A2A3BB6FBA4314F02815AE941A32B0DB70A961FF81

Function 00ED2EB0 Relevance: 3.0, APIs: 2, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00ED0367,?,00ED0367,00000000), ref: 00ED2ED1
RtlFreeHeap.NTDLL(00000000,?,00ED0367,00000000), ref: 00ED2ED8

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 5a4547048a7e7c6b2f2a96dbc1db343c94c7b6be050ae117867db34f4bcb16b8
Instruction ID: a8c201e9746559d9db5bf1fccaafd57362cef9e1271ae68659cfabb70cfbbbb0
Opcode Fuzzy Hash: 5a4547048a7e7c6b2f2a96dbc1db343c94c7b6be050ae117867db34f4bcb16b8
Instruction Fuzzy Hash: 32012B7960824CCFC314DF65FE965353BF6F798724701420AE60AAB2B1D3309895EB55

Function 00EE45A9 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00EE4699

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 09cd121e620a7544c3ff32f1b7e06e7377e97674aefbbff9db3646266ac141e8
Instruction ID: 113b037200e4e01ce5988e002af3c5481306ec5910132a94588630a77defa697
Opcode Fuzzy Hash: 09cd121e620a7544c3ff32f1b7e06e7377e97674aefbbff9db3646266ac141e8
Instruction Fuzzy Hash: 32110475A1220ECBD710FF71FE8952637F1F7A13153015426E082E62B9EB759815FB82

Function 00EC2800 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00EC2842

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3196dac6aa140ef1ea46b6d718afaf5324932ff6671361c7928fa85f5b93d871
Instruction ID: 4c4f80d94e352bef4330c9021870d35e434c705639041051a5c6f3fd8dd43b14
Opcode Fuzzy Hash: 3196dac6aa140ef1ea46b6d718afaf5324932ff6671361c7928fa85f5b93d871
Instruction Fuzzy Hash: 75E0863C00520D8FC308DF16D89687637B6A7C5304374C41F9A152B660D635E44DDF51

Function 00ECA4E0 Relevance: 1.3, APIs: 1, Instructions: 33
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 00ECA4FE

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: e9b50138ab0e6cdd2ecf88f7300384c4980ba23b4c958ba5b2adcab1dd5ead4a
Instruction ID: c148535b02ceb4207ddb9c2705f4a60436550cda96724510db873cef27b3e0da
Opcode Fuzzy Hash: e9b50138ab0e6cdd2ecf88f7300384c4980ba23b4c958ba5b2adcab1dd5ead4a
Instruction Fuzzy Hash: 24F0AF7160122CEFD7059F22FD0A46637BAFB993713404012E885A2179EB745825FB96

Non-executed Functions

Function 00EE0D80 Relevance: 25.7, APIs: 11, Strings: 3, Instructions: 1222COMMON

Download Yara Rule

Strings

XH, xrefs: 00EE153C
U][v, xrefs: 00EE1ED5
/, xrefs: 00EE100F

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: XH$/$U][v
API String ID: 0-1996962770
Opcode ID: b0a2cf9300248b28fa393e2a1b27f6e3a606c034a0ac0c3603443c612df5ab56
Instruction ID: cbe0f87bfdac8801b97cea0c1c6a0be83935b3264ee718a0d5ec8a412daff1eb
Opcode Fuzzy Hash: b0a2cf9300248b28fa393e2a1b27f6e3a606c034a0ac0c3603443c612df5ab56
Instruction Fuzzy Hash: 4BB27775A0020DCFD704EF21FD856B93BB6FB94320F11805AE946A72B4EB3159A5EF81

Function 00EDA930 Relevance: 21.8, APIs: 11, Strings: 1, Instructions: 829memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00EDAACC

Strings

#~\, xrefs: 00EDB319

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: HeapProcess
String ID: #~\
API String ID: 54951025-95464956
Opcode ID: 0f14a7ff8b49ee4d187eadd86658bd0ed28830fc4eb61aec6352567a91e704de
Instruction ID: 8262bad689ff011e193079c5e0aa01672e184a4ddc4949e8e0f70e34f3182357
Opcode Fuzzy Hash: 0f14a7ff8b49ee4d187eadd86658bd0ed28830fc4eb61aec6352567a91e704de
Instruction Fuzzy Hash: 5E722175A0020DCFC304EF25FD856A53BB6FB94320B11912AE841E73B0E77498A6FB91

Function 00EE6A7B Relevance: 16.4, Strings: 12, Instructions: 1391COMMON

Download Yara Rule

Strings

X, xrefs: 00EE7455
l, xrefs: 00EE76E8
d, xrefs: 00EE6D7D
p, xrefs: 00EE77B9
0, xrefs: 00EE7B16
d, xrefs: 00EE7849
o, xrefs: 00EE7B09
x, xrefs: 00EE7450
l, xrefs: 00EE76D0
%, xrefs: 00EE7656
d, xrefs: 00EE72FC
p, xrefs: 00EE6CAA

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: wvsprintf
String ID: %$0$X$d$d$d$l$l$o$p$p$x
API String ID: 2795597889-2884493731
Opcode ID: f92f6c8f449a6c116e7da17c7583849869964869bc8fcd6d93e38e0f14c7f5c0
Instruction ID: 9070dabbae8be345e3bf625040ac53bee3abf63df550c7025a6c7687842f72a1
Opcode Fuzzy Hash: f92f6c8f449a6c116e7da17c7583849869964869bc8fcd6d93e38e0f14c7f5c0
Instruction Fuzzy Hash: 3DD26AB5A0464DCFD704DF26FD892643BB2FBA5360B225016D881E72B4E73488A5FF85

Function 00ED0500 Relevance: 13.7, APIs: 9, Instructions: 170serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00ED0537
CreateServiceA.ADVAPI32(00000000,015BFCE0,015BFCE0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00ED0596
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00ED0615
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00ED062A
CloseServiceHandle.ADVAPI32(00000000), ref: 00ED06A7
OpenServiceA.ADVAPI32(00000000,015BFCE0,00000010), ref: 00ED06EB
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00ED072D
CloseServiceHandle.ADVAPI32(00000000), ref: 00ED073E
CloseServiceHandle.ADVAPI32(00000000), ref: 00ED07A8

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: 2214fe1248702ba8f81ba9057f2485effb5338c68e003484a3838755ac39b9e0
Instruction ID: 60df90658ae7eec91d8b4e6a17983b0f088a7cc6418ae2c137ac9eb754ed44ab
Opcode Fuzzy Hash: 2214fe1248702ba8f81ba9057f2485effb5338c68e003484a3838755ac39b9e0
Instruction Fuzzy Hash: CB61423564230CEFD3019F60FC8AB6A3BB1FBA2711F168406E941AA2B4DBB45461FF45

Function 00ECAF20 Relevance: 7.9, APIs: 5, Instructions: 385serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00ECB0AA
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 00ECB15A
GetLastError.KERNEL32 ref: 00ECB17A
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 00ECB216
CloseServiceHandle.ADVAPI32(00000000), ref: 00ECB41C

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: be5db060266a1e2c42a24536c0bb124873ca20b2c94a3ffbc3cfc4d14e99f905
Instruction ID: 02a1415922848d758417c2b662cf5993eb1abc3f7aa7acc23bd58be981068896
Opcode Fuzzy Hash: be5db060266a1e2c42a24536c0bb124873ca20b2c94a3ffbc3cfc4d14e99f905
Instruction Fuzzy Hash: 91F166B6A0120DDFC704DF65FD86B6A3BB6F794320F114019E942E32B4E73598A5EB81

Function 00EF50E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(}$,00000001,?,?,00EE247D), ref: 00EF518C
GetTickCount.KERNEL32 ref: 00EF52BE

Strings

}$, xrefs: 00EF5188, 00EF518B
@AB , xrefs: 00EF52CD

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: CountSystemTickTime
String ID: @AB $}$
API String ID: 2164215191-3602920818
Opcode ID: bd3704033cc7f82c0a961be74820690f9b60e91924dad0054261ad1bd9bc782e
Instruction ID: 765e2a9f2acaf89155237627480628b436d4ba662941e2424be251b14029a41f
Opcode Fuzzy Hash: bd3704033cc7f82c0a961be74820690f9b60e91924dad0054261ad1bd9bc782e
Instruction Fuzzy Hash: EA51EC76A1560CCFD308DF69FD895263BF2F7A53203014115E986D72B4EBB488A0FB85

Function 00ED2120 Relevance: 6.2, APIs: 4, Instructions: 207processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00ED21D0
Process32First.KERNEL32(00000000,00000128), ref: 00ED2257
Process32Next.KERNEL32(00000000,00000128), ref: 00ED2384
CloseHandle.KERNEL32(00000000), ref: 00ED2426

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 8de0e581005b55fb8bf2f9f1a695af12dcf37754eb8fe65ba9ad98ae15d4d886
Instruction ID: d20da305f84c8c89875634466f27b0827bc64a6296ca5487741141a7666023ed
Opcode Fuzzy Hash: 8de0e581005b55fb8bf2f9f1a695af12dcf37754eb8fe65ba9ad98ae15d4d886
Instruction Fuzzy Hash: BC9125B1A0131CCFD710DF25FC886A537B6FBA0320F15801AD942A22B4EB7499A6FF55

Function 00ECE550 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 521COMMON

Download Yara Rule

Strings

{mYr, xrefs: 00ECEC73
, xrefs: 00ECE8A2

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: ${mYr
API String ID: 0-2876023986
Opcode ID: cf414f53df31c1998e730feea7a9970b28ea201115dabeafe609a10f3b893afe
Instruction ID: 08fbd8687f5d635e050320b5166275db806c9cf85e92e4563ad685388e36ba89
Opcode Fuzzy Hash: cf414f53df31c1998e730feea7a9970b28ea201115dabeafe609a10f3b893afe
Instruction Fuzzy Hash: 63222675A0020DCFC704EF24FE81A7637F6F794321B00812AE945A63B5EB759856EB91

Function 00EDF160 Relevance: 4.9, Strings: 3, Instructions: 1183COMMON

Download Yara Rule

Strings

t?Wx, xrefs: 00EE016D
C@% , xrefs: 00EDFD04
, xrefs: 00EE0233

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: $C@% $t?Wx
API String ID: 0-2869517708
Opcode ID: 62a031e75935b5c04bc132a3ed8e28a3a5af0ca7165661a8464ae4b985f1e9f0
Instruction ID: 4e0880652cd1c6a497a41d40c8c1d16118d5f3de37a59e28d25b832865751589
Opcode Fuzzy Hash: 62a031e75935b5c04bc132a3ed8e28a3a5af0ca7165661a8464ae4b985f1e9f0
Instruction Fuzzy Hash: 6BB24375A0020DCFCB04DF65FD855A977F2FB98320715811AD842A73B4EB7499A2EF80

Function 00EE55E0 Relevance: 4.1, Strings: 2, Instructions: 1592COMMON

Download Yara Rule

Strings

l, xrefs: 00EE664B
p R, xrefs: 00EE5AB1

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: l$p R
API String ID: 0-2271698361
Opcode ID: 7aa7aa6c3cd3af6b6db58d4cb1a54ce8823498b0a65a238e4c21a5de8fc932cf
Instruction ID: 37eeeb1a805bff7afd814a90d26be99e3c459dcf277c4d04976e624e0cc7dcc7
Opcode Fuzzy Hash: 7aa7aa6c3cd3af6b6db58d4cb1a54ce8823498b0a65a238e4c21a5de8fc932cf
Instruction Fuzzy Hash: 57E267B5A0064DCFC704DF26FD851A93BB2F7A5360712801AD882E72B4E77488A5FF85

Function 00EDE1C0 Relevance: 3.7, APIs: 2, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3300348e49dc20250f9251706d8ae2e06ffa62cde23a70230bff88acc59b0d1c
Instruction ID: 1b36b70668174866a7d084d29e63dd59c7d11bbbc5b85db2b4588cfbe351824a
Opcode Fuzzy Hash: 3300348e49dc20250f9251706d8ae2e06ffa62cde23a70230bff88acc59b0d1c
Instruction Fuzzy Hash: 486235B5A0020DCFD714EF25FD896653BF2FB90310B21901AE942AB3B5EB315856EF81

Function 00ED30F0 Relevance: 2.3, Strings: 1, Instructions: 1008COMMON

Download Yara Rule

Strings

+#T, xrefs: 00ED3D25

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: +#T
API String ID: 0-666610905
Opcode ID: 422c876e055d41d0b02bdadc8726d90ad7b3274a0ab25eddf13e6db2f4b69a27
Instruction ID: 91ff3235ded36b306e67d7bf0c2d222f5f3610f7a08c46412a72126810ec7bbb
Opcode Fuzzy Hash: 422c876e055d41d0b02bdadc8726d90ad7b3274a0ab25eddf13e6db2f4b69a27
Instruction Fuzzy Hash: EA9256B6A0020DDFCB04DF25FD855AA3BB5FB94310B11551AE842B3374E7309A66EF92

Function 00EE9B00 Relevance: 2.2, APIs: 1, Instructions: 701COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 00EE9C49

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 484b53b6e741d3e81c12055320c2ad313c823d89d69ec2581c0741edf8eda33b
Instruction ID: fef05058d4739fb4a08e9eba1296b223252e6c273f74f35722525bbcd662f958
Opcode Fuzzy Hash: 484b53b6e741d3e81c12055320c2ad313c823d89d69ec2581c0741edf8eda33b
Instruction Fuzzy Hash: 4C62227590020DCFC704EF60FD92AB937B5FBA4310F10906AE546A32B5EB706A99EF51

Function 00EEE70B Relevance: 2.0, Strings: 1, Instructions: 773COMMON

Download Yara Rule

Strings

Bzb, xrefs: 00EEF276

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: Bzb
API String ID: 0-2804807757
Opcode ID: d5a29f0763e1f5b484e8d8e9f5f87992b5662648d034601d0e82c43a36932234
Instruction ID: fe84be1d4fd83e1ee81bae1077240034114e20fb0505da534d128802b78f8914
Opcode Fuzzy Hash: d5a29f0763e1f5b484e8d8e9f5f87992b5662648d034601d0e82c43a36932234
Instruction Fuzzy Hash: 2D72FC7AA1121DCFC754DF29FD851613BF2FB983603168016D881E72B1E734A8A5EF85

Function 00EE22A0 Relevance: 1.8, APIs: 1, Instructions: 598sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF08B0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00EF0929
Part of subcall function 00EF08B0: __aulldiv.LIBCMT ref: 00EF0953

Part of subcall function 00ED1200: Sleep.KERNEL32(000003E8), ref: 00ED139B

Sleep.KERNEL32(000008AE), ref: 00EE2C03

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: SleepTime$FileSystem__aulldiv
String ID:
API String ID: 3227937447-0
Opcode ID: 61606da5c4849da9fc251addb2e9cb328ff9ab8ab32e6d23ef5046e66d91c21d
Instruction ID: 5c3be1a85f3c9be32783f53c31263d8d0945b558e1edbe80245eff6fce752527
Opcode Fuzzy Hash: 61606da5c4849da9fc251addb2e9cb328ff9ab8ab32e6d23ef5046e66d91c21d
Instruction Fuzzy Hash: 63425575A0020CCFD704DF61FD92ABA3BB6FB94320F11815AE542A32B4EB3459A5EF51

Function 00EE66E7 Relevance: 1.8, Strings: 1, Instructions: 554COMMON

Download Yara Rule

Strings

gZ, xrefs: 00EE683E

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: gZ
API String ID: 0-129470356
Opcode ID: 060766898e97797508cae85bb6ef1643ae9bccf0b660e32366c9c238a65948a4
Instruction ID: 56deae6b1e5f7e6f96d7ed5367bed3b53b468e6a5b753cb805a7e0086f7d01e1
Opcode Fuzzy Hash: 060766898e97797508cae85bb6ef1643ae9bccf0b660e32366c9c238a65948a4
Instruction Fuzzy Hash: 2D326975A0020DCFC704DF26FD851683BB2FBA43607229116D885E72B9EB3598A5FF81

Function 00ECD760 Relevance: 1.7, Strings: 1, Instructions: 473COMMON

Download Yara Rule

Strings

viH, xrefs: 00ECDE93

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: viH
API String ID: 0-3523788874
Opcode ID: 77a86b583fb01dbcface5edcde623038514373f2fe83428ad6c6d47c2647aaf8
Instruction ID: 08904d66b1c574cfd1b08fb8c25bca6fe9e2804949a80a4c147a5e6775b31805
Opcode Fuzzy Hash: 77a86b583fb01dbcface5edcde623038514373f2fe83428ad6c6d47c2647aaf8
Instruction Fuzzy Hash: 8C124676A0420DCFC704EF25FD81A7937F6FBE4320711802AE846A7275EB758856EB91

Function 00EF0A90 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

DH@ , xrefs: 00EF0BF7

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: DH@
API String ID: 0-2158797763
Opcode ID: de3ec833a0800e9c5c38fd6e29b34485b855036ad65d9dde5cb5155ae124deea
Instruction ID: 39b90410948e521df87a8812eabd87321667fd5c24a3e3c52ba57d78ac530568
Opcode Fuzzy Hash: de3ec833a0800e9c5c38fd6e29b34485b855036ad65d9dde5cb5155ae124deea
Instruction Fuzzy Hash: 75D1F07A60520CCFC744CF29FD851657BB2FBA5320756811AD880A73B6EB389852FB51

Function 00EF5930 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

63{, xrefs: 00EF5A32

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: 63{
API String ID: 0-1405228871
Opcode ID: ccff89fe0668485377f09e62f780ef7284dbaf04f34c2b58ff2a62ff65586143
Instruction ID: 0ddfd51f24d71cab4f89e11cee311c952934f961a4c17523633e9e569437e775
Opcode Fuzzy Hash: ccff89fe0668485377f09e62f780ef7284dbaf04f34c2b58ff2a62ff65586143
Instruction Fuzzy Hash: C6C1EDB6605A0DCFC708DF28FC912213BF2FBA5320355411AD982D67B9E73958A5FB80

Function 00ECC660 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00ECC692

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 08caf793cbde872aa278f8ecc0774257d8f68101934eefde2f59065bc6ad6605
Instruction ID: 04d304e1a51c4c839c27e2fcec3f00a6d61792f6ff16067e6d1210d13ec31178
Opcode Fuzzy Hash: 08caf793cbde872aa278f8ecc0774257d8f68101934eefde2f59065bc6ad6605
Instruction Fuzzy Hash: 61E01A75D0220C9BC704EFB4ED454AEBBF4FB88300B408A9AE414EB360EB745501DF85

Function 00ED97B0 Relevance: .9, Instructions: 866COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ddc75a53c87f5e78ba94c9d78e3876b0504af5e00414338225496c316e1cbc
Instruction ID: 7f95925ac3052cafa6d4ed56c21fef8ed02c44fb95fcc5c27e4238137472e9c6
Opcode Fuzzy Hash: 95ddc75a53c87f5e78ba94c9d78e3876b0504af5e00414338225496c316e1cbc
Instruction Fuzzy Hash: 13824675A0420DCFC704EF25FD852A93BF2FBA5350B15801AD881A63BAE7344966FF85

Function 00EC1490 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8d2c28a291f400bb74ac61dad203ef75c9433b16fe653a0d5d9bb81f810065
Instruction ID: c715c1878940e29e8e0184d91614c1e77f6f2b4b5aa2dcca4f4fdd213c355a3e
Opcode Fuzzy Hash: 3a8d2c28a291f400bb74ac61dad203ef75c9433b16fe653a0d5d9bb81f810065
Instruction Fuzzy Hash: D10238B6A0130DCFD708DF25FE951643BB1F7A6321312815AD882A72B9E73548A5FF80

Function 00EE4EA0 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629b60e97bebf0cff9e30b87cc9b5c65a690e1ca0bd33697d786fdbe934d6185
Instruction ID: 8e661af675f3da278b2dbcb33b8f73888c191b0f9982c5c23d96981ed8641483
Opcode Fuzzy Hash: 629b60e97bebf0cff9e30b87cc9b5c65a690e1ca0bd33697d786fdbe934d6185
Instruction Fuzzy Hash: DDF11576B0260CCFC704DF26FC851693BB2F7D9314726811AD842A32B8EB759461EF84

Function 00EF0220 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc475e609cf5c85cdbb082806a3b7177ccae0bcf6538c06b0bbbfdb521446348
Instruction ID: 4afba5501d9f247e30c0c87fc54765f6a0b21f0c09aebd36e66bb32a58444b4a
Opcode Fuzzy Hash: cc475e609cf5c85cdbb082806a3b7177ccae0bcf6538c06b0bbbfdb521446348
Instruction Fuzzy Hash: D8E16376A0020DCFD714DF24FC412B53BE1F7A5325B14812AEA86E22B6E7349991EF91

Function 00ECF330 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 31744e45162e65109ca99474c45f06abec933146bff16fee278986cb91695423
Instruction ID: 6f4c2c3228bdc1a4255addadc520716c7071884b00313ada5047d47508d2e9e9
Opcode Fuzzy Hash: 31744e45162e65109ca99474c45f06abec933146bff16fee278986cb91695423
Instruction Fuzzy Hash: 36D1D176A0420DCFC704DF29FD856653BB2FB98321311852AD885D73B4E73598A2EF81

Function 00EDA0A6 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0320c7209bd7049ce0075f62f93618beae7ca07f53c06241e11bd396ae0b9cd8
Instruction ID: 8af3d69740b3153ed9ce6e36dc9f57968a885a88af124a264b631312686a4193
Opcode Fuzzy Hash: 0320c7209bd7049ce0075f62f93618beae7ca07f53c06241e11bd396ae0b9cd8
Instruction Fuzzy Hash: DCD144B5A0430DCFC705EF25FD812A93BB2F790310F198066D981A73B5E3349556EB81

Function 00ED6C10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 187registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(015BFCE0,Function_00011860), ref: 00ED6D72
SetServiceStatus.ADVAPI32(00000000,00F305F8), ref: 00ED6DD5
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00ED6DE9
SetServiceStatus.ADVAPI32(00000000,00F305F8), ref: 00ED6E8A
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00ED6EBE
SetServiceStatus.ADVAPI32(00000000,00F305F8), ref: 00ED6F2B
CloseHandle.KERNEL32(00000000), ref: 00ED6F42
SetServiceStatus.ADVAPI32(00000000,00F305F8), ref: 00ED6FAA

Strings

=ZMI, xrefs: 00ED6D10

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID: =ZMI
API String ID: 3399922960-150576250
Opcode ID: 993f75257717011b179b84dd92680b5cafa7e6ca035eeb4a23fbb2b9721836f8
Instruction ID: 8efab2cca66e2f53ce2f16e55872ed816bf4437c43ccc3371fb75d0dddfcf5a0
Opcode Fuzzy Hash: 993f75257717011b179b84dd92680b5cafa7e6ca035eeb4a23fbb2b9721836f8
Instruction Fuzzy Hash: 01911FB5A4130DCFD304DF25FD9A5223BB6F798720705810AE895E22B8DBB84465FF86

Function 00ED4380 Relevance: 10.9, APIs: 7, Instructions: 387processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00ED44A7
Process32First.KERNEL32(00000000,?), ref: 00ED45C2
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00ED47CE
Module32First.KERNEL32(00000000,00000224), ref: 00ED4842
CloseHandle.KERNEL32(00000000,0000000A), ref: 00ED495A
Process32Next.KERNEL32(?,00000128), ref: 00ED49AD
CloseHandle.KERNEL32(00000000), ref: 00ED4A20

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: bea7ae8730019887069b1301f6f9c863f1bf42d7ff33c684c2ac75d97f0e92db
Instruction ID: f7cf5590ccbed5189ac05a4cfb90f0e0d14509178262b6509897318a47586d15
Opcode Fuzzy Hash: bea7ae8730019887069b1301f6f9c863f1bf42d7ff33c684c2ac75d97f0e92db
Instruction Fuzzy Hash: E9F165B1A0020DCFD704DF25FD866A93BB6F7D5321B11405AD886E62B4EB7488A6FF41

Function 00ECBBC0 Relevance: 10.7, APIs: 7, Instructions: 205processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00ECBC90
Process32First.KERNEL32(00000000,?), ref: 00ECBCE3
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00ECBDDD

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: 06dbd40af95fee4b9df84260c849655c6504dd0f537da668f3296eebba71b4c1
Instruction ID: 7f3089d3b4962ffc562e55b735e338fc14a634655d833947e6f6ac636ec4389e
Opcode Fuzzy Hash: 06dbd40af95fee4b9df84260c849655c6504dd0f537da668f3296eebba71b4c1
Instruction Fuzzy Hash: EB91157960020DCFD714DF25FD96A793BFAFBA8714B15801AD801A3270DB349999EF40

Function 00EF5440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,00EDE92E,00EDCA40,00000000,?), ref: 00EF54B2
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 00EF54E4
CloseHandle.KERNEL32(00000000,?,00EDE92E,00EDCA40,00000000,?), ref: 00EF551D
WaitForSingleObject.KERNEL32(?,000000FF,?,00EDE92E,00EDCA40,00000000,?), ref: 00EF5538
CloseHandle.KERNEL32(?,?,000000FF,?,00EDE92E,00EDCA40,00000000,?), ref: 00EF554B

Strings

., xrefs: 00EF5477

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID: .
API String ID: 1404307249-3963672497
Opcode ID: 2bb32d345ec09731ca962ee7b64a4c7e551600ce3b7a70e8542ecc3b704d9c05
Instruction ID: f611a96465e869d365ae21a37a4c81e6b75439468aae59ad6b822e2d890d2147
Opcode Fuzzy Hash: 2bb32d345ec09731ca962ee7b64a4c7e551600ce3b7a70e8542ecc3b704d9c05
Instruction Fuzzy Hash: 2831CE3460030DEFD308DF65EC59B627BE5FB88B21F10801AE6869B2B0E7709490EF91

Function 00ED1530 Relevance: 9.2, APIs: 6, Instructions: 176filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00ED15C3
GetFileTime.KERNEL32(00000000,?,?,?), ref: 00ED168A
CloseHandle.KERNEL32(00000000), ref: 00ED16A7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00ED1715
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00ED1774
CloseHandle.KERNEL32(00000000), ref: 00ED1792

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: d321e781cbf9f1441814cfe89cafe2f33cd6c75855371886c32d4e4226e0e6a0
Instruction ID: bff7e21ddfb5a0bcb2cda27b018d1b2df0eb32a1f25459d7203244543fa4822d
Opcode Fuzzy Hash: d321e781cbf9f1441814cfe89cafe2f33cd6c75855371886c32d4e4226e0e6a0
Instruction Fuzzy Hash: 62714376A0120CEFC700DFA6FC85679BBB6FBD5720B11455AE885A22B4E73444A5FF80

Function 00ECBD08 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00ECBDDD
TerminateProcess.KERNEL32(00000000,000000FF), ref: 00ECBE24
CloseHandle.KERNEL32(00000000), ref: 00ECBE68
Process32Next.KERNEL32(00000000,00000128), ref: 00ECBF01
CloseHandle.KERNEL32(00000000), ref: 00ECBF2F

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: CloseHandleProcess$NextOpenProcess32Terminate
String ID:
API String ID: 3173823348-0
Opcode ID: d3a7c70086f03a309b379c39b55f2309f658499a3d8121a7484bb2defa2ac4f8
Instruction ID: 99af73ee4da4ba16f617b3a08a6c8b5a77cb8adcd50b4545031f3a7c5163efda
Opcode Fuzzy Hash: d3a7c70086f03a309b379c39b55f2309f658499a3d8121a7484bb2defa2ac4f8
Instruction Fuzzy Hash: 1051217960120DCFC704DF25FD96ABA37FAFB98329B14811AE801E3270DB348995EB40

Function 00ECD000 Relevance: 6.3, APIs: 4, Instructions: 269fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00ECD11A
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00ECD1CC
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00ECD3EE
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00ECD2E9

Part of subcall function 00EEFCC0: ReleaseMutex.KERNEL32(00ECD410,?,00ECD410,00000128), ref: 00EEFCE9

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: CloseFileHandle$CreateMutexReadRelease
String ID:
API String ID: 1760212717-0
Opcode ID: 70116dbed224fa2c84218285dd5944b8090a186eae5dd8703ef609bf5513c601
Instruction ID: 5d5b96eca969e512cfbac893aaa83ec483d0c2d91ac217a97fbf732292d0c85d
Opcode Fuzzy Hash: 70116dbed224fa2c84218285dd5944b8090a186eae5dd8703ef609bf5513c601
Instruction Fuzzy Hash: FFB1767160160CDFC7049F24FD86B6937B6F7D4310F22805AE541A32B0EB7259A5EB82

Function 00ED68D0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,00ED03A9,00000000,?), ref: 00ED6957
RtlReAllocateHeap.NTDLL(00000000,?,00ED03A9,00000000), ref: 00ED695E
GetProcessHeap.KERNEL32(00000000,?,?,00ED03A9,00000000,?), ref: 00ED69C8
HeapAlloc.KERNEL32(00000000,?,00ED03A9,00000000,?), ref: 00ED69CF

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 8f69f12962976cb9816dd29f9d6d25bc1f84a19c15201bdaa9e77e5a17442094
Instruction ID: 49897cc2d86d8a1a9a304bd6dec94471397f264c275cbd14a16744a66380ba68
Opcode Fuzzy Hash: 8f69f12962976cb9816dd29f9d6d25bc1f84a19c15201bdaa9e77e5a17442094
Instruction Fuzzy Hash: 1521CDB5A0130CDFD7009F21FE8AA503B79F792320B628005D985A22B4EB319874FF91

Function 00EE0FD8 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 409COMMON

Download Yara Rule

Strings

XH, xrefs: 00EE153C
/, xrefs: 00EE100F

Memory Dump Source

Source File: 00000000.00000002.1332887026.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1332871344.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332916326.0000000000EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000EFE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F39000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1332933550.0000000000F4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1333011841.0000000000F4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_mtuXDnH1Di.jbxd

Similarity

API ID:
String ID: XH$/
API String ID: 0-571299465
Opcode ID: 24494eb224d859068fe71043c8e3c79e28e68fd185f11fc856fff3c0035d3a63
Instruction ID: 8aa204b5c9123a443755abc5a65ee24111d81f95b0c09954eccaf95aadda893d
Opcode Fuzzy Hash: 24494eb224d859068fe71043c8e3c79e28e68fd185f11fc856fff3c0035d3a63
Instruction Fuzzy Hash: CCF12331A0024DDFD704EF60FD92ABA37BAFB54320F00816AE946772B1EB715959EB50

Analysis Process: qbf30bzbv7f7qnhdav.exePID: 5064, Parent PID: 2064COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	1717
Total number of Limit Nodes:	22

Executed Functions

Function 009D7A04 Relevance: 63.6, APIs: 29, Strings: 6, Instructions: 2326sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 009D83DA
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 009D8448
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 009D84DC
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 009D84F7
GetTickCount.KERNEL32 ref: 009D8599

Part of subcall function 009E5200: GetVersionExA.KERNEL32(00A5AE70), ref: 009E52CC

Sleep.KERNEL32(00000D05), ref: 009D8B70
Sleep.KERNEL32(000007D0), ref: 009D8DAC
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 009D8E86
SetFileAttributesA.KERNEL32(?,00000080), ref: 009D8E9F
CopyFileA.KERNEL32(?,?,00000000), ref: 009D8EC3
SetFileAttributesA.KERNEL32(?,00000002), ref: 009D912B
SetFileAttributesA.KERNEL32(?,00000080), ref: 009D9186
GetCommandLineA.KERNEL32 ref: 009D9265
GetModuleFileNameA.KERNEL32(00000000,?), ref: 009D9370

Part of subcall function 009DA4E0: lstrlen.KERNEL32(?), ref: 009DA4FE

Part of subcall function 009DD500: lstrlen.KERNEL32(?,?,009DD630,?), ref: 009DD523

MessageBoxA.USER32(00000000,00000004,00000005,?), ref: 009D96D4
WSAStartup.WS2_32(00000202,?), ref: 009D995E
CloseHandle.KERNEL32(00000134), ref: 009D9AC8
SetFileAttributesA.KERNELBASE(?,00000080), ref: 009D9AEC
CopyFileA.KERNEL32(?,?,00000000), ref: 009D9B0C
SetFileAttributesA.KERNELBASE(?,00000002), ref: 009D9B3B
Sleep.KERNELBASE(000003E8), ref: 009D9C52
Sleep.KERNEL32(000003E8), ref: 009D8CB2

Part of subcall function 009DBBC0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009DBC90
Part of subcall function 009DBBC0: Process32First.KERNEL32(00000000,?), ref: 009DBCE3

GetCommandLineA.KERNEL32 ref: 009D86AE

Part of subcall function 009D2800: ExitProcess.KERNEL32 ref: 009D2842

Part of subcall function 00A008B0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00A00929
Part of subcall function 00A008B0: __aulldiv.LIBCMT ref: 00A00953

Sleep.KERNEL32(000007D0), ref: 009D9E32
SetFileAttributesA.KERNEL32(C:\whfkpbh\amdrhfskpcu.exe,00000080), ref: 009D9E88
CopyFileA.KERNEL32(?,C:\whfkpbh\amdrhfskpcu.exe,00000000), ref: 009D9EA6
SetFileAttributesA.KERNEL32(C:\whfkpbh\amdrhfskpcu.exe,00000002), ref: 009D9EC5

Part of subcall function 009E0500: OpenSCManagerA.SECHOST(00000000,00000000,00000002), ref: 009E0537
Part of subcall function 009E0500: CreateServiceA.ADVAPI32(00000000,012A0610,012A0610,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 009E0596
Part of subcall function 009E0500: ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 009E0615
Part of subcall function 009E0500: StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 009E062A

CreateThread.KERNEL32(00000000,00000000,Function_000222A0,00000000,00000000,00000000), ref: 009DA26A
Sleep.KERNEL32(0000C350), ref: 009DA327

Strings

}en, xrefs: 009D9856
C:\Users\user, xrefs: 009D83D4
%Tmd, xrefs: 009D8421
zS, xrefs: 009D9CD7
C:\whfkpbh\amdrhfskpcu.exe, xrefs: 009D98CE, 009D9909, 009D9E83, 009D9E90, 009D9EC0, 009DA17B
@L, xrefs: 009D7E24

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: File$Attributes$CreateSleep$CopyMutexService$CommandLineModuleNameTimelstrlen$ChangeCloseConfig2CountEnvironmentExitFirstHandleManagerMessageOpenProcessProcess32SnapshotStartStartupSystemThreadTickToolhelp32VariableVersion__aulldiv
String ID: zS$%Tmd$C:\Users\user$C:\whfkpbh\amdrhfskpcu.exe$@L$}en
API String ID: 3864866415-903891288
Opcode ID: 29acd2b1c1a1010f2ce0f3ba3a617ec4e4b6e625a0da83f8dd31f2acc6b593f7
Instruction ID: 685f115f23c1d45fb74e56f843a3ebb737ccc7f35c10c3f1a43edcfe6a207124
Opcode Fuzzy Hash: 29acd2b1c1a1010f2ce0f3ba3a617ec4e4b6e625a0da83f8dd31f2acc6b593f7
Instruction Fuzzy Hash: 852333B9A00300DFD704EFE4FD86AA63BB4F7D9301B11851AE542962B5EB7588A3CF51

Function 009E5200 Relevance: 30.9, APIs: 12, Strings: 5, Instructions: 1106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00A5AE70), ref: 009E52CC
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 009E549F
DeleteFileA.KERNELBASE(?), ref: 009E56FE
RemoveDirectoryA.KERNELBASE(00000000), ref: 009E5743
CreateDirectoryA.KERNELBASE(?,00000000), ref: 009E583A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 009E58F3
CreateDirectoryA.KERNEL32(?,00000000), ref: 009E5D71
CreateDirectoryA.KERNEL32(?,00000000), ref: 009E5E82
GetTempPathA.KERNEL32(00000104,?), ref: 009E6029
CreateDirectoryA.KERNEL32(?,00000000), ref: 009E61FF
GetTempPathA.KERNEL32(00000104,?), ref: 009E63DE
SetFileAttributesA.KERNELBASE(?,00000002), ref: 009E655F

Strings

C:\Users\user, xrefs: 009E5B3A, 009E5C6A
C:\whfkpbh\, xrefs: 009E5851, 009E5D90, 009E61A2, 009E63F5
\, xrefs: 009E6092
aE'P, xrefs: 009E5BDE
r9:, xrefs: 009E6085

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\whfkpbh\$\$aE'P$r9:
API String ID: 1691758827-1166413814
Opcode ID: 08967c55f8a1793ed7df720ba54a80414af752ee979969d8694cdd05e8816709
Instruction ID: e07f7c5fb51390047158890cbeeb334b28c0d4212725318e2cb1d5781558d462
Opcode Fuzzy Hash: 08967c55f8a1793ed7df720ba54a80414af752ee979969d8694cdd05e8816709
Instruction Fuzzy Hash: 9EA276BAA40305CFC704DFE4FC86AA93BB4F7D5351B01C62AE542962B5EB358897CB41

Function 009EA930 Relevance: 25.3, APIs: 13, Strings: 1, Instructions: 829
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 009EAACC

Strings

#~\, xrefs: 009EB319

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: HeapProcess
String ID: #~\
API String ID: 54951025-95464956
Opcode ID: d121cfc44e5143c08b23175d4c3d5b0d863cfbd20a62ec4ed443656288b80dea
Instruction ID: d280bcc8c4a0822153c717f2e8b3fd0c80568ca51f5a02c2ff67201078658da7
Opcode Fuzzy Hash: d121cfc44e5143c08b23175d4c3d5b0d863cfbd20a62ec4ed443656288b80dea
Instruction Fuzzy Hash: 8A72117EA01205CFC304DFE5FC856A63BB4FB99321B11851AE845C72B4E73698A3CB91

Function 009E0500 Relevance: 13.7, APIs: 9, Instructions: 170
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST(00000000,00000000,00000002), ref: 009E0537
CreateServiceA.ADVAPI32(00000000,012A0610,012A0610,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 009E0596
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 009E0615
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 009E062A
CloseServiceHandle.SECHOST(00000000), ref: 009E06A7
OpenServiceA.ADVAPI32(00000000,012A0610,00000010), ref: 009E06EB
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 009E072D
CloseServiceHandle.ADVAPI32(00000000), ref: 009E073E
CloseServiceHandle.ADVAPI32(00000000), ref: 009E07A8

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: ea63547929bc2555587b95f9949ad8241b2fa675acfa1459c4245c1549414b89
Instruction ID: aeb99cb736fc88db5100af5a83bb45803ad5e40b5a8415c946856cfb3bee887b
Opcode Fuzzy Hash: ea63547929bc2555587b95f9949ad8241b2fa675acfa1459c4245c1549414b89
Instruction Fuzzy Hash: B561CB3AA41310EFD301DFE4FC46BAA3BB4FB96B12F118505E441AA2B4E77558A3CB45

Function 009E0920 Relevance: 4.8, APIs: 3, Instructions: 254
libraryloaderencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76850000,00000000), ref: 009E0A8A
GetProcAddress.KERNEL32(76850000,00000000), ref: 009E0B05
CryptGenRandom.ADVAPI32(00000000,00000004,?,?), ref: 009E0C10

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: AddressProc$CryptRandom
String ID:
API String ID: 646182245-0
Opcode ID: a94674aae1e46f174f4a8b5766d2b2705e53b2d6d22b3a1366dd5aa0df6281bf
Instruction ID: f35f98a79a661da264ade6db8b05c44f7a94eaffd252c5ef770b7bc61b081324
Opcode Fuzzy Hash: a94674aae1e46f174f4a8b5766d2b2705e53b2d6d22b3a1366dd5aa0df6281bf
Instruction Fuzzy Hash: 08B110BAA00355CBC710DFE5FC856A537B4FBD6311B11822AE445972B4E3724897CF85

Function 009F9B00 Relevance: 2.2, APIs: 1, Instructions: 701
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 009F9C49

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 6f296f34a4c9752ddb1679845c494357c0787bfa2cd55c4c5f19e59684ca0f67
Instruction ID: 95f65c5bd640e32f7e231da41fa8d857c03dea76c500975c377f25e61f2c2a06
Opcode Fuzzy Hash: 6f296f34a4c9752ddb1679845c494357c0787bfa2cd55c4c5f19e59684ca0f67
Instruction Fuzzy Hash: DD62CDB9900209CBC704EFE0FD92AFA77B8FB95301F10806AE146961B5EB315A97CF51

Function 009FFA80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,009EED48,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 009FFBF1
CloseHandle.KERNEL32(009EED48,?,?,?,?,?,00000000), ref: 009FFC2F
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 009FFC58

Strings

D, xrefs: 009FFB8F

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: f9a12e02d18f54893bf3c8ac3c15b850ea4c597d7b5c7912f61241a60c96f672
Instruction ID: 0f8849c3aa8bb04b9609ab00aa1f309939e898099abbfce0f70ecf28e2b8197b
Opcode Fuzzy Hash: f9a12e02d18f54893bf3c8ac3c15b850ea4c597d7b5c7912f61241a60c96f672
Instruction Fuzzy Hash: FC510039A51218DBD704DFE4FC427FA3BF4FB89711F00802AE1469A2A4E7759453CB85

Function 009DD000 Relevance: 6.3, APIs: 4, Instructions: 269
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009DD11A
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 009DD1CC
CloseHandle.KERNEL32(00000000,?,00000000), ref: 009DD3EE
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 009DD2E9

Part of subcall function 009FFCC0: ReleaseMutex.KERNEL32(009DD410,?,009DD410,00000128), ref: 009FFCE9

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: CloseFileHandle$CreateMutexReadRelease
String ID:
API String ID: 1760212717-0
Opcode ID: bf0515dcc65bac66d7783563db39221e8fd36783abb84f12014c4513ecc964e0
Instruction ID: 76c4781c4509a40ea030ded0cf6782885c0fa09e9374c9abc26d9e1aaa0542fe
Opcode Fuzzy Hash: bf0515dcc65bac66d7783563db39221e8fd36783abb84f12014c4513ecc964e0
Instruction Fuzzy Hash: A9B143BAA01604DBD704DFE4FC867A93BB5FBD8312F11C456E145862B0EB7149A7CB41

Function 009E1D90 Relevance: 4.7, APIs: 3, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009F3110: WaitForSingleObject.KERNEL32(?,00004E20,?,009DD0F2,00000128), ref: 009F31AD

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 009E1E7B

Part of subcall function 009FFCC0: ReleaseMutex.KERNEL32(009DD410,?,009DD410,00000128), ref: 009FFCE9

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: 86bd1a580ac627909eb7dc0a30719ce3f9a462c3afc623551d6c3d8b18f77c78
Instruction ID: 7d022a6a7996e242e272378c3102cf937df472a7d0374d5bae725cd4843de80e
Opcode Fuzzy Hash: 86bd1a580ac627909eb7dc0a30719ce3f9a462c3afc623551d6c3d8b18f77c78
Instruction Fuzzy Hash: 0371DF79611208DFC304CFE9FC96AAA37B4FB99316F418119E905972B0DB359863CF81

Function 009DB7A0 Relevance: 3.1, APIs: 2, Instructions: 89
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 009DB82B
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 009DB87D

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: AllocateCheckInitializeMembershipToken
String ID:
API String ID: 1663163955-0
Opcode ID: 9305acac8d9bb0afff04a7f5136104a5466c74832d2aff0ad0f983a0e1601d51
Instruction ID: 8326e7e60d8d0dfac591510392c08cbc9f5c9f8d3914eebe01f5309cf83032f6
Opcode Fuzzy Hash: 9305acac8d9bb0afff04a7f5136104a5466c74832d2aff0ad0f983a0e1601d51
Instruction Fuzzy Hash: 6931BC78901388EFD704CFF4ED999BA7B78FB9A301B01815AE80296270C3705917DB51

Function 009E2EB0 Relevance: 3.0, APIs: 2, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,009E0367,?,009E0367,00000000), ref: 009E2ED1
RtlFreeHeap.NTDLL(00000000,?,009E0367,00000000), ref: 009E2ED8

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: a343c12eace479fafe7a3391502ff3fcfe3380ccd97ccc08bf1ee024380ce086
Instruction ID: 711b1b36ad373c24605d8e86f9e7e282cf5c9385b0bfb28c113cfb3025508d15
Opcode Fuzzy Hash: a343c12eace479fafe7a3391502ff3fcfe3380ccd97ccc08bf1ee024380ce086
Instruction Fuzzy Hash: 8D017C79504288DBC724CFE9FE5546A37F9F7987257508316E01A8B2B0D3329C97CB15

Function 009DE2C0 Relevance: 3.0, APIs: 2, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00A0220A,02167FFC,?,?,?,?,009F463C), ref: 009DE2F8
RtlAllocateHeap.NTDLL(00000000,?,00A0220A,02167FFC,?,?,?,?,009F463C), ref: 009DE2FF

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: f16b0b59db5c697199693f4fe4521dec0968a6cae56726d08118e3ef7e096b68
Instruction ID: 5018bd38071d6999664bd1b28fc4381cc4ff6cc5d3f10a726d5a30e037da0123
Opcode Fuzzy Hash: f16b0b59db5c697199693f4fe4521dec0968a6cae56726d08118e3ef7e096b68
Instruction Fuzzy Hash: 76E04F76514204DFCB04DFE5EC49AD937B8E748305B008119F60AC6261C631A5838B94

Function 009F3CF0 Relevance: 1.6, APIs: 1, Instructions: 120
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 009F3E0B

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4c26716bb4c073b7557be37fd0dc21693c5eba9dd1435b0fb424abb2ef405ed5
Instruction ID: ad5b5917a52c3d0492b24549a9bc06da42bc6636f8c3fbe5944c7a6c70060416
Opcode Fuzzy Hash: 4c26716bb4c073b7557be37fd0dc21693c5eba9dd1435b0fb424abb2ef405ed5
Instruction Fuzzy Hash: 0941DD7AA50308DBC350EBE0FC827A53BB0FBD9701F218615E641962B4E77949A3CB85

Function 009F45A9 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 009F4699

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: becfd5f3b5691a2dc0466f6583effe11da7baf907b1783ca6dabaf8e4889ee36
Instruction ID: 9a783c89bb3e2861f0f6760016ad9fe5f4eb8a1cc8018239fa41d1d223d62040
Opcode Fuzzy Hash: becfd5f3b5691a2dc0466f6583effe11da7baf907b1783ca6dabaf8e4889ee36
Instruction Fuzzy Hash: 8611047AA512098FC710EFF4FE8956937B0FBD53463058826E142862B5FB364413D781

Function 009D2800 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 009D2842

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 233d91fd9a26e77d5b8211320e67d156e9dab4154f19ef02e248df83533ae2e7
Instruction ID: 04e1e452eaa030daae98deda51cb39f395bf54fb194e4d011c90fe7f38c215f5
Opcode Fuzzy Hash: 233d91fd9a26e77d5b8211320e67d156e9dab4154f19ef02e248df83533ae2e7
Instruction Fuzzy Hash: 3AE08C3C10030CCBC308DFE8D8D687637A9EB86304754C21B99164B2A1CA39A487DF81

Function 009DA4E0 Relevance: 1.3, APIs: 1, Instructions: 33
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 009DA4FE

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 22e6905838fb92f0446a6585a068e19cf296a7d68aaa01dcdcd890b706c82a61
Instruction ID: 56bc7fb1c161a0fcee1d4ce2bd6eeb66c5bfdadadf54100390ea82a3784227ee
Opcode Fuzzy Hash: 22e6905838fb92f0446a6585a068e19cf296a7d68aaa01dcdcd890b706c82a61
Instruction Fuzzy Hash: 02F0AF7D650224EFC701DFE1FD0A0AA3BB8FBDA3613414012E40692134E7764867DF82

Non-executed Functions

Function 009DAF20 Relevance: 7.9, APIs: 5, Instructions: 385serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 009DB0AA
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 009DB15A
GetLastError.KERNEL32 ref: 009DB17A
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 009DB216
CloseServiceHandle.ADVAPI32(00000000), ref: 009DB41C

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: 0759a2bcae14879d1550fdbe9e27605c3bea1956c73a3f714b4440dcaf09b39b
Instruction ID: 39cea7886abf54855b0b8c653a410f3a0fe7fd4647fda1ff6f43cedbc6c8d386
Opcode Fuzzy Hash: 0759a2bcae14879d1550fdbe9e27605c3bea1956c73a3f714b4440dcaf09b39b
Instruction Fuzzy Hash: 5AF142BAA01300DFC714CFE4FD856AA3BB4F799351B11C51AE542972B4E73588A3CB91

Function 009F9580 Relevance: 7.7, APIs: 5, Instructions: 220filesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,00000001), ref: 009F9679
FindFirstFileA.KERNEL32(?,?), ref: 009F97B8
DeleteFileA.KERNEL32(?), ref: 009F98A9
FindNextFileA.KERNEL32(00000000,?), ref: 009F98CB
FindClose.KERNEL32(00000000), ref: 009F98E4

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: b5ec3635a9bf465298b857a510bd642f6a76ed862f0da6413d83a1655af61603
Instruction ID: b3690aa2fb8cf6e2d4f22f7b05300e487472cbd357cfe6224f2b083e8f164705
Opcode Fuzzy Hash: b5ec3635a9bf465298b857a510bd642f6a76ed862f0da6413d83a1655af61603
Instruction Fuzzy Hash: D091EF7E901304CBC704DFE4FC826A937B4FBDA311B00861AEA469B270EB768953CB51

Function 009E6C10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 187registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(012A0610,Function_00011860), ref: 009E6D72
SetServiceStatus.ADVAPI32(00000000,00A405F8), ref: 009E6DD5
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 009E6DE9
SetServiceStatus.ADVAPI32(00000000,00A405F8), ref: 009E6E8A
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 009E6EBE
SetServiceStatus.ADVAPI32(00000000,00A405F8), ref: 009E6F2B
CloseHandle.KERNEL32(00000000), ref: 009E6F42
SetServiceStatus.ADVAPI32(00000000,00A405F8), ref: 009E6FAA

Strings

=ZMI, xrefs: 009E6D10

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID: =ZMI
API String ID: 3399922960-150576250
Opcode ID: 4e0b9cbaf2cae9297906cbdaa18e65ee5f522d8c1e87ae6e07a9fdaa2412c5e3
Instruction ID: 36fc171f3ccf6bb2aaa2418f4384932fbc993af247088ba5b5b71f3ec1c5423c
Opcode Fuzzy Hash: 4e0b9cbaf2cae9297906cbdaa18e65ee5f522d8c1e87ae6e07a9fdaa2412c5e3
Instruction Fuzzy Hash: 7391AA7C601311CBC304CFE9FD899A63BB5F7EA351702860AE556862B4C77A4863CF46

Function 009E4380 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 387processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009E44A7
Process32First.KERNEL32(00000000,?), ref: 009E45C2
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 009E47CE
Module32First.KERNEL32(00000000,00000224), ref: 009E4842
CloseHandle.KERNEL32(00000000,0000000A), ref: 009E495A
Process32Next.KERNEL32(?,00000128), ref: 009E49AD
CloseHandle.KERNEL32(00000000), ref: 009E4A20

Strings

Eln_, xrefs: 009E48DE, 009E48ED

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID: Eln_
API String ID: 930127669-3437842203
Opcode ID: be4cc78da283987cb357fbc0dc250f4049f7ea051fe30f705d4d1c7d6c3bfc6b
Instruction ID: cb103d42892a12c27dfff0e4e9d15312672648889f49a5b82cf50845a6c7d0b1
Opcode Fuzzy Hash: be4cc78da283987cb357fbc0dc250f4049f7ea051fe30f705d4d1c7d6c3bfc6b
Instruction Fuzzy Hash: 4FF13079A00204CFD715CFE9FC866A93BB5F7C9311B00C55AE486962B4EB3988A7CF51

Function 009DCA40 Relevance: 10.8, APIs: 7, Instructions: 345fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,00000003,00000000,00000000), ref: 009DCB20
ReadFile.KERNEL32(00000000,?,?,?,00000000), ref: 009DCB5D
CloseHandle.KERNEL32(00000000), ref: 009DCBBD
GetTickCount.KERNEL32 ref: 009DCC1D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 009DCED4
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 009DCF0E
CloseHandle.KERNEL32(00000000), ref: 009DCF47

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID:
API String ID: 3478262135-0
Opcode ID: 6749f31cbeb231adf29bfcc88c58df59c72497ab15174343772159f44e4b58e5
Instruction ID: 2bb4d7748ba33bfa28bc22d514622ed0d467aa896493a8c6b62b43942f8ab72f
Opcode Fuzzy Hash: 6749f31cbeb231adf29bfcc88c58df59c72497ab15174343772159f44e4b58e5
Instruction Fuzzy Hash: 1BE163BAA00201DFC704DFE8FD86AB93B74FBD5711B10851AE8429B2B4E7364867CB55

Function 009DBBC0 Relevance: 10.7, APIs: 7, Instructions: 205processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009DBC90
Process32First.KERNEL32(00000000,?), ref: 009DBCE3
OpenProcess.KERNEL32(00000001,00000000,?), ref: 009DBDDD

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: 528c9a7ac26e0aef7db2bee44d78eb30b5aa3b2d1f3a0a6b41fb7b24246e057e
Instruction ID: e2052be21cdcd774ee0618383d636486310ecdf4fef3a63b3972ed213d46bf28
Opcode Fuzzy Hash: 528c9a7ac26e0aef7db2bee44d78eb30b5aa3b2d1f3a0a6b41fb7b24246e057e
Instruction Fuzzy Hash: D291017AA11315CFC704DFE4FC96AA937B9FB99311B15811AE406972B0DB388997CF40

Function 009E1530 Relevance: 9.2, APIs: 6, Instructions: 176filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 009E15C3
GetFileTime.KERNEL32(00000000,?,?,?), ref: 009E168A
CloseHandle.KERNEL32(00000000), ref: 009E16A7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009E1715
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 009E1774
CloseHandle.KERNEL32(00000000), ref: 009E1792

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: d4ac49639c21a9765f5c3d6b20e60f5573b4c7fd83a630a10e8e9a6e83e3298e
Instruction ID: 0f646c940a8d12bebbca7e636610da90861137e80c311820292257acf4735be3
Opcode Fuzzy Hash: d4ac49639c21a9765f5c3d6b20e60f5573b4c7fd83a630a10e8e9a6e83e3298e
Instruction Fuzzy Hash: 8B71FE7AA01304EFC700DFE9FC856A97BB4FBCA711B11855AE445922B4E73648A7CF44

Function 009DBD08 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000001,00000000,?), ref: 009DBDDD
TerminateProcess.KERNEL32(00000000,000000FF), ref: 009DBE24
CloseHandle.KERNEL32(00000000), ref: 009DBE68
Process32Next.KERNEL32(00000000,00000128), ref: 009DBF01
CloseHandle.KERNEL32(00000000), ref: 009DBF2F

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: CloseHandleProcess$NextOpenProcess32Terminate
String ID:
API String ID: 3173823348-0
Opcode ID: 8676c7e2611cd57b5610e3fba051adffdf31b5a61386644da041d787c0cb0454
Instruction ID: 9db671d18ab438394cf3579caaa57d657dfe4b302b86a05cb9132a4d9d73d72d
Opcode Fuzzy Hash: 8676c7e2611cd57b5610e3fba051adffdf31b5a61386644da041d787c0cb0454
Instruction Fuzzy Hash: 7D51FF7AA01315DFC704DFE4EC95AE937B9FB98326B11811AE40697260E7388997CB40

Function 00A05440 Relevance: 7.6, APIs: 5, Instructions: 71synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,009EE92E,009ECA40,00000000,?), ref: 00A054B2
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 00A054E4
CloseHandle.KERNEL32(00000000,?,009EE92E,009ECA40,00000000,?), ref: 00A0551D
WaitForSingleObject.KERNEL32(?,000000FF,?,009EE92E,009ECA40,00000000,?), ref: 00A05538
CloseHandle.KERNEL32(?,?,000000FF,?,009EE92E,009ECA40,00000000,?), ref: 00A0554B

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 8a277dca0079699cd13d51235f3ce1015a06ef58d80e3a3829ce05631c50d865
Instruction ID: a63d974acd207500ddf0abeb92ba562bc76f4264d6b42d7bd2764c43d61e8f5c
Opcode Fuzzy Hash: 8a277dca0079699cd13d51235f3ce1015a06ef58d80e3a3829ce05631c50d865
Instruction Fuzzy Hash: B631A938A05304DFD304CFA4ED89BA23BB5FB88711F10C119E5568B6B4E7758882CF91

Function 009E1860 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(00000000,00A405F8), ref: 009E19BA

Strings

uRh, xrefs: 009E18A1

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: ServiceStatus
String ID: uRh
API String ID: 3969395364-64653548
Opcode ID: a3c5390e2cd6c3449014e1d3af956b7e73a469c6ced39d7e36adad4e055c2650
Instruction ID: 39501b5aafe275bdba9f9e461ad02c1095b04c49f3719326e39a23c15991ba1c
Opcode Fuzzy Hash: a3c5390e2cd6c3449014e1d3af956b7e73a469c6ced39d7e36adad4e055c2650
Instruction Fuzzy Hash: FC31BA7E650205EFD304CFE9FC899A63BB9F7A9322305C526E1428A274C7359563DF12

Function 009E2120 Relevance: 6.2, APIs: 4, Instructions: 207processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009E21D0
Process32First.KERNEL32(00000000,00000128), ref: 009E2257
Process32Next.KERNEL32(00000000,00000128), ref: 009E2384
CloseHandle.KERNEL32(00000000), ref: 009E2426

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 0efa45bbd995fe1558bffb24a6a538b9e6c9e69d54a2f64297da26258fa6f7f3
Instruction ID: e75437920bc08bad092c8846306ac58625f4a46403d529159c7d5ea636e94847
Opcode Fuzzy Hash: 0efa45bbd995fe1558bffb24a6a538b9e6c9e69d54a2f64297da26258fa6f7f3
Instruction Fuzzy Hash: EB910F79A10314CBD301DFE5FC89AA937B8FBE5350B118116D842962B4E77688A7CF51

Function 009E68D0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,009E03A9,00000000,?), ref: 009E6957
RtlReAllocateHeap.NTDLL(00000000,?,009E03A9,00000000), ref: 009E695E
GetProcessHeap.KERNEL32(00000000,?,?,009E03A9,00000000,?), ref: 009E69C8
HeapAlloc.KERNEL32(00000000,?,009E03A9,00000000,?), ref: 009E69CF

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: a3358e88340f454ca4486eed615a4da64efd142dbf207500728c1fd530be2205
Instruction ID: 5ed1d9f07ef732f8188e0e4ad0b32ae6f1a916f257116d31d5f832b33641254f
Opcode Fuzzy Hash: a3358e88340f454ca4486eed615a4da64efd142dbf207500728c1fd530be2205
Instruction Fuzzy Hash: 2721DCB9A41304DFD701DFE1FE89A953F38F796325B628504E489922B5E73298A3CF10

Function 009F0FD8 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 409COMMON

Download Yara Rule

Strings

XH, xrefs: 009F153C
/, xrefs: 009F100F

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID:
String ID: XH$/
API String ID: 0-571299465
Opcode ID: d3133bfd3e7dfc905fa58a0a96d014ecce9b3e1dc54ebce8076dbeeef5851cb2
Instruction ID: 02a7f1bb2a9f4a03807c952a7c3f37af160c37ac0f938c0c7e01696f49b55b0b
Opcode Fuzzy Hash: d3133bfd3e7dfc905fa58a0a96d014ecce9b3e1dc54ebce8076dbeeef5851cb2
Instruction Fuzzy Hash: 56F1FD39A01209CBC714EFE0FC92AFE77B8FB96311F00812AE546572A5EB714957CB51

Function 00A050E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(009F247D,00000001,?,?,009F247D), ref: 00A0518C
GetTickCount.KERNEL32 ref: 00A052BE

Strings

@AB , xrefs: 00A052CD

Memory Dump Source

Source File: 00000002.00000002.1322438878.00000000009D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.1322410149.00000000009D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322480504.0000000000A07000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A0C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A49000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322500850.0000000000A5A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1322570694.0000000000A5B000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_qbf30bzbv7f7qnhdav.jbxd

Similarity

API ID: CountSystemTickTime
String ID: @AB
API String ID: 2164215191-841575833
Opcode ID: 6ff71f60c067353a5fc774fb41a9646eace7bd5589e4139081fcb3840d0c675b
Instruction ID: 724428f13741904c1c5df704e34fdbcec56f72c9e405d4b671098175873124e9
Opcode Fuzzy Hash: 6ff71f60c067353a5fc774fb41a9646eace7bd5589e4139081fcb3840d0c675b
Instruction Fuzzy Hash: 4851DE7AA01614CFC708DFE9FD8A5A63BB1F7983513058116E4828B2B4E77588A3CB85

Analysis Process: idtpqzltyfy.exePID: 3452, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1717
Total number of Limit Nodes:	38

Executed Functions

Function 00147A04 Relevance: 65.3, APIs: 29, Strings: 7, Instructions: 2326sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 001483DA
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00148448
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 001484DC
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 001484F7
GetTickCount.KERNEL32 ref: 00148599

Part of subcall function 00155200: GetVersionExA.KERNEL32(001CAE70), ref: 001552CC

Sleep.KERNEL32(00000D05), ref: 00148B70
Sleep.KERNEL32(000007D0), ref: 00148DAC
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00148E86
SetFileAttributesA.KERNEL32(?,00000080), ref: 00148E9F
CopyFileA.KERNEL32(?,?,00000000), ref: 00148EC3
SetFileAttributesA.KERNEL32(?,00000002), ref: 0014912B
SetFileAttributesA.KERNEL32(?,00000080), ref: 00149186
GetCommandLineA.KERNEL32 ref: 00149265
GetModuleFileNameA.KERNEL32(00000000,?), ref: 00149370

Part of subcall function 0014A4E0: lstrlen.KERNEL32(00152325,00000000,?,00152325,?), ref: 0014A4FE
Part of subcall function 0014A4E0: CharLowerBuffA.USER32(00152325,00000000,?,00152325,?), ref: 0014A550

Part of subcall function 0014D500: lstrlen.KERNEL32(?,?,0016965D,?,00000104,?,00000001), ref: 0014D523

MessageBoxA.USER32(00000000,00000004,00000005,?), ref: 001496D4
WSAStartup.WS2_32(00000202,?), ref: 0014995E
CloseHandle.KERNEL32(0000012C), ref: 00149AC8
SetFileAttributesA.KERNEL32(?,00000080), ref: 00149AEC
CopyFileA.KERNEL32(?,?,00000000), ref: 00149B0C
SetFileAttributesA.KERNEL32(?,00000002), ref: 00149B3B
Sleep.KERNEL32(000003E8), ref: 00149C52
Sleep.KERNEL32(000003E8), ref: 00148CB2

Part of subcall function 0014BBC0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0014BC90
Part of subcall function 0014BBC0: Process32First.KERNEL32(00000000,?), ref: 0014BCE3

GetCommandLineA.KERNEL32 ref: 001486AE

Part of subcall function 00142800: ExitProcess.KERNEL32 ref: 00142842

Part of subcall function 001708B0: GetSystemTimeAsFileTime.KERNEL32(?,?,?,0016247D), ref: 00170929
Part of subcall function 001708B0: __aulldiv.LIBCMT ref: 00170953

Sleep.KERNEL32(000007D0), ref: 00149E32
SetFileAttributesA.KERNELBASE(C:\whfkpbh\amdrhfskpcu.exe,00000080), ref: 00149E88
CopyFileA.KERNEL32(?,C:\whfkpbh\amdrhfskpcu.exe,00000000), ref: 00149EA6
SetFileAttributesA.KERNELBASE(C:\whfkpbh\amdrhfskpcu.exe,00000002), ref: 00149EC5

Part of subcall function 00150500: OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00150537
Part of subcall function 00150500: CreateServiceA.ADVAPI32(00000000,0113E608,0113E608,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00150596
Part of subcall function 00150500: ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00150615
Part of subcall function 00150500: StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0015062A

CreateThread.KERNELBASE(00000000,00000000,Function_000222A0,00000000,00000000,00000000), ref: 0014A26A
Sleep.KERNEL32(0000C350), ref: 0014A327

Strings

}en, xrefs: 00149856
C:\Windows\system32\config\systemprofile, xrefs: 001483D4
%Tmd, xrefs: 00148421
C:\whfkpbh\amdrhfskpcu.exe, xrefs: 001498CE, 00149909, 00149E83, 00149E90, 00149EC0, 0014A17B
wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe", xrefs: 0014A0E8, 0014A176
@L, xrefs: 00147E24
zS, xrefs: 00149CD7

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: File$Attributes$CreateSleep$CopyMutexService$CommandLineModuleNameTimelstrlen$BuffChangeCharCloseConfig2CountEnvironmentExitFirstHandleLowerManagerMessageOpenProcessProcess32SnapshotStartStartupSystemThreadTickToolhelp32VariableVersion__aulldiv
String ID: zS$%Tmd$C:\Windows\system32\config\systemprofile$C:\whfkpbh\amdrhfskpcu.exe$wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe"$@L$}en
API String ID: 256806839-120791303
Opcode ID: 369658b6b367a4ced69129a6b9e3043cdf76c79c11a1e1c72fbc263f7454970b
Instruction ID: e3293a6eb730aeb8f51adb720d26d57176b8f05384c9608a1d62fc2f8fe7eafc
Opcode Fuzzy Hash: 369658b6b367a4ced69129a6b9e3043cdf76c79c11a1e1c72fbc263f7454970b
Instruction Fuzzy Hash: F22358B1A00301DFD304EF64FC8AA663BB4FB98301B51461AE54697EB5EB708AE5CF51

Function 00155200 Relevance: 30.9, APIs: 12, Strings: 5, Instructions: 1106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(001CAE70), ref: 001552CC
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 0015549F
DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 001556FE
RemoveDirectoryA.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 00155743
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0015583A
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001558F3
CreateDirectoryA.KERNEL32(?,00000000), ref: 00155D71
CreateDirectoryA.KERNEL32(?,00000000), ref: 00155E82
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00156029
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 001561FF
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 001563DE
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 0015655F

Strings

C:\Windows\system32\config\systemprofile, xrefs: 00155B3A, 00155C6A
C:\whfkpbh\, xrefs: 00155851, 00155D90, 001561A2, 001563F5
\, xrefs: 00156092
r9:, xrefs: 00156085
aE'P, xrefs: 00155BDE

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\whfkpbh\$\$aE'P$r9:
API String ID: 1691758827-2593203275
Opcode ID: dc9f98b22f666bbcf108a18948fa63c92f78fdf39cd281546a33d22608c74b73
Instruction ID: 1f69f77ae9c2a9888138bc1b0f7bbbd8c8c650dcf00358e654a38ae4449ba2f0
Opcode Fuzzy Hash: dc9f98b22f666bbcf108a18948fa63c92f78fdf39cd281546a33d22608c74b73
Instruction Fuzzy Hash: 9FA26BB2A00205DFC704DF24FC96AA53BB5FBA4311B518219E94297EB5FB308AD5CF91

Function 00160D80 Relevance: 25.7, APIs: 11, Strings: 3, Instructions: 1222COMMON

Download Yara Rule

Strings

U][v, xrefs: 00161ED5
XH, xrefs: 0016153C
/, xrefs: 0016100F

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID:
String ID: XH$/$U][v
API String ID: 0-1996962770
Opcode ID: a457eeb441ef02acbbd4f9f617d531920dcb212b0b411580e480863b52f9d365
Instruction ID: 90313c74ff47ac2c4b629f26429c197e08e3fbfd281e0d3b7a6a192a629c6b15
Opcode Fuzzy Hash: a457eeb441ef02acbbd4f9f617d531920dcb212b0b411580e480863b52f9d365
Instruction Fuzzy Hash: C4B25671A00204DFD709EF64FC95AB93BB5FBA4300B55425AE44697EB4EB308AE5CF81

Function 0015A930 Relevance: 25.3, APIs: 13, Strings: 1, Instructions: 829
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0015AACC

Strings

#~\, xrefs: 0015B319

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: HeapProcess
String ID: #~\
API String ID: 54951025-95464956
Opcode ID: 78b4514fca032ac38f2048c54f6be1c7d5ae35206958cb6b6a394fc72ff63e13
Instruction ID: f5e059731d034deb7662b2b573f59cf7ee5e479a09cbcd0b11f0d708ed3ccc74
Opcode Fuzzy Hash: 78b4514fca032ac38f2048c54f6be1c7d5ae35206958cb6b6a394fc72ff63e13
Instruction Fuzzy Hash: 58720E76A04205CFC304DF65FC866A53BF5FB98312B51421AE845DBEB0EB708AE5CB91

Function 00169580 Relevance: 7.7, APIs: 5, Instructions: 220
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8,00000001), ref: 00169679
FindFirstFileA.KERNELBASE(?,?), ref: 001697B8
DeleteFileA.KERNELBASE(?), ref: 001698A9
FindNextFileA.KERNELBASE(00000000,?), ref: 001698CB
FindClose.KERNEL32(00000000), ref: 001698E4

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: c949ea3f2e6a2350f6bf94a409c1f545a5a5e425c8513c22f02f1df68cce28f4
Instruction ID: 4b7ec12d77ae79b803ec06132f6e0ec141d2224b252409d7c9888dc2bb5e892e
Opcode Fuzzy Hash: c949ea3f2e6a2350f6bf94a409c1f545a5a5e425c8513c22f02f1df68cce28f4
Instruction Fuzzy Hash: B3914375901205DFC714DF34FC86AA53BB9FB98704B40861AE94687E70EB348AE1CF91

Function 001622A0 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 598
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001708B0: GetSystemTimeAsFileTime.KERNEL32(?,?,?,0016247D), ref: 00170929
Part of subcall function 001708B0: __aulldiv.LIBCMT ref: 00170953

Part of subcall function 00151200: Sleep.KERNELBASE(000003E8,?,?,001625B4,?,00000708,00000000), ref: 0015139B

Sleep.KERNELBASE(000008AE), ref: 00162C03

Strings

C:\whfkpbh\amdrhfskpcu.exe, xrefs: 00162CCC
wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe", xrefs: 00162CC7

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: SleepTime$FileSystem__aulldiv
String ID: C:\whfkpbh\amdrhfskpcu.exe$wudcwbel2zfb "c:\whfkpbh\idtpqzltyfy.exe"
API String ID: 3227937447-2559296042
Opcode ID: 39dec3fa197a23e8428c1119ec35419c93c428d93996f14d5e9a5bac583e8f47
Instruction ID: 859dc9bc5602d084fa999fe1f82ab3b24767d83da741eb5aafe56970c0b74639
Opcode Fuzzy Hash: 39dec3fa197a23e8428c1119ec35419c93c428d93996f14d5e9a5bac583e8f47
Instruction Fuzzy Hash: ED422371A01204DFD708DF64FD96AAA3BB1FB58300F11825AE44697EB4EB309AE5CF51

Function 00150920 Relevance: 4.8, APIs: 3, Instructions: 254
libraryloaderencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76850000,00000000), ref: 00150A8A
GetProcAddress.KERNEL32(76850000,00000000), ref: 00150B05
CryptGenRandom.ADVAPI32(00000000,00000004,00000000,00000000), ref: 00150C10

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: AddressProc$CryptRandom
String ID:
API String ID: 646182245-0
Opcode ID: 1e3089d542ef6e99337a3c23b6dd01c75f5a8e89c589ef8a6d3e53cd1a5e9817
Instruction ID: 9a44081cad21fa68937cdfac915acb2760fe07f4e57f5f8e993902d14031d0fe
Opcode Fuzzy Hash: 1e3089d542ef6e99337a3c23b6dd01c75f5a8e89c589ef8a6d3e53cd1a5e9817
Instruction Fuzzy Hash: 2AB176B2A00315DBC315DFA9FC85A253BB4FB58715B01422EE8569BEB8E33089D5CF85

Function 00169B00 Relevance: 2.2, APIs: 1, Instructions: 701
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 00169C49

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 9220cc9c9a1f5675a9203f292a9059f11226fd8a05d40183f4828c667a17de15
Instruction ID: 34e6f4f578bdec1e6be86874b55dc7acfcab8c70e72e6e697f1b4be8d9521ef9
Opcode Fuzzy Hash: 9220cc9c9a1f5675a9203f292a9059f11226fd8a05d40183f4828c667a17de15
Instruction Fuzzy Hash: 72621371900205DFD709EF60FC86AA97BB8FBA4300F90815AE446A7DB5EB309AD5CF51

Function 0014C660 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0014C692

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 3c536f3847f32ef5e49169e1599c94027631dae4c457486be30412fe90921ee2
Instruction ID: a58d952cd8e76c61e1fe2f3448b1df420af2cf5de54f1e50ec7d677e88862a53
Opcode Fuzzy Hash: 3c536f3847f32ef5e49169e1599c94027631dae4c457486be30412fe90921ee2
Instruction Fuzzy Hash: 06E01271D01209DBC744DFB4ED4546EBBF4FB88304B814959E414EB650EB705640CFC5

Function 00156C10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 187
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(0113E608,Function_00011860), ref: 00156D72
SetServiceStatus.SECHOST(0114A1C8,001B05F8), ref: 00156DD5
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00156DE9
SetServiceStatus.ADVAPI32(0114A1C8,001B05F8), ref: 00156E8A
WaitForSingleObject.KERNEL32(00000230,00001388), ref: 00156EBE
SetServiceStatus.ADVAPI32(0114A1C8,001B05F8), ref: 00156F2B
CloseHandle.KERNEL32(00000230), ref: 00156F42
SetServiceStatus.ADVAPI32(0114A1C8,001B05F8), ref: 00156FAA

Strings

=ZMI, xrefs: 00156D10

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID: =ZMI
API String ID: 3399922960-150576250
Opcode ID: 40ec19d656a58706c57997c51155d74a87f515a578a80e6159e34f145aafe141
Instruction ID: 5a1c3a6e04a96dff3e1d90b3f17175ac5cad2d66a39274963f12cd4536c4cc8c
Opcode Fuzzy Hash: 40ec19d656a58706c57997c51155d74a87f515a578a80e6159e34f145aafe141
Instruction Fuzzy Hash: 5E91DBB1901301CFC306DF28FD8A9663FB4FB88715781821AE49586EB4E73885E5CF85

Function 0016FA80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00162CD6,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000001), ref: 0016FBF1
CloseHandle.KERNEL32(00162CD6,?,?,?,?,?,00000001), ref: 0016FC2F
CloseHandle.KERNEL32(?,?,?,?,?,?,00000001), ref: 0016FC58

Strings

D, xrefs: 0016FB8F

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 9542ac12595cab16621c469d33f1d8401552a73f37da0d947711aa3d00ecbda6
Instruction ID: b5e36886409db179b7c7625acc9b4959b6bec182829420ef1e314270b64b7669
Opcode Fuzzy Hash: 9542ac12595cab16621c469d33f1d8401552a73f37da0d947711aa3d00ecbda6
Instruction Fuzzy Hash: BA51EA31950218DBD704DF64FC86BB63BF8FB48B11F40021AE04696EB4EBB496E4CB95

Function 00152120 Relevance: 6.2, APIs: 4, Instructions: 207
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001521D0
Process32First.KERNEL32(00000000,00000128), ref: 00152257
Process32Next.KERNEL32(00000000,00000128), ref: 00152384
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00152426

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: df6481a2fc8bef7960ef4df4ab32a0a47e318a250fa21f99609356e2b18cc9b3
Instruction ID: 59af42ebffe2aa8119f653f5c99daec505b1ab9a5abd3c0c54f61812807c80c2
Opcode Fuzzy Hash: df6481a2fc8bef7960ef4df4ab32a0a47e318a250fa21f99609356e2b18cc9b3
Instruction Fuzzy Hash: 95913372A00314CFC305DF25FC89AA53BB4FBA9310F15820AD84296EB4EB7486E9CF51

Function 00160FD8 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XH, xrefs: 0016153C
/, xrefs: 0016100F

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID:
String ID: XH$/
API String ID: 0-571299465
Opcode ID: 86313e4a76824fe82bdf1430199052fe167cbb740b3c353f206373189f083d22
Instruction ID: ef8cb2bfebd598330e323af41355f5a4dbc948586ff720e8fd952b287562e22a
Opcode Fuzzy Hash: 86313e4a76824fe82bdf1430199052fe167cbb740b3c353f206373189f083d22
Instruction Fuzzy Hash: 11F11371A00215DFD714EF60FC92ABA3BB9FB64300F54826AE40A579B1EB708AD4CF50

Function 00151D90 Relevance: 4.7, APIs: 3, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00163110: WaitForSingleObject.KERNEL32(00000708,00004E20,?,00150A18,00000128,00000000,00000000,?,0015126B,?,001625B4,?,00000708,00000000), ref: 001631AD

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,-0000004B,00000009), ref: 00151E7B

Part of subcall function 0016FCC0: ReleaseMutex.KERNEL32(00150D8E,?,00150D8E,00000128,00000000), ref: 0016FCE9

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: 37c28564cba5a741b0206745fee1ea3b11a0d511c04560e6312677a5e70a4794
Instruction ID: 4c38f319b3cbb9f489e097b241f6d020158641a4adba2a40a042d69e04128246
Opcode Fuzzy Hash: 37c28564cba5a741b0206745fee1ea3b11a0d511c04560e6312677a5e70a4794
Instruction Fuzzy Hash: 7D71F472611204DFC304DF64FC89A6A3BB9FB98315F418259E80697EB4DB709AE5CF81

Function 0014B7A0 Relevance: 4.6, APIs: 3, Instructions: 89
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0014B82B
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 0014B87D
FreeSid.ADVAPI32(?), ref: 0014B8D6

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 1e434bf8c9f31915622607fa10d4e0e72f03e96b0633d08eb81183e79bc3b665
Instruction ID: 837e2b70412a640a764e1ba25bcebfe3eee488d6fa528ad107c108dc0005887f
Opcode Fuzzy Hash: 1e434bf8c9f31915622607fa10d4e0e72f03e96b0633d08eb81183e79bc3b665
Instruction Fuzzy Hash: 07319E75905248EFD704CFA8FDD99BA7BB8FB58304B01819AE40297AB0D7709AD4CB51

Function 00152EB0 Relevance: 3.0, APIs: 2, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000002,?,00151BE7,0016979D,0016979D,00000000,-00000002,00000000,?,0016979D,00000002,00000000), ref: 00152ED1
RtlFreeHeap.NTDLL(00000000,?,00151BE7,0016979D,0016979D,00000000,-00000002,00000000,?,0016979D,00000002,00000000), ref: 00152ED8

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 59c7adb539fa9924a3090a7480335d9ad5942488817bfa6c414050d21aedd6ee
Instruction ID: f30e63a88a2a06e5d576f11d18279de1a55d9d7526c50d3dd3a750582e1e580e
Opcode Fuzzy Hash: 59c7adb539fa9924a3090a7480335d9ad5942488817bfa6c414050d21aedd6ee
Instruction Fuzzy Hash: 1301DF31608245CBC318DFA4FE668293BF9F7487207144206F51A8BEB0D330D8E98B15

Function 0014A4E0 Relevance: 3.0, APIs: 2, Instructions: 33
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00152325,00000000,?,00152325,?), ref: 0014A4FE
CharLowerBuffA.USER32(00152325,00000000,?,00152325,?), ref: 0014A550

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: cb5344382e32d7667f7ad6ad5330b9229be933540e370482a7f9664a0f35c812
Instruction ID: 1e7763b11c5200db3712b05806d599bd6850ffa4db8f98c1eab530ff360ec9b2
Opcode Fuzzy Hash: cb5344382e32d7667f7ad6ad5330b9229be933540e370482a7f9664a0f35c812
Instruction Fuzzy Hash: CAF0CD71600220EFC3025F21FD4D5663BB8FF893613840512E48A86974E77489E2DFD2

Function 0014E2C0 Relevance: 3.0, APIs: 2, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,0017220A,02167FFC,?,?,?,?,0016463C), ref: 0014E2F8
RtlAllocateHeap.NTDLL(00000000,?,0017220A,02167FFC,?,?,?,?,0016463C), ref: 0014E2FF

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 8416483f14de977ede38d531b499846a59f5f9a06fabc187798644c3ca993560
Instruction ID: baadc4dfb9003755db613a08ab54eecf014547e236bae513d1af665befb331d9
Opcode Fuzzy Hash: 8416483f14de977ede38d531b499846a59f5f9a06fabc187798644c3ca993560
Instruction Fuzzy Hash: B4E08C76104200AFC7089FA9FC8DA5633B8FB09305F144518FA0DC6AB2CB71E6C18B91

Function 00150DC0 Relevance: 1.7, APIs: 1, Instructions: 182fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000708,80000000,00000000,00000000,00000003,00000000,00000000,?,?,00000708,00000000), ref: 00150F65

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f158f3300c98406f93f6878d735f0f9e18101cd3256fe716ff650a87f9cf76e2
Instruction ID: f8f99eb120a3361efe80290b3c46567df0733683f53e677aa19ebdb78b873c63
Opcode Fuzzy Hash: f158f3300c98406f93f6878d735f0f9e18101cd3256fe716ff650a87f9cf76e2
Instruction Fuzzy Hash: 80715372A00205DBD304DF68FC85B253BB5FB88311F65411AE81AC7EB4E7349AE5CB85

Function 00163CF0 Relevance: 1.6, APIs: 1, Instructions: 120fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00163E0B

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6067148dacfaaca10ff7886e7f0ae1bcb1f024ef822556e2d9005961edea5d71
Instruction ID: 5397fee7e2b920637bbddda1b32943dd6f83130f7f52fca8c039dd05e7acc12c
Opcode Fuzzy Hash: 6067148dacfaaca10ff7886e7f0ae1bcb1f024ef822556e2d9005961edea5d71
Instruction Fuzzy Hash: 9E412372A10314DBD314AF20FC82BA13BB1F7A4710F524219E651E6DB5FB709AE1CB91

Function 001645A9 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00164699

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: bfd0829247956772bdd8471333a8a263eff98c5e69947d433bafc4494db83330
Instruction ID: 79393dc8eedb8d78068f854f1d3d96820b88099698812382f07167b77e973e2e
Opcode Fuzzy Hash: bfd0829247956772bdd8471333a8a263eff98c5e69947d433bafc4494db83330
Instruction Fuzzy Hash: D61104755502068BC714AF74FE894253BF0FB55346325452AE04696DB5EB3086E1CB82

Function 00151200 Relevance: 1.4, APIs: 1, Instructions: 165sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8,?,?,001625B4,?,00000708,00000000), ref: 0015139B

Part of subcall function 00150920: GetProcAddress.KERNEL32(76850000,00000000), ref: 00150A8A
Part of subcall function 00150920: GetProcAddress.KERNEL32(76850000,00000000), ref: 00150B05

Part of subcall function 00175370: CloseHandle.KERNEL32(?,00000000,?,001514A0,00000000,001CAF24,00000004,00000001,00000000,?,?,001625B4,?,00000708,00000000), ref: 00175398

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: AddressProc$CloseHandleSleep
String ID:
API String ID: 2193747199-0
Opcode ID: 4b8893c0aebf7913d2779d052911446eda635433a7387e4f3cc0c068bfaa9c16
Instruction ID: be10187cfa2a3223c39ba84b81cac73f50791c0244182be0abf5d40a8fa663fa
Opcode Fuzzy Hash: 4b8893c0aebf7913d2779d052911446eda635433a7387e4f3cc0c068bfaa9c16
Instruction Fuzzy Hash: E16135B0A00301DFD301AF24FC89B253FB8F799351B454619E85157EB5DB708AE4CB96

Non-executed Functions

Function 00150500 Relevance: 13.7, APIs: 9, Instructions: 170serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00150537
CreateServiceA.ADVAPI32(00000000,0113E608,0113E608,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00150596
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00150615
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0015062A
CloseServiceHandle.ADVAPI32(00000000), ref: 001506A7
OpenServiceA.ADVAPI32(00000000,0113E608,00000010), ref: 001506EB
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0015072D
CloseServiceHandle.ADVAPI32(00000000), ref: 0015073E
CloseServiceHandle.ADVAPI32(00000000), ref: 001507A8

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: b8b4f44c17c0bc74e276535aa552d30ab99f5524378763319dc805df7666e641
Instruction ID: ff063a97b803de87bef5ecaa9953c4dd416f2eb688c892f462b62d6c0cfe8f4a
Opcode Fuzzy Hash: b8b4f44c17c0bc74e276535aa552d30ab99f5524378763319dc805df7666e641
Instruction Fuzzy Hash: 4D610131A01314EFD3069F60FC8AB253FB4FB88B11F518605E842AAEB4E77496E5CB45

Function 0014AF20 Relevance: 7.9, APIs: 5, Instructions: 385serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0014B0AA
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 0014B15A
GetLastError.KERNEL32 ref: 0014B17A
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 0014B216
CloseServiceHandle.ADVAPI32(00000000), ref: 0014B41C

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: 2f3bef2db8e794f34a2e304e0a6023eb5335007f1e9ab96ad1206d913d936871
Instruction ID: a0f2b06d3ada50d015d75a2ad3a634f7f9534579d36afb4ae1e502eb1c4fd254
Opcode Fuzzy Hash: 2f3bef2db8e794f34a2e304e0a6023eb5335007f1e9ab96ad1206d913d936871
Instruction Fuzzy Hash: 42F143B2A05201EFC304DF64FCC9A6A3BB1FB94350B15421AE54697EB5E730DAE4CB81

Function 00154380 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 387processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001544A7
Process32First.KERNEL32(00000000,?), ref: 001545C2
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 001547CE
Module32First.KERNEL32(00000000,00000224), ref: 00154842
CloseHandle.KERNEL32(00000000,0000000A), ref: 0015495A
Process32Next.KERNEL32(?,00000128), ref: 001549AD
CloseHandle.KERNEL32(00000000), ref: 00154A20

Strings

Eln_, xrefs: 001548DE, 001548ED

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID: Eln_
API String ID: 930127669-3437842203
Opcode ID: 6d8320fa28f0d2aaff4a95890231cf9e715981bcf6a58efcc56d29fb527cfcdc
Instruction ID: b7f0551deb72147bec76d60c7128754b5d8e8aecf9e3f1e2f017552fc06afc34
Opcode Fuzzy Hash: 6d8320fa28f0d2aaff4a95890231cf9e715981bcf6a58efcc56d29fb527cfcdc
Instruction Fuzzy Hash: 55F16771A00601DFD304CF25FC89A753BB5FB88315B51825AE84A87EB4EB748AE9CF51

Function 0014CA40 Relevance: 10.8, APIs: 7, Instructions: 345fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,00000003,00000000,00000000), ref: 0014CB20
ReadFile.KERNEL32(00000000,?,?,?,00000000), ref: 0014CB5D
CloseHandle.KERNEL32(00000000), ref: 0014CBBD
GetTickCount.KERNEL32 ref: 0014CC1D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0014CED4
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0014CF0E
CloseHandle.KERNEL32(00000000), ref: 0014CF47

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID:
API String ID: 3478262135-0
Opcode ID: a2a1b766b654ab3d93827935dcd88c8090cf5561f183097baa27fed90573557b
Instruction ID: 22b809317a1e8f4ceabd0f7e90db9fa3d01592c38e56970ef6dbfb3cb24e9e0a
Opcode Fuzzy Hash: a2a1b766b654ab3d93827935dcd88c8090cf5561f183097baa27fed90573557b
Instruction Fuzzy Hash: 54E14671A01200EFD304EF24FD89A693BB5FB94710F11421AE9569BEF4EB308AD5CB95

Function 0014BBC0 Relevance: 10.7, APIs: 7, Instructions: 205processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0014BC90
Process32First.KERNEL32(00000000,?), ref: 0014BCE3
OpenProcess.KERNEL32(00000001,00000000,?,?,?,?,?,00000000), ref: 0014BDDD

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: 43af716147c893c8216416e538511d6df22f3fec8a39ff57ade77b41a1f480e4
Instruction ID: 7a2530460fd01909547851a5077a9f467e3d0dd6411ff288c9576712f78708c7
Opcode Fuzzy Hash: 43af716147c893c8216416e538511d6df22f3fec8a39ff57ade77b41a1f480e4
Instruction Fuzzy Hash: B891FE75A04215DFC704DF24FCD6AAA3BB5FB98314B05815AE40693EB4EB349AD4CB40

Function 00151530 Relevance: 9.2, APIs: 6, Instructions: 176filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 001515C3
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0015168A
CloseHandle.KERNEL32(00000000), ref: 001516A7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00151715
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00151774
CloseHandle.KERNEL32(00000000), ref: 00151792

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: c790db70c0ad818271181fe7d940470d40b1c58603dba8fb8f25ca032381e17d
Instruction ID: 7cea0b3704c3af19e84f17581c6bd26a002671af38bbf90a46284e20a9b8cb3f
Opcode Fuzzy Hash: c790db70c0ad818271181fe7d940470d40b1c58603dba8fb8f25ca032381e17d
Instruction Fuzzy Hash: 24712031A01304EFC701DFA9FC85A757BB4FB88710B61465AE44592EB4E77489E4CF81

Function 0014BD08 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000001,00000000,?,?,?,?,?,00000000), ref: 0014BDDD
TerminateProcess.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 0014BE24
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 0014BE68
Process32Next.KERNEL32(00000000,00000128), ref: 0014BF01
CloseHandle.KERNEL32(00000000), ref: 0014BF2F

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseHandleProcess$NextOpenProcess32Terminate
String ID:
API String ID: 3173823348-0
Opcode ID: 5ba676787640153d2252fcbb025fb90852a26ef8373a16aedf42bdc60a562f5c
Instruction ID: ccb021a07620769e6defeb3c3bf0685f2b768490c4ec524bc0fb80500a692929
Opcode Fuzzy Hash: 5ba676787640153d2252fcbb025fb90852a26ef8373a16aedf42bdc60a562f5c
Instruction Fuzzy Hash: FD51FE75A01315DFC708DF24FCD5AAA3BF5FB98329B05825AE50597AB0EB348AD0CB40

Function 00175440 Relevance: 7.6, APIs: 5, Instructions: 71synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,0015E92E,0015CA40,00000000,?), ref: 001754B2
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 001754E4
CloseHandle.KERNEL32(00000000,?,0015E92E,0015CA40,00000000,?), ref: 0017551D
WaitForSingleObject.KERNEL32(?,000000FF,?,0015E92E,0015CA40,00000000,?), ref: 00175538
CloseHandle.KERNEL32(?,?,000000FF,?,0015E92E,0015CA40,00000000,?), ref: 0017554B

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 74c2ad7216397147a5393ea55bd6ad1447b18c4dd5cf088603c679d8f1950da1
Instruction ID: 694a498d2173d1225c7d47ecbbef0716c760df5f3367694ff5c9aa56facf8e8f
Opcode Fuzzy Hash: 74c2ad7216397147a5393ea55bd6ad1447b18c4dd5cf088603c679d8f1950da1
Instruction Fuzzy Hash: ED318931601305EBD3289F64FC89B227BB6FB48711F50821AE5469BEB0E77086D0CB91

Function 00151860 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(0114A1C8,001B05F8), ref: 001519BA

Strings

uRh, xrefs: 001518A1

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: ServiceStatus
String ID: uRh
API String ID: 3969395364-64653548
Opcode ID: 2c8cd3d8f5839c0de9f0ebf9f0579bd21492590be531aa7e20a790c2fe380a0f
Instruction ID: ebb5af3c7ddb6819f865183d911c89f0e80dbb817fb0338720aabf1215abcb95
Opcode Fuzzy Hash: 2c8cd3d8f5839c0de9f0ebf9f0579bd21492590be531aa7e20a790c2fe380a0f
Instruction Fuzzy Hash: 523122B2600205EFC349DF64FC8A8213BB9F798356345821AE9468BE70D734D6E5CF51

Function 0014D000 Relevance: 6.3, APIs: 4, Instructions: 269fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0014D11A
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 0014D1CC
CloseHandle.KERNEL32(00000000,?,00000000), ref: 0014D3EE
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 0014D2E9

Part of subcall function 0016FCC0: ReleaseMutex.KERNEL32(00150D8E,?,00150D8E,00000128,00000000), ref: 0016FCE9

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseFileHandle$CreateMutexReadRelease
String ID:
API String ID: 1760212717-0
Opcode ID: 3d534696c6e2fb3e9828526f86848338571ca5e1be7cbd6b450027837ff8df9b
Instruction ID: b53dfed79cce73865776e9820254b5fbdbd8f5860e03451f709f7cc4fa9efc8e
Opcode Fuzzy Hash: 3d534696c6e2fb3e9828526f86848338571ca5e1be7cbd6b450027837ff8df9b
Instruction Fuzzy Hash: 54B16A71A00600DBCB04AF64FC85B693BB5FBD8711F218156E54597EF1EB709AE4CB82

Function 001568D0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,001503A9,00000000,?), ref: 00156957
RtlReAllocateHeap.NTDLL(00000000,?,001503A9,00000000), ref: 0015695E
GetProcessHeap.KERNEL32(00000000,?,?,001503A9,00000000,?), ref: 001569C8
HeapAlloc.KERNEL32(00000000,?,001503A9,00000000,?), ref: 001569CF

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 0854f8f39c79355000b5cca1c97547dff543017d721ebea2f690d2947a5c11b6
Instruction ID: 5fe13a9a5083639da10640ce7b551ac2f636f8185c7407b44799b024cbd98ca6
Opcode Fuzzy Hash: 0854f8f39c79355000b5cca1c97547dff543017d721ebea2f690d2947a5c11b6
Instruction Fuzzy Hash: ED21AEB2605204DFD7049F61FE8A9503F78F785310B624619E98693DB4E73199E1CF90

Function 001750E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0016247D,00000001,?,?,0016247D), ref: 0017518C
GetTickCount.KERNEL32 ref: 001752BE

Strings

@AB , xrefs: 001752CD

Memory Dump Source

Source File: 00000003.00000002.2068966797.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000003.00000002.2068937876.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069001869.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B4000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B7000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069023405.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2069190910.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CountSystemTickTime
String ID: @AB
API String ID: 2164215191-841575833
Opcode ID: 078d7c74786d9cd1011380062dce38b52bf8972c8095f24bab9c3b901f651bbe
Instruction ID: 82845a754f6ede21e7eb08de9a3fb57ff9c2689891cd13d6accb8e7c52fc6a73
Opcode Fuzzy Hash: 078d7c74786d9cd1011380062dce38b52bf8972c8095f24bab9c3b901f651bbe
Instruction Fuzzy Hash: 0451DE72A00A11CFC308DF69FD899253BB6F7987003464116E48AC7EB4EB748AE4CB85

Analysis Process: amdrhfskpcu.exePID: 7240, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1712
Total number of Limit Nodes:	17

Executed Functions

Function 00A37A04 Relevance: 60.1, APIs: 28, Strings: 5, Instructions: 2326sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 00A383DA
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00A38448
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00A384DC
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00A384F7
GetTickCount.KERNEL32 ref: 00A38599

Part of subcall function 00A45200: GetVersionExA.KERNEL32(00ABAE70), ref: 00A452CC

Sleep.KERNEL32(00000D05), ref: 00A38B70
Sleep.KERNELBASE(000007D0), ref: 00A38DAC
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00A38E86
SetFileAttributesA.KERNEL32(?,00000080), ref: 00A38E9F
CopyFileA.KERNEL32(?,?,00000000), ref: 00A38EC3
SetFileAttributesA.KERNEL32(?,00000002), ref: 00A3912B
SetFileAttributesA.KERNEL32(?,00000080), ref: 00A39186
GetCommandLineA.KERNEL32 ref: 00A39265
GetModuleFileNameA.KERNEL32(00000000,?), ref: 00A39370

Part of subcall function 00A3A4E0: lstrlen.KERNEL32(?), ref: 00A3A4FE

Part of subcall function 00A3D500: lstrlen.KERNEL32(?,?,00A3D630,?), ref: 00A3D523

MessageBoxA.USER32(00000000,00000004,00000005,?), ref: 00A396D4
CloseHandle.KERNEL32(00000000), ref: 00A39AC8
SetFileAttributesA.KERNEL32(?,00000080), ref: 00A39AEC
CopyFileA.KERNEL32(?,?,00000000), ref: 00A39B0C
SetFileAttributesA.KERNEL32(?,00000002), ref: 00A39B3B
Sleep.KERNEL32(000003E8), ref: 00A39C52
Sleep.KERNELBASE(000003E8), ref: 00A38CB2

Part of subcall function 00A3BBC0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A3BC90
Part of subcall function 00A3BBC0: Process32First.KERNEL32(00000000,?), ref: 00A3BCE3

GetCommandLineA.KERNEL32 ref: 00A386AE

Part of subcall function 00A32800: ExitProcess.KERNEL32 ref: 00A32842

Part of subcall function 00A608B0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00A60929
Part of subcall function 00A608B0: __aulldiv.LIBCMT ref: 00A60953

Sleep.KERNEL32(000007D0), ref: 00A39E32
SetFileAttributesA.KERNEL32(00A7D800,00000080), ref: 00A39E88
CopyFileA.KERNEL32(?,00A7D800,00000000), ref: 00A39EA6
SetFileAttributesA.KERNEL32(00A7D800,00000002), ref: 00A39EC5

Part of subcall function 00A40500: OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00A40537
Part of subcall function 00A40500: CreateServiceA.ADVAPI32(00000000,00F7E6B0,00F7E6B0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00A40596
Part of subcall function 00A40500: ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00A40615
Part of subcall function 00A40500: StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00A4062A

CreateThread.KERNEL32(00000000,00000000,Function_000222A0,00000000,00000000,00000000), ref: 00A3A26A
Sleep.KERNEL32(0000C350), ref: 00A3A327

Strings

@L, xrefs: 00A37E24
}en, xrefs: 00A39856
%Tmd, xrefs: 00A38421
C:\Windows\system32\config\systemprofile, xrefs: 00A383D4
zS, xrefs: 00A39CD7

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: File$Attributes$CreateSleep$CopyMutexService$CommandLineModuleNameTimelstrlen$ChangeCloseConfig2CountEnvironmentExitFirstHandleManagerMessageOpenProcessProcess32SnapshotStartSystemThreadTickToolhelp32VariableVersion__aulldiv
String ID: zS$%Tmd$C:\Windows\system32\config\systemprofile$@L$}en
API String ID: 2964372999-1718768463
Opcode ID: 0783e844ac88657a94db2c5da09d83c4cb248c0cca2a7ec78a59e9604986e705
Instruction ID: a2a12dc258a8578df2b07ac1a53681734985336260cf234bf1cefaef442085ed
Opcode Fuzzy Hash: 0783e844ac88657a94db2c5da09d83c4cb248c0cca2a7ec78a59e9604986e705
Instruction Fuzzy Hash: 9C230471A00302DFD704EFE4FD8A6663BB4FB95341F11861AE14A962B6EB7448A3CF51

Function 00A45200 Relevance: 30.9, APIs: 12, Strings: 5, Instructions: 1106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00ABAE70), ref: 00A452CC
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00A4549F
DeleteFileA.KERNELBASE(?), ref: 00A456FE
RemoveDirectoryA.KERNELBASE(00000000), ref: 00A45743
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00A4583A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00A458F3
CreateDirectoryA.KERNEL32(?,00000000), ref: 00A45D71
CreateDirectoryA.KERNEL32(?,00000000), ref: 00A45E82
GetTempPathA.KERNEL32(00000104,?), ref: 00A46029
CreateDirectoryA.KERNEL32(?,00000000), ref: 00A461FF
GetTempPathA.KERNEL32(00000104,?), ref: 00A463DE
SetFileAttributesA.KERNELBASE(?,00000002), ref: 00A4655F

Strings

aE'P, xrefs: 00A45BDE
C:\whfkpbh\, xrefs: 00A45851, 00A45D90, 00A461A2, 00A463F5
r9:, xrefs: 00A46085
\, xrefs: 00A46092
C:\Windows\system32\config\systemprofile, xrefs: 00A45B3A, 00A45C6A

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\whfkpbh\$\$aE'P$r9:
API String ID: 1691758827-2593203275
Opcode ID: 62caa11a9e2060968d82e3a696ad758f0aaf8b43382329be7bca47d1823dbf3c
Instruction ID: 2c96d200c69962e61b844d1e3b72e8e099aba07f43bd0043a4d9982b556e2def
Opcode Fuzzy Hash: 62caa11a9e2060968d82e3a696ad758f0aaf8b43382329be7bca47d1823dbf3c
Instruction Fuzzy Hash: E6A267B6A00202DFC704DFE4FD866B637B0F795310B018629E546962F6EB7488A7CF55

Function 00A3BBC0 Relevance: 10.7, APIs: 7, Instructions: 205
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A3BC90
Process32First.KERNEL32(00000000,?), ref: 00A3BCE3
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A3BDDD

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: 7ff895f26800880b000775b91c1f49ac2e5023c49fe0ddecf5c347cedb1cfaf0
Instruction ID: 37c59a9f99e81d822ce26ec8cf89c931651ab7c52b21601042ee485fa495e204
Opcode Fuzzy Hash: 7ff895f26800880b000775b91c1f49ac2e5023c49fe0ddecf5c347cedb1cfaf0
Instruction Fuzzy Hash: D89123B6A10202CFC704DFE8FC99AAA37B5FB98310F15811AE505972B1DB788997CF54

Function 00A41530 Relevance: 9.2, APIs: 6, Instructions: 176
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00A415C3
GetFileTime.KERNEL32(00000000,?,?,?), ref: 00A4168A
CloseHandle.KERNEL32(00000000), ref: 00A416A7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A41715
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00A41774
CloseHandle.KERNEL32(00000000), ref: 00A41792

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 0ce10a2caef4782c700173dca69e920874a21eae7d0a0e282ac50b800be46bde
Instruction ID: 73920238fc919d22c3cdbb1fe34d81c4edb629e2df67584089582fab6d3ece12
Opcode Fuzzy Hash: 0ce10a2caef4782c700173dca69e920874a21eae7d0a0e282ac50b800be46bde
Instruction Fuzzy Hash: C271F071A01206EFC700DFE9FC85676BBB4FB8A710F11861AE449922B5E77548A7CF44

Function 00A3BD08 Relevance: 7.6, APIs: 5, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A3BDDD
TerminateProcess.KERNELBASE(00000000,000000FF), ref: 00A3BE24
CloseHandle.KERNEL32(00000000), ref: 00A3BE68
Process32Next.KERNEL32(00000000,00000128), ref: 00A3BF01
CloseHandle.KERNEL32(00000000), ref: 00A3BF2F

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: CloseHandleProcess$NextOpenProcess32Terminate
String ID:
API String ID: 3173823348-0
Opcode ID: 4f0d1cdcedccbe76f6ded1fe79bd689d2d999f101a75dd60c96dcef4bcbe41b3
Instruction ID: 7b56230b5e0ed75174e27f8e116c4c2f3a736ac4ae110ba8c4b8edac1a60a86f
Opcode Fuzzy Hash: 4f0d1cdcedccbe76f6ded1fe79bd689d2d999f101a75dd60c96dcef4bcbe41b3
Instruction Fuzzy Hash: 5D510F76A11202DFC704DFE4FC95AAA37B5FB98315F15811AE50A872B0EB348987CB50

Function 00A5FA80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00A4ED48,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00A5FBF1
CloseHandle.KERNEL32(00A4ED48,?,?,?,?,?,00000000), ref: 00A5FC2F
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00A5FC58

Strings

D, xrefs: 00A5FB8F

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 033bfb43cdac20b4b9b06e7148d736cbf6a62fcd8b3ce9a351e39c515733d92c
Instruction ID: a1b31a5481abf9eaa3a7a8f88c57dda38a80ca55ed8cec0b440ec99d20baaaf7
Opcode Fuzzy Hash: 033bfb43cdac20b4b9b06e7148d736cbf6a62fcd8b3ce9a351e39c515733d92c
Instruction Fuzzy Hash: D2510E31A11206EBD704DFE4FC427AA3BF4FB49711F00812AE44A962B0EBB45497CB85

Function 00A42120 Relevance: 6.2, APIs: 4, Instructions: 207
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A421D0
Process32First.KERNEL32(00000000,00000128), ref: 00A42257
Process32Next.KERNEL32(00000000,00000128), ref: 00A42384
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00A42426

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 04b3df3ff69ba08359e638bfbb9750729ad294c79ec897ed2c0813eb1358b969
Instruction ID: bdfa29c3537afa85fd9fbf8e1d91d230705cb31a1856d367db9cc8c7d90c9842
Opcode Fuzzy Hash: 04b3df3ff69ba08359e638bfbb9750729ad294c79ec897ed2c0813eb1358b969
Instruction Fuzzy Hash: 8F910175A00212CFD300DFE5FC887A63BB4FBA5350F45811AE846962B5EBB484A7CF65

Function 00A41D90 Relevance: 4.7, APIs: 3, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A53110: WaitForSingleObject.KERNEL32(?,00004E20,?,00A3D0F2,00000124), ref: 00A531AD

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00A41E7B

Part of subcall function 00A5FCC0: ReleaseMutex.KERNEL32(00A3D410,?,00A3D410,00000124), ref: 00A5FCE9

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: 3cc83534d6ca5f84a5db8fe4ddfcae365e3d4abd800437ea6ec0d9947994cffe
Instruction ID: 107a3564fe7ee5614e34130f0c0209cc3ea7b1d8c300cdc4a29cdb7bb77d90bc
Opcode Fuzzy Hash: 3cc83534d6ca5f84a5db8fe4ddfcae365e3d4abd800437ea6ec0d9947994cffe
Instruction Fuzzy Hash: 27712376611205DFC704CFE8FC8AA6A37B4FB99305F018219E909976B2DB7498A7CF41

Function 00A3B7A0 Relevance: 3.1, APIs: 2, Instructions: 89
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00A3B82B
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00A3B87D

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: AllocateCheckInitializeMembershipToken
String ID:
API String ID: 1663163955-0
Opcode ID: cb2320dfd7dded724d60044db2bdce2d785148f283502e6ecd8397e4bcd9c598
Instruction ID: ca3dcf391744184f04991b07ae794c925df5099c58c7547d04ad524cf781e432
Opcode Fuzzy Hash: cb2320dfd7dded724d60044db2bdce2d785148f283502e6ecd8397e4bcd9c598
Instruction Fuzzy Hash: F331EF75901249EFE704CFF4ED999BA7BB8FB4A300B00815EE402972B2D7B05997DB61

Function 00A42EB0 Relevance: 3.0, APIs: 2, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00A40367,?,00A40367,00000000), ref: 00A42ED1
RtlFreeHeap.NTDLL(00000000,?,00A40367,00000000), ref: 00A42ED8

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 51453e171365800b39587b640dfba2d7d373c1cef88367d0351b26f821e7243b
Instruction ID: da7cebd527969591de45e92ccd45986466256c7db839162995e0fa9c7dc7db49
Opcode Fuzzy Hash: 51453e171365800b39587b640dfba2d7d373c1cef88367d0351b26f821e7243b
Instruction Fuzzy Hash: 5A019A39604249CBC314DBE4FE5552A37F9F7887207818306E00E8A2B2C33188A78B15

Function 00A3E2C0 Relevance: 3.0, APIs: 2, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00A6220A,02167FFC,?,?,?,?,00A5463C), ref: 00A3E2F8
RtlAllocateHeap.NTDLL(00000000,?,00A6220A,02167FFC,?,?,?,?,00A5463C), ref: 00A3E2FF

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 0273fc1cbb152a6bc930267508da95e311d01b10d79e29cb0b8bb7c9b8b6878f
Instruction ID: 115c3a2d1878f4645bd551f45ec073ce44982c9c4d5a53c4d0c7b7b110ce8786
Opcode Fuzzy Hash: 0273fc1cbb152a6bc930267508da95e311d01b10d79e29cb0b8bb7c9b8b6878f
Instruction Fuzzy Hash: 1CE04F761142009FCB04CBE5FC49A9A33B8EB04205B008119F60EC6261C671A5C38F95

Function 00A545A9 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00A54699

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: eed45312cf678ed519a7cd086c85abd0585a53cbef91f64656c42db4127056c6
Instruction ID: f4d496f603e0242a49d50459535a6b9e1c5b029a3393182aa724177a304aec99
Opcode Fuzzy Hash: eed45312cf678ed519a7cd086c85abd0585a53cbef91f64656c42db4127056c6
Instruction Fuzzy Hash: 2F112B766101028FC700EFF0FE4A82637B0F7A63463058426E447861B9FB754557C782

Function 00A32800 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00A32842

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a3a0ff1febee31ff2595b58e54fabce9312fd878626ba8f54c38cbe7a8a19ffe
Instruction ID: 769b970884b9b042a864c2ff9405fe195b8306b6ac39ac464c12490918a27c81
Opcode Fuzzy Hash: a3a0ff1febee31ff2595b58e54fabce9312fd878626ba8f54c38cbe7a8a19ffe
Instruction Fuzzy Hash: AAE0867C1002058BC354DFE4D8968763775EB45345754C11BE9560B2A1CA74A447DF91

Function 00A3A4E0 Relevance: 1.3, APIs: 1, Instructions: 33
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 00A3A4FE

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: fb6ad022c96201497fecab829161df29a9393a3e7afd10e341746d21400d6a0c
Instruction ID: 33253f8a111a098c066300093cf6db2359c199d7a30ea3ed47c8416afab21d11
Opcode Fuzzy Hash: fb6ad022c96201497fecab829161df29a9393a3e7afd10e341746d21400d6a0c
Instruction Fuzzy Hash: 9CF0AF71250222EFC706DFE1FD0A0663BF8FB9E3613414002E449961B5E77848A3DF96

Non-executed Functions

Function 00A40500 Relevance: 13.7, APIs: 9, Instructions: 170serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00A40537
CreateServiceA.ADVAPI32(00000000,00F7E6B0,00F7E6B0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00A40596
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00A40615
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00A4062A
CloseServiceHandle.ADVAPI32(00000000), ref: 00A406A7
OpenServiceA.ADVAPI32(00000000,00F7E6B0,00000010), ref: 00A406EB
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00A4072D
CloseServiceHandle.ADVAPI32(00000000), ref: 00A4073E
CloseServiceHandle.ADVAPI32(00000000), ref: 00A407A8

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: de8e159468b4f0bc8a9bb0894b80a4a299a9a1fb82c03c2f995eb625e9809858
Instruction ID: ce417c1d91f3ce8d51d631607863670805ea07e0a46e1e558e61201db612544a
Opcode Fuzzy Hash: de8e159468b4f0bc8a9bb0894b80a4a299a9a1fb82c03c2f995eb625e9809858
Instruction Fuzzy Hash: 0C610D32A01210EFD301CFE4FC8AB663BB0FB85701F118606E546AA2B6D7B054A3DF45

Function 00A3AF20 Relevance: 7.9, APIs: 5, Instructions: 385serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00A3B0AA
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 00A3B15A
GetLastError.KERNEL32 ref: 00A3B17A
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 00A3B216
CloseServiceHandle.ADVAPI32(00000000), ref: 00A3B41C

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: 1096e11805b1d408d25a6790cc0bdd99606469bfdccd1a57d342e1e3a1eb41ed
Instruction ID: 445cd35e24f8a97e8b833ff1900e65b5adb00d07f1ff57f3b76efc3d26dd96be
Opcode Fuzzy Hash: 1096e11805b1d408d25a6790cc0bdd99606469bfdccd1a57d342e1e3a1eb41ed
Instruction Fuzzy Hash: 5FF158B2A10202DFC704DFE4FD857AA3BB1F794350F11821AE646972B6E7748893CB95

Function 00A59580 Relevance: 7.7, APIs: 5, Instructions: 220filesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,00000001), ref: 00A59679
FindFirstFileA.KERNEL32(?,?), ref: 00A597B8
DeleteFileA.KERNEL32(?), ref: 00A598A9
FindNextFileA.KERNEL32(00000000,?), ref: 00A598CB
FindClose.KERNEL32(00000000), ref: 00A598E4

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: 26deea10f89413d119bc0d3c803a3602e587578ddf8a2ced69b8a5936307c02b
Instruction ID: a3d58b3399594d122d120d5f04eb7e5b9b38f5472d16f7701e955c1fcc323117
Opcode Fuzzy Hash: 26deea10f89413d119bc0d3c803a3602e587578ddf8a2ced69b8a5936307c02b
Instruction Fuzzy Hash: 1D911676900302DFC704DFE4FD865A637B0FB9A301B40861AE94A9B6B1EB744997CF51

Function 00A46C10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 187registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00F7E6B0,Function_00011860), ref: 00A46D72
SetServiceStatus.ADVAPI32(00000000,00AA05F8), ref: 00A46DD5
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A46DE9
SetServiceStatus.ADVAPI32(00000000,00AA05F8), ref: 00A46E8A
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00A46EBE
SetServiceStatus.ADVAPI32(00000000,00AA05F8), ref: 00A46F2B
CloseHandle.KERNEL32(00000000), ref: 00A46F42
SetServiceStatus.ADVAPI32(00000000,00AA05F8), ref: 00A46FAA

Strings

=ZMI, xrefs: 00A46D10

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID: =ZMI
API String ID: 3399922960-150576250
Opcode ID: c59585d34e5be1a0c39dee3d6b35e907823d28627476febd6b89b8f261f8c9f1
Instruction ID: 9b52648552593a5778e792c8ef0ac2980204434f91145e5263eef7a4b213864e
Opcode Fuzzy Hash: c59585d34e5be1a0c39dee3d6b35e907823d28627476febd6b89b8f261f8c9f1
Instruction Fuzzy Hash: 7891A875A01302CFD304CFE8FD8A9263BB5FB9A310B01C61AE45A862B5D77844A7CF46

Function 00A44380 Relevance: 10.9, APIs: 7, Instructions: 387processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A444A7
Process32First.KERNEL32(00000000,?), ref: 00A445C2
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00A447CE
Module32First.KERNEL32(00000000,00000224), ref: 00A44842
CloseHandle.KERNEL32(00000000,0000000A), ref: 00A4495A
Process32Next.KERNEL32(?,00000128), ref: 00A449AD
CloseHandle.KERNEL32(00000000), ref: 00A44A20

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: 35dc4ec46c7b823aef5a53de2999291b85a681e27805a3dfe1dc80e4ba1f231a
Instruction ID: 49e08c34100de70ce558eec95754fba04ea2fd7c6ef95ce187558c18034a9a3d
Opcode Fuzzy Hash: 35dc4ec46c7b823aef5a53de2999291b85a681e27805a3dfe1dc80e4ba1f231a
Instruction Fuzzy Hash: DAF14371A00202CFE704DFE9FC866693BB5F789311B01821AE44AC62B6EB7449E7CF51

Function 00A3CA40 Relevance: 10.8, APIs: 7, Instructions: 345fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,00000003,00000000,00000000), ref: 00A3CB20
ReadFile.KERNEL32(00000000,?,?,?,00000000), ref: 00A3CB5D
CloseHandle.KERNEL32(00000000), ref: 00A3CBBD
GetTickCount.KERNEL32 ref: 00A3CC1D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00A3CED4
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00A3CF0E
CloseHandle.KERNEL32(00000000), ref: 00A3CF47

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID:
API String ID: 3478262135-0
Opcode ID: 4e670c0918ac8da224ea325960e5d88cdd03eade04c7de2470dd2a16c0f6e262
Instruction ID: 8c257779c19ac687b70482483f60f8c7ed3b8783cbcc384463517b387fa4c27c
Opcode Fuzzy Hash: 4e670c0918ac8da224ea325960e5d88cdd03eade04c7de2470dd2a16c0f6e262
Instruction Fuzzy Hash: 73E14472A00201DFD704DFE4FD99AA937B4FB95720F10811AE44A9B2F5EB7049A3CB55

Function 00A65440 Relevance: 7.6, APIs: 5, Instructions: 71synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,00A4E92E,00A4CA40,00000000,?), ref: 00A654B2
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 00A654E4
CloseHandle.KERNEL32(00000000,?,00A4E92E,00A4CA40,00000000,?), ref: 00A6551D
WaitForSingleObject.KERNEL32(?,000000FF,?,00A4E92E,00A4CA40,00000000,?), ref: 00A65538
CloseHandle.KERNEL32(?,?,000000FF,?,00A4E92E,00A4CA40,00000000,?), ref: 00A6554B

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 5ad323cc4031770fb6ecbd95b36ca535b0f891e548d2eea525ce2f7292b5a8d6
Instruction ID: 215c1bd99f08ee1ed8c8d59e23a8217e5f3a2f6b9cc5e3a29d7dc0437d63e2bd
Opcode Fuzzy Hash: 5ad323cc4031770fb6ecbd95b36ca535b0f891e548d2eea525ce2f7292b5a8d6
Instruction Fuzzy Hash: 74319A30A00302DFD308CFA4EC55B627BF4FB58711F11C10AE64A9A6F0E7B08482CB94

Function 00A3D000 Relevance: 6.3, APIs: 4, Instructions: 269fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A3D11A
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00A3D1CC
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00A3D3EE
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00A3D2E9

Part of subcall function 00A5FCC0: ReleaseMutex.KERNEL32(00A3D410,?,00A3D410,00000124), ref: 00A5FCE9

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: CloseFileHandle$CreateMutexReadRelease
String ID:
API String ID: 1760212717-0
Opcode ID: e02a80854afacdf2c570b97747e2d1baf9c1187ac199642f01ba4f368193e844
Instruction ID: d3aafe448fd1fe2eb8ee35f2d5c27203a8ba157755f6e090e8070c71bcd5adb4
Opcode Fuzzy Hash: e02a80854afacdf2c570b97747e2d1baf9c1187ac199642f01ba4f368193e844
Instruction Fuzzy Hash: 87B144B2A00601DBD704DFE4FC8676A3BB5FBD8311F118156E549862F1EB7049A7CB82

Function 00A468D0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,00A403A9,00000000,?), ref: 00A46957
RtlReAllocateHeap.NTDLL(00000000,?,00A403A9,00000000), ref: 00A4695E
GetProcessHeap.KERNEL32(00000000,?,?,00A403A9,00000000,?), ref: 00A469C8
HeapAlloc.KERNEL32(00000000,?,00A403A9,00000000,?), ref: 00A469CF

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 1366f8e83cec30296f4d264fe60031fc695a163b6fce106dd267c26d4b885b92
Instruction ID: 9e551574a25923334a05601fbc6cba99f61f3ae9c0274e63d74a3b322e013c0a
Opcode Fuzzy Hash: 1366f8e83cec30296f4d264fe60031fc695a163b6fce106dd267c26d4b885b92
Instruction Fuzzy Hash: 0721C072A00601DFD705DFE1FE89A553F78F786310B628605D54A921B6EB3198B3CF61

Function 00A50FD8 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 409COMMON

Download Yara Rule

Strings

XH, xrefs: 00A5153C
/, xrefs: 00A5100F

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID:
String ID: XH$/
API String ID: 0-571299465
Opcode ID: 655c91e7dfa10185b5f462ac1dbf03d0b5a084fd6e778f1bca01eab606fc198f
Instruction ID: 527bfe71cb5981a9bdd86815a3397d12b391aa472feaeaa7c7565e7abc18b9d2
Opcode Fuzzy Hash: 655c91e7dfa10185b5f462ac1dbf03d0b5a084fd6e778f1bca01eab606fc198f
Instruction Fuzzy Hash: CAF1DF31910212DBDB04EFE0FD92BBA37B8FB55311F00822AE54A561F2EB70499BCB50

Function 00A650E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(00A5247D,00000001,?,?,00A5247D), ref: 00A6518C
GetTickCount.KERNEL32 ref: 00A652BE

Strings

@AB , xrefs: 00A652CD

Memory Dump Source

Source File: 00000005.00000002.2077154991.0000000000A31000.00000020.00000001.01000000.00000007.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000005.00000002.2077138911.0000000000A30000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077181409.0000000000A67000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000A6C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000AA9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077201160.0000000000ABA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2077261874.0000000000ABB000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_a30000_amdrhfskpcu.jbxd

Similarity

API ID: CountSystemTickTime
String ID: @AB
API String ID: 2164215191-841575833
Opcode ID: c74745e614e743ec1cdb1bca26d92038d83242aea85fd3c5bfe3dfd70ad133ac
Instruction ID: 6f62f3329ec825d48679b0233fc0ec290a1f2640418363a609b0444e1603681e
Opcode Fuzzy Hash: c74745e614e743ec1cdb1bca26d92038d83242aea85fd3c5bfe3dfd70ad133ac
Instruction Fuzzy Hash: 6951CEB2A10601CFC308DFF9FD8A6263BB1F7993107058216D48AC72B5EB7498A7CB45

Analysis Process: idtpqzltyfy.exePID: 7276, Parent PID: 5064COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1713
Total number of Limit Nodes:	13

Executed Functions

Function 00147A04 Relevance: 60.1, APIs: 28, Strings: 5, Instructions: 2326sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 001483DA
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00148448
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 001484DC
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 001484F7
GetTickCount.KERNEL32 ref: 00148599

Part of subcall function 00155200: GetVersionExA.KERNEL32(001CAE70), ref: 001552CC

Sleep.KERNEL32(00000D05), ref: 00148B70
Sleep.KERNEL32(000007D0), ref: 00148DAC
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00148E86
SetFileAttributesA.KERNEL32(?,00000080), ref: 00148E9F
CopyFileA.KERNEL32(?,?,00000000), ref: 00148EC3
SetFileAttributesA.KERNEL32(?,00000002), ref: 0014912B
SetFileAttributesA.KERNEL32(?,00000080), ref: 00149186
GetCommandLineA.KERNEL32 ref: 00149265
GetModuleFileNameA.KERNEL32(00000000,?), ref: 00149370

Part of subcall function 0014A4E0: lstrlen.KERNEL32(?), ref: 0014A4FE

Part of subcall function 0014D500: lstrlen.KERNEL32(?,?,0014D630,?), ref: 0014D523

MessageBoxA.USER32(00000000,00000004,00000005,?), ref: 001496D4
CloseHandle.KERNEL32(FFFFFFFF), ref: 00149AC8
SetFileAttributesA.KERNEL32(?,00000080), ref: 00149AEC
CopyFileA.KERNEL32(?,?,00000000), ref: 00149B0C
SetFileAttributesA.KERNEL32(?,00000002), ref: 00149B3B
Sleep.KERNEL32(000003E8), ref: 00149C52
Sleep.KERNEL32(000003E8), ref: 00148CB2

Part of subcall function 0014BBC0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0014BC90
Part of subcall function 0014BBC0: Process32First.KERNEL32(00000000,?), ref: 0014BCE3

GetCommandLineA.KERNEL32 ref: 001486AE

Part of subcall function 00142800: ExitProcess.KERNEL32 ref: 00142842

Part of subcall function 001708B0: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00170929
Part of subcall function 001708B0: __aulldiv.LIBCMT ref: 00170953

Sleep.KERNEL32(000007D0), ref: 00149E32
SetFileAttributesA.KERNEL32(0018D800,00000080), ref: 00149E88
CopyFileA.KERNEL32(?,0018D800,00000000), ref: 00149EA6
SetFileAttributesA.KERNEL32(0018D800,00000002), ref: 00149EC5

Part of subcall function 00150500: OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00150537
Part of subcall function 00150500: CreateServiceA.ADVAPI32(00000000,012532A8,012532A8,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00150596
Part of subcall function 00150500: ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00150615
Part of subcall function 00150500: StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0015062A

CreateThread.KERNEL32(00000000,00000000,Function_000222A0,00000000,00000000,00000000), ref: 0014A26A
Sleep.KERNEL32(0000C350), ref: 0014A327

Strings

zS, xrefs: 00149CD7
%Tmd, xrefs: 00148421
@L, xrefs: 00147E24
C:\Users\user, xrefs: 001483D4
}en, xrefs: 00149856

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: File$Attributes$CreateSleep$CopyMutexService$CommandLineModuleNameTimelstrlen$ChangeCloseConfig2CountEnvironmentExitFirstHandleManagerMessageOpenProcessProcess32SnapshotStartSystemThreadTickToolhelp32VariableVersion__aulldiv
String ID: zS$%Tmd$C:\Users\user$@L$}en
API String ID: 2964372999-4230071128
Opcode ID: afd3d6351805866d66c3ea40e9ff8472c26585f880d6c70bcffcadbdc90c277c
Instruction ID: e3293a6eb730aeb8f51adb720d26d57176b8f05384c9608a1d62fc2f8fe7eafc
Opcode Fuzzy Hash: afd3d6351805866d66c3ea40e9ff8472c26585f880d6c70bcffcadbdc90c277c
Instruction Fuzzy Hash: F22358B1A00301DFD304EF64FC8AA663BB4FB98301B51461AE54697EB5EB708AE5CF51

Function 00155200 Relevance: 30.9, APIs: 12, Strings: 5, Instructions: 1106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(001CAE70), ref: 001552CC
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 0015549F
DeleteFileA.KERNELBASE(?), ref: 001556FE
RemoveDirectoryA.KERNELBASE(00000000), ref: 00155743
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0015583A
CreateDirectoryA.KERNELBASE(?,00000000), ref: 001558F3
CreateDirectoryA.KERNEL32(?,00000000), ref: 00155D71
CreateDirectoryA.KERNEL32(?,00000000), ref: 00155E82
GetTempPathA.KERNEL32(00000104,?), ref: 00156029
CreateDirectoryA.KERNEL32(?,00000000), ref: 001561FF
GetTempPathA.KERNEL32(00000104,?), ref: 001563DE
SetFileAttributesA.KERNELBASE(?,00000002), ref: 0015655F

Strings

C:\whfkpbh\, xrefs: 00155851, 00155D90, 001561A2, 001563F5
aE'P, xrefs: 00155BDE
r9:, xrefs: 00156085
C:\Users\user, xrefs: 00155B3A, 00155C6A
\, xrefs: 00156092

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\whfkpbh\$\$aE'P$r9:
API String ID: 1691758827-1166413814
Opcode ID: 9bee97c4b9d065477c1dea236d010cf1b3e047ea12314249cbe35ff5e6a5ac55
Instruction ID: 1f69f77ae9c2a9888138bc1b0f7bbbd8c8c650dcf00358e654a38ae4449ba2f0
Opcode Fuzzy Hash: 9bee97c4b9d065477c1dea236d010cf1b3e047ea12314249cbe35ff5e6a5ac55
Instruction Fuzzy Hash: 9FA26BB2A00205DFC704DF24FC96AA53BB5FBA4311B518219E94297EB5FB308AD5CF91

Function 00151D90 Relevance: 4.7, APIs: 3, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00163110: WaitForSingleObject.KERNEL32(?,00004E20,?,0014D0F2,00000108), ref: 001631AD

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00151E7B

Part of subcall function 0016FCC0: ReleaseMutex.KERNEL32(0014D410,?,0014D410,00000108), ref: 0016FCE9

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: 22f5837e7a40c6c3ee3be3263d5944823e2568d89bb5d090c9fae3ee51ec13ed
Instruction ID: 4c38f319b3cbb9f489e097b241f6d020158641a4adba2a40a042d69e04128246
Opcode Fuzzy Hash: 22f5837e7a40c6c3ee3be3263d5944823e2568d89bb5d090c9fae3ee51ec13ed
Instruction Fuzzy Hash: 7D71F472611204DFC304DF64FC89A6A3BB9FB98315F418259E80697EB4DB709AE5CF81

Function 0014B7A0 Relevance: 3.1, APIs: 2, Instructions: 89
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0014B82B
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0014B87D

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: AllocateCheckInitializeMembershipToken
String ID:
API String ID: 1663163955-0
Opcode ID: 1e434bf8c9f31915622607fa10d4e0e72f03e96b0633d08eb81183e79bc3b665
Instruction ID: 837e2b70412a640a764e1ba25bcebfe3eee488d6fa528ad107c108dc0005887f
Opcode Fuzzy Hash: 1e434bf8c9f31915622607fa10d4e0e72f03e96b0633d08eb81183e79bc3b665
Instruction Fuzzy Hash: 07319E75905248EFD704CFA8FDD99BA7BB8FB58304B01819AE40297AB0D7709AD4CB51

Function 00152EB0 Relevance: 3.0, APIs: 2, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00150367,?,00150367,00000000), ref: 00152ED1
RtlFreeHeap.NTDLL(00000000,?,00150367,00000000), ref: 00152ED8

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 59c7adb539fa9924a3090a7480335d9ad5942488817bfa6c414050d21aedd6ee
Instruction ID: f30e63a88a2a06e5d576f11d18279de1a55d9d7526c50d3dd3a750582e1e580e
Opcode Fuzzy Hash: 59c7adb539fa9924a3090a7480335d9ad5942488817bfa6c414050d21aedd6ee
Instruction Fuzzy Hash: 1301DF31608245CBC318DFA4FE668293BF9F7487207144206F51A8BEB0D330D8E98B15

Function 0014E2C0 Relevance: 3.0, APIs: 2, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,0017220A,02167FFC,?,?,?,?,0016463C), ref: 0014E2F8
RtlAllocateHeap.NTDLL(00000000,?,0017220A,02167FFC,?,?,?,?,0016463C), ref: 0014E2FF

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 8416483f14de977ede38d531b499846a59f5f9a06fabc187798644c3ca993560
Instruction ID: baadc4dfb9003755db613a08ab54eecf014547e236bae513d1af665befb331d9
Opcode Fuzzy Hash: 8416483f14de977ede38d531b499846a59f5f9a06fabc187798644c3ca993560
Instruction Fuzzy Hash: B4E08C76104200AFC7089FA9FC8DA5633B8FB09305F144518FA0DC6AB2CB71E6C18B91

Function 00163CF0 Relevance: 1.6, APIs: 1, Instructions: 120
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00163E0B

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e71c06b8d01da2d9b1fa5f9489f71a6a325f1027e8d1682d195e916b76a1f532
Instruction ID: 5397fee7e2b920637bbddda1b32943dd6f83130f7f52fca8c039dd05e7acc12c
Opcode Fuzzy Hash: e71c06b8d01da2d9b1fa5f9489f71a6a325f1027e8d1682d195e916b76a1f532
Instruction Fuzzy Hash: 9E412372A10314DBD314AF20FC82BA13BB1F7A4710F524219E651E6DB5FB709AE1CB91

Function 001645A9 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00164699

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: bfd0829247956772bdd8471333a8a263eff98c5e69947d433bafc4494db83330
Instruction ID: 79393dc8eedb8d78068f854f1d3d96820b88099698812382f07167b77e973e2e
Opcode Fuzzy Hash: bfd0829247956772bdd8471333a8a263eff98c5e69947d433bafc4494db83330
Instruction Fuzzy Hash: D61104755502068BC714AF74FE894253BF0FB55346325452AE04696DB5EB3086E1CB82

Function 00142800 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00142842

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a6e9de3245b5161842192eea3b4aacc7f914e0cfb3f3aaf760300ecdab966f0a
Instruction ID: a07e79358fcdb384baf0eb726059429aa817269585d175b227b1520268001373
Opcode Fuzzy Hash: a6e9de3245b5161842192eea3b4aacc7f914e0cfb3f3aaf760300ecdab966f0a
Instruction Fuzzy Hash: 6FE08C78000209DBC328DF28E8D687A37B5AB84348394C11EE91A4BE70CB35E4C5CF81

Function 0014A4E0 Relevance: 1.3, APIs: 1, Instructions: 33
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 0014A4FE

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: cb5344382e32d7667f7ad6ad5330b9229be933540e370482a7f9664a0f35c812
Instruction ID: 1e7763b11c5200db3712b05806d599bd6850ffa4db8f98c1eab530ff360ec9b2
Opcode Fuzzy Hash: cb5344382e32d7667f7ad6ad5330b9229be933540e370482a7f9664a0f35c812
Instruction Fuzzy Hash: CAF0CD71600220EFC3025F21FD4D5663BB8FF893613840512E48A86974E77489E2DFD2

Non-executed Functions

Function 00150500 Relevance: 13.7, APIs: 9, Instructions: 170serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00150537
CreateServiceA.ADVAPI32(00000000,012532A8,012532A8,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00150596
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00150615
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0015062A
CloseServiceHandle.ADVAPI32(00000000), ref: 001506A7
OpenServiceA.ADVAPI32(00000000,012532A8,00000010), ref: 001506EB
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0015072D
CloseServiceHandle.ADVAPI32(00000000), ref: 0015073E
CloseServiceHandle.ADVAPI32(00000000), ref: 001507A8

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: b8b4f44c17c0bc74e276535aa552d30ab99f5524378763319dc805df7666e641
Instruction ID: ff063a97b803de87bef5ecaa9953c4dd416f2eb688c892f462b62d6c0cfe8f4a
Opcode Fuzzy Hash: b8b4f44c17c0bc74e276535aa552d30ab99f5524378763319dc805df7666e641
Instruction Fuzzy Hash: 4D610131A01314EFD3069F60FC8AB253FB4FB88B11F518605E842AAEB4E77496E5CB45

Function 0014AF20 Relevance: 7.9, APIs: 5, Instructions: 385serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0014B0AA
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 0014B15A
GetLastError.KERNEL32 ref: 0014B17A
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 0014B216
CloseServiceHandle.ADVAPI32(00000000), ref: 0014B41C

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: 331cf4f33daa062ab1d3b483cf07c2dfc8ec10dad8647be868cd077e006811b0
Instruction ID: a0f2b06d3ada50d015d75a2ad3a634f7f9534579d36afb4ae1e502eb1c4fd254
Opcode Fuzzy Hash: 331cf4f33daa062ab1d3b483cf07c2dfc8ec10dad8647be868cd077e006811b0
Instruction Fuzzy Hash: 42F143B2A05201EFC304DF64FCC9A6A3BB1FB94350B15421AE54697EB5E730DAE4CB81

Function 00169580 Relevance: 7.7, APIs: 5, Instructions: 220filesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,00000001), ref: 00169679
FindFirstFileA.KERNEL32(?,?), ref: 001697B8
DeleteFileA.KERNEL32(?), ref: 001698A9
FindNextFileA.KERNEL32(00000000,?), ref: 001698CB
FindClose.KERNEL32(00000000), ref: 001698E4

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: 4cedb6e00ea1a001223a52bf3e07025e40a3e96bfd2fc7d6ed234a5740a58e8b
Instruction ID: 4b7ec12d77ae79b803ec06132f6e0ec141d2224b252409d7c9888dc2bb5e892e
Opcode Fuzzy Hash: 4cedb6e00ea1a001223a52bf3e07025e40a3e96bfd2fc7d6ed234a5740a58e8b
Instruction Fuzzy Hash: B3914375901205DFC714DF34FC86AA53BB9FB98704B40861AE94687E70EB348AE1CF91

Function 00156C10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 187registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(012532A8,Function_00011860), ref: 00156D72
SetServiceStatus.ADVAPI32(00000000,001B05F8), ref: 00156DD5
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00156DE9
SetServiceStatus.ADVAPI32(00000000,001B05F8), ref: 00156E8A
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00156EBE
SetServiceStatus.ADVAPI32(00000000,001B05F8), ref: 00156F2B
CloseHandle.KERNEL32(00000000), ref: 00156F42
SetServiceStatus.ADVAPI32(00000000,001B05F8), ref: 00156FAA

Strings

=ZMI, xrefs: 00156D10

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID: =ZMI
API String ID: 3399922960-150576250
Opcode ID: a205d31f3086a2e8d2777c3a776bb635b6cd40c20c3db5d3f5931fbdff293a38
Instruction ID: 5a1c3a6e04a96dff3e1d90b3f17175ac5cad2d66a39274963f12cd4536c4cc8c
Opcode Fuzzy Hash: a205d31f3086a2e8d2777c3a776bb635b6cd40c20c3db5d3f5931fbdff293a38
Instruction Fuzzy Hash: 5E91DBB1901301CFC306DF28FD8A9663FB4FB88715781821AE49586EB4E73885E5CF85

Function 00154380 Relevance: 10.9, APIs: 7, Instructions: 387processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001544A7
Process32First.KERNEL32(00000000,?), ref: 001545C2
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 001547CE
Module32First.KERNEL32(00000000,00000224), ref: 00154842
CloseHandle.KERNEL32(00000000,0000000A), ref: 0015495A
Process32Next.KERNEL32(?,00000128), ref: 001549AD
CloseHandle.KERNEL32(00000000), ref: 00154A20

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: c2d4bd66a5cd0989c8173c72a25ea1fd3aed0103977415bf54743e44424b37d3
Instruction ID: b7f0551deb72147bec76d60c7128754b5d8e8aecf9e3f1e2f017552fc06afc34
Opcode Fuzzy Hash: c2d4bd66a5cd0989c8173c72a25ea1fd3aed0103977415bf54743e44424b37d3
Instruction Fuzzy Hash: 55F16771A00601DFD304CF25FC89A753BB5FB88315B51825AE84A87EB4EB748AE9CF51

Function 0014CA40 Relevance: 10.8, APIs: 7, Instructions: 345fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,00000003,00000000,00000000), ref: 0014CB20
ReadFile.KERNEL32(00000000,?,?,?,00000000), ref: 0014CB5D
CloseHandle.KERNEL32(00000000), ref: 0014CBBD
GetTickCount.KERNEL32 ref: 0014CC1D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0014CED4
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0014CF0E
CloseHandle.KERNEL32(00000000), ref: 0014CF47

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID:
API String ID: 3478262135-0
Opcode ID: f5b99e6a369382524b0f43eccf478a10086ac918bd0f362fcceb32a3a7009806
Instruction ID: 22b809317a1e8f4ceabd0f7e90db9fa3d01592c38e56970ef6dbfb3cb24e9e0a
Opcode Fuzzy Hash: f5b99e6a369382524b0f43eccf478a10086ac918bd0f362fcceb32a3a7009806
Instruction Fuzzy Hash: 54E14671A01200EFD304EF24FD89A693BB5FB94710F11421AE9569BEF4EB308AD5CB95

Function 0014BBC0 Relevance: 10.7, APIs: 7, Instructions: 205processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0014BC90
Process32First.KERNEL32(00000000,?), ref: 0014BCE3
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0014BDDD

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: 090026f7b67d7041bf3c12b2170c76f33d7a6ed27cb2576847ce17b7965815de
Instruction ID: 7a2530460fd01909547851a5077a9f467e3d0dd6411ff288c9576712f78708c7
Opcode Fuzzy Hash: 090026f7b67d7041bf3c12b2170c76f33d7a6ed27cb2576847ce17b7965815de
Instruction Fuzzy Hash: B891FE75A04215DFC704DF24FCD6AAA3BB5FB98314B05815AE40693EB4EB349AD4CB40

Function 00151530 Relevance: 9.2, APIs: 6, Instructions: 176filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 001515C3
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0015168A
CloseHandle.KERNEL32(00000000), ref: 001516A7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00151715
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00151774
CloseHandle.KERNEL32(00000000), ref: 00151792

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: c790db70c0ad818271181fe7d940470d40b1c58603dba8fb8f25ca032381e17d
Instruction ID: 7cea0b3704c3af19e84f17581c6bd26a002671af38bbf90a46284e20a9b8cb3f
Opcode Fuzzy Hash: c790db70c0ad818271181fe7d940470d40b1c58603dba8fb8f25ca032381e17d
Instruction Fuzzy Hash: 24712031A01304EFC701DFA9FC85A757BB4FB88710B61465AE44592EB4E77489E4CF81

Function 0014BD08 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0014BDDD
TerminateProcess.KERNEL32(00000000,000000FF), ref: 0014BE24
CloseHandle.KERNEL32(00000000), ref: 0014BE68
Process32Next.KERNEL32(00000000,00000128), ref: 0014BF01
CloseHandle.KERNEL32(00000000), ref: 0014BF2F

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseHandleProcess$NextOpenProcess32Terminate
String ID:
API String ID: 3173823348-0
Opcode ID: 39eac9d5adceefb8c15550e11d1bcf67db098d1d40c4cd8446dce11c0c6a71ee
Instruction ID: ccb021a07620769e6defeb3c3bf0685f2b768490c4ec524bc0fb80500a692929
Opcode Fuzzy Hash: 39eac9d5adceefb8c15550e11d1bcf67db098d1d40c4cd8446dce11c0c6a71ee
Instruction Fuzzy Hash: FD51FE75A01315DFC708DF24FCD5AAA3BF5FB98329B05825AE50597AB0EB348AD0CB40

Function 00175440 Relevance: 7.6, APIs: 5, Instructions: 71synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,0015E92E,0015CA40,00000000,?), ref: 001754B2
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 001754E4
CloseHandle.KERNEL32(00000000,?,0015E92E,0015CA40,00000000,?), ref: 0017551D
WaitForSingleObject.KERNEL32(?,000000FF,?,0015E92E,0015CA40,00000000,?), ref: 00175538
CloseHandle.KERNEL32(?,?,000000FF,?,0015E92E,0015CA40,00000000,?), ref: 0017554B

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 74c2ad7216397147a5393ea55bd6ad1447b18c4dd5cf088603c679d8f1950da1
Instruction ID: 694a498d2173d1225c7d47ecbbef0716c760df5f3367694ff5c9aa56facf8e8f
Opcode Fuzzy Hash: 74c2ad7216397147a5393ea55bd6ad1447b18c4dd5cf088603c679d8f1950da1
Instruction Fuzzy Hash: ED318931601305EBD3289F64FC89B227BB6FB48711F50821AE5469BEB0E77086D0CB91

Function 0016FA80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,0015ED48,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 0016FBF1
CloseHandle.KERNEL32(0015ED48,?,?,?,?,?,00000000), ref: 0016FC2F
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 0016FC58

Strings

D, xrefs: 0016FB8F

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 9542ac12595cab16621c469d33f1d8401552a73f37da0d947711aa3d00ecbda6
Instruction ID: b5e36886409db179b7c7625acc9b4959b6bec182829420ef1e314270b64b7669
Opcode Fuzzy Hash: 9542ac12595cab16621c469d33f1d8401552a73f37da0d947711aa3d00ecbda6
Instruction Fuzzy Hash: BA51EA31950218DBD704DF64FC86BB63BF8FB48B11F40021AE04696EB4EBB496E4CB95

Function 0014D000 Relevance: 6.3, APIs: 4, Instructions: 269fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0014D11A
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 0014D1CC
CloseHandle.KERNEL32(00000000,?,00000000), ref: 0014D3EE
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 0014D2E9

Part of subcall function 0016FCC0: ReleaseMutex.KERNEL32(0014D410,?,0014D410,00000108), ref: 0016FCE9

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CloseFileHandle$CreateMutexReadRelease
String ID:
API String ID: 1760212717-0
Opcode ID: 72af997ed25fe048fd48a17c9fea360f5ddf1f87d2654848f55dde944fd5d7c8
Instruction ID: b53dfed79cce73865776e9820254b5fbdbd8f5860e03451f709f7cc4fa9efc8e
Opcode Fuzzy Hash: 72af997ed25fe048fd48a17c9fea360f5ddf1f87d2654848f55dde944fd5d7c8
Instruction Fuzzy Hash: 54B16A71A00600DBCB04AF64FC85B693BB5FBD8711F218156E54597EF1EB709AE4CB82

Function 00152120 Relevance: 6.2, APIs: 4, Instructions: 207processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001521D0
Process32First.KERNEL32(00000000,00000128), ref: 00152257
Process32Next.KERNEL32(00000000,00000128), ref: 00152384
CloseHandle.KERNEL32(00000000), ref: 00152426

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d09377855a9eda7c2e7454410b60b6d780d694d168c48a09e5e4403fa5e214ce
Instruction ID: 59af42ebffe2aa8119f653f5c99daec505b1ab9a5abd3c0c54f61812807c80c2
Opcode Fuzzy Hash: d09377855a9eda7c2e7454410b60b6d780d694d168c48a09e5e4403fa5e214ce
Instruction Fuzzy Hash: 95913372A00314CFC305DF25FC89AA53BB4FBA9310F15820AD84296EB4EB7486E9CF51

Function 001568D0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,001503A9,00000000,?), ref: 00156957
RtlReAllocateHeap.NTDLL(00000000,?,001503A9,00000000), ref: 0015695E
GetProcessHeap.KERNEL32(00000000,?,?,001503A9,00000000,?), ref: 001569C8
HeapAlloc.KERNEL32(00000000,?,001503A9,00000000,?), ref: 001569CF

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 0854f8f39c79355000b5cca1c97547dff543017d721ebea2f690d2947a5c11b6
Instruction ID: 5fe13a9a5083639da10640ce7b551ac2f636f8185c7407b44799b024cbd98ca6
Opcode Fuzzy Hash: 0854f8f39c79355000b5cca1c97547dff543017d721ebea2f690d2947a5c11b6
Instruction Fuzzy Hash: ED21AEB2605204DFD7049F61FE8A9503F78F785310B624619E98693DB4E73199E1CF90

Function 00160FD8 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 409COMMON

Download Yara Rule

Strings

/, xrefs: 0016100F
XH, xrefs: 0016153C

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID:
String ID: XH$/
API String ID: 0-571299465
Opcode ID: b4656a4c5f8482031727f7f7eaad5f1f04ca7793e41cb5cc8ead07e1821537b5
Instruction ID: ef8cb2bfebd598330e323af41355f5a4dbc948586ff720e8fd952b287562e22a
Opcode Fuzzy Hash: b4656a4c5f8482031727f7f7eaad5f1f04ca7793e41cb5cc8ead07e1821537b5
Instruction Fuzzy Hash: 11F11371A00215DFD714EF60FC92ABA3BB9FB64300F54826AE40A579B1EB708AD4CF50

Function 001750E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0016247D,00000001,?,?,0016247D), ref: 0017518C
GetTickCount.KERNEL32 ref: 001752BE

Strings

@AB , xrefs: 001752CD

Memory Dump Source

Source File: 00000006.00000002.1324986509.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 00000006.00000002.1324959249.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325019042.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.000000000017E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.0000000000188000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325033920.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.1325150649.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CountSystemTickTime
String ID: @AB
API String ID: 2164215191-841575833
Opcode ID: 078d7c74786d9cd1011380062dce38b52bf8972c8095f24bab9c3b901f651bbe
Instruction ID: 82845a754f6ede21e7eb08de9a3fb57ff9c2689891cd13d6accb8e7c52fc6a73
Opcode Fuzzy Hash: 078d7c74786d9cd1011380062dce38b52bf8972c8095f24bab9c3b901f651bbe
Instruction Fuzzy Hash: 0451DE72A00A11CFC308DF69FD899253BB6F7987003464116E48AC7EB4EB748AE4CB85

Analysis Process: idtpqzltyfy.exePID: 7912, Parent PID: 7240COMMON

Executed Functions

Function 00160D80 Relevance: 25.7, APIs: 11, Strings: 3, Instructions: 1222COMMON

Download Yara Rule

Strings

XH, xrefs: 0016153C
U][v, xrefs: 00161ED5
/, xrefs: 0016100F

Memory Dump Source

Source File: 0000000B.00000002.2531980973.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 0000000B.00000002.2531909149.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532039542.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532323438.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000_idtpqzltyfy.jbxd

Similarity

API ID:
String ID: XH$/$U][v
API String ID: 0-1996962770
Opcode ID: a457eeb441ef02acbbd4f9f617d531920dcb212b0b411580e480863b52f9d365
Instruction ID: 90313c74ff47ac2c4b629f26429c197e08e3fbfd281e0d3b7a6a192a629c6b15
Opcode Fuzzy Hash: a457eeb441ef02acbbd4f9f617d531920dcb212b0b411580e480863b52f9d365
Instruction Fuzzy Hash: C4B25671A00204DFD709EF64FC95AB93BB5FBA4300B55425AE44697EB4EB308AE5CF81

Function 0015A930 Relevance: 25.3, APIs: 13, Strings: 1, Instructions: 829
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0015AACC

Strings

#~\, xrefs: 0015B319

Memory Dump Source

Source File: 0000000B.00000002.2531980973.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 0000000B.00000002.2531909149.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532039542.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532323438.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: HeapProcess
String ID: #~\
API String ID: 54951025-95464956
Opcode ID: 78b4514fca032ac38f2048c54f6be1c7d5ae35206958cb6b6a394fc72ff63e13
Instruction ID: f5e059731d034deb7662b2b573f59cf7ee5e479a09cbcd0b11f0d708ed3ccc74
Opcode Fuzzy Hash: 78b4514fca032ac38f2048c54f6be1c7d5ae35206958cb6b6a394fc72ff63e13
Instruction Fuzzy Hash: 58720E76A04205CFC304DF65FC866A53BF5FB98312B51421AE845DBEB0EB708AE5CB91

Function 00169580 Relevance: 7.7, APIs: 5, Instructions: 220
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8,00000001), ref: 00169679
FindFirstFileA.KERNELBASE(?,?), ref: 001697B8
DeleteFileA.KERNELBASE(?), ref: 001698A9
FindNextFileA.KERNELBASE(00000000,?), ref: 001698CB
FindClose.KERNEL32(00000000), ref: 001698E4

Memory Dump Source

Source File: 0000000B.00000002.2531980973.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 0000000B.00000002.2531909149.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532039542.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532323438.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: c949ea3f2e6a2350f6bf94a409c1f545a5a5e425c8513c22f02f1df68cce28f4
Instruction ID: 4b7ec12d77ae79b803ec06132f6e0ec141d2224b252409d7c9888dc2bb5e892e
Opcode Fuzzy Hash: c949ea3f2e6a2350f6bf94a409c1f545a5a5e425c8513c22f02f1df68cce28f4
Instruction Fuzzy Hash: B3914375901205DFC714DF34FC86AA53BB9FB98704B40861AE94687E70EB348AE1CF91

Function 00150920 Relevance: 4.8, APIs: 3, Instructions: 254
libraryloaderencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76850000,00000000), ref: 00150A8A
GetProcAddress.KERNEL32(76850000,00000000), ref: 00150B05
CryptGenRandom.ADVAPI32(00000000,00000004,00000000,00000000), ref: 00150C10

Memory Dump Source

Source File: 0000000B.00000002.2531980973.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 0000000B.00000002.2531909149.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532039542.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532323438.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: AddressProc$CryptRandom
String ID:
API String ID: 646182245-0
Opcode ID: 1e3089d542ef6e99337a3c23b6dd01c75f5a8e89c589ef8a6d3e53cd1a5e9817
Instruction ID: 9a44081cad21fa68937cdfac915acb2760fe07f4e57f5f8e993902d14031d0fe
Opcode Fuzzy Hash: 1e3089d542ef6e99337a3c23b6dd01c75f5a8e89c589ef8a6d3e53cd1a5e9817
Instruction Fuzzy Hash: 2AB176B2A00315DBC315DFA9FC85A253BB4FB58715B01422EE8569BEB8E33089D5CF85

Function 00152120 Relevance: 6.2, APIs: 4, Instructions: 207
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001521D0
Process32First.KERNEL32(00000000,00000128), ref: 00152257
Process32Next.KERNEL32(00000000,00000128), ref: 00152384
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00152426

Memory Dump Source

Source File: 0000000B.00000002.2531980973.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 0000000B.00000002.2531909149.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532039542.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532323438.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: df6481a2fc8bef7960ef4df4ab32a0a47e318a250fa21f99609356e2b18cc9b3
Instruction ID: 59af42ebffe2aa8119f653f5c99daec505b1ab9a5abd3c0c54f61812807c80c2
Opcode Fuzzy Hash: df6481a2fc8bef7960ef4df4ab32a0a47e318a250fa21f99609356e2b18cc9b3
Instruction Fuzzy Hash: 95913372A00314CFC305DF25FC89AA53BB4FBA9310F15820AD84296EB4EB7486E9CF51

Function 00151D90 Relevance: 4.7, APIs: 3, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00163110: WaitForSingleObject.KERNEL32(00000708,00004E20,?,00150A18,00000114,00000000,00000000,?,0015126B,?,001625B4,?,00000708,00000000), ref: 001631AD

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,-0000004B,00000009), ref: 00151E7B

Part of subcall function 0016FCC0: ReleaseMutex.KERNEL32(00150D8E,?,00150D8E,00000114,00000000), ref: 0016FCE9

Memory Dump Source

Source File: 0000000B.00000002.2531980973.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 0000000B.00000002.2531909149.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532039542.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532323438.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CreateFileMutexObjectReleaseSingleWait
String ID:
API String ID: 1564016613-0
Opcode ID: 37c28564cba5a741b0206745fee1ea3b11a0d511c04560e6312677a5e70a4794
Instruction ID: 4c38f319b3cbb9f489e097b241f6d020158641a4adba2a40a042d69e04128246
Opcode Fuzzy Hash: 37c28564cba5a741b0206745fee1ea3b11a0d511c04560e6312677a5e70a4794
Instruction Fuzzy Hash: 7D71F472611204DFC304DF64FC89A6A3BB9FB98315F418259E80697EB4DB709AE5CF81

Function 00163CF0 Relevance: 1.6, APIs: 1, Instructions: 120
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00163E0B

Memory Dump Source

Source File: 0000000B.00000002.2531980973.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 0000000B.00000002.2531909149.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532039542.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532323438.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6067148dacfaaca10ff7886e7f0ae1bcb1f024ef822556e2d9005961edea5d71
Instruction ID: 5397fee7e2b920637bbddda1b32943dd6f83130f7f52fca8c039dd05e7acc12c
Opcode Fuzzy Hash: 6067148dacfaaca10ff7886e7f0ae1bcb1f024ef822556e2d9005961edea5d71
Instruction Fuzzy Hash: 9E412372A10314DBD314AF20FC82BA13BB1F7A4710F524219E651E6DB5FB709AE1CB91

Function 0014A4E0 Relevance: 1.3, APIs: 1, Instructions: 33stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00152325,00000000,?,00152325,?), ref: 0014A4FE

Memory Dump Source

Source File: 0000000B.00000002.2531980973.0000000000141000.00000020.00000001.01000000.00000005.sdmp, Offset: 00140000, based on PE: true

Associated: 0000000B.00000002.2531909149.0000000000140000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532039542.0000000000177000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.000000000017C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001B9000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532083179.00000000001CA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2532323438.00000000001CB000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_140000_idtpqzltyfy.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: cb5344382e32d7667f7ad6ad5330b9229be933540e370482a7f9664a0f35c812
Instruction ID: 1e7763b11c5200db3712b05806d599bd6850ffa4db8f98c1eab530ff360ec9b2
Opcode Fuzzy Hash: cb5344382e32d7667f7ad6ad5330b9229be933540e370482a7f9664a0f35c812
Instruction Fuzzy Hash: CAF0CD71600220EFC3025F21FD4D5663BB8FF893613840512E48A86974E77489E2DFD2

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mtuXDnH1Di.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\whfkpbh\euwvjohdxkkj

C:\whfkpbh\amdrhfskpcu.exe

C:\whfkpbh\euwvjohdxkkj

C:\whfkpbh\idtpqzltyfy.exe

C:\whfkpbh\qbf30bzbv7f7qnhdav.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
mtuXDnH1Di.exe

Function 00ED5200 Relevance: 30.9, APIs: 12, Strings: 5, Instructions: 1106
fileCOMMON

Function 00EE9580 Relevance: 7.7, APIs: 5, Instructions: 220
filesleepCOMMON

Function 00ECB7A0 Relevance: 3.1, APIs: 2, Instructions: 89
memoryCOMMON

Function 00ECE2C0 Relevance: 3.0, APIs: 2, Instructions: 19
memoryCOMMON

Function 00ECCA40 Relevance: 10.8, APIs: 7, Instructions: 345
fileCOMMON

Function 00EEFA80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 133
processCOMMON

Function 00ED1D90 Relevance: 4.7, APIs: 3, Instructions: 187
fileCOMMON

Function 00ED2EB0 Relevance: 3.0, APIs: 2, Instructions: 40
memoryCOMMON

Function 00EE45A9 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 00EC2800 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Function 00ECA4E0 Relevance: 1.3, APIs: 1, Instructions: 33
stringCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre