Edit tour

Windows Analysis Report
7qBBKk0P4l.exe

Overview

General Information

Sample name:	7qBBKk0P4l.exe renamed because original name is a hash value
Original sample name:	3397920e23cf8435201e9e90796b2a8c9ec340e4733cbc8064999e462dc53470.exe
Analysis ID:	1488122
MD5:	94e7772b2b1bda89b23a2fba0e57742e
SHA1:	2af48b80b7354b4a15eff49af3f3d70d3e5789a4
SHA256:	3397920e23cf8435201e9e90796b2a8c9ec340e4733cbc8064999e462dc53470
Tags:	exe
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to resolve many domain names, but no domain seems valid

Connects to many different domains

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Executes massive DNS lookups (> 100)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7qBBKk0P4l.exe (PID: 1824 cmdline: "C:\Users\user\Desktop\7qBBKk0P4l.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

psjpq2i82ktsjq0yguk.exe (PID: 6892 cmdline: "C:\hjflhukc\psjpq2i82ktsjq0yguk.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

yanidfx.exe (PID: 4136 cmdline: "C:\hjflhukc\yanidfx.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

yanidfx.exe (PID: 2768 cmdline: C:\hjflhukc\yanidfx.exe MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

xxxniijvj.exe (PID: 3552 cmdline: tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

yanidfx.exe (PID: 3392 cmdline: "c:\hjflhukc\yanidfx.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

xxxniijvj.exe (PID: 764 cmdline: tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe" MD5: 94E7772B2B1BDA89B23A2FBA0E57742E)

svchost.exe (PID: 3964 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 3964, ProcessName: svchost.exe

Snort Signatures

Suricata Signatures

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 35.164.78.200

Timestamp:	2024-08-05T16:29:15.427900+0200
SID:	2815568
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 15.197.192.55

Timestamp:	2024-08-05T16:29:21.526506+0200
SID:	2815568
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 170.187.200.48

Timestamp:	2024-08-05T16:29:28.585913+0200
SID:	2815568
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) - Source IP: 1.1.1.1 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:29:11.586178+0200
SID:	2811542
Source Port:	53
Destination Port:	56919
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 3.33.130.190

Timestamp:	2024-08-05T16:29:12.540506+0200
SID:	2815568
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 35.164.78.200 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:29:15.432885+0200
SID:	2037771
Source Port:	80
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 34.246.200.160 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:29:17.836857+0200
SID:	2037771
Source Port:	80
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 54.244.188.177 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:29:31.727756+0200
SID:	2037771
Source Port:	80
Destination Port:	49719
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 35.164.78.200

Timestamp:	2024-08-05T16:31:09.914916+0200
SID:	2815568
Source Port:	60229
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort - Source IP: 192.168.2.8 - Destination IP: 3.33.130.190

Timestamp:	2024-08-05T16:30:40.325809+0200
SID:	2815568
Source Port:	60228
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses - Source IP: 1.1.1.1 - Destination IP: 192.168.2.8

Timestamp:	2024-08-05T16:29:18.843079+0200
SID:	2018316
Source Port:	53
Destination Port:	54266
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7qBBKk0P4l.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\hjflhukc\xxxniijvj.exe	Avira: detection malicious, Label: HEUR/AGEN.1318579
Source: C:\hjflhukc\yanidfx.exe	Avira: detection malicious, Label: HEUR/AGEN.1318579
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Avira: detection malicious, Label: HEUR/AGEN.1318579

Multi AV Scanner detection for dropped file

Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	ReversingLabs: Detection: 92%
Source: C:\hjflhukc\xxxniijvj.exe	ReversingLabs: Detection: 92%
Source: C:\hjflhukc\yanidfx.exe	ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: 7qBBKk0P4l.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\hjflhukc\xxxniijvj.exe	Joe Sandbox ML: detected
Source: C:\hjflhukc\yanidfx.exe	Joe Sandbox ML: detected
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7qBBKk0P4l.exe

Joe Sandbox ML: detected

Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0092BECE GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,	2_2_0092BECE
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0093AE3B CryptAcquireContextA,	2_2_0093AE3B
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006EBECE GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,	3_2_006EBECE
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006FAE3B CryptAcquireContextA,	3_2_006FAE3B

Source: 7qBBKk0P4l.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000C5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_000C5C39
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00925C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00925C39
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006E5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_006E5C39
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000E5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_000E5C39
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E25C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_00E25C39

Networking

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: smokesystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadylaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadybranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womannorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadysystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemansystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencequarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencereceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokegeneral.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokequarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experienceconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summersystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partysystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partybranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencefriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightnorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightinclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightgeneral.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experienceneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadytrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fighttrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokebelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencebelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencebranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokenorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokehonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womantrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: watertrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokeneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadybelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencesystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knowntrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokereceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyinclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summertrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partytrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fighthonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: begintrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokeclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughtneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smoketrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemantrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partynorth.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womangeneral.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokeinclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followfancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followtrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womaninclude.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followconsider.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: waterhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencetrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughttrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: knownsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womanclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thoughthonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightclear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginsystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fightbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencelaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencehonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshtrust.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: experiencefancy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberfriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanfriend.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: freshbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: womansystem.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: followquarter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smokebranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanreceive.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyneither.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: beginbranch.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: memberhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: summerbelieve.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alreadyhonor.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanlaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: partyneither.net replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 170

Source: global traffic

DNS traffic detected: number of DNS queries: 170

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtbranch.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanbelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partybelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membertrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: crowdtrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtsystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: watersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanhonor.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: freshfancy.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: alreadyfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: followfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net

Source: Joe Sandbox View	IP Address: 188.225.40.227 188.225.40.227
Source: Joe Sandbox View	IP Address: 34.246.200.160 34.246.200.160

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000D8695 socket,setsockopt,gethostbyname,inet_ntoa,inet_addr,htons,connect,send,recv,closesocket,

1_2_000D8695

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtbranch.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanbelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partybelieve.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: membertrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: crowdtrust.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: thoughtsystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: watersystem.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: womanhonor.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: freshfancy.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: alreadyfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: followfriend.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: partygeneral.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: memberreceive.net

Source: global traffic	DNS traffic detected: DNS query: womanclear.net
Source: global traffic	DNS traffic detected: DNS query: smokeclear.net
Source: global traffic	DNS traffic detected: DNS query: womangeneral.net
Source: global traffic	DNS traffic detected: DNS query: smokegeneral.net
Source: global traffic	DNS traffic detected: DNS query: womaninclude.net
Source: global traffic	DNS traffic detected: DNS query: smokeinclude.net
Source: global traffic	DNS traffic detected: DNS query: womannorth.net
Source: global traffic	DNS traffic detected: DNS query: smokenorth.net
Source: global traffic	DNS traffic detected: DNS query: partyclear.net
Source: global traffic	DNS traffic detected: DNS query: fightclear.net
Source: global traffic	DNS traffic detected: DNS query: partygeneral.net
Source: global traffic	DNS traffic detected: DNS query: fightgeneral.net
Source: global traffic	DNS traffic detected: DNS query: partyinclude.net
Source: global traffic	DNS traffic detected: DNS query: fightinclude.net
Source: global traffic	DNS traffic detected: DNS query: partynorth.net
Source: global traffic	DNS traffic detected: DNS query: fightnorth.net
Source: global traffic	DNS traffic detected: DNS query: freshbranch.net
Source: global traffic	DNS traffic detected: DNS query: experiencebranch.net
Source: global traffic	DNS traffic detected: DNS query: freshbelieve.net
Source: global traffic	DNS traffic detected: DNS query: experiencebelieve.net
Source: global traffic	DNS traffic detected: DNS query: freshreceive.net
Source: global traffic	DNS traffic detected: DNS query: experiencereceive.net
Source: global traffic	DNS traffic detected: DNS query: freshquarter.net
Source: global traffic	DNS traffic detected: DNS query: experiencequarter.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanbranch.net
Source: global traffic	DNS traffic detected: DNS query: alreadybranch.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanbelieve.net
Source: global traffic	DNS traffic detected: DNS query: alreadybelieve.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanreceive.net
Source: global traffic	DNS traffic detected: DNS query: alreadyreceive.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanquarter.net
Source: global traffic	DNS traffic detected: DNS query: alreadyquarter.net
Source: global traffic	DNS traffic detected: DNS query: followbranch.net
Source: global traffic	DNS traffic detected: DNS query: memberbranch.net
Source: global traffic	DNS traffic detected: DNS query: followbelieve.net
Source: global traffic	DNS traffic detected: DNS query: memberbelieve.net
Source: global traffic	DNS traffic detected: DNS query: followreceive.net
Source: global traffic	DNS traffic detected: DNS query: memberreceive.net
Source: global traffic	DNS traffic detected: DNS query: followquarter.net
Source: global traffic	DNS traffic detected: DNS query: memberquarter.net
Source: global traffic	DNS traffic detected: DNS query: beginbranch.net
Source: global traffic	DNS traffic detected: DNS query: knownbranch.net
Source: global traffic	DNS traffic detected: DNS query: beginbelieve.net
Source: global traffic	DNS traffic detected: DNS query: knownbelieve.net
Source: global traffic	DNS traffic detected: DNS query: beginreceive.net
Source: global traffic	DNS traffic detected: DNS query: knownreceive.net
Source: global traffic	DNS traffic detected: DNS query: beginquarter.net
Source: global traffic	DNS traffic detected: DNS query: knownquarter.net
Source: global traffic	DNS traffic detected: DNS query: summerbranch.net
Source: global traffic	DNS traffic detected: DNS query: crowdbranch.net
Source: global traffic	DNS traffic detected: DNS query: summerbelieve.net
Source: global traffic	DNS traffic detected: DNS query: crowdbelieve.net
Source: global traffic	DNS traffic detected: DNS query: summerreceive.net
Source: global traffic	DNS traffic detected: DNS query: crowdreceive.net
Source: global traffic	DNS traffic detected: DNS query: summerquarter.net
Source: global traffic	DNS traffic detected: DNS query: crowdquarter.net
Source: global traffic	DNS traffic detected: DNS query: thoughtbranch.net
Source: global traffic	DNS traffic detected: DNS query: waterbranch.net
Source: global traffic	DNS traffic detected: DNS query: thoughtbelieve.net
Source: global traffic	DNS traffic detected: DNS query: waterbelieve.net
Source: global traffic	DNS traffic detected: DNS query: thoughtreceive.net
Source: global traffic	DNS traffic detected: DNS query: waterreceive.net
Source: global traffic	DNS traffic detected: DNS query: thoughtquarter.net
Source: global traffic	DNS traffic detected: DNS query: waterquarter.net
Source: global traffic	DNS traffic detected: DNS query: womanbranch.net
Source: global traffic	DNS traffic detected: DNS query: smokebranch.net
Source: global traffic	DNS traffic detected: DNS query: womanbelieve.net
Source: global traffic	DNS traffic detected: DNS query: smokebelieve.net
Source: global traffic	DNS traffic detected: DNS query: womanreceive.net
Source: global traffic	DNS traffic detected: DNS query: smokereceive.net
Source: global traffic	DNS traffic detected: DNS query: womanquarter.net
Source: global traffic	DNS traffic detected: DNS query: smokequarter.net
Source: global traffic	DNS traffic detected: DNS query: partybranch.net
Source: global traffic	DNS traffic detected: DNS query: fightbranch.net
Source: global traffic	DNS traffic detected: DNS query: partybelieve.net
Source: global traffic	DNS traffic detected: DNS query: fightbelieve.net
Source: global traffic	DNS traffic detected: DNS query: partyreceive.net
Source: global traffic	DNS traffic detected: DNS query: fightreceive.net
Source: global traffic	DNS traffic detected: DNS query: partyquarter.net
Source: global traffic	DNS traffic detected: DNS query: fightquarter.net
Source: global traffic	DNS traffic detected: DNS query: freshhonor.net
Source: global traffic	DNS traffic detected: DNS query: experiencehonor.net
Source: global traffic	DNS traffic detected: DNS query: freshneither.net
Source: global traffic	DNS traffic detected: DNS query: experienceneither.net
Source: global traffic	DNS traffic detected: DNS query: freshsystem.net
Source: global traffic	DNS traffic detected: DNS query: experiencesystem.net
Source: global traffic	DNS traffic detected: DNS query: freshtrust.net
Source: global traffic	DNS traffic detected: DNS query: experiencetrust.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanhonor.net
Source: global traffic	DNS traffic detected: DNS query: alreadyhonor.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanneither.net
Source: global traffic	DNS traffic detected: DNS query: alreadyneither.net
Source: global traffic	DNS traffic detected: DNS query: gentlemansystem.net
Source: global traffic	DNS traffic detected: DNS query: alreadysystem.net
Source: global traffic	DNS traffic detected: DNS query: gentlemantrust.net
Source: global traffic	DNS traffic detected: DNS query: alreadytrust.net
Source: global traffic	DNS traffic detected: DNS query: followhonor.net
Source: global traffic	DNS traffic detected: DNS query: memberhonor.net
Source: global traffic	DNS traffic detected: DNS query: followneither.net
Source: global traffic	DNS traffic detected: DNS query: memberneither.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Mon, 05 Aug 2024 14:29:19 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 05 Aug 2024 14:29:28 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 14:29:34 GMTServer: Apache/2.4.61 (Unix)Content-Length: 196Content-Type: text/html; charset=iso-8859-1Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Source: yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fasthosts.co.uk/
Source: yanidfx.exe, 00000003.00000002.2246965678.000000000166D000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://followfriend.net/index.php
Source: yanidfx.exe, 00000003.00000002.2246965678.000000000166D000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_par
Source: yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fasthosts.co.uk/domain-names/search/?domain=$
Source: yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fasthosts.co.uk/get-online?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_
Source: yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-199510482-1

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	File created: C:\Windows\hjflhukc\	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	File created: C:\Windows\hjflhukc\hhziccmdjsti	Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

File deleted: C:\Windows\hjflhukc\hhziccmdjsti

Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000C88A8	1_2_000C88A8
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D111E	1_2_000D111E
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000DFF20	1_2_000DFF20
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000DA805	1_2_000DA805
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000E3025	1_2_000E3025
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000ED831	1_2_000ED831
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000C60AD	1_2_000C60AD
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000E84D7	1_2_000E84D7
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000E24D3	1_2_000E24D3
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D0CE6	1_2_000D0CE6
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D70E6	1_2_000D70E6
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000C9903	1_2_000C9903
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D0113	1_2_000D0113
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000CA928	1_2_000CA928
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000C69A8	1_2_000C69A8
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000C11B7	1_2_000C11B7
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000E7DC0	1_2_000E7DC0
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D1636	1_2_000D1636
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D8695	1_2_000D8695
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000C46CF	1_2_000C46CF
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000E5F1E	1_2_000E5F1E
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D571F	1_2_000D571F
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D9F24	1_2_000D9F24
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000C774C	1_2_000C774C
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D5FBA	1_2_000D5FBA
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000CCFBB	1_2_000CCFBB
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000EDFCC	1_2_000EDFCC
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000DB3DB	1_2_000DB3DB
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_009288A8	2_2_009288A8
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_009484D7	2_2_009484D7
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0093B3DB	2_2_0093B3DB
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0093FF2A	2_2_0093FF2A
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_009260AD	2_2_009260AD
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_009424D3	2_2_009424D3
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00930CE6	2_2_00930CE6
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_009370E6	2_2_009370E6
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0093A805	2_2_0093A805
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0094D831	2_2_0094D831
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00943025	2_2_00943025
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_009211B7	2_2_009211B7
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_009269A8	2_2_009269A8
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00947DC0	2_2_00947DC0
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00930113	2_2_00930113
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0093111E	2_2_0093111E
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00929903	2_2_00929903
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0092A928	2_2_0092A928
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00938695	2_2_00938695
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_009246CF	2_2_009246CF
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00931636	2_2_00931636
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00935FBA	2_2_00935FBA
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0092CFBB	2_2_0092CFBB
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0094DFCC	2_2_0094DFCC
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00945F1E	2_2_00945F1E
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0093571F	2_2_0093571F
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00939F24	2_2_00939F24
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_0092774C	2_2_0092774C
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007024D3	3_2_007024D3
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007084D7	3_2_007084D7
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006E88A8	3_2_006E88A8
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F8695	3_2_006F8695
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006FFF2A	3_2_006FFF2A
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F571F	3_2_006F571F
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006FB3DB	3_2_006FB3DB
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0070D831	3_2_0070D831
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00703025	3_2_00703025
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006FA805	3_2_006FA805
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F0CE6	3_2_006F0CE6
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F70E6	3_2_006F70E6
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006E60AD	3_2_006E60AD
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006EA928	3_2_006EA928
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006E9903	3_2_006E9903
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F111E	3_2_006F111E
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F0113	3_2_006F0113
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00707DC0	3_2_00707DC0
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006E69A8	3_2_006E69A8
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006E11B7	3_2_006E11B7
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F1636	3_2_006F1636
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006E46CF	3_2_006E46CF
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006E774C	3_2_006E774C
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F9F24	3_2_006F9F24
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_00705F1E	3_2_00705F1E
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_0070DFCC	3_2_0070DFCC
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006ECFBB	3_2_006ECFBB
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F5FBA	3_2_006F5FBA
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000E88A8	4_2_000E88A8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F571F	4_2_000F571F
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000FFF2A	4_2_000FFF2A
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000FA805	4_2_000FA805
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_0010D831	4_2_0010D831
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00103025	4_2_00103025
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000E60AD	4_2_000E60AD
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_001024D3	4_2_001024D3
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_001084D7	4_2_001084D7
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F0CE6	4_2_000F0CE6
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F70E6	4_2_000F70E6
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000E9903	4_2_000E9903
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F111E	4_2_000F111E
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F0113	4_2_000F0113
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000EA928	4_2_000EA928
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000E69A8	4_2_000E69A8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000E11B7	4_2_000E11B7
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00107DC0	4_2_00107DC0
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F1636	4_2_000F1636
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F8695	4_2_000F8695
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000E46CF	4_2_000E46CF
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_00105F1E	4_2_00105F1E
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F9F24	4_2_000F9F24
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000E774C	4_2_000E774C
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F5FBA	4_2_000F5FBA
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000ECFBB	4_2_000ECFBB
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000FB3DB	4_2_000FB3DB
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_0010DFCC	4_2_0010DFCC
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E288A8	11_2_00E288A8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E3FF25	11_2_00E3FF25
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E3571F	11_2_00E3571F
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E30CE6	11_2_00E30CE6
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E370E6	11_2_00E370E6
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E484D7	11_2_00E484D7
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E424D3	11_2_00E424D3
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E260AD	11_2_00E260AD
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E43025	11_2_00E43025
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E4D831	11_2_00E4D831
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E3A805	11_2_00E3A805
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E47DC0	11_2_00E47DC0
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E269A8	11_2_00E269A8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E211B7	11_2_00E211B7
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E2A928	11_2_00E2A928
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E29903	11_2_00E29903
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E30113	11_2_00E30113
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E3111E	11_2_00E3111E
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E246CF	11_2_00E246CF
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E38695	11_2_00E38695
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E31636	11_2_00E31636
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E4DFCC	11_2_00E4DFCC
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E3B3DB	11_2_00E3B3DB
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E35FBA	11_2_00E35FBA
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E2CFBB	11_2_00E2CFBB
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E2774C	11_2_00E2774C
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E39F24	11_2_00E39F24
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E45F1E	11_2_00E45F1E

Source: 7qBBKk0P4l.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7qBBKk0P4l.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: psjpq2i82ktsjq0yguk.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: yanidfx.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: xxxniijvj.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal88.troj.evad.winEXE@13/5@207/12

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	1_2_000E35AD
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	2_2_009435AD
Source: C:\hjflhukc\yanidfx.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	3_2_007035AD
Source: C:\hjflhukc\xxxniijvj.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	4_2_001035AD
Source: C:\hjflhukc\xxxniijvj.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	11_2_00E435AD

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000D0806 CreateToolhelp32Snapshot,Process32First,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

1_2_000D0806

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000E74E8 StartServiceCtrlDispatcherA,

1_2_000E74E8

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000E74E8 StartServiceCtrlDispatcherA,	1_2_000E74E8
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_009474E8 StartServiceCtrlDispatcherA,	2_2_009474E8
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_007074E8 StartServiceCtrlDispatcherA,	3_2_007074E8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_001074E8 StartServiceCtrlDispatcherA,	4_2_001074E8
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E474E8 StartServiceCtrlDispatcherA,	11_2_00E474E8

Source: C:\hjflhukc\xxxniijvj.exe

Mutant created: NULL

Source: 7qBBKk0P4l.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7qBBKk0P4l.exe

ReversingLabs: Detection: 92%

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

File read: C:\Users\user\Desktop\7qBBKk0P4l.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7qBBKk0P4l.exe "C:\Users\user\Desktop\7qBBKk0P4l.exe"
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Process created: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe "C:\hjflhukc\psjpq2i82ktsjq0yguk.exe"
Source: unknown	Process created: C:\hjflhukc\yanidfx.exe C:\hjflhukc\yanidfx.exe
Source: C:\hjflhukc\yanidfx.exe	Process created: C:\hjflhukc\xxxniijvj.exe tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Process created: C:\hjflhukc\yanidfx.exe "C:\hjflhukc\yanidfx.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\hjflhukc\xxxniijvj.exe	Process created: C:\hjflhukc\yanidfx.exe "c:\hjflhukc\yanidfx.exe"
Source: C:\hjflhukc\yanidfx.exe	Process created: C:\hjflhukc\xxxniijvj.exe tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Process created: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe "C:\hjflhukc\psjpq2i82ktsjq0yguk.exe"	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Process created: C:\hjflhukc\yanidfx.exe "C:\hjflhukc\yanidfx.exe"	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Process created: C:\hjflhukc\xxxniijvj.exe tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	Process created: C:\hjflhukc\yanidfx.exe "c:\hjflhukc\yanidfx.exe"	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Process created: C:\hjflhukc\xxxniijvj.exe tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000E84D7 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

1_2_000E84D7

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000D2C94 push edi; iretd	1_2_000D2C95
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00932C94 push edi; iretd	2_2_00932C95
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006F2C94 push edi; iretd	3_2_006F2C95
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000F2C94 push edi; iretd	4_2_000F2C95
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E32C94 push edi; iretd	11_2_00E32C95

Source: 7qBBKk0P4l.exe	Static PE information: section name: .text entropy: 6.839663016682375
Source: psjpq2i82ktsjq0yguk.exe.1.dr	Static PE information: section name: .text entropy: 6.839663016682375
Source: yanidfx.exe.2.dr	Static PE information: section name: .text entropy: 6.839663016682375
Source: xxxniijvj.exe.3.dr	Static PE information: section name: .text entropy: 6.839663016682375

Source: C:\hjflhukc\yanidfx.exe	File created: C:\hjflhukc\xxxniijvj.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	File created: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Jump to dropped file
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	File created: C:\hjflhukc\yanidfx.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000E74E8 StartServiceCtrlDispatcherA,

1_2_000E74E8

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000D3285 sldt cx

1_2_000D3285

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	1_2_000D9F24
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	2_2_00939F24
Source: C:\hjflhukc\yanidfx.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	3_2_006F9F24
Source: C:\hjflhukc\xxxniijvj.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	4_2_000F9F24
Source: C:\hjflhukc\xxxniijvj.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	11_2_00E39F24

Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		2_2_009484D7
Source: C:\hjflhukc\yanidfx.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		3_2_007084D7

Source: C:\hjflhukc\xxxniijvj.exe	Window / User API: threadDelayed 615	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe	Window / User API: threadDelayed 1260	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Window / User API: threadDelayed 370	Jump to behavior

Source: C:\hjflhukc\xxxniijvj.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_4-9413
Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_1-9411
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_2-8821

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_1-9041
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_2-8277
Source: C:\hjflhukc\xxxniijvj.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_4-8321
Source: C:\hjflhukc\yanidfx.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_3-8890

Source: C:\hjflhukc\yanidfx.exe TID: 5692	Thread sleep time: -31108s >= -30000s	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 4412	Thread sleep count: 615 > 30	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 4412	Thread sleep time: -615000s >= -30000s	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 4412	Thread sleep count: 1260 > 30	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 4412	Thread sleep time: -1260000s >= -30000s	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe TID: 1032	Thread sleep count: 370 > 30	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe TID: 1032	Thread sleep time: -18500000s >= -30000s	Jump to behavior
Source: C:\hjflhukc\yanidfx.exe TID: 1032	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 2668	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\hjflhukc\xxxniijvj.exe TID: 2668	Thread sleep time: -47000s >= -30000s	Jump to behavior

Source: C:\hjflhukc\yanidfx.exe	Last function: Thread delayed
Source: C:\hjflhukc\yanidfx.exe	Last function: Thread delayed
Source: C:\hjflhukc\xxxniijvj.exe	Last function: Thread delayed
Source: C:\hjflhukc\xxxniijvj.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	Code function: 1_2_000C5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_000C5C39
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	Code function: 2_2_00925C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00925C39
Source: C:\hjflhukc\yanidfx.exe	Code function: 3_2_006E5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_006E5C39
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 4_2_000E5C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_000E5C39
Source: C:\hjflhukc\xxxniijvj.exe	Code function: 11_2_00E25C39 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_00E25C39

Source: C:\hjflhukc\yanidfx.exe	Thread delayed: delay time: 50000			Jump to behavior
Source: C:\hjflhukc\yanidfx.exe	Thread delayed: delay time: 50000			Jump to behavior

Source: yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: yanidfx.exe, 0000000A.00000002.2721900414.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
Source: psjpq2i82ktsjq0yguk.exe, 00000002.00000002.1501380176.000000000165E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe	API call chain: ExitProcess graph end node	graph_1-8844
Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	API call chain: ExitProcess graph end node	graph_2-8491
Source: C:\hjflhukc\yanidfx.exe	API call chain: ExitProcess graph end node	graph_3-8592
Source: C:\hjflhukc\yanidfx.exe	API call chain: ExitProcess graph end node	graph_3-9198
Source: C:\hjflhukc\xxxniijvj.exe	API call chain: ExitProcess graph end node	graph_4-8837
Source: C:\hjflhukc\xxxniijvj.exe	API call chain: ExitProcess graph end node	graph_11-8535
Source: C:\hjflhukc\xxxniijvj.exe	API call chain: ExitProcess graph end node	graph_11-9099

Source: C:\hjflhukc\yanidfx.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000E84D7 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

1_2_000E84D7

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000CDE5A GetProcessHeap,RtlFreeHeap,

1_2_000CDE5A

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000CE769 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

1_2_000CE769

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000ED256 GetSystemTime,GetTickCount,

1_2_000ED256

Source: C:\Users\user\Desktop\7qBBKk0P4l.exe

Code function: 1_2_000C88A8 GetVersionExA,CreateDirectoryA,DeleteFileA,RemoveDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,GetTempPathA,CreateDirectoryA,GetTempPathA,SetFileAttributesA,

1_2_000C88A8

Source: C:\hjflhukc\psjpq2i82ktsjq0yguk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Service Execution	4 Windows Service	4 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Process Injection	21 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Service Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	4 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
7qBBKk0P4l.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
7qBBKk0P4l.exe	100%	Avira	HEUR/AGEN.1318579
7qBBKk0P4l.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\hjflhukc\xxxniijvj.exe	100%	Avira	HEUR/AGEN.1318579
C:\hjflhukc\yanidfx.exe	100%	Avira	HEUR/AGEN.1318579
C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	100%	Avira	HEUR/AGEN.1318579
C:\hjflhukc\xxxniijvj.exe	100%	Joe Sandbox ML
C:\hjflhukc\yanidfx.exe	100%	Joe Sandbox ML
C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	100%	Joe Sandbox ML
C:\hjflhukc\psjpq2i82ktsjq0yguk.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
C:\hjflhukc\xxxniijvj.exe	92%	ReversingLabs	Win32.Spyware.Nivdort
C:\hjflhukc\yanidfx.exe	92%	ReversingLabs	Win32.Spyware.Nivdort

Source	Detection	Scanner	Label
https://fasthosts.co.uk/	0%	Avira URL Cloud	safe
https://followfriend.net/index.php	0%	Avira URL Cloud	safe
https://www.fasthosts.co.uk/domain-names/search/?domain=$	0%	Avira URL Cloud	safe
https://www.fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_par	0%	Avira URL Cloud	safe
https://www.fasthosts.co.uk/get-online?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
crowdtrust.net	170.187.200.48	true	false	unknown
watersystem.net	64.190.63.222	true	false	unknown
thoughtsystem.net	213.171.195.105	true	false	unknown
membersystem.net	85.13.130.3	true	false	unknown
partygeneral.net	3.33.130.190	true	false	unknown
womanbelieve.net	15.197.142.173	true	false	unknown
womanhonor.net	54.244.188.177	true	false	unknown
membertrust.net	3.33.130.190	true	false	unknown
memberreceive.net	35.164.78.200	true	false	unknown
followfriend.net	188.225.40.227	true	false	unknown
partybelieve.net	15.197.192.55	true	false	unknown
freshfancy.net	81.169.145.88	true	false	unknown
alreadyfriend.net	15.197.192.55	true	false	unknown
thoughtbranch.net	34.246.200.160	true	false	unknown
beginhonor.net	unknown	unknown	true	unknown
memberlaughter.net	unknown	unknown	true	unknown
freshneither.net	unknown	unknown	true	unknown
thoughtneither.net	unknown	unknown	true	unknown
experiencefancy.net	unknown	unknown	true	unknown
followconsider.net	unknown	unknown	true	unknown
alreadyhonor.net	unknown	unknown	true	unknown
fighttrust.net	unknown	unknown	true	unknown
knownsystem.net	unknown	unknown	true	unknown
gentlemanhonor.net	unknown	unknown	true	unknown
memberfriend.net	unknown	unknown	true	unknown
freshtrust.net	unknown	unknown	true	unknown
experiencetrust.net	unknown	unknown	true	unknown
alreadybelieve.net	unknown	unknown	true	unknown
partyclear.net	unknown	unknown	true	unknown
waterquarter.net	unknown	unknown	true	unknown
fightbranch.net	unknown	unknown	true	unknown
knownlaughter.net	unknown	unknown	true	unknown
followtrust.net	unknown	unknown	true	unknown
experiencebelieve.net	unknown	unknown	true	unknown
summerhonor.net	unknown	unknown	true	unknown
thoughttrust.net	unknown	unknown	true	unknown
freshhonor.net	unknown	unknown	true	unknown
followfancy.net	unknown	unknown	true	unknown
freshfriend.net	unknown	unknown	true	unknown
freshconsider.net	unknown	unknown	true	unknown
summerquarter.net	unknown	unknown	true	unknown
gentlemantrust.net	unknown	unknown	true	unknown
fightinclude.net	unknown	unknown	true	unknown
gentlemanlaughter.net	unknown	unknown	true	unknown
memberbelieve.net	unknown	unknown	true	unknown
alreadylaughter.net	unknown	unknown	true	unknown
summerreceive.net	unknown	unknown	true	unknown
smokequarter.net	unknown	unknown	true	unknown
experiencesystem.net	unknown	unknown	true	unknown
thoughthonor.net	unknown	unknown	true	unknown
followbelieve.net	unknown	unknown	true	unknown
knowntrust.net	unknown	unknown	true	unknown
partybranch.net	unknown	unknown	true	unknown
crowdneither.net	unknown	unknown	true	unknown
womaninclude.net	unknown	unknown	true	unknown
smokebelieve.net	unknown	unknown	true	unknown
fightnorth.net	unknown	unknown	true	unknown
gentlemanneither.net	unknown	unknown	true	unknown
followquarter.net	unknown	unknown	true	unknown
knownhonor.net	unknown	unknown	true	unknown
womantrust.net	unknown	unknown	true	unknown
memberquarter.net	unknown	unknown	true	unknown
experiencefriend.net	unknown	unknown	true	unknown
waterbranch.net	unknown	unknown	true	unknown
smoketrust.net	unknown	unknown	true	unknown
gentlemanreceive.net	unknown	unknown	true	unknown
fightsystem.net	unknown	unknown	true	unknown
memberfancy.net	unknown	unknown	true	unknown
crowdhonor.net	unknown	unknown	true	unknown
summerbelieve.net	unknown	unknown	true	unknown
womanbranch.net	unknown	unknown	true	unknown
crowdbranch.net	unknown	unknown	true	unknown
beginbranch.net	unknown	unknown	true	unknown
experiencehonor.net	unknown	unknown	true	unknown
waterreceive.net	unknown	unknown	true	unknown
gentlemansystem.net	unknown	unknown	true	unknown
crowdsystem.net	unknown	unknown	true	unknown
knownbelieve.net	unknown	unknown	true	unknown
knownquarter.net	unknown	unknown	true	unknown
beginsystem.net	unknown	unknown	true	unknown
followsystem.net	unknown	unknown	true	unknown
crowdreceive.net	unknown	unknown	true	unknown
alreadyquarter.net	unknown	unknown	true	unknown
beginquarter.net	unknown	unknown	true	unknown
freshbelieve.net	unknown	unknown	true	unknown
alreadyconsider.net	unknown	unknown	true	unknown
alreadytrust.net	unknown	unknown	true	unknown
freshquarter.net	unknown	unknown	true	unknown
gentlemanfriend.net	unknown	unknown	true	unknown
beginbelieve.net	unknown	unknown	true	unknown
memberhonor.net	unknown	unknown	true	unknown
summersystem.net	unknown	unknown	true	unknown
partyquarter.net	unknown	unknown	true	unknown
alreadyfancy.net	unknown	unknown	true	unknown
fightneither.net	unknown	unknown	true	unknown
alreadybranch.net	unknown	unknown	true	unknown
partynorth.net	unknown	unknown	true	unknown
womangeneral.net	unknown	unknown	true	unknown
thoughtreceive.net	unknown	unknown	true	unknown
smokegeneral.net	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fasthosts.co.uk/	yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fasthosts.co.uk/domain-names/search/?domain=$	yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://followfriend.net/index.php	yanidfx.exe, 00000003.00000002.2246965678.000000000166D000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fasthosts.co.uk/get-online?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_	yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_par	yanidfx.exe, 00000003.00000002.2246965678.000000000166D000.00000004.00000010.00020000.00000000.sdmp, yanidfx.exe, 00000003.00000002.2246797634.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.13.130.3	membersystem.net	Germany	34788	NMM-ASD-02742FriedersdorfHauptstrasse68DE	false
188.225.40.227	followfriend.net	Russian Federation	9123	TIMEWEB-ASRU	false
34.246.200.160	thoughtbranch.net	United States	16509	AMAZON-02US	false
170.187.200.48	crowdtrust.net	United States	7018	ATT-INTERNET4US	false
35.164.78.200	memberreceive.net	United States	16509	AMAZON-02US	false
15.197.142.173	womanbelieve.net	United States	7430	TANDEMUS	false
54.244.188.177	womanhonor.net	United States	16509	AMAZON-02US	false
64.190.63.222	watersystem.net	United States	11696	NBS11696US	false
15.197.192.55	partybelieve.net	United States	7430	TANDEMUS	false
3.33.130.190	partygeneral.net	United States	8987	AMAZONEXPANSIONGB	false
213.171.195.105	thoughtsystem.net	United Kingdom	8560	ONEANDONE-ASBrauerstrasse48DE	false
81.169.145.88	freshfancy.net	Germany	6724	STRATOSTRATOAGDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488122
Start date and time:	2024-08-05 16:28:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7qBBKk0P4l.exe renamed because original name is a hash value
Original Sample Name:	3397920e23cf8435201e9e90796b2a8c9ec340e4733cbc8064999e462dc53470.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@13/5@207/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 71 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 7qBBKk0P4l.exe

Simulations

Behavior and APIs

Time	Type	Description
10:29:41	API Interceptor	1860x Sleep call for process: xxxniijvj.exe modified
10:30:26	API Interceptor	436x Sleep call for process: yanidfx.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.13.130.3	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	membersystem.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	membersystem.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	membersystem.net/index.php
188.225.40.227	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	followfriend.net/index.php
	BeR96suzTx.exe	Get hash	malicious	FormBook	Browse	www.skazhiraku.net/itq4/?ATvHA=k2MpXHpX2FlDSbL&m8=xx/ELnNnKvtlLUNVhX4h3nTX7+vGZrU3iKsqjiSQXnXFY1tr2Fuuzh2bLYvRiJP5MpAf
	Rh3zHXGC0W.exe	Get hash	malicious	FormBook	Browse	www.ikra-prem.space/g8kn/?3f=SObGRIQc2SXqBOlWxSNvpO1BE/+cxQu6skH9Iz/5ZN4shibJkSmH+F/+6dh/KvA+GdhZXNtYOg==&s2J=v6Ah24bh4tF
	doc88.exe	Get hash	malicious	FormBook	Browse	www.skazhiraku.net/itq4/?BJ=xx/ELnNnKvtlLUNVhX4h3nTX7+vGZrU3iKsqjiSQXnXFY1tr2Fuuzh2bLbPBtofBSMpY&k6Apv=4hB0VF
	p6le0wM39E.exe	Get hash	malicious	DCRat	Browse	cq80904.tmweb.ru/vmHttpdefaultDb.php?K5Glm1IjUwWQCq0Uioy42v=MLZsFTiDn8Em9rir7K7wImpq3&EXQnpxYJ4aMICQvs=R7D0m961u58njgszmOLxASR&0xIfyHrB=3XszmcYUw52afU&3fe0eef725958b7929a02603a5aa73a2=f84fad6cd29a3006db8b86eab6e3e434&36f380f5a045f0456c7866159c7edf74=AZ4YzM3YjZzgDNxkzM5UzMhNTNmVTNhNjN0MmZ4EmN4gzYmVjN4kTZ&K5Glm1IjUwWQCq0Uioy42v=MLZsFTiDn8Em9rir7K7wImpq3&EXQnpxYJ4aMICQvs=R7D0m961u58njgszmOLxASR&0xIfyHrB=3XszmcYUw52afU
	UYAfvxRha7.exe	Get hash	malicious	DCRat	Browse	cq80904.tmweb.ru/vmHttpdefaultDb.php?wNx8559dK63E8kRo7N3gYQ=50VYeNDsGBfOUR3suNfn4yWU&3fe0eef725958b7929a02603a5aa73a2=f84fad6cd29a3006db8b86eab6e3e434&36f380f5a045f0456c7866159c7edf74=AZ1MGNjVWZkZTMmRGOmRjNiZWMlNzYiNGZwEmY2UjNlRGZyMmZyQWM&wNx8559dK63E8kRo7N3gYQ=50VYeNDsGBfOUR3suNfn4yWU
34.246.200.160	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	thoughtbranch.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	thoughtbranch.net/index.php
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	thoughtbranch.net/index.php
	7sAylAXBOb.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	7sAylAXBOb.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	5a5O0c0oJP.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	5a5O0c0oJP.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php
	Jla3M8Fe16.exe	Get hash	malicious	Unknown	Browse	figurewithout.net/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
membertrust.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
watersystem.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
crowdtrust.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
thoughtsystem.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	213.171.195.105
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	213.171.195.105
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	213.171.195.105
womanbelieve.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	15.197.142.173
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	15.197.142.173
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	15.197.142.173
womanhonor.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
partygeneral.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	3.33.130.190
membersystem.net	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	170.187.200.48
	View Invoice#98783859 Statement for dpo.lu.htm	Get hash	malicious	HTMLPhisher	Browse	13.32.27.44
	unLc6VekkL.elf	Get hash	malicious	Mirai	Browse	13.143.18.150
	17nDkQW4tK.elf	Get hash	malicious	Mirai	Browse	69.236.41.25
	2PQz3l61Pc.elf	Get hash	malicious	Mirai	Browse	199.186.2.28
	botx.mips.elf	Get hash	malicious	Mirai	Browse	75.56.221.43
	botx.x86.elf	Get hash	malicious	Mirai	Browse	76.246.229.111
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	12.169.146.180
TIMEWEB-ASRU	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	188.225.40.227
	Runtime Broker.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	r6KYedz4VQ.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	Gz3zPqMdtn.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	cnGgzU2rkd.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	https://diigo.com/0wzrly?ID=QtERFQmXrhNlWxfeW9PbYZfS3+Email=ambre.boyon@gerflor.com	Get hash	malicious	Unknown	Browse	188.225.39.170
	5F6Ny9UaKt.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	LisectAVT_2403002C_62.dll	Get hash	malicious	Emotet	Browse	188.225.32.231
	qqMLbietPf.exe	Get hash	malicious	DCRat	Browse	185.114.247.170
	Reference ID6f5f047b6cdf41716e164ec64879e463.eml	Get hash	malicious	HTMLPhisher	Browse	185.114.245.110
NMM-ASD-02742FriedersdorfHauptstrasse68DE	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	85.13.130.3
	LisectAVT_2403002A_76.exe	Get hash	malicious	AgentTesla	Browse	85.13.147.213
	hNX3ktCRra.elf	Get hash	malicious	Unknown	Browse	85.13.140.189
	Fzfee1Lgc2.elf	Get hash	malicious	Unknown	Browse	85.13.155.154
	Yb6ztdvQaB.elf	Get hash	malicious	Unknown	Browse	85.13.132.87
	SLL8zVmaGj.elf	Get hash	malicious	Unknown	Browse	85.13.163.148
	Wk8eTHnajw.elf	Get hash	malicious	Unknown	Browse	85.13.130.45
	0SpHek7Jd8.elf	Get hash	malicious	Unknown	Browse	85.13.156.180
AMAZON-02US	mtuXDnH1Di.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	Exv453QQIX.exe	Get hash	malicious	FormBook	Browse	76.223.105.230
	OneDriveSetup.exe	Get hash	malicious	ZTrat	Browse	3.126.224.214
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	Scanned Docs from Emnes Metal Sdn Bhd_.exe	Get hash	malicious	FormBook	Browse	76.223.67.189
	http://verizonwireless-employmentvalidation.com	Get hash	malicious	Unknown	Browse	3.124.93.206
	UjCrfOAkJJiZyZh.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	75.2.115.196
	vzPAucRnt7.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	.exe	Get hash	malicious	Unknown	Browse	52.42.85.34
	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	35.165.37.251

Process:	C:\Users\user\Desktop\7qBBKk0P4l.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:o+k:op
MD5:	869F9B7357D5489D5FE37B208940AFD8
SHA1:	8D4C9419F43D41066C40C67ED43F63A268A7E7AC
SHA-256:	DEE53FC307F455BF9E72689A4472B6E5252C6B36B848C8F531DAD9714A8D3F80
SHA-512:	9B7E12978891487D2BD31DCF0BCF02CFC74331AEBA1372AE9B0DA3B4BD7B1B177F25FD4A9E798D48A7F7C569409647FD1D975C3E4D12631B0953A50BDF71C75D
Malicious:	false
Reputation:	low
Preview:	.RkQ.

C:\hjflhukc\hhziccmdjsti

Download File

Process:	C:\Users\user\Desktop\7qBBKk0P4l.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:o+k:op
MD5:	869F9B7357D5489D5FE37B208940AFD8
SHA1:	8D4C9419F43D41066C40C67ED43F63A268A7E7AC
SHA-256:	DEE53FC307F455BF9E72689A4472B6E5252C6B36B848C8F531DAD9714A8D3F80
SHA-512:	9B7E12978891487D2BD31DCF0BCF02CFC74331AEBA1372AE9B0DA3B4BD7B1B177F25FD4A9E798D48A7F7C569409647FD1D975C3E4D12631B0953A50BDF71C75D
Malicious:	false
Reputation:	low
Preview:	.RkQ.

C:\hjflhukc\psjpq2i82ktsjq0yguk.exe

Download File

Process:	C:\Users\user\Desktop\7qBBKk0P4l.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236032
Entropy (8bit):	7.1119041831804
Encrypted:	false
SSDEEP:	6144:nSzlgBOTkmrLSoVjBLW5w+ihTEzD4NptOi9:n+gITkmrWoJZW+PhTEzcNptb
MD5:	94E7772B2B1BDA89B23A2FBA0E57742E
SHA1:	2AF48B80B7354B4A15EFF49AF3F3D70D3E5789A4
SHA-256:	3397920E23CF8435201E9E90796B2A8C9EC340E4733CBC8064999E462DC53470
SHA-512:	28F2B94180CBD451FDF887B6E47DC92596FDFB37D06B0F115B4C4A79524366681E05EB2624922A7311BCB9CA983D275BB10F29338628F8654FD673619669F101
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i............D..............q......q.....Rich....................PE..L...w..T.....................>....................@..........................@............@.....................................P................................w......................................................T............................text............................... ..`.rdata..............................@..@.data............>..................@....reloc...w.......x..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\hjflhukc\xxxniijvj.exe

Download File

Process:	C:\hjflhukc\yanidfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236032
Entropy (8bit):	7.1119041831804
Encrypted:	false
SSDEEP:	6144:nSzlgBOTkmrLSoVjBLW5w+ihTEzD4NptOi9:n+gITkmrWoJZW+PhTEzcNptb
MD5:	94E7772B2B1BDA89B23A2FBA0E57742E
SHA1:	2AF48B80B7354B4A15EFF49AF3F3D70D3E5789A4
SHA-256:	3397920E23CF8435201E9E90796B2A8C9EC340E4733CBC8064999E462DC53470
SHA-512:	28F2B94180CBD451FDF887B6E47DC92596FDFB37D06B0F115B4C4A79524366681E05EB2624922A7311BCB9CA983D275BB10F29338628F8654FD673619669F101
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i............D..............q......q.....Rich....................PE..L...w..T.....................>....................@..........................@............@.....................................P................................w......................................................T............................text............................... ..`.rdata..............................@..@.data............>..................@....reloc...w.......x..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\hjflhukc\yanidfx.exe

Download File

Process:	C:\hjflhukc\psjpq2i82ktsjq0yguk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236032
Entropy (8bit):	7.1119041831804
Encrypted:	false
SSDEEP:	6144:nSzlgBOTkmrLSoVjBLW5w+ihTEzD4NptOi9:n+gITkmrWoJZW+PhTEzcNptb
MD5:	94E7772B2B1BDA89B23A2FBA0E57742E
SHA1:	2AF48B80B7354B4A15EFF49AF3F3D70D3E5789A4
SHA-256:	3397920E23CF8435201E9E90796B2A8C9EC340E4733CBC8064999E462DC53470
SHA-512:	28F2B94180CBD451FDF887B6E47DC92596FDFB37D06B0F115B4C4A79524366681E05EB2624922A7311BCB9CA983D275BB10F29338628F8654FD673619669F101
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i............D..............q......q.....Rich....................PE..L...w..T.....................>....................@..........................@............@.....................................P................................w......................................................T............................text............................... ..`.rdata..............................@..@.data............>..................@....reloc...w.......x..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.1119041831804
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7qBBKk0P4l.exe
File size:	236'032 bytes
MD5:	94e7772b2b1bda89b23a2fba0e57742e
SHA1:	2af48b80b7354b4a15eff49af3f3d70d3e5789a4
SHA256:	3397920e23cf8435201e9e90796b2a8c9ec340e4733cbc8064999e462dc53470
SHA512:	28f2b94180cbd451fdf887b6e47dc92596fdfb37d06b0f115b4c4a79524366681e05eb2624922a7311bcb9ca983d275bb10f29338628f8654fd673619669f101
SSDEEP:	6144:nSzlgBOTkmrLSoVjBLW5w+ihTEzD4NptOi9:n+gITkmrWoJZW+PhTEzcNptb
TLSH:	D234AE27EA481433C92B627C8F4F3BE555BF71735A216A0D87AD29C85CA13CDB23251B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..............D................q.......q......Rich....................PE..L...w..T.....................>....................@

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x42cffe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x5415F677 [Sun Sep 14 20:11:35 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	f2a0245d6e1fa4eff8f7908b9115e5a5

Entrypoint Preview

Instruction
inc dword ptr [004364E0h]
mov eax, dword ptr [004364E0h]
movsx ecx, word ptr [00439A58h]
shl ecx, 05h
add ecx, eax
cmp ecx, 88FDF618h
jne 00007FE034DCF4D5h
movsx ecx, word ptr [00439E9Eh]
movsx eax, word ptr [00438E72h]
shl ecx, 09h
add eax, eax
or ecx, 8B9FEAD2h
cmp eax, ecx
jl 00007FE034DCF4AEh
add dword ptr [004351D4h], 32000450h
jmp 00007FE034DCF4ACh
and dword ptr [004355ACh], FE8EB909h
call 00007FE034DC81A8h
mov ax, word ptr [00439448h]
cwde
and dword ptr [004364CCh], eax
call 00007FE034DB818Eh
movsx eax, word ptr [0043A870h]
not eax
cmp eax, 89F860A1h
jle 00007FE034DCF4C8h
mov ecx, dword ptr [00434EF8h]
mov eax, dword ptr [00438310h]
and ecx, 57A11F5Bh
or eax, 87C03C33h
inc dword ptr [00434EF8h]
cmp ecx, eax
jl 00007FE034DCF4A8h
mov ax, word ptr [00438B68h]
push esi
push 0042F15Ch
push 0042F154h
call 00007FE034DC525Eh
add dword ptr [004340B0h], FDBF763Fh
pop ecx
pop ecx
call 00007FE034DCBE05h
imul ecx, dword ptr [004347E0h], 0000ED7Bh

Rich Headers

Programming Language:

[C++] VS2013 UPD4 build 31101
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2f198	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3c000	0x77e8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f000	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2d4a4	0x2d600	a008b9f965a55234d4e9fec1e12e9ec6	False	0.7345310347796143	data	6.839663016682375	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2f000	0x8be	0xa00	55aa2668bd66e2095758bac52ad4d6a9	False	0.4265625	data	4.9731112242142945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0xbaa0	0x3e00	bd6e729852a57125388e38f19ed205d8	False	0.9037298387096774	data	7.278103942872461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3c000	0x77e8	0x7800	623b73b7d554b0184d990dca084cd43a	False	0.77333984375	data	6.84069434637676	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	GetBkColor, GetDCBrushColor, GetDCPenColor, GetClipRgn, GetMetaRgn, GetCurrentObject, GetDeviceCaps, GetObjectType, GetRandomRgn, GetStretchBltMode, GetSystemPaletteUse, GetTextCharacterExtra, GetTextAlign, GetTextColor, GetTextCharset, GetTextCharsetInfo, GetFontLanguageInfo
USER32.dll	GetMenuContextHelpId, GetCursor, GetWindowLongA, LoadIconA, GetWindowContextHelpId, SetWindowTextA, RemovePropA, GetPropA, GetScrollPos, EndPaint, GetDC, WindowFromDC, GetForegroundWindow, DrawTextA, GetMenuCheckMarkDimensions, GetMenuItemCount, GetMenuItemID, GetMenuState, GetMenu, IsWindowEnabled, EnableWindow, GetQueueStatus, SetFocus, GetDialogBaseUnits, CheckDlgButton, SetDlgItemTextA, GetDlgItemInt, GetDlgItem, EndDialog, MoveWindow, ShowWindow, CallWindowProcA, PostMessageA, SendMessageA, BeginPaint
KERNEL32.dll	MoveFileA, LocalFlags, GlobalHandle, GlobalFlags, GlobalSize, SizeofResource, LockResource, LoadResource, GetProcAddress, GetModuleHandleA, GetTickCount, GetVersion, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentProcess, GetProcessHeap, HeapAlloc, QueryPerformanceCounter, GetLastError, CloseHandle, IsDebuggerPresent, WriteFile, SetFilePointer, GetFileType, GetFileTime, GetDriveTypeA, FlushFileBuffers, FindClose, DeleteFileA, GetStdHandle

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-05T16:29:15.427900+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49705	80	192.168.2.8	35.164.78.200
2024-08-05T16:29:21.526506+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49711	80	192.168.2.8	15.197.192.55
2024-08-05T16:29:28.585913+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49716	80	192.168.2.8	170.187.200.48
2024-08-05T16:29:11.586178+0200	UDP	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	53	56919	1.1.1.1	192.168.2.8
2024-08-05T16:29:12.540506+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	49704	80	192.168.2.8	3.33.130.190
2024-08-05T16:29:15.432885+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49705	35.164.78.200	192.168.2.8
2024-08-05T16:29:17.836857+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49706	34.246.200.160	192.168.2.8
2024-08-05T16:29:31.727756+0200	TCP	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49719	54.244.188.177	192.168.2.8
2024-08-05T16:31:09.914916+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	60229	80	192.168.2.8	35.164.78.200
2024-08-05T16:30:40.325809+0200	TCP	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	60228	80	192.168.2.8	3.33.130.190
2024-08-05T16:29:18.843079+0200	UDP	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	53	54266	1.1.1.1	192.168.2.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 16:29:12.065845013 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:12.071082115 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:12.071178913 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:12.071218014 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:12.076324940 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:12.540308952 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:12.540328979 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:12.540505886 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:12.540577888 CEST	49704	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:12.545561075 CEST	80	49704	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:14.686279058 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:29:14.692420006 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:29:14.692543030 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:29:14.692574024 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:29:14.698522091 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:29:15.427299976 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:29:15.427824020 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:29:15.427900076 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:29:15.428062916 CEST	49705	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:29:15.432884932 CEST	80	49705	35.164.78.200	192.168.2.8
Aug 5, 2024 16:29:17.035758972 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:29:17.040955067 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:29:17.041033983 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:29:17.041102886 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:29:17.046912909 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:29:17.830583096 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:29:17.831773996 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:29:17.831890106 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:29:17.831890106 CEST	49706	80	192.168.2.8	34.246.200.160
Aug 5, 2024 16:29:17.836857080 CEST	80	49706	34.246.200.160	192.168.2.8
Aug 5, 2024 16:29:19.529993057 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:29:19.535176992 CEST	80	49707	15.197.142.173	192.168.2.8
Aug 5, 2024 16:29:19.535249949 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:29:19.535299063 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:29:19.540290117 CEST	80	49707	15.197.142.173	192.168.2.8
Aug 5, 2024 16:29:20.101177931 CEST	80	49707	15.197.142.173	192.168.2.8
Aug 5, 2024 16:29:20.101299047 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:29:20.117944956 CEST	80	49707	15.197.142.173	192.168.2.8
Aug 5, 2024 16:29:20.117995977 CEST	49707	80	192.168.2.8	15.197.142.173
Aug 5, 2024 16:29:21.049998999 CEST	49711	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:21.055402994 CEST	80	49711	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:21.055469036 CEST	49711	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:21.055541992 CEST	49711	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:21.060467958 CEST	80	49711	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:21.526259899 CEST	80	49711	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:21.526505947 CEST	49711	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:21.526566029 CEST	80	49711	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:21.526608944 CEST	49711	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:21.531361103 CEST	80	49711	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:24.561898947 CEST	49714	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:29:24.566826105 CEST	80	49714	85.13.130.3	192.168.2.8
Aug 5, 2024 16:29:24.566931009 CEST	49714	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:29:24.566958904 CEST	49714	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:29:24.571830034 CEST	80	49714	85.13.130.3	192.168.2.8
Aug 5, 2024 16:29:25.243931055 CEST	80	49714	85.13.130.3	192.168.2.8
Aug 5, 2024 16:29:25.244179010 CEST	49714	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:29:25.244664907 CEST	80	49714	85.13.130.3	192.168.2.8
Aug 5, 2024 16:29:25.244726896 CEST	49714	80	192.168.2.8	85.13.130.3
Aug 5, 2024 16:29:25.249881029 CEST	80	49714	85.13.130.3	192.168.2.8
Aug 5, 2024 16:29:25.418395996 CEST	49715	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:25.426352978 CEST	80	49715	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:25.426425934 CEST	49715	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:25.426461935 CEST	49715	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:25.433134079 CEST	80	49715	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:26.839092970 CEST	80	49715	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:26.839190006 CEST	80	49715	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:26.839265108 CEST	49715	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:26.839318991 CEST	49715	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:29:26.845216036 CEST	80	49715	3.33.130.190	192.168.2.8
Aug 5, 2024 16:29:28.090379953 CEST	49716	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:29:28.096540928 CEST	80	49716	170.187.200.48	192.168.2.8
Aug 5, 2024 16:29:28.096625090 CEST	49716	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:29:28.096674919 CEST	49716	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:29:28.102552891 CEST	80	49716	170.187.200.48	192.168.2.8
Aug 5, 2024 16:29:28.585762978 CEST	80	49716	170.187.200.48	192.168.2.8
Aug 5, 2024 16:29:28.585912943 CEST	49716	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:29:28.585988998 CEST	80	49716	170.187.200.48	192.168.2.8
Aug 5, 2024 16:29:28.586029053 CEST	49716	80	192.168.2.8	170.187.200.48
Aug 5, 2024 16:29:28.591212988 CEST	80	49716	170.187.200.48	192.168.2.8
Aug 5, 2024 16:29:28.899480104 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:29:28.904766083 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:29:28.904879093 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:29:28.904913902 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:29:28.909677982 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:29:29.508569956 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:29:29.508590937 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:29:29.508605003 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:29:29.508676052 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:29:29.508698940 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:29:29.508738995 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:29:29.508866072 CEST	49717	80	192.168.2.8	213.171.195.105
Aug 5, 2024 16:29:29.514097929 CEST	80	49717	213.171.195.105	192.168.2.8
Aug 5, 2024 16:29:29.894680023 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:29:29.899880886 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:29:29.899956942 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:29:29.900022030 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:29:29.904846907 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:29:30.538731098 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:29:30.538876057 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:29:30.539040089 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:29:30.539040089 CEST	49718	80	192.168.2.8	64.190.63.222
Aug 5, 2024 16:29:30.544055939 CEST	80	49718	64.190.63.222	192.168.2.8
Aug 5, 2024 16:29:30.991458893 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:29:30.997493029 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:29:30.997596025 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:29:30.997627974 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:29:31.003624916 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:29:31.721687078 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:29:31.722110987 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:29:31.722199917 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:29:31.722739935 CEST	49719	80	192.168.2.8	54.244.188.177
Aug 5, 2024 16:29:31.727756023 CEST	80	49719	54.244.188.177	192.168.2.8
Aug 5, 2024 16:29:33.677495956 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:29:33.682679892 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:29:33.682810068 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:29:33.682877064 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:29:33.688606977 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:29:34.358859062 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:29:34.359009981 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:29:34.359103918 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:29:34.359146118 CEST	49720	80	192.168.2.8	81.169.145.88
Aug 5, 2024 16:29:34.363785982 CEST	80	49720	81.169.145.88	192.168.2.8
Aug 5, 2024 16:29:36.427856922 CEST	60223	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:36.432811975 CEST	80	60223	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:36.432909012 CEST	60223	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:36.432952881 CEST	60223	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:36.437908888 CEST	80	60223	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:36.959588051 CEST	80	60223	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:36.959820986 CEST	60223	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:36.959952116 CEST	80	60223	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:36.960002899 CEST	60223	80	192.168.2.8	15.197.192.55
Aug 5, 2024 16:29:36.964721918 CEST	80	60223	15.197.192.55	192.168.2.8
Aug 5, 2024 16:29:37.878561974 CEST	60224	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:29:37.883460045 CEST	80	60224	188.225.40.227	192.168.2.8
Aug 5, 2024 16:29:37.883611917 CEST	60224	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:29:37.883701086 CEST	60224	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:29:37.888633966 CEST	80	60224	188.225.40.227	192.168.2.8
Aug 5, 2024 16:29:38.609452009 CEST	80	60224	188.225.40.227	192.168.2.8
Aug 5, 2024 16:29:38.609632969 CEST	60224	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:29:38.611435890 CEST	80	60224	188.225.40.227	192.168.2.8
Aug 5, 2024 16:29:38.611502886 CEST	60224	80	192.168.2.8	188.225.40.227
Aug 5, 2024 16:29:38.614476919 CEST	80	60224	188.225.40.227	192.168.2.8
Aug 5, 2024 16:30:39.833633900 CEST	60228	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:30:39.838700056 CEST	80	60228	3.33.130.190	192.168.2.8
Aug 5, 2024 16:30:39.838896990 CEST	60228	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:30:39.838965893 CEST	60228	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:30:39.843888998 CEST	80	60228	3.33.130.190	192.168.2.8
Aug 5, 2024 16:30:40.325565100 CEST	80	60228	3.33.130.190	192.168.2.8
Aug 5, 2024 16:30:40.325807095 CEST	80	60228	3.33.130.190	192.168.2.8
Aug 5, 2024 16:30:40.325809002 CEST	60228	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:30:40.325864077 CEST	60228	80	192.168.2.8	3.33.130.190
Aug 5, 2024 16:30:40.330770016 CEST	80	60228	3.33.130.190	192.168.2.8
Aug 5, 2024 16:31:08.895189047 CEST	60229	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:31:09.140079021 CEST	80	60229	35.164.78.200	192.168.2.8
Aug 5, 2024 16:31:09.141366959 CEST	60229	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:31:09.141431093 CEST	60229	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:31:09.146253109 CEST	80	60229	35.164.78.200	192.168.2.8
Aug 5, 2024 16:31:09.908768892 CEST	80	60229	35.164.78.200	192.168.2.8
Aug 5, 2024 16:31:09.908910990 CEST	80	60229	35.164.78.200	192.168.2.8
Aug 5, 2024 16:31:09.914916039 CEST	60229	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:31:09.914963961 CEST	60229	80	192.168.2.8	35.164.78.200
Aug 5, 2024 16:31:09.919799089 CEST	80	60229	35.164.78.200	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 16:29:11.065494061 CEST	61902	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:11.075903893 CEST	53	61902	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:11.078541994 CEST	49451	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:11.319818020 CEST	53	49451	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:11.320658922 CEST	63185	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:11.562056065 CEST	53	63185	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:11.563086033 CEST	55706	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:11.574672937 CEST	53	55706	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:11.575319052 CEST	56919	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:11.586178064 CEST	53	56919	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:11.586781025 CEST	55415	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:11.597752094 CEST	53	55415	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:11.598402977 CEST	61045	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:11.769155979 CEST	53	61045	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:11.770251989 CEST	62407	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:12.020760059 CEST	53	62407	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:12.021816015 CEST	55599	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:12.033452034 CEST	53	55599	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:12.034068108 CEST	59448	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:12.045797110 CEST	53	59448	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:12.046355963 CEST	59613	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:12.063851118 CEST	53	59613	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:12.541176081 CEST	61573	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:12.552897930 CEST	53	61573	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:12.553683996 CEST	64638	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:12.564909935 CEST	53	64638	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:12.565465927 CEST	60297	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:12.806520939 CEST	53	60297	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:12.812391043 CEST	57349	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:12.823904037 CEST	53	57349	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:12.824645996 CEST	50523	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:12.836756945 CEST	53	50523	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:12.840949059 CEST	52046	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.082669973 CEST	53	52046	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.083547115 CEST	61632	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.094002008 CEST	53	61632	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.094641924 CEST	59774	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.104852915 CEST	53	59774	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.105659962 CEST	64082	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.349757910 CEST	53	64082	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.350748062 CEST	63732	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.361143112 CEST	53	63732	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.362283945 CEST	52280	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.610430002 CEST	53	52280	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.613801956 CEST	62749	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.630697012 CEST	53	62749	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.631630898 CEST	61701	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.873183966 CEST	53	61701	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.874267101 CEST	57334	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.886759996 CEST	53	57334	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.887563944 CEST	53843	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.898473024 CEST	53	53843	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.899183989 CEST	58685	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.908046961 CEST	53	58685	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.908596992 CEST	59609	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:13.919905901 CEST	53	59609	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:13.920641899 CEST	50085	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.166552067 CEST	53	50085	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:14.167725086 CEST	54652	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.179265976 CEST	53	54652	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:14.180432081 CEST	58147	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.421227932 CEST	53	58147	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:14.422060013 CEST	62903	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.435067892 CEST	53	62903	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:14.435710907 CEST	59371	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.449076891 CEST	53	59371	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:14.449692965 CEST	53146	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.462477922 CEST	53	53146	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:14.463047981 CEST	56053	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.473382950 CEST	53	56053	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:14.473974943 CEST	64295	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.485368013 CEST	53	64295	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:14.485919952 CEST	54596	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.497977972 CEST	53	54596	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:14.498548031 CEST	49396	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:14.685664892 CEST	53	49396	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:15.428821087 CEST	65045	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:15.442127943 CEST	53	65045	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:15.442900896 CEST	62299	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:15.454788923 CEST	53	62299	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:15.455332041 CEST	59547	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:15.467430115 CEST	53	59547	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:15.467931986 CEST	59909	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:15.717009068 CEST	53	59909	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:15.718341112 CEST	52517	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:15.959619045 CEST	53	52517	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:15.960390091 CEST	61074	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:15.972425938 CEST	53	61074	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:15.973066092 CEST	57690	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:15.986114979 CEST	53	57690	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:15.987015963 CEST	61928	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.000363111 CEST	53	61928	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.001110077 CEST	50901	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.016840935 CEST	53	50901	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.017591953 CEST	63096	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.029915094 CEST	53	63096	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.030514002 CEST	56143	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.273901939 CEST	53	56143	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.274945021 CEST	53554	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.527143955 CEST	53	53554	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.527899027 CEST	56030	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.538775921 CEST	53	56030	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.539710045 CEST	53002	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.550420046 CEST	53	53002	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.551245928 CEST	63064	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.561091900 CEST	53	63064	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.561868906 CEST	52188	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.573014021 CEST	53	52188	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.573728085 CEST	57888	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.826725006 CEST	53	57888	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.827564001 CEST	59607	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:16.842817068 CEST	53	59607	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:16.843451023 CEST	56916	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:17.033474922 CEST	53	56916	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:17.832559109 CEST	61128	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:18.072935104 CEST	53	61128	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:18.073951960 CEST	58046	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:18.325112104 CEST	53	58046	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:18.326138973 CEST	56288	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:18.577333927 CEST	53	56288	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:18.578224897 CEST	63106	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:18.591264963 CEST	53	63106	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:18.591835976 CEST	49274	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:18.603315115 CEST	53	49274	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:18.603794098 CEST	54266	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:18.843079090 CEST	53	54266	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:18.843851089 CEST	55060	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:19.086600065 CEST	53	55060	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:19.087703943 CEST	64820	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:19.264308929 CEST	53	64820	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:19.265280008 CEST	54030	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:19.275741100 CEST	53	54030	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:19.276313066 CEST	60983	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:19.529501915 CEST	53	60983	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:20.101965904 CEST	49449	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:20.576548100 CEST	53	49449	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:20.577208042 CEST	56055	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:20.590104103 CEST	53	56055	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:20.590744019 CEST	55157	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:20.602689981 CEST	53	55157	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:20.603493929 CEST	52363	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:20.616842985 CEST	53	52363	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:20.617430925 CEST	58891	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:20.628355980 CEST	53	58891	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:20.628869057 CEST	55369	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:20.644896030 CEST	53	55369	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:20.645447969 CEST	52676	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:20.657478094 CEST	53	52676	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:20.657969952 CEST	58884	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:21.049282074 CEST	53	58884	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:21.527123928 CEST	54487	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:21.539367914 CEST	53	54487	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:21.540577888 CEST	54521	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:21.551533937 CEST	53	54521	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:21.574789047 CEST	52264	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:21.586282969 CEST	53	52264	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:21.588284016 CEST	65291	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:21.599277973 CEST	53	65291	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:21.605344057 CEST	63622	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:21.774164915 CEST	53	63622	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:21.775163889 CEST	59709	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:21.790712118 CEST	53	59709	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:21.791454077 CEST	53785	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:22.035350084 CEST	53	53785	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:22.036303043 CEST	59318	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:22.283190966 CEST	53	59318	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:22.284100056 CEST	49343	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:22.295522928 CEST	53	49343	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:22.296231985 CEST	54338	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:22.542083025 CEST	53	54338	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:22.543116093 CEST	60614	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:22.556404114 CEST	53	60614	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:22.557199955 CEST	64796	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:22.802392006 CEST	53	64796	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:22.803252935 CEST	59535	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:22.816875935 CEST	53	59535	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:22.817553997 CEST	65507	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:23.068275928 CEST	53	65507	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:23.069380045 CEST	50452	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:23.080602884 CEST	53	50452	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:23.081440926 CEST	65494	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:23.092896938 CEST	53	65494	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:23.094146967 CEST	65405	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:23.105020046 CEST	53	65405	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:23.105925083 CEST	64963	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:23.349452019 CEST	53	64963	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:23.350382090 CEST	58878	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:23.600841045 CEST	53	58878	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:23.601757050 CEST	49435	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:23.844789028 CEST	53	49435	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:23.845623016 CEST	57941	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:23.856199026 CEST	53	57941	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:23.859431982 CEST	58600	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:24.110539913 CEST	53	58600	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:24.111649036 CEST	63584	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:24.121798992 CEST	53	63584	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:24.122636080 CEST	54531	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:24.132436991 CEST	53	54531	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:24.133210897 CEST	50134	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:24.374351978 CEST	53	50134	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:24.375549078 CEST	55497	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:24.386292934 CEST	53	55497	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:24.387716055 CEST	60783	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:24.561223030 CEST	53	60783	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:25.244843006 CEST	55776	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:25.405180931 CEST	53	55776	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:25.406193018 CEST	61375	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:25.417926073 CEST	53	61375	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:26.839979887 CEST	60552	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.180814028 CEST	53	60552	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.181804895 CEST	51064	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.193702936 CEST	53	51064	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.209050894 CEST	56435	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.218801022 CEST	53	56435	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.219665051 CEST	52736	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.231834888 CEST	53	52736	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.232584953 CEST	60107	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.241944075 CEST	53	60107	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.244308949 CEST	56179	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.255887032 CEST	53	56179	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.256525040 CEST	61442	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.268976927 CEST	53	61442	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.269598007 CEST	64228	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.280803919 CEST	53	64228	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.281316042 CEST	62040	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.292068958 CEST	53	62040	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.295509100 CEST	62309	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.540225029 CEST	53	62309	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.541318893 CEST	64780	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.551896095 CEST	53	64780	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.552515984 CEST	63310	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.563276052 CEST	53	63310	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.563822985 CEST	64996	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.575335979 CEST	53	64996	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.576066971 CEST	53297	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.586533070 CEST	53	53297	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.587156057 CEST	55776	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:27.835112095 CEST	53	55776	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:27.836185932 CEST	55908	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:28.089803934 CEST	53	55908	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:28.586568117 CEST	62848	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:28.598711014 CEST	53	62848	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:28.599617958 CEST	63537	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:28.611409903 CEST	53	63537	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:28.612117052 CEST	52678	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:28.623290062 CEST	53	52678	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:28.623883963 CEST	61162	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:28.633673906 CEST	53	61162	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:28.634130001 CEST	51776	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:28.898875952 CEST	53	51776	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:29.509442091 CEST	62894	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:29.893948078 CEST	53	62894	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:30.539659023 CEST	53234	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:30.550525904 CEST	53	53234	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:30.551412106 CEST	64272	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:30.561933041 CEST	53	64272	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:30.562755108 CEST	63496	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:30.990739107 CEST	53	63496	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:31.722907066 CEST	49589	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:31.735565901 CEST	53	49589	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:31.736613035 CEST	55558	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:31.986884117 CEST	53	55558	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:31.987783909 CEST	63806	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.229449034 CEST	53	63806	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.230547905 CEST	58099	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.471544027 CEST	53	58099	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.472404003 CEST	61168	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.715445042 CEST	53	61168	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.716721058 CEST	59232	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.728327990 CEST	53	59232	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.729016066 CEST	54417	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.739342928 CEST	53	54417	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.740132093 CEST	51042	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.753119946 CEST	53	51042	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.753752947 CEST	57280	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.764743090 CEST	53	57280	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.765336037 CEST	64841	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.776576042 CEST	53	64841	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.777215004 CEST	55796	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.788311005 CEST	53	55796	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.788881063 CEST	52455	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.799129009 CEST	53	52455	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.799729109 CEST	60613	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.833617926 CEST	53	60613	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.836863041 CEST	63224	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.849631071 CEST	53	63224	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.850334883 CEST	55954	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:32.862149954 CEST	53	55954	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:32.863744020 CEST	50278	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:33.105950117 CEST	53	50278	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:33.106801987 CEST	58968	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:33.347024918 CEST	53	58968	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:33.348392963 CEST	54067	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:33.676670074 CEST	53	54067	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:34.359734058 CEST	50581	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:34.372128963 CEST	53	50581	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:34.373200893 CEST	57769	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:34.386163950 CEST	53	57769	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:34.387434959 CEST	51101	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:34.398993969 CEST	53	51101	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:34.399947882 CEST	57612	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:34.408263922 CEST	53	57612	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:34.983928919 CEST	55829	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:34.996634960 CEST	53	55829	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:34.997538090 CEST	50716	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:35.245126963 CEST	53	50716	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:35.246263027 CEST	64643	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:35.491301060 CEST	53	64643	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:35.492263079 CEST	65313	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:35.503212929 CEST	53	65313	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:35.503863096 CEST	54613	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:35.743726015 CEST	53	54613	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:35.744888067 CEST	51099	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:35.755346060 CEST	53	51099	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:35.756145000 CEST	64170	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:35.916809082 CEST	53	64170	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:35.918016911 CEST	64943	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:35.928347111 CEST	53	64943	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:35.929451942 CEST	59758	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:36.426992893 CEST	53	59758	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:36.961030960 CEST	58011	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:36.977796078 CEST	53	58011	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:36.978693008 CEST	62706	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:37.231750011 CEST	53	62706	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:37.232698917 CEST	65397	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:37.242609978 CEST	53	65397	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:37.243967056 CEST	64720	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:37.258848906 CEST	53	64720	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:37.259624004 CEST	60765	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:37.276952028 CEST	53	60765	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:37.277749062 CEST	58144	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:37.289258003 CEST	53	58144	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:37.290199995 CEST	60845	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:37.877857924 CEST	53	60845	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:38.610333920 CEST	49218	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:38.621022940 CEST	53	49218	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:38.621824980 CEST	55401	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:38.631786108 CEST	53	55401	1.1.1.1	192.168.2.8
Aug 5, 2024 16:29:38.633855104 CEST	53886	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:29:38.884322882 CEST	53	53886	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:30.198882103 CEST	63775	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:30.211678028 CEST	53	63775	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:31.220506907 CEST	54126	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:31.232464075 CEST	53	54126	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:32.236110926 CEST	53781	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:32.477427959 CEST	53	53781	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:33.486401081 CEST	64797	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:33.496949911 CEST	53	64797	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:34.501719952 CEST	55778	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:34.741450071 CEST	53	55778	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:35.751744986 CEST	62524	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:35.763319016 CEST	53	62524	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:36.767462015 CEST	65127	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:36.782304049 CEST	53	65127	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:37.798796892 CEST	65401	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:37.810231924 CEST	53	65401	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:38.814814091 CEST	61698	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:38.828094959 CEST	53	61698	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:41.329832077 CEST	59382	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:41.581301928 CEST	53	59382	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:42.595699072 CEST	59726	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:42.606931925 CEST	53	59726	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:43.611092091 CEST	60968	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:43.622618914 CEST	53	60968	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:44.627640009 CEST	54430	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:44.639799118 CEST	53	54430	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:45.642466068 CEST	54316	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:45.720616102 CEST	53	54316	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:46.736110926 CEST	63484	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:46.980622053 CEST	53	63484	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:47.986190081 CEST	65316	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:47.997689009 CEST	53	65316	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:49.002470016 CEST	62730	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:49.020262003 CEST	53	62730	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:50.032907963 CEST	60309	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:50.044676065 CEST	53	60309	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:51.048510075 CEST	53535	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:51.060859919 CEST	53	53535	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:52.064111948 CEST	58130	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:52.074872017 CEST	53	58130	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:53.080308914 CEST	61560	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:53.100538015 CEST	53	61560	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:54.114175081 CEST	50586	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:54.125411987 CEST	53	50586	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:55.142385960 CEST	62163	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:55.160931110 CEST	53	62163	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:56.173604965 CEST	52005	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:56.414340019 CEST	53	52005	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:57.423520088 CEST	50887	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:57.437084913 CEST	53	50887	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:58.439157963 CEST	60556	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:58.684453964 CEST	53	60556	1.1.1.1	192.168.2.8
Aug 5, 2024 16:30:59.689167976 CEST	64071	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:30:59.699279070 CEST	53	64071	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:00.704968929 CEST	55694	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:00.946132898 CEST	53	55694	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:01.954981089 CEST	50918	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:01.965470076 CEST	53	50918	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:03.009968996 CEST	51571	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:03.020843029 CEST	53	51571	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:04.048811913 CEST	61642	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:04.060475111 CEST	53	61642	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:05.033351898 CEST	64006	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:05.277419090 CEST	53	64006	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:06.220510006 CEST	53718	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:06.230575085 CEST	53	53718	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:07.142529964 CEST	50010	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:07.155838966 CEST	53	50010	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:08.033078909 CEST	58155	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:08.045919895 CEST	53	58155	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:10.736260891 CEST	56232	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:11.173512936 CEST	53	56232	1.1.1.1	192.168.2.8
Aug 5, 2024 16:31:11.970381975 CEST	56393	53	192.168.2.8	1.1.1.1
Aug 5, 2024 16:31:11.978821993 CEST	53	56393	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 16:29:11.065494061 CEST	192.168.2.8	1.1.1.1	0x6d10	Standard query (0)	womanclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.078541994 CEST	192.168.2.8	1.1.1.1	0x8476	Standard query (0)	smokeclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.320658922 CEST	192.168.2.8	1.1.1.1	0xfe28	Standard query (0)	womangeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.563086033 CEST	192.168.2.8	1.1.1.1	0xd7bb	Standard query (0)	smokegeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.575319052 CEST	192.168.2.8	1.1.1.1	0x88ae	Standard query (0)	womaninclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.586781025 CEST	192.168.2.8	1.1.1.1	0x9463	Standard query (0)	smokeinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.598402977 CEST	192.168.2.8	1.1.1.1	0x38e8	Standard query (0)	womannorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.770251989 CEST	192.168.2.8	1.1.1.1	0x3387	Standard query (0)	smokenorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.021816015 CEST	192.168.2.8	1.1.1.1	0x4e84	Standard query (0)	partyclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.034068108 CEST	192.168.2.8	1.1.1.1	0x2b79	Standard query (0)	fightclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.046355963 CEST	192.168.2.8	1.1.1.1	0xc3a9	Standard query (0)	partygeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.541176081 CEST	192.168.2.8	1.1.1.1	0x4803	Standard query (0)	fightgeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.553683996 CEST	192.168.2.8	1.1.1.1	0xd9aa	Standard query (0)	partyinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.565465927 CEST	192.168.2.8	1.1.1.1	0x1f95	Standard query (0)	fightinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.812391043 CEST	192.168.2.8	1.1.1.1	0xb26	Standard query (0)	partynorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.824645996 CEST	192.168.2.8	1.1.1.1	0x3b37	Standard query (0)	fightnorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.840949059 CEST	192.168.2.8	1.1.1.1	0xaf47	Standard query (0)	freshbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.083547115 CEST	192.168.2.8	1.1.1.1	0x9bd2	Standard query (0)	experiencebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.094641924 CEST	192.168.2.8	1.1.1.1	0xb315	Standard query (0)	freshbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.105659962 CEST	192.168.2.8	1.1.1.1	0x28bb	Standard query (0)	experiencebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.350748062 CEST	192.168.2.8	1.1.1.1	0x79f9	Standard query (0)	freshreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.362283945 CEST	192.168.2.8	1.1.1.1	0x7c87	Standard query (0)	experiencereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.613801956 CEST	192.168.2.8	1.1.1.1	0x614d	Standard query (0)	freshquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.631630898 CEST	192.168.2.8	1.1.1.1	0x137f	Standard query (0)	experiencequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.874267101 CEST	192.168.2.8	1.1.1.1	0xa541	Standard query (0)	gentlemanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.887563944 CEST	192.168.2.8	1.1.1.1	0x52e0	Standard query (0)	alreadybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.899183989 CEST	192.168.2.8	1.1.1.1	0x7cd6	Standard query (0)	gentlemanbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.908596992 CEST	192.168.2.8	1.1.1.1	0x7fa7	Standard query (0)	alreadybelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.920641899 CEST	192.168.2.8	1.1.1.1	0x3357	Standard query (0)	gentlemanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.167725086 CEST	192.168.2.8	1.1.1.1	0x3ef9	Standard query (0)	alreadyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.180432081 CEST	192.168.2.8	1.1.1.1	0x9ea2	Standard query (0)	gentlemanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.422060013 CEST	192.168.2.8	1.1.1.1	0x10cb	Standard query (0)	alreadyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.435710907 CEST	192.168.2.8	1.1.1.1	0xe392	Standard query (0)	followbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.449692965 CEST	192.168.2.8	1.1.1.1	0x9a7d	Standard query (0)	memberbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.463047981 CEST	192.168.2.8	1.1.1.1	0xeda	Standard query (0)	followbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.473974943 CEST	192.168.2.8	1.1.1.1	0x7059	Standard query (0)	memberbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.485919952 CEST	192.168.2.8	1.1.1.1	0x942c	Standard query (0)	followreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.498548031 CEST	192.168.2.8	1.1.1.1	0xf05f	Standard query (0)	memberreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.428821087 CEST	192.168.2.8	1.1.1.1	0x6e28	Standard query (0)	followquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.442900896 CEST	192.168.2.8	1.1.1.1	0x68f1	Standard query (0)	memberquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.455332041 CEST	192.168.2.8	1.1.1.1	0xedf9	Standard query (0)	beginbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.467931986 CEST	192.168.2.8	1.1.1.1	0x4d20	Standard query (0)	knownbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.718341112 CEST	192.168.2.8	1.1.1.1	0xb61d	Standard query (0)	beginbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.960390091 CEST	192.168.2.8	1.1.1.1	0x799f	Standard query (0)	knownbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.973066092 CEST	192.168.2.8	1.1.1.1	0x304	Standard query (0)	beginreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.987015963 CEST	192.168.2.8	1.1.1.1	0x62bf	Standard query (0)	knownreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.001110077 CEST	192.168.2.8	1.1.1.1	0xc50b	Standard query (0)	beginquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.017591953 CEST	192.168.2.8	1.1.1.1	0x6516	Standard query (0)	knownquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.030514002 CEST	192.168.2.8	1.1.1.1	0x4770	Standard query (0)	summerbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.274945021 CEST	192.168.2.8	1.1.1.1	0x70fb	Standard query (0)	crowdbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.527899027 CEST	192.168.2.8	1.1.1.1	0x2cab	Standard query (0)	summerbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.539710045 CEST	192.168.2.8	1.1.1.1	0x3930	Standard query (0)	crowdbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.551245928 CEST	192.168.2.8	1.1.1.1	0x8d10	Standard query (0)	summerreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.561868906 CEST	192.168.2.8	1.1.1.1	0x13ef	Standard query (0)	crowdreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.573728085 CEST	192.168.2.8	1.1.1.1	0xbf38	Standard query (0)	summerquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.827564001 CEST	192.168.2.8	1.1.1.1	0x8305	Standard query (0)	crowdquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.843451023 CEST	192.168.2.8	1.1.1.1	0xb621	Standard query (0)	thoughtbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:17.832559109 CEST	192.168.2.8	1.1.1.1	0x1a7a	Standard query (0)	waterbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.073951960 CEST	192.168.2.8	1.1.1.1	0xf4fd	Standard query (0)	thoughtbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.326138973 CEST	192.168.2.8	1.1.1.1	0x52a1	Standard query (0)	waterbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.578224897 CEST	192.168.2.8	1.1.1.1	0xae7a	Standard query (0)	thoughtreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.591835976 CEST	192.168.2.8	1.1.1.1	0x2b38	Standard query (0)	waterreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.603794098 CEST	192.168.2.8	1.1.1.1	0x696	Standard query (0)	thoughtquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.843851089 CEST	192.168.2.8	1.1.1.1	0x89ba	Standard query (0)	waterquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:19.087703943 CEST	192.168.2.8	1.1.1.1	0x8c0	Standard query (0)	womanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:19.265280008 CEST	192.168.2.8	1.1.1.1	0x2ccd	Standard query (0)	smokebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:19.276313066 CEST	192.168.2.8	1.1.1.1	0x604a	Standard query (0)	womanbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.101965904 CEST	192.168.2.8	1.1.1.1	0x34c0	Standard query (0)	smokebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.577208042 CEST	192.168.2.8	1.1.1.1	0x43ea	Standard query (0)	womanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.590744019 CEST	192.168.2.8	1.1.1.1	0xcfce	Standard query (0)	smokereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.603493929 CEST	192.168.2.8	1.1.1.1	0xe433	Standard query (0)	womanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.617430925 CEST	192.168.2.8	1.1.1.1	0xaf58	Standard query (0)	smokequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.628869057 CEST	192.168.2.8	1.1.1.1	0xbab5	Standard query (0)	partybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.645447969 CEST	192.168.2.8	1.1.1.1	0xdc0	Standard query (0)	fightbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.657969952 CEST	192.168.2.8	1.1.1.1	0xda1e	Standard query (0)	partybelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.527123928 CEST	192.168.2.8	1.1.1.1	0x33ac	Standard query (0)	fightbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.540577888 CEST	192.168.2.8	1.1.1.1	0xc188	Standard query (0)	partyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.574789047 CEST	192.168.2.8	1.1.1.1	0x2213	Standard query (0)	fightreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.588284016 CEST	192.168.2.8	1.1.1.1	0x711b	Standard query (0)	partyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.605344057 CEST	192.168.2.8	1.1.1.1	0x46c1	Standard query (0)	fightquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.775163889 CEST	192.168.2.8	1.1.1.1	0x83cd	Standard query (0)	freshhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.791454077 CEST	192.168.2.8	1.1.1.1	0x80	Standard query (0)	experiencehonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.036303043 CEST	192.168.2.8	1.1.1.1	0x3781	Standard query (0)	freshneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.284100056 CEST	192.168.2.8	1.1.1.1	0xb7c2	Standard query (0)	experienceneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.296231985 CEST	192.168.2.8	1.1.1.1	0x767d	Standard query (0)	freshsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.543116093 CEST	192.168.2.8	1.1.1.1	0xcff	Standard query (0)	experiencesystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.557199955 CEST	192.168.2.8	1.1.1.1	0xfdc6	Standard query (0)	freshtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.803252935 CEST	192.168.2.8	1.1.1.1	0xf6d0	Standard query (0)	experiencetrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.817553997 CEST	192.168.2.8	1.1.1.1	0xc008	Standard query (0)	gentlemanhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.069380045 CEST	192.168.2.8	1.1.1.1	0xf4c0	Standard query (0)	alreadyhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.081440926 CEST	192.168.2.8	1.1.1.1	0xc1ca	Standard query (0)	gentlemanneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.094146967 CEST	192.168.2.8	1.1.1.1	0xdcd7	Standard query (0)	alreadyneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.105925083 CEST	192.168.2.8	1.1.1.1	0xf441	Standard query (0)	gentlemansystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.350382090 CEST	192.168.2.8	1.1.1.1	0x974b	Standard query (0)	alreadysystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.601757050 CEST	192.168.2.8	1.1.1.1	0x413e	Standard query (0)	gentlemantrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.845623016 CEST	192.168.2.8	1.1.1.1	0x289d	Standard query (0)	alreadytrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.859431982 CEST	192.168.2.8	1.1.1.1	0x9770	Standard query (0)	followhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.111649036 CEST	192.168.2.8	1.1.1.1	0x4c2e	Standard query (0)	memberhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.122636080 CEST	192.168.2.8	1.1.1.1	0x9aa	Standard query (0)	followneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.133210897 CEST	192.168.2.8	1.1.1.1	0x6f24	Standard query (0)	memberneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.375549078 CEST	192.168.2.8	1.1.1.1	0x3251	Standard query (0)	followsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.387716055 CEST	192.168.2.8	1.1.1.1	0x3d51	Standard query (0)	membersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:25.244843006 CEST	192.168.2.8	1.1.1.1	0x4fdf	Standard query (0)	followtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:25.406193018 CEST	192.168.2.8	1.1.1.1	0x254f	Standard query (0)	membertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:26.839979887 CEST	192.168.2.8	1.1.1.1	0xdaa5	Standard query (0)	beginhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.181804895 CEST	192.168.2.8	1.1.1.1	0x3be6	Standard query (0)	knownhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.209050894 CEST	192.168.2.8	1.1.1.1	0xd2e6	Standard query (0)	beginneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.219665051 CEST	192.168.2.8	1.1.1.1	0xa591	Standard query (0)	knownneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.232584953 CEST	192.168.2.8	1.1.1.1	0x57c8	Standard query (0)	beginsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.244308949 CEST	192.168.2.8	1.1.1.1	0xa8ca	Standard query (0)	knownsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.256525040 CEST	192.168.2.8	1.1.1.1	0xc0bc	Standard query (0)	begintrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.269598007 CEST	192.168.2.8	1.1.1.1	0x82be	Standard query (0)	knowntrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.281316042 CEST	192.168.2.8	1.1.1.1	0x34a7	Standard query (0)	summerhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.295509100 CEST	192.168.2.8	1.1.1.1	0xc793	Standard query (0)	crowdhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.541318893 CEST	192.168.2.8	1.1.1.1	0x6ff4	Standard query (0)	summerneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.552515984 CEST	192.168.2.8	1.1.1.1	0xb55c	Standard query (0)	crowdneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.563822985 CEST	192.168.2.8	1.1.1.1	0xbf43	Standard query (0)	summersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.576066971 CEST	192.168.2.8	1.1.1.1	0x2c77	Standard query (0)	crowdsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.587156057 CEST	192.168.2.8	1.1.1.1	0x8c6b	Standard query (0)	summertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.836185932 CEST	192.168.2.8	1.1.1.1	0x4106	Standard query (0)	crowdtrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.586568117 CEST	192.168.2.8	1.1.1.1	0xbc52	Standard query (0)	thoughthonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.599617958 CEST	192.168.2.8	1.1.1.1	0x5215	Standard query (0)	waterhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.612117052 CEST	192.168.2.8	1.1.1.1	0xe59c	Standard query (0)	thoughtneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.623883963 CEST	192.168.2.8	1.1.1.1	0xb28e	Standard query (0)	waterneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.634130001 CEST	192.168.2.8	1.1.1.1	0xe350	Standard query (0)	thoughtsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:29.509442091 CEST	192.168.2.8	1.1.1.1	0xc454	Standard query (0)	watersystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:30.539659023 CEST	192.168.2.8	1.1.1.1	0xbc3b	Standard query (0)	thoughttrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:30.551412106 CEST	192.168.2.8	1.1.1.1	0x21b1	Standard query (0)	watertrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:30.562755108 CEST	192.168.2.8	1.1.1.1	0xa572	Standard query (0)	womanhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:31.722907066 CEST	192.168.2.8	1.1.1.1	0x2bfd	Standard query (0)	smokehonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:31.736613035 CEST	192.168.2.8	1.1.1.1	0x407d	Standard query (0)	womanneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:31.987783909 CEST	192.168.2.8	1.1.1.1	0xa179	Standard query (0)	smokeneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.230547905 CEST	192.168.2.8	1.1.1.1	0x6759	Standard query (0)	womansystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.472404003 CEST	192.168.2.8	1.1.1.1	0x88f9	Standard query (0)	smokesystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.716721058 CEST	192.168.2.8	1.1.1.1	0x9f5f	Standard query (0)	womantrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.729016066 CEST	192.168.2.8	1.1.1.1	0xf9a2	Standard query (0)	smoketrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.740132093 CEST	192.168.2.8	1.1.1.1	0xac47	Standard query (0)	partyhonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.753752947 CEST	192.168.2.8	1.1.1.1	0x5114	Standard query (0)	fighthonor.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.765336037 CEST	192.168.2.8	1.1.1.1	0x6a23	Standard query (0)	partyneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.777215004 CEST	192.168.2.8	1.1.1.1	0x561e	Standard query (0)	fightneither.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.788881063 CEST	192.168.2.8	1.1.1.1	0x9abc	Standard query (0)	partysystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.799729109 CEST	192.168.2.8	1.1.1.1	0xf52b	Standard query (0)	fightsystem.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.836863041 CEST	192.168.2.8	1.1.1.1	0xc0db	Standard query (0)	partytrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.850334883 CEST	192.168.2.8	1.1.1.1	0xb32c	Standard query (0)	fighttrust.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.863744020 CEST	192.168.2.8	1.1.1.1	0x9f65	Standard query (0)	freshlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:33.106801987 CEST	192.168.2.8	1.1.1.1	0x8a77	Standard query (0)	experiencelaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:33.348392963 CEST	192.168.2.8	1.1.1.1	0x6b13	Standard query (0)	freshfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.359734058 CEST	192.168.2.8	1.1.1.1	0x1d6c	Standard query (0)	experiencefancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.373200893 CEST	192.168.2.8	1.1.1.1	0x81d2	Standard query (0)	freshconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.387434959 CEST	192.168.2.8	1.1.1.1	0x6b12	Standard query (0)	experienceconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.399947882 CEST	192.168.2.8	1.1.1.1	0x463a	Standard query (0)	freshfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.983928919 CEST	192.168.2.8	1.1.1.1	0xb6b7	Standard query (0)	experiencefriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.997538090 CEST	192.168.2.8	1.1.1.1	0xf2ce	Standard query (0)	gentlemanlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.246263027 CEST	192.168.2.8	1.1.1.1	0x2ce3	Standard query (0)	alreadylaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.492263079 CEST	192.168.2.8	1.1.1.1	0x7ac2	Standard query (0)	gentlemanfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.503863096 CEST	192.168.2.8	1.1.1.1	0x7e89	Standard query (0)	alreadyfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.744888067 CEST	192.168.2.8	1.1.1.1	0x2d97	Standard query (0)	gentlemanconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.756145000 CEST	192.168.2.8	1.1.1.1	0x12d	Standard query (0)	alreadyconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.918016911 CEST	192.168.2.8	1.1.1.1	0x2a0a	Standard query (0)	gentlemanfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.929451942 CEST	192.168.2.8	1.1.1.1	0x7839	Standard query (0)	alreadyfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:36.961030960 CEST	192.168.2.8	1.1.1.1	0xe21	Standard query (0)	followlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:36.978693008 CEST	192.168.2.8	1.1.1.1	0xa71a	Standard query (0)	memberlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.232698917 CEST	192.168.2.8	1.1.1.1	0x3525	Standard query (0)	followfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.243967056 CEST	192.168.2.8	1.1.1.1	0xf5e7	Standard query (0)	memberfancy.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.259624004 CEST	192.168.2.8	1.1.1.1	0xfd1	Standard query (0)	followconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.277749062 CEST	192.168.2.8	1.1.1.1	0x7520	Standard query (0)	memberconsider.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.290199995 CEST	192.168.2.8	1.1.1.1	0x154f	Standard query (0)	followfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:38.610333920 CEST	192.168.2.8	1.1.1.1	0x1d24	Standard query (0)	memberfriend.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:38.621824980 CEST	192.168.2.8	1.1.1.1	0x5b5d	Standard query (0)	beginlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:38.633855104 CEST	192.168.2.8	1.1.1.1	0xc016	Standard query (0)	knownlaughter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:30.198882103 CEST	192.168.2.8	1.1.1.1	0x9c67	Standard query (0)	smokeclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:31.220506907 CEST	192.168.2.8	1.1.1.1	0xd09	Standard query (0)	womangeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:32.236110926 CEST	192.168.2.8	1.1.1.1	0x9ae1	Standard query (0)	smokegeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:33.486401081 CEST	192.168.2.8	1.1.1.1	0xe179	Standard query (0)	womaninclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:34.501719952 CEST	192.168.2.8	1.1.1.1	0x463b	Standard query (0)	smokeinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:35.751744986 CEST	192.168.2.8	1.1.1.1	0xfec1	Standard query (0)	womannorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:36.767462015 CEST	192.168.2.8	1.1.1.1	0x1880	Standard query (0)	smokenorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:37.798796892 CEST	192.168.2.8	1.1.1.1	0x49d	Standard query (0)	partyclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:38.814814091 CEST	192.168.2.8	1.1.1.1	0x6890	Standard query (0)	fightclear.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:41.329832077 CEST	192.168.2.8	1.1.1.1	0x749a	Standard query (0)	fightgeneral.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:42.595699072 CEST	192.168.2.8	1.1.1.1	0xf04	Standard query (0)	partyinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:43.611092091 CEST	192.168.2.8	1.1.1.1	0x6903	Standard query (0)	fightinclude.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:44.627640009 CEST	192.168.2.8	1.1.1.1	0x3984	Standard query (0)	partynorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:45.642466068 CEST	192.168.2.8	1.1.1.1	0x8a3d	Standard query (0)	fightnorth.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:46.736110926 CEST	192.168.2.8	1.1.1.1	0x9178	Standard query (0)	freshbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:47.986190081 CEST	192.168.2.8	1.1.1.1	0x1fbf	Standard query (0)	experiencebranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:49.002470016 CEST	192.168.2.8	1.1.1.1	0xf922	Standard query (0)	freshbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:50.032907963 CEST	192.168.2.8	1.1.1.1	0x8935	Standard query (0)	experiencebelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:51.048510075 CEST	192.168.2.8	1.1.1.1	0x7c09	Standard query (0)	freshreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:52.064111948 CEST	192.168.2.8	1.1.1.1	0xad79	Standard query (0)	experiencereceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:53.080308914 CEST	192.168.2.8	1.1.1.1	0x482c	Standard query (0)	freshquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:54.114175081 CEST	192.168.2.8	1.1.1.1	0x2639	Standard query (0)	experiencequarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:55.142385960 CEST	192.168.2.8	1.1.1.1	0x8ac6	Standard query (0)	gentlemanbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:56.173604965 CEST	192.168.2.8	1.1.1.1	0xb15d	Standard query (0)	alreadybranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:57.423520088 CEST	192.168.2.8	1.1.1.1	0x176e	Standard query (0)	gentlemanbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:58.439157963 CEST	192.168.2.8	1.1.1.1	0xda66	Standard query (0)	alreadybelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:59.689167976 CEST	192.168.2.8	1.1.1.1	0xc207	Standard query (0)	gentlemanreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:00.704968929 CEST	192.168.2.8	1.1.1.1	0x6279	Standard query (0)	alreadyreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:01.954981089 CEST	192.168.2.8	1.1.1.1	0xbb7d	Standard query (0)	gentlemanquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:03.009968996 CEST	192.168.2.8	1.1.1.1	0xbf1f	Standard query (0)	alreadyquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:04.048811913 CEST	192.168.2.8	1.1.1.1	0xa1b	Standard query (0)	followbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:05.033351898 CEST	192.168.2.8	1.1.1.1	0x96f5	Standard query (0)	memberbranch.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:06.220510006 CEST	192.168.2.8	1.1.1.1	0xc0f4	Standard query (0)	followbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:07.142529964 CEST	192.168.2.8	1.1.1.1	0xb540	Standard query (0)	memberbelieve.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:08.033078909 CEST	192.168.2.8	1.1.1.1	0xa8c9	Standard query (0)	followreceive.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:10.736260891 CEST	192.168.2.8	1.1.1.1	0x17b8	Standard query (0)	followquarter.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:11.970381975 CEST	192.168.2.8	1.1.1.1	0x270b	Standard query (0)	memberquarter.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 16:29:11.075903893 CEST	1.1.1.1	192.168.2.8	0x6d10	Name error (3)	womanclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.319818020 CEST	1.1.1.1	192.168.2.8	0x8476	Name error (3)	smokeclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.562056065 CEST	1.1.1.1	192.168.2.8	0xfe28	Name error (3)	womangeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.574672937 CEST	1.1.1.1	192.168.2.8	0xd7bb	Name error (3)	smokegeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.586178064 CEST	1.1.1.1	192.168.2.8	0x88ae	Name error (3)	womaninclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.597752094 CEST	1.1.1.1	192.168.2.8	0x9463	Name error (3)	smokeinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:11.769155979 CEST	1.1.1.1	192.168.2.8	0x38e8	Name error (3)	womannorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.020760059 CEST	1.1.1.1	192.168.2.8	0x3387	Name error (3)	smokenorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.033452034 CEST	1.1.1.1	192.168.2.8	0x4e84	Name error (3)	partyclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.045797110 CEST	1.1.1.1	192.168.2.8	0x2b79	Name error (3)	fightclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.063851118 CEST	1.1.1.1	192.168.2.8	0xc3a9	No error (0)	partygeneral.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.063851118 CEST	1.1.1.1	192.168.2.8	0xc3a9	No error (0)	partygeneral.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.552897930 CEST	1.1.1.1	192.168.2.8	0x4803	Name error (3)	fightgeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.564909935 CEST	1.1.1.1	192.168.2.8	0xd9aa	Name error (3)	partyinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.806520939 CEST	1.1.1.1	192.168.2.8	0x1f95	Name error (3)	fightinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.823904037 CEST	1.1.1.1	192.168.2.8	0xb26	Name error (3)	partynorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:12.836756945 CEST	1.1.1.1	192.168.2.8	0x3b37	Name error (3)	fightnorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.082669973 CEST	1.1.1.1	192.168.2.8	0xaf47	Name error (3)	freshbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.094002008 CEST	1.1.1.1	192.168.2.8	0x9bd2	Name error (3)	experiencebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.104852915 CEST	1.1.1.1	192.168.2.8	0xb315	Name error (3)	freshbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.349757910 CEST	1.1.1.1	192.168.2.8	0x28bb	Name error (3)	experiencebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.361143112 CEST	1.1.1.1	192.168.2.8	0x79f9	Name error (3)	freshreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.610430002 CEST	1.1.1.1	192.168.2.8	0x7c87	Name error (3)	experiencereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.630697012 CEST	1.1.1.1	192.168.2.8	0x614d	Name error (3)	freshquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.873183966 CEST	1.1.1.1	192.168.2.8	0x137f	Name error (3)	experiencequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.886759996 CEST	1.1.1.1	192.168.2.8	0xa541	Name error (3)	gentlemanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.898473024 CEST	1.1.1.1	192.168.2.8	0x52e0	Name error (3)	alreadybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.908046961 CEST	1.1.1.1	192.168.2.8	0x7cd6	Name error (3)	gentlemanbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:13.919905901 CEST	1.1.1.1	192.168.2.8	0x7fa7	Name error (3)	alreadybelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.166552067 CEST	1.1.1.1	192.168.2.8	0x3357	Name error (3)	gentlemanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.179265976 CEST	1.1.1.1	192.168.2.8	0x3ef9	Name error (3)	alreadyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.421227932 CEST	1.1.1.1	192.168.2.8	0x9ea2	Name error (3)	gentlemanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.435067892 CEST	1.1.1.1	192.168.2.8	0x10cb	Name error (3)	alreadyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.449076891 CEST	1.1.1.1	192.168.2.8	0xe392	Name error (3)	followbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.462477922 CEST	1.1.1.1	192.168.2.8	0x9a7d	Name error (3)	memberbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.473382950 CEST	1.1.1.1	192.168.2.8	0xeda	Name error (3)	followbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.485368013 CEST	1.1.1.1	192.168.2.8	0x7059	Name error (3)	memberbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.497977972 CEST	1.1.1.1	192.168.2.8	0x942c	Name error (3)	followreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:14.685664892 CEST	1.1.1.1	192.168.2.8	0xf05f	No error (0)	memberreceive.net		35.164.78.200	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.442127943 CEST	1.1.1.1	192.168.2.8	0x6e28	Name error (3)	followquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.454788923 CEST	1.1.1.1	192.168.2.8	0x68f1	Name error (3)	memberquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.467430115 CEST	1.1.1.1	192.168.2.8	0xedf9	Name error (3)	beginbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.717009068 CEST	1.1.1.1	192.168.2.8	0x4d20	Name error (3)	knownbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.959619045 CEST	1.1.1.1	192.168.2.8	0xb61d	Name error (3)	beginbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.972425938 CEST	1.1.1.1	192.168.2.8	0x799f	Name error (3)	knownbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:15.986114979 CEST	1.1.1.1	192.168.2.8	0x304	Name error (3)	beginreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.000363111 CEST	1.1.1.1	192.168.2.8	0x62bf	Name error (3)	knownreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.016840935 CEST	1.1.1.1	192.168.2.8	0xc50b	Name error (3)	beginquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.029915094 CEST	1.1.1.1	192.168.2.8	0x6516	Name error (3)	knownquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.273901939 CEST	1.1.1.1	192.168.2.8	0x4770	Name error (3)	summerbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.527143955 CEST	1.1.1.1	192.168.2.8	0x70fb	Name error (3)	crowdbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.538775921 CEST	1.1.1.1	192.168.2.8	0x2cab	Name error (3)	summerbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.550420046 CEST	1.1.1.1	192.168.2.8	0x3930	Name error (3)	crowdbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.561091900 CEST	1.1.1.1	192.168.2.8	0x8d10	Name error (3)	summerreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.573014021 CEST	1.1.1.1	192.168.2.8	0x13ef	Name error (3)	crowdreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.826725006 CEST	1.1.1.1	192.168.2.8	0xbf38	Name error (3)	summerquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:16.842817068 CEST	1.1.1.1	192.168.2.8	0x8305	Name error (3)	crowdquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:17.033474922 CEST	1.1.1.1	192.168.2.8	0xb621	No error (0)	thoughtbranch.net		34.246.200.160	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.072935104 CEST	1.1.1.1	192.168.2.8	0x1a7a	Name error (3)	waterbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.325112104 CEST	1.1.1.1	192.168.2.8	0xf4fd	Name error (3)	thoughtbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.577333927 CEST	1.1.1.1	192.168.2.8	0x52a1	Name error (3)	waterbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.591264963 CEST	1.1.1.1	192.168.2.8	0xae7a	Name error (3)	thoughtreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.603315115 CEST	1.1.1.1	192.168.2.8	0x2b38	Name error (3)	waterreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:18.843079090 CEST	1.1.1.1	192.168.2.8	0x696	Name error (3)	thoughtquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:19.086600065 CEST	1.1.1.1	192.168.2.8	0x89ba	Name error (3)	waterquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:19.264308929 CEST	1.1.1.1	192.168.2.8	0x8c0	Name error (3)	womanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:19.275741100 CEST	1.1.1.1	192.168.2.8	0x2ccd	Name error (3)	smokebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:19.529501915 CEST	1.1.1.1	192.168.2.8	0x604a	No error (0)	womanbelieve.net		15.197.142.173	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:19.529501915 CEST	1.1.1.1	192.168.2.8	0x604a	No error (0)	womanbelieve.net		3.33.152.147	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.576548100 CEST	1.1.1.1	192.168.2.8	0x34c0	Name error (3)	smokebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.590104103 CEST	1.1.1.1	192.168.2.8	0x43ea	Name error (3)	womanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.602689981 CEST	1.1.1.1	192.168.2.8	0xcfce	Name error (3)	smokereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.616842985 CEST	1.1.1.1	192.168.2.8	0xe433	Name error (3)	womanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.628355980 CEST	1.1.1.1	192.168.2.8	0xaf58	Name error (3)	smokequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.644896030 CEST	1.1.1.1	192.168.2.8	0xbab5	Name error (3)	partybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:20.657478094 CEST	1.1.1.1	192.168.2.8	0xdc0	Name error (3)	fightbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.049282074 CEST	1.1.1.1	192.168.2.8	0xda1e	No error (0)	partybelieve.net		15.197.192.55	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.539367914 CEST	1.1.1.1	192.168.2.8	0x33ac	Name error (3)	fightbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.551533937 CEST	1.1.1.1	192.168.2.8	0xc188	Name error (3)	partyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.586282969 CEST	1.1.1.1	192.168.2.8	0x2213	Name error (3)	fightreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.599277973 CEST	1.1.1.1	192.168.2.8	0x711b	Name error (3)	partyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.774164915 CEST	1.1.1.1	192.168.2.8	0x46c1	Name error (3)	fightquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:21.790712118 CEST	1.1.1.1	192.168.2.8	0x83cd	Name error (3)	freshhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.035350084 CEST	1.1.1.1	192.168.2.8	0x80	Name error (3)	experiencehonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.283190966 CEST	1.1.1.1	192.168.2.8	0x3781	Name error (3)	freshneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.295522928 CEST	1.1.1.1	192.168.2.8	0xb7c2	Name error (3)	experienceneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.542083025 CEST	1.1.1.1	192.168.2.8	0x767d	Name error (3)	freshsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.556404114 CEST	1.1.1.1	192.168.2.8	0xcff	Name error (3)	experiencesystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.802392006 CEST	1.1.1.1	192.168.2.8	0xfdc6	Name error (3)	freshtrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:22.816875935 CEST	1.1.1.1	192.168.2.8	0xf6d0	Name error (3)	experiencetrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.068275928 CEST	1.1.1.1	192.168.2.8	0xc008	Name error (3)	gentlemanhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.080602884 CEST	1.1.1.1	192.168.2.8	0xf4c0	Name error (3)	alreadyhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.092896938 CEST	1.1.1.1	192.168.2.8	0xc1ca	Name error (3)	gentlemanneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.105020046 CEST	1.1.1.1	192.168.2.8	0xdcd7	Name error (3)	alreadyneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.349452019 CEST	1.1.1.1	192.168.2.8	0xf441	Name error (3)	gentlemansystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.600841045 CEST	1.1.1.1	192.168.2.8	0x974b	Name error (3)	alreadysystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.844789028 CEST	1.1.1.1	192.168.2.8	0x413e	Name error (3)	gentlemantrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:23.856199026 CEST	1.1.1.1	192.168.2.8	0x289d	Name error (3)	alreadytrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.110539913 CEST	1.1.1.1	192.168.2.8	0x9770	Name error (3)	followhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.121798992 CEST	1.1.1.1	192.168.2.8	0x4c2e	Name error (3)	memberhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.132436991 CEST	1.1.1.1	192.168.2.8	0x9aa	Name error (3)	followneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.374351978 CEST	1.1.1.1	192.168.2.8	0x6f24	Name error (3)	memberneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.386292934 CEST	1.1.1.1	192.168.2.8	0x3251	Name error (3)	followsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:24.561223030 CEST	1.1.1.1	192.168.2.8	0x3d51	No error (0)	membersystem.net		85.13.130.3	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:25.405180931 CEST	1.1.1.1	192.168.2.8	0x4fdf	Name error (3)	followtrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:25.417926073 CEST	1.1.1.1	192.168.2.8	0x254f	No error (0)	membertrust.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:25.417926073 CEST	1.1.1.1	192.168.2.8	0x254f	No error (0)	membertrust.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.180814028 CEST	1.1.1.1	192.168.2.8	0xdaa5	Name error (3)	beginhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.193702936 CEST	1.1.1.1	192.168.2.8	0x3be6	Name error (3)	knownhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.218801022 CEST	1.1.1.1	192.168.2.8	0xd2e6	Name error (3)	beginneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.231834888 CEST	1.1.1.1	192.168.2.8	0xa591	Name error (3)	knownneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.241944075 CEST	1.1.1.1	192.168.2.8	0x57c8	Name error (3)	beginsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.255887032 CEST	1.1.1.1	192.168.2.8	0xa8ca	Name error (3)	knownsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.268976927 CEST	1.1.1.1	192.168.2.8	0xc0bc	Name error (3)	begintrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.280803919 CEST	1.1.1.1	192.168.2.8	0x82be	Name error (3)	knowntrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.292068958 CEST	1.1.1.1	192.168.2.8	0x34a7	Name error (3)	summerhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.540225029 CEST	1.1.1.1	192.168.2.8	0xc793	Name error (3)	crowdhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.551896095 CEST	1.1.1.1	192.168.2.8	0x6ff4	Name error (3)	summerneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.563276052 CEST	1.1.1.1	192.168.2.8	0xb55c	Name error (3)	crowdneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.575335979 CEST	1.1.1.1	192.168.2.8	0xbf43	Name error (3)	summersystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.586533070 CEST	1.1.1.1	192.168.2.8	0x2c77	Name error (3)	crowdsystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:27.835112095 CEST	1.1.1.1	192.168.2.8	0x8c6b	Name error (3)	summertrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.089803934 CEST	1.1.1.1	192.168.2.8	0x4106	No error (0)	crowdtrust.net		170.187.200.48	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.598711014 CEST	1.1.1.1	192.168.2.8	0xbc52	Name error (3)	thoughthonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.611409903 CEST	1.1.1.1	192.168.2.8	0x5215	Name error (3)	waterhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.623290062 CEST	1.1.1.1	192.168.2.8	0xe59c	Name error (3)	thoughtneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.633673906 CEST	1.1.1.1	192.168.2.8	0xb28e	Name error (3)	waterneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:28.898875952 CEST	1.1.1.1	192.168.2.8	0xe350	No error (0)	thoughtsystem.net		213.171.195.105	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:29.893948078 CEST	1.1.1.1	192.168.2.8	0xc454	No error (0)	watersystem.net		64.190.63.222	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:30.550525904 CEST	1.1.1.1	192.168.2.8	0xbc3b	Name error (3)	thoughttrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:30.561933041 CEST	1.1.1.1	192.168.2.8	0x21b1	Name error (3)	watertrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:30.990739107 CEST	1.1.1.1	192.168.2.8	0xa572	No error (0)	womanhonor.net		54.244.188.177	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:31.735565901 CEST	1.1.1.1	192.168.2.8	0x2bfd	Name error (3)	smokehonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:31.986884117 CEST	1.1.1.1	192.168.2.8	0x407d	Name error (3)	womanneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.229449034 CEST	1.1.1.1	192.168.2.8	0xa179	Name error (3)	smokeneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.471544027 CEST	1.1.1.1	192.168.2.8	0x6759	Name error (3)	womansystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.715445042 CEST	1.1.1.1	192.168.2.8	0x88f9	Name error (3)	smokesystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.728327990 CEST	1.1.1.1	192.168.2.8	0x9f5f	Name error (3)	womantrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.739342928 CEST	1.1.1.1	192.168.2.8	0xf9a2	Name error (3)	smoketrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.753119946 CEST	1.1.1.1	192.168.2.8	0xac47	Name error (3)	partyhonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.764743090 CEST	1.1.1.1	192.168.2.8	0x5114	Name error (3)	fighthonor.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.776576042 CEST	1.1.1.1	192.168.2.8	0x6a23	Name error (3)	partyneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.788311005 CEST	1.1.1.1	192.168.2.8	0x561e	Name error (3)	fightneither.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.799129009 CEST	1.1.1.1	192.168.2.8	0x9abc	Name error (3)	partysystem.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.849631071 CEST	1.1.1.1	192.168.2.8	0xc0db	Name error (3)	partytrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:32.862149954 CEST	1.1.1.1	192.168.2.8	0xb32c	Name error (3)	fighttrust.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:33.105950117 CEST	1.1.1.1	192.168.2.8	0x9f65	Name error (3)	freshlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:33.347024918 CEST	1.1.1.1	192.168.2.8	0x8a77	Name error (3)	experiencelaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:33.676670074 CEST	1.1.1.1	192.168.2.8	0x6b13	No error (0)	freshfancy.net		81.169.145.88	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.372128963 CEST	1.1.1.1	192.168.2.8	0x1d6c	Name error (3)	experiencefancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.386163950 CEST	1.1.1.1	192.168.2.8	0x81d2	Name error (3)	freshconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.398993969 CEST	1.1.1.1	192.168.2.8	0x6b12	Name error (3)	experienceconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:34.996634960 CEST	1.1.1.1	192.168.2.8	0xb6b7	Name error (3)	experiencefriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.245126963 CEST	1.1.1.1	192.168.2.8	0xf2ce	Name error (3)	gentlemanlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.491301060 CEST	1.1.1.1	192.168.2.8	0x2ce3	Name error (3)	alreadylaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.503212929 CEST	1.1.1.1	192.168.2.8	0x7ac2	Name error (3)	gentlemanfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.743726015 CEST	1.1.1.1	192.168.2.8	0x7e89	Name error (3)	alreadyfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.755346060 CEST	1.1.1.1	192.168.2.8	0x2d97	Name error (3)	gentlemanconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.916809082 CEST	1.1.1.1	192.168.2.8	0x12d	Name error (3)	alreadyconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:35.928347111 CEST	1.1.1.1	192.168.2.8	0x2a0a	Name error (3)	gentlemanfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:36.426992893 CEST	1.1.1.1	192.168.2.8	0x7839	No error (0)	alreadyfriend.net		15.197.192.55	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:36.977796078 CEST	1.1.1.1	192.168.2.8	0xe21	Name error (3)	followlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.231750011 CEST	1.1.1.1	192.168.2.8	0xa71a	Name error (3)	memberlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.242609978 CEST	1.1.1.1	192.168.2.8	0x3525	Name error (3)	followfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.258848906 CEST	1.1.1.1	192.168.2.8	0xf5e7	Name error (3)	memberfancy.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.276952028 CEST	1.1.1.1	192.168.2.8	0xfd1	Name error (3)	followconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.289258003 CEST	1.1.1.1	192.168.2.8	0x7520	Name error (3)	memberconsider.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:37.877857924 CEST	1.1.1.1	192.168.2.8	0x154f	No error (0)	followfriend.net		188.225.40.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:38.621022940 CEST	1.1.1.1	192.168.2.8	0x1d24	Name error (3)	memberfriend.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:38.631786108 CEST	1.1.1.1	192.168.2.8	0x5b5d	Name error (3)	beginlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:29:38.884322882 CEST	1.1.1.1	192.168.2.8	0xc016	Name error (3)	knownlaughter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:30.211678028 CEST	1.1.1.1	192.168.2.8	0x9c67	Name error (3)	smokeclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:31.232464075 CEST	1.1.1.1	192.168.2.8	0xd09	Name error (3)	womangeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:32.477427959 CEST	1.1.1.1	192.168.2.8	0x9ae1	Name error (3)	smokegeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:33.496949911 CEST	1.1.1.1	192.168.2.8	0xe179	Name error (3)	womaninclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:34.741450071 CEST	1.1.1.1	192.168.2.8	0x463b	Name error (3)	smokeinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:35.763319016 CEST	1.1.1.1	192.168.2.8	0xfec1	Name error (3)	womannorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:36.782304049 CEST	1.1.1.1	192.168.2.8	0x1880	Name error (3)	smokenorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:37.810231924 CEST	1.1.1.1	192.168.2.8	0x49d	Name error (3)	partyclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:38.828094959 CEST	1.1.1.1	192.168.2.8	0x6890	Name error (3)	fightclear.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:41.581301928 CEST	1.1.1.1	192.168.2.8	0x749a	Name error (3)	fightgeneral.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:42.606931925 CEST	1.1.1.1	192.168.2.8	0xf04	Name error (3)	partyinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:43.622618914 CEST	1.1.1.1	192.168.2.8	0x6903	Name error (3)	fightinclude.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:44.639799118 CEST	1.1.1.1	192.168.2.8	0x3984	Name error (3)	partynorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:45.720616102 CEST	1.1.1.1	192.168.2.8	0x8a3d	Name error (3)	fightnorth.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:46.980622053 CEST	1.1.1.1	192.168.2.8	0x9178	Name error (3)	freshbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:47.997689009 CEST	1.1.1.1	192.168.2.8	0x1fbf	Name error (3)	experiencebranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:49.020262003 CEST	1.1.1.1	192.168.2.8	0xf922	Name error (3)	freshbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:50.044676065 CEST	1.1.1.1	192.168.2.8	0x8935	Name error (3)	experiencebelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:51.060859919 CEST	1.1.1.1	192.168.2.8	0x7c09	Name error (3)	freshreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:52.074872017 CEST	1.1.1.1	192.168.2.8	0xad79	Name error (3)	experiencereceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:53.100538015 CEST	1.1.1.1	192.168.2.8	0x482c	Name error (3)	freshquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:54.125411987 CEST	1.1.1.1	192.168.2.8	0x2639	Name error (3)	experiencequarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:55.160931110 CEST	1.1.1.1	192.168.2.8	0x8ac6	Name error (3)	gentlemanbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:56.414340019 CEST	1.1.1.1	192.168.2.8	0xb15d	Name error (3)	alreadybranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:57.437084913 CEST	1.1.1.1	192.168.2.8	0x176e	Name error (3)	gentlemanbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:58.684453964 CEST	1.1.1.1	192.168.2.8	0xda66	Name error (3)	alreadybelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:30:59.699279070 CEST	1.1.1.1	192.168.2.8	0xc207	Name error (3)	gentlemanreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:00.946132898 CEST	1.1.1.1	192.168.2.8	0x6279	Name error (3)	alreadyreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:01.965470076 CEST	1.1.1.1	192.168.2.8	0xbb7d	Name error (3)	gentlemanquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:03.020843029 CEST	1.1.1.1	192.168.2.8	0xbf1f	Name error (3)	alreadyquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:04.060475111 CEST	1.1.1.1	192.168.2.8	0xa1b	Name error (3)	followbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:05.277419090 CEST	1.1.1.1	192.168.2.8	0x96f5	Name error (3)	memberbranch.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:06.230575085 CEST	1.1.1.1	192.168.2.8	0xc0f4	Name error (3)	followbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:07.155838966 CEST	1.1.1.1	192.168.2.8	0xb540	Name error (3)	memberbelieve.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:08.045919895 CEST	1.1.1.1	192.168.2.8	0xa8c9	Name error (3)	followreceive.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:11.173512936 CEST	1.1.1.1	192.168.2.8	0x17b8	Name error (3)	followquarter.net	none	none	A (IP address)	IN (0x0001)	false
Aug 5, 2024 16:31:11.978821993 CEST	1.1.1.1	192.168.2.8	0x270b	Name error (3)	memberquarter.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

partygeneral.net

memberreceive.net

thoughtbranch.net

womanbelieve.net

partybelieve.net

membersystem.net

membertrust.net

crowdtrust.net

thoughtsystem.net

watersystem.net

womanhonor.net

freshfancy.net

alreadyfriend.net

followfriend.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	3.33.130.190	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:12.071218014 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partygeneral.net
Aug 5, 2024 16:29:12.540308952 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:29:12 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	35.164.78.200	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:14.692574024 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: memberreceive.net
Aug 5, 2024 16:29:15.427299976 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:29:15 GMT Content-Type: text/html Connection: close Set-Cookie: btst=3f009f681c83367b74541261127a886f\|8.46.123.33\|1722868155\|1722868155\|0\|1\|0; path=/; domain=.memberreceive.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49706	34.246.200.160	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:17.041102886 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: thoughtbranch.net
Aug 5, 2024 16:29:17.830583096 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:29:17 GMT Content-Type: text/html Connection: close Set-Cookie: btst=8258cda71c936d7b7244f8a65d537fb1\|8.46.123.33\|1722868157\|1722868157\|0\|1\|0; path=/; domain=.thoughtbranch.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49707	15.197.142.173	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:19.535299063 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: womanbelieve.net
Aug 5, 2024 16:29:20.101177931 CEST	266	IN	HTTP/1.1 403 Forbidden Server: awselb/2.0 Date: Mon, 05 Aug 2024 14:29:19 GMT Content-Type: text/html Content-Length: 118 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49711	15.197.192.55	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:21.055541992 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partybelieve.net
Aug 5, 2024 16:29:21.526259899 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:29:21 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49714	85.13.130.3	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:24.566958904 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: membersystem.net
Aug 5, 2024 16:29:25.243931055 CEST	452	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 05 Aug 2024 14:29:25 GMT Server: Apache Location: https://all-inkl.com/index.php Content-Length: 238 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6c 6c 2d 69 6e 6b 6c 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://all-inkl.com/index.php">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49715	3.33.130.190	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:25.426461935 CEST	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: membertrust.net
Aug 5, 2024 16:29:26.839092970 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:29:26 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49716	170.187.200.48	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:28.096674919 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: crowdtrust.net
Aug 5, 2024 16:29:28.585762978 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 05 Aug 2024 14:29:28 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49717	213.171.195.105	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:28.904913902 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: thoughtsystem.net
Aug 5, 2024 16:29:29.508569956 CEST	1236	IN	HTTP/1.1 200 OK server: nginx/1.20.1 date: Mon, 05 Aug 2024 14:29:29 GMT content-type: text/html content-length: 2873 last-modified: Tue, 16 Jul 2024 11:33:23 GMT etag: "66965a83-b39" accept-ranges: bytes connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 44 6f 6d 61 69 6e 20 70 61 72 6b 69 6e 67 20 70 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 73 2f 63 73 73 2f 69 6e 64 65 78 2e 63 73 73 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 66 61 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Domain parking page</title> <link rel="stylesheet" href="/styles/css/index.css"> <link rel="shortcut icon" href="https://static.fasthosts.co.uk/icons/favicon.ico" type="image/x-icon" /> ... Global site tag (gtag.js) - Google Analytics --> <script async src="https://www.googletagmanager.com/gtag/js?id=UA-199510482-1"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-199510482-1'); </script> </head><body> <div class="container"> <nav class="logo"> <a href="https://fasthosts.co.uk/" rel="nofollow"> <img src="/assets/fasthosts-logo-secondary.svg" alt="Fasthosts"></img> </a> </nav> <main> <h2>Welcome to <span class="domain
Aug 5, 2024 16:29:29.508590937 CEST	1236	IN	Data Raw: 56 61 72 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 68 32 3e 0a 20 20 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 69 73 20 70 61 72 6b 65 64 20 66 6f 72 20 46 52 45 45 20 62 79 0a 20 20 20 20 20 20 20 Data Ascii: Var"></span></h2> <p> This domain name is parked for FREE by <strong><a href="https://fasthosts.co.uk/" rel="nofollow">fasthosts.co.uk</a></strong> </p> <div class="row"> <div class="card card--is-cta
Aug 5, 2024 16:29:29.508605003 CEST	635	IN	Data Raw: 66 61 73 74 68 6f 73 74 73 2e 63 6f 2e 75 6b 2f 63 6f 6e 74 61 63 74 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 64 6f 6d 61 69 6e 70 61 72 6b 69 6e 67 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 72 65 66 65 72 72 61 6c 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d Data Ascii: fasthosts.co.uk/contact?utm_source=domainparking&utm_medium=referral&utm_campaign=fh_parking_contact">Contact us</a> </main> </div> <script> const cleanHostname = document.location.hostname.indexOf("www.") && document.location.hos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49718	64.190.63.222	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:29.900022030 CEST	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: watersystem.net
Aug 5, 2024 16:29:30.538731098 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49719	54.244.188.177	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:30.997627974 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: womanhonor.net
Aug 5, 2024 16:29:31.721687078 CEST	379	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:29:31 GMT Content-Type: text/html Connection: close Set-Cookie: btst=5a675666a9e15e650b2851028bb30416\|8.46.123.33\|1722868171\|1722868171\|0\|1\|0; path=/; domain=.womanhonor.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49720	81.169.145.88	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:33.682877064 CEST	81	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: freshfancy.net
Aug 5, 2024 16:29:34.358859062 CEST	374	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 14:29:34 GMT Server: Apache/2.4.61 (Unix) Content-Length: 196 Content-Type: text/html; charset=iso-8859-1 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	60223	15.197.192.55	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:36.432952881 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: alreadyfriend.net
Aug 5, 2024 16:29:36.959588051 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:29:36 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	60224	188.225.40.227	80	2768	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:29:37.883701086 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: followfriend.net
Aug 5, 2024 16:29:38.609452009 CEST	373	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.1 Date: Mon, 05 Aug 2024 14:29:38 GMT Content-Type: text/html Content-Length: 169 Connection: close Location: https://followfriend.net/index.php Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.26.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	60228	3.33.130.190	80	3392	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:30:39.838965893 CEST	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: partygeneral.net
Aug 5, 2024 16:30:40.325565100 CEST	254	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 05 Aug 2024 14:30:40 GMT Content-Type: text/html Content-Length: 114 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	60229	35.164.78.200	80	3392	C:\hjflhukc\yanidfx.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 16:31:09.141431093 CEST	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: memberreceive.net
Aug 5, 2024 16:31:09.908768892 CEST	382	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 14:31:09 GMT Content-Type: text/html Connection: close Set-Cookie: btst=443bdde055355c9f079649ca0975a0a4\|8.46.123.33\|1722868269\|1722868269\|0\|1\|0; path=/; domain=.memberreceive.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Target ID:	1
Start time:	10:29:05
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\7qBBKk0P4l.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7qBBKk0P4l.exe"
Imagebase:	0xc0000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:29:06
Start date:	05/08/2024
Path:	C:\hjflhukc\psjpq2i82ktsjq0yguk.exe
Wow64 process (32bit):	true
Commandline:	"C:\hjflhukc\psjpq2i82ktsjq0yguk.exe"
Imagebase:	0x920000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:29:06
Start date:	05/08/2024
Path:	C:\hjflhukc\yanidfx.exe
Wow64 process (32bit):	true
Commandline:	C:\hjflhukc\yanidfx.exe
Imagebase:	0x6e0000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:29:08
Start date:	05/08/2024
Path:	C:\hjflhukc\xxxniijvj.exe
Wow64 process (32bit):	true
Commandline:	tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
Imagebase:	0xe0000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:29:09
Start date:	05/08/2024
Path:	C:\hjflhukc\yanidfx.exe
Wow64 process (32bit):	true
Commandline:	"C:\hjflhukc\yanidfx.exe"
Imagebase:	0x6e0000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:29:48
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:30:25
Start date:	05/08/2024
Path:	C:\hjflhukc\yanidfx.exe
Wow64 process (32bit):	true
Commandline:	"c:\hjflhukc\yanidfx.exe"
Imagebase:	0x6e0000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	10:30:26
Start date:	05/08/2024
Path:	C:\hjflhukc\xxxniijvj.exe
Wow64 process (32bit):	true
Commandline:	tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
Imagebase:	0xe20000
File size:	236'032 bytes
MD5 hash:	94E7772B2B1BDA89B23A2FBA0E57742E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	54.1%
Total number of Nodes:	1491
Total number of Limit Nodes:	4

Executed Functions

Function 000DFF20 Relevance: 65.0, APIs: 29, Strings: 7, Instructions: 2030synchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 000E0590
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 000E05E4
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 000E0629
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 000E0649
GetTickCount.KERNEL32 ref: 000E06E6
GetCommandLineA.KERNEL32 ref: 000E0873

Strings

$}\N, xrefs: 000E13B4
wb_m, xrefs: 000E1FC6
C:\Users\user, xrefs: 000E058A
241, xrefs: 000E0787
~z0, xrefs: 000E06C2
^d/, xrefs: 000E0102
HO, xrefs: 000E1893

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CreateMutex$CommandCountEnvironmentLineTickVariable
String ID: $}\N$241$C:\Users\user$HO$^d/$wb_m$~z0
API String ID: 3327569919-2066331522
Opcode ID: cc13ec0fe6d8ade43902024f07155eb0d9060ea195597cc6a4e6e7602ea72d4e
Instruction ID: 05a4aceeacadd651943cdfeae31799d91f9c42994799875e4b6f14718543a14f
Opcode Fuzzy Hash: cc13ec0fe6d8ade43902024f07155eb0d9060ea195597cc6a4e6e7602ea72d4e
Instruction Fuzzy Hash: 5903EC716046409FF758DF69FC82ABA37F4FB44301B10411AE906DAEB1EB7D9981EB12

Function 000C88A8 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(000FB028), ref: 000C893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 000C8AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 000C8D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 000C8D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 000C8DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 000C8E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 000C9158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 000C91F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 000C936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 000C94DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 000C963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 000C97B0

Strings

\, xrefs: 000C93D0
C:\Users\user, xrefs: 000C9016, 000C908E
C:\hjflhukc\, xrefs: 000C8DF6, 000C9174, 000C947F, 000C9666
gKV`, xrefs: 000C8CE7

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\hjflhukc\$\$gKV`
API String ID: 1691758827-3473430694
Opcode ID: 778ef66eed9e010294ea5ac634631dbf82583273810f14e389e1f415edef4fb3
Instruction ID: 194d7e943f75bb312d412f21b4b146f55b9ac6c8a599a9ba3faec92eb9e5b9ec
Opcode Fuzzy Hash: 778ef66eed9e010294ea5ac634631dbf82583273810f14e389e1f415edef4fb3
Instruction Fuzzy Hash: 0F82F4B15046059FF708DF64EC86AFA37B4FB54301B00802EE906D6AB2EB3C9945EF56

Function 000D111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000D11F7
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 000D1267
FindCloseChangeNotification.KERNELBASE(00000000), ref: 000D128B
GetTickCount.KERNEL32 ref: 000D12D1
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 000D153B
WriteFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 000D157E
CloseHandle.KERNEL32(00000000), ref: 000D158F

Strings

Ra);, xrefs: 000D1514

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: File$CloseCreate$ChangeCountFindHandleNotificationReadTickWrite
String ID: Ra);
API String ID: 688250028-4229484525
Opcode ID: 943f3e3e715df5df2d59fd2ce18c109223204c4b5d3781c349d29a1a8e621e20
Instruction ID: 75080ce39a08e03dc072e2bbeb67a45c59c6ff23a4f3bcabae16aa0a12dfb75b
Opcode Fuzzy Hash: 943f3e3e715df5df2d59fd2ce18c109223204c4b5d3781c349d29a1a8e621e20
Instruction Fuzzy Hash: 95B1EFB1615600EEF7189F68FC85ABA37F8FB48351710401AF905C6EB1EB7C8941EB26

Function 000C5C39 Relevance: 7.7, APIs: 5, Instructions: 247
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 000C5DEC
FindFirstFileA.KERNELBASE(?,?), ref: 000C5EB2
DeleteFileA.KERNELBASE(?), ref: 000C5FE2
FindNextFileA.KERNELBASE(00000000,?), ref: 000C6020
FindClose.KERNEL32(00000000), ref: 000C6042

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: 0304f1a21f46f192774a60dfc0b2ed96913166de9c93906ce0e27c751e72419f
Instruction ID: 776328a147c840fca59686de9354d94b184148ff6fa1b872f9975b358b3a75e8
Opcode Fuzzy Hash: 0304f1a21f46f192774a60dfc0b2ed96913166de9c93906ce0e27c751e72419f
Instruction Fuzzy Hash: E8A1EFB5114A05CFF758CF54EC86AB933B8F744342710402AE906CAE71EB7CA986EF52

Function 000CE769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(000C8954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,000C8954), ref: 000CE865
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 000CE895
FreeSid.ADVAPI32(?), ref: 000CE8DC

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 44976fb9cdd092f20e6e6b0fc39a580a523aeb4be6bca759fd8a25db207696d7
Instruction ID: 7a8c73461f3bdb291b4493e2205844bb629f619409bb92743cadce3af56c7dc4
Opcode Fuzzy Hash: 44976fb9cdd092f20e6e6b0fc39a580a523aeb4be6bca759fd8a25db207696d7
Instruction Fuzzy Hash: 2C41BCB4915204EFEB04CFA5EC85AB977F4FB08305B40401AE50AD7A60EB3C9945FB16

Function 000CDE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,000D8109,?,000D8109,00000000), ref: 000CDE6C
RtlFreeHeap.NTDLL(00000000,?,000D8109,00000000), ref: 000CDE73

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 125a8eee30b0ad751e47ba119c7fdc67b8f2be73806f61a844f524327122d9a9
Instruction ID: ce7721993f9482c97c1c28098c68fa81f67eba1a13371c8e119a1844f3c6d335
Opcode Fuzzy Hash: 125a8eee30b0ad751e47ba119c7fdc67b8f2be73806f61a844f524327122d9a9
Instruction Fuzzy Hash: 78E0C232500384DBFE009BD5FC8AB2A3BE8FB61781F148121F905CA930C7299551DA84

Function 000D5498 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,000CDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 000D5628
CloseHandle.KERNEL32(000CDA33,?,?,?,?,00000000), ref: 000D5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 000D5665

Strings

D, xrefs: 000D55A3

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: cc6ac80bf967af553be75eccbe50e5790dfc2ce2c5553fb6cca33912906ba1f8
Instruction ID: d5b3e6c1843abba361c16602d90e655b41a74f7595ed27b0b61c4a50247308e5
Opcode Fuzzy Hash: cc6ac80bf967af553be75eccbe50e5790dfc2ce2c5553fb6cca33912906ba1f8
Instruction Fuzzy Hash: 49412432600A409BEB18DF64FC55ABA37B4FB84301B04401FE906CBAB1EB7D8801EB21

Function 000D54D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,000CDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 000D5628
CloseHandle.KERNEL32(000CDA33,?,?,?,?,00000000), ref: 000D5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 000D5665

Strings

D, xrefs: 000D55A3

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 2f409144b995f010346691955483ce284b18c75a58069c1cd4ca8180b7dd9675
Instruction ID: acc3cf1c1ebb7c438cf04b9fb0d8ca1000d82c6f5f74c5fdde50227263963d78
Opcode Fuzzy Hash: 2f409144b995f010346691955483ce284b18c75a58069c1cd4ca8180b7dd9675
Instruction Fuzzy Hash: 5941C171500A05DBEB18DF65FD999BA37B4FB84701B00401BE9069AE70EB7C9944FF26

Function 000CC622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000CB7CD: WaitForSingleObject.KERNEL32(000DAEAC,00004E20,00000001,?,000CBFA2,00000001,-AF16B4FB,?,000DAEAC,000C66DE), ref: 000CB81D

CreateFileA.KERNELBASE(00000004,40000000,00000000,00000000,00000002,00000000,00000000,?,000C67E3,?,00000004,?,00000000,?), ref: 000CC746
WriteFile.KERNELBASE(00000000,?,00000001,00000001,00000000,?,?,?,?,?,00000001), ref: 000CC90B
CloseHandle.KERNEL32(00000000,?,?,?,00000001), ref: 000CC983

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: File$CloseCreateHandleObjectSingleWaitWrite
String ID:
API String ID: 3361265286-0
Opcode ID: cd34f788ce7046903ca61005da043c318bd27d824c0eb75842df243fc03becf6
Instruction ID: 6de2c11b9a3003150cc86a3dc9f2f8993ac11691b45fcd18d0010e2a977cf5be
Opcode Fuzzy Hash: cd34f788ce7046903ca61005da043c318bd27d824c0eb75842df243fc03becf6
Instruction Fuzzy Hash: 9C91BAB1514601DBF708CF28ED95A7A3BF4FB84311710812AE90ACBAB1EB3D9941EF05

Function 000D20D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,000D09C2,?,?,?), ref: 000D20F0
CharLowerBuffA.USER32(?,00000000,?,000D09C2,?,?,?), ref: 000D2131

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 65f0a2c710b383e7ace3ccb8feb6b2df6dd4afa094e34cf11d710ca005338817
Instruction ID: 204405291c4f83ba75a4cefc070859559669394d06d63a96bc869e2628bed9a0
Opcode Fuzzy Hash: 65f0a2c710b383e7ace3ccb8feb6b2df6dd4afa094e34cf11d710ca005338817
Instruction Fuzzy Hash: 43F090315143049BEB05CF05EC4647A37F1FB64740700801AF8068AE30EB3DAD80FB56

Function 000E23A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,000EA3A7,?,?,?,000ED0BE), ref: 000E23F6
RtlAllocateHeap.NTDLL(00000000,?,000EA3A7,?,?,?,000ED0BE), ref: 000E23FD

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 8c4021f76e7a15f3e1517669c52a024a7321b4d9a01c00e579ca2fae3402e7cf
Instruction ID: 824fbc39bf0ba26bfddefa5d18f38e40aa4c866ccc7da2b69f46131adb7ebfef
Opcode Fuzzy Hash: 8c4021f76e7a15f3e1517669c52a024a7321b4d9a01c00e579ca2fae3402e7cf
Instruction Fuzzy Hash: D3F0E5361043419FEB108FA9FC89A7A37A4F304714B240002F449EA4B5C3BCE844DF50

Function 000D15E5 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 000D160D

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ffede3e330983a38755438b85723dfa9d2767e1827ef164de216c51d5e78bf8b
Instruction ID: f9916c16cb986cd92e016800c3f47e219ddf2a3ed9f0a8aef401c50a61c1cc46
Opcode Fuzzy Hash: ffede3e330983a38755438b85723dfa9d2767e1827ef164de216c51d5e78bf8b
Instruction Fuzzy Hash: 8CD012A4104344DAAB10AF64DC065753BB5FF487007411021EC44D9931EB79E900FB5B

Non-executed Functions

Function 000ED831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388pipeprocessfileCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,?,?,00000000,?,00000001,?), ref: 000ED98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 000ED9F9
CreatePipe.KERNEL32(?,?,?,00000000), ref: 000EDA48
SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 000EDA7E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 000EDBCC
WriteFile.KERNEL32(?,?,00000020,00000020,00000000), ref: 000EDC1C
CloseHandle.KERNEL32(?), ref: 000EDC33
CloseHandle.KERNEL32(?), ref: 000EDC66
CloseHandle.KERNEL32(?), ref: 000EDC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 000EDD4F
CloseHandle.KERNEL32(?), ref: 000EDD9F
CloseHandle.KERNEL32(?), ref: 000EDDB2
CloseHandle.KERNEL32(?), ref: 000EDE41
CloseHandle.KERNEL32(00000000), ref: 000EDE67
CloseHandle.KERNEL32(?), ref: 000EDE7E

Strings

D, xrefs: 000EDB1A

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: 7a11729726679cd6e3e5bc3e4f04dc36f0184592ee659b30eb9f623f7c9f16f9
Instruction ID: f53b1cee7553d8ad616101223310b5b2f4e9f497fe9c0e5cbcae4754687af883
Opcode Fuzzy Hash: 7a11729726679cd6e3e5bc3e4f04dc36f0184592ee659b30eb9f623f7c9f16f9
Instruction Fuzzy Hash: 2302C776614640DFEB14DF69EC81ABA7BF4FB08301714811AE806E7A30EB3D9951EF52

Function 000E84D7 Relevance: 23.4, APIs: 11, Strings: 2, Instructions: 688memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000,00000100), ref: 000E86E1
LoadLibraryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000,00000100), ref: 000E876A
GetProcAddress.KERNEL32(00000000,00000000), ref: 000E8854
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000,00000100), ref: 000E8891
HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000), ref: 000E88DD
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000,00000100), ref: 000E8908
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000), ref: 000E897A
HeapAlloc.KERNEL32(?,00000000,00000100,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000), ref: 000E89C3
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000,00000100), ref: 000E8A10
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000), ref: 000E90B2
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,000DB7C4,?,?,00000000,00000100), ref: 000E90D7

Strings

SAcA, xrefs: 000E8614
Q:3q, xrefs: 000E85DB

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Free$HeapLibrary$Alloc$AddressLoadProcProcess
String ID: Q:3q$SAcA
API String ID: 1560921867-494069912
Opcode ID: 862ce0fc4df080c7acaad3c4d94b10e3e8387cd43eca8532ba3d2d9fa3ec37fa
Instruction ID: 575b7b52360d4766831ea994d0f480e1dc24c6e476fa2783015d4831fb82b6c2
Opcode Fuzzy Hash: 862ce0fc4df080c7acaad3c4d94b10e3e8387cd43eca8532ba3d2d9fa3ec37fa
Instruction Fuzzy Hash: 3052DD71614640CFE758CF69EC816B937F4FB48311B14841AE90ADBAB1EB3C9940EB56

Function 000D8695 Relevance: 22.0, APIs: 10, Strings: 2, Instructions: 1045networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 000D9154
setsockopt.WS2_32(00000000,0000FFFF,00001006,00000000,00000004), ref: 000D91DB
gethostbyname.WS2_32(?), ref: 000D9261
inet_ntoa.WS2_32(?), ref: 000D92CF
inet_addr.WS2_32(00000000), ref: 000D92D6
htons.WS2_32(00000050), ref: 000D92FB
connect.WS2_32(00000000,?,00000010), ref: 000D9316
send.WS2_32(00000000,00000000,00000000,00000000), ref: 000D93A1
recv.WS2_32(00000000,?,00000400,00000000), ref: 000D947C
closesocket.WS2_32(00000000), ref: 000D97C6

Strings

;$Rb, xrefs: 000D8C35
/, xrefs: 000D8982

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonsinet_addrinet_ntoarecvsendsetsockoptsocket
String ID: /$;$Rb
API String ID: 4203722200-1076244922
Opcode ID: a611e5471c736219518736169f4de320fcc0f76a2cb4bdfcd95049bff88ecd1a
Instruction ID: 42cf90c1e04521ff2d7fcf94789ee76403cf34c3831c7ac92a8983322ba53b06
Opcode Fuzzy Hash: a611e5471c736219518736169f4de320fcc0f76a2cb4bdfcd95049bff88ecd1a
Instruction Fuzzy Hash: 0792D2715147008BF718DF64EC92AB937B4FB44711B10801BE90AD7AB1EB7D9981EB61

Function 000E35AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 000E3685
CreateServiceA.ADVAPI32(00000000,00930558,00930558,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 000E36D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 000E3728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 000E374C
CloseServiceHandle.ADVAPI32(00000000), ref: 000E375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 000E37D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 000E3836
CloseServiceHandle.ADVAPI32(00000000), ref: 000E3847
CloseServiceHandle.ADVAPI32(00000000), ref: 000E38B1

Strings

3ch, xrefs: 000E3701
qh~B, xrefs: 000E360F

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: 1a52161b501d93ca1e93a507c07e430d5382a31b2efeaec47b9220703ed6ced2
Instruction ID: 4b9a8291ea4e8fbeeb9ed1ba7b88d77f4b96d40ba119549ed9a7a2e346e8acbc
Opcode Fuzzy Hash: 1a52161b501d93ca1e93a507c07e430d5382a31b2efeaec47b9220703ed6ced2
Instruction Fuzzy Hash: E891C8B5614600AFF3088F29ED899793BF4FB49701340400AE902EBE71EB7D9A41FB51

Function 000C11B7 Relevance: 13.6, Strings: 9, Instructions: 2310COMMON

Download Yara Rule

Strings

T8G, xrefs: 000C29C2
%, xrefs: 000C2C72
l, xrefs: 000C2D0A
o, xrefs: 000C3187
0, xrefs: 000C3191
c< n, xrefs: 000C27BB
"Ib, xrefs: 000C2B38
l, xrefs: 000C2CFA
jQn, xrefs: 000C12C5

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: "Ib$%$0$c< n$jQn$l$l$o$T8G
API String ID: 0-3181560568
Opcode ID: da733d93755384a79fad938ffd9bb8eafaf8d109f8cdc662f927e4ce03018115
Instruction ID: f06d61fa37b2e299aa78b85b20e8765ed0b9b7bd4250194bb78440689634c5db
Opcode Fuzzy Hash: da733d93755384a79fad938ffd9bb8eafaf8d109f8cdc662f927e4ce03018115
Instruction Fuzzy Hash: 2A23CC75A146018BEB18CF68ED91ABD77F0FB59301B14811EE806DBE71E73C9981EB42

Function 000D1636 Relevance: 10.8, APIs: 7, Instructions: 279processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000D16B2
Process32First.KERNEL32(00000000,00000128), ref: 000D17BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 000D1932
Module32First.KERNEL32(00000000,00000224), ref: 000D1991
CloseHandle.KERNEL32(?,0000000A), ref: 000D1A6A
Process32Next.KERNEL32(00000000,00000128), ref: 000D1ACE
CloseHandle.KERNEL32(00000000), ref: 000D1AF5

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: f3ea9cef5b4728047c6f76dc8683e4f4a1d585120a82042af46159807db0822d
Instruction ID: ef4adf7f6c89ed5989a629e8f232f753cee30f7ccafdfaf4a6021420323fd5ab
Opcode Fuzzy Hash: f3ea9cef5b4728047c6f76dc8683e4f4a1d585120a82042af46159807db0822d
Instruction Fuzzy Hash: 7AC10276A04600DBF748DF64FC966BA37B4FB05312B00411AE909C6AA1EF7C9981EF55

Function 000D0806 Relevance: 10.7, APIs: 7, Instructions: 195processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000D08C2
Process32First.KERNEL32(00000000,00000128), ref: 000D0966
OpenProcess.KERNEL32(00000001,00000000,?), ref: 000D0A15
TerminateProcess.KERNEL32(00000000,000000FF), ref: 000D0A64
CloseHandle.KERNEL32(00000000), ref: 000D0A82
Process32Next.KERNEL32(00000000,00000128), ref: 000D0AD2
CloseHandle.KERNEL32(00000000), ref: 000D0B10

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: ff5d335054d8b3bd5fee8368dbed82d60ba4fa4a6922a89660dba498425eb217
Instruction ID: 04797fe68755b54e5e6751e5e06ae98a34d9c2a4aa34507db6436a4852ceb174
Opcode Fuzzy Hash: ff5d335054d8b3bd5fee8368dbed82d60ba4fa4a6922a89660dba498425eb217
Instruction Fuzzy Hash: 3881CB725116019BF344DF28FC91ABA37F8FB48712B40411AE90AC6E71EB7C8981EB56

Function 000D9F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 000D9FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 000DA049
GetLastError.KERNEL32 ref: 000DA061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 000DA162
CloseServiceHandle.ADVAPI32(00000000), ref: 000DA3B6

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: c3a3198d066e795e22a5e782b443dbc09fed017efb09c78c29453ac16f1ea919
Instruction ID: 37e3e35f29915d94bc47ddfa905703971ae3018f96b1a9e436870cc1680442b4
Opcode Fuzzy Hash: c3a3198d066e795e22a5e782b443dbc09fed017efb09c78c29453ac16f1ea919
Instruction Fuzzy Hash: A0D1EE76A046009FF708CF68FC85ABA37F4FB44311B15401BE905D7A61EB7C9A81EB62

Function 000C60AD Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 513COMMON

Download Yara Rule

Strings

-4/, xrefs: 000C61E4
, xrefs: 000C6516
, xrefs: 000C6809

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: $ $-4/
API String ID: 0-196967448
Opcode ID: f31f9be29c7e3c557d48bcf2dbdb7b5f130c96d1967cb197026c376f31357f3f
Instruction ID: 42ef52ad50d7025e1e43928f7197db8956cdb5a72923f5988517479c93506d45
Opcode Fuzzy Hash: f31f9be29c7e3c557d48bcf2dbdb7b5f130c96d1967cb197026c376f31357f3f
Instruction Fuzzy Hash: C8220372608600CFF718DF64ED86AB937F4FB49711B10401EE50AC7AA2EB7D9941EB16

Function 000C9903 Relevance: 7.3, Strings: 5, Instructions: 1018COMMON

Download Yara Rule

Strings

vE{, xrefs: 000CA18D, 000CA193
L08s, xrefs: 000C9A59
8%A, xrefs: 000CA337
, xrefs: 000CA648
5Nv, xrefs: 000CA271

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: $5Nv$8%A$L08s$vE{
API String ID: 0-1922508855
Opcode ID: fd43facd7c70926ab27fa52edf8669260c36e3e72292a5b0cd1dff189cb18260
Instruction ID: 60d238a165349b07e7ce8009aeb422b07f60a16f74962a858c56fe1c03fdebc1
Opcode Fuzzy Hash: fd43facd7c70926ab27fa52edf8669260c36e3e72292a5b0cd1dff189cb18260
Instruction Fuzzy Hash: 8592F172A04615CFEB18CFA8EC81ABE77F4FB05315714412EE806DBA61EB3D9941EB41

Function 000D571F Relevance: 6.2, APIs: 4, Instructions: 213processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000D5804
Process32First.KERNEL32(00000000,00000128), ref: 000D58E2
Process32Next.KERNEL32(00000000,00000128), ref: 000D59E8
CloseHandle.KERNEL32(00000000), ref: 000D5A7E

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 95cb47af45acf37140b125ec496ed65d6f0c67fcfa8130873e22786dd098a25e
Instruction ID: 8518b606b3c88e75450b8c4b2bc1865d17292a964656e9edcc762d8ccb3a207d
Opcode Fuzzy Hash: 95cb47af45acf37140b125ec496ed65d6f0c67fcfa8130873e22786dd098a25e
Instruction Fuzzy Hash: 0691DD75605A10CFE758DF28EC9A5BA37F4FB48312B10411AE906C7E60EB3C9942EF52

Function 000CCFBB Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 675threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,000E6E81,00000000,00000000,00000000), ref: 000CD636
CloseHandle.KERNEL32(00000000), ref: 000CD65B

Part of subcall function 000E4589: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,000CD583,Function_0000AD87,00000002,00000000), ref: 000E4637
Part of subcall function 000E4589: CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 000E4655
Part of subcall function 000E4589: CloseHandle.KERNEL32(00000000,?,00000002,?,000CD583,Function_0000AD87,00000002,00000000), ref: 000E468D
Part of subcall function 000E4589: WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,000CD583,Function_0000AD87,00000002,00000000), ref: 000E46A1
Part of subcall function 000E4589: CloseHandle.KERNEL32(?,00000002,?,000CD583,Function_0000AD87,00000002,00000000), ref: 000E4712

Strings

$}\N, xrefs: 000CCFD8, 000CCFDE

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseCreateHandle$Thread$EventObjectSingleWait
String ID: $}\N
API String ID: 784754931-3579273913
Opcode ID: 99a1485ea8b4bff1e9c53560b5f6985f4b2ae9fcea95808a106a3b33b85ea7af
Instruction ID: f2ecaf2f51c3b3ae74ac300c9171d10a9b759011f3ef4d8f8e630df1b4ea82ff
Opcode Fuzzy Hash: 99a1485ea8b4bff1e9c53560b5f6985f4b2ae9fcea95808a106a3b33b85ea7af
Instruction Fuzzy Hash: FC52BEB5614600DBE708DF64EC92AB933F5FB48301B14402FE906D6EB2EB7D9941EB51

Function 000C69A8 Relevance: 5.9, Strings: 4, Instructions: 901COMMON

Download Yara Rule

Strings

W/=D, xrefs: 000C6BA1
vE{, xrefs: 000C74B5, 000C74C9
:JDX, xrefs: 000C6DCA
cZ), xrefs: 000C6C06

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: :JDX$W/=D$cZ)$vE{
API String ID: 0-1531476030
Opcode ID: d29ffbb74da2be72beae2fb6c4b9f35328cbf44db3e29b7cb94d9127eb58ec28
Instruction ID: d84a7cf3e4af8694ae6ad6d6a417086f813e8741e3163a154a5d5ca4580bc186
Opcode Fuzzy Hash: d29ffbb74da2be72beae2fb6c4b9f35328cbf44db3e29b7cb94d9127eb58ec28
Instruction Fuzzy Hash: 3772CF72904605DFEB18DF68EC81ABE77F4FB44310B10812EE909D7A61EB399A41EF51

Function 000DB3DB Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 588COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,?), ref: 000DB528

Part of subcall function 000E42B6: lstrlen.KERNEL32(?,?,000C2347,?), ref: 000E4320

Strings

myiW, xrefs: 000DB70F

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: ComputerNamelstrlen
String ID: myiW
API String ID: 4141851928-4061706148
Opcode ID: ea62b910ef29f7e6157fe411a1f15e1e149d38703b36f1bb813e432391cff6a3
Instruction ID: c6e97f28017f2679e7e54e7ba6ceb3c9889225e4fd38a19121fdcb4e196d5657
Opcode Fuzzy Hash: ea62b910ef29f7e6157fe411a1f15e1e149d38703b36f1bb813e432391cff6a3
Instruction Fuzzy Hash: 5042C371904205CBE714EF64ED92AFE73B8FB14301B10401AE506E7AB2EF399A45EF61

Function 000ED256 Relevance: 3.1, APIs: 2, Instructions: 88timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(000E261C,?,?,000E261C), ref: 000ED2D5
GetTickCount.KERNEL32 ref: 000ED37D

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CountSystemTickTime
String ID:
API String ID: 2164215191-0
Opcode ID: b4f214a24bbe2e8eb2b435ee65f3a50d743c797933454a6b0878cbb05eb097ca
Instruction ID: 76fbe1599f8b120bcfccbbd1c92764031d1d398daab2046efe5df98b0185b635
Opcode Fuzzy Hash: b4f214a24bbe2e8eb2b435ee65f3a50d743c797933454a6b0878cbb05eb097ca
Instruction Fuzzy Hash: F5319C76624610CFF7049B68FC466BA77F4F748721304401AE805C7AB1EB7D8952FB5A

Function 000D5FBA Relevance: 1.9, Strings: 1, Instructions: 688COMMON

Download Yara Rule

Strings

B&>, xrefs: 000D6019

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: B&>
API String ID: 0-1526646359
Opcode ID: 825864b86ccc61672f9430a520d26234d7044cef6e018555c06a65337eb99faa
Instruction ID: bc89e831db79a6a9e20350888e1dd47e9ebf23e24dcab94e37372968ac1d9643
Opcode Fuzzy Hash: 825864b86ccc61672f9430a520d26234d7044cef6e018555c06a65337eb99faa
Instruction Fuzzy Hash: C452DC756047418FF708DF68EC926BA37F4F719701B14401BE949CAB62EB3D9981EB22

Function 000E24D3 Relevance: 1.8, APIs: 1, Instructions: 520sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000008AE), ref: 000E2D0A

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b6c1014346ed44cd36518ae2ebaceca3aac14e7b2e0e5f255aa5f95338840659
Instruction ID: d6a614164734eba557c08a0e25e83f2413615a0ec058e316f56011cde244dbfe
Opcode Fuzzy Hash: b6c1014346ed44cd36518ae2ebaceca3aac14e7b2e0e5f255aa5f95338840659
Instruction Fuzzy Hash: FD32CE71904644CFE708DF65ED92ABA77F4FB14301F10401AE50AEBAA1EB3D9945EF11

Function 000C46CF Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

"d@, xrefs: 000C4C45

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: "d@
API String ID: 0-2935523628
Opcode ID: 2eb649c41c375fa292f8ba1ef86f4e390be85c014183932eb8320f9c98056b23
Instruction ID: 7658c57a38914022eea820d481146f53397390381e0787cd8e688ba01033da8e
Opcode Fuzzy Hash: 2eb649c41c375fa292f8ba1ef86f4e390be85c014183932eb8320f9c98056b23
Instruction Fuzzy Hash: 91E18976614651CBF348CF28EC9167A37F0FB59712354811AE809CAE71EB7D9941FB02

Function 000E74E8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 000E7525

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 0b321e84a6bfce8ba830c26040b5605ef255b76fe5795a64b4a39d879280959b
Instruction ID: a52d18fff2259672500030e576d7a4181575b0d82fbc3165b36b37f28aecbf66
Opcode Fuzzy Hash: 0b321e84a6bfce8ba830c26040b5605ef255b76fe5795a64b4a39d879280959b
Instruction Fuzzy Hash: 20F03A72D102049BE704DF58E84977977F8F708316F04055ED419D3A20D7799A10DF80

Function 000D0CE6 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

'S, xrefs: 000D10BE

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID: 'S
API String ID: 0-46969972
Opcode ID: a10e10b229eda817aba11cc5cc11ccd14baf60aa60a525cb60b507c859c39891
Instruction ID: abf2754d2949d0c6c401b5d4b50b9537f421b3fa0dbc19629f38718673da1c9d
Opcode Fuzzy Hash: a10e10b229eda817aba11cc5cc11ccd14baf60aa60a525cb60b507c859c39891
Instruction Fuzzy Hash: DFA1BDB1614701CBE758CF28FD916BA77B5FB44311B10851BE80ACAF61EB7C9980EB61

Function 000E7DC0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ab9e6ed5a10f51edd541b495c218e6108439b4984ba194224c3e324f95a0b1
Instruction ID: d5ea5f311d060f8e743c6bcf4775f529ec538ff864c4f4b71102f8247eb8741e
Opcode Fuzzy Hash: 37ab9e6ed5a10f51edd541b495c218e6108439b4984ba194224c3e324f95a0b1
Instruction Fuzzy Hash: F7E1BC716142409FEB18DF29ED92AB937F5FB54300710842AE80ADBA72EB3DD941EB45

Function 000D0113 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df12cbc3776e622afc148e50592fb3ca8300fc77613350aef880e224f0545a7a
Instruction ID: bfcc383118492b408f5f9303ad339b6338c0b2ae6dfee758e3124902122e6036
Opcode Fuzzy Hash: df12cbc3776e622afc148e50592fb3ca8300fc77613350aef880e224f0545a7a
Instruction Fuzzy Hash: 45E1A175A102048FE748CF68EC9167A77F1FB98311B14802EE90AD7B61DB3DA940EF55

Function 000E3025 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58dece4fac7ff7546780cf248d74d7a49fa1bf17d2da48ae6fee283a038223d9
Instruction ID: aa87b2a12194cbab8c9cbf6bbd43d75b1fdc7557292e23f34d7eb3f3ebb62862
Opcode Fuzzy Hash: 58dece4fac7ff7546780cf248d74d7a49fa1bf17d2da48ae6fee283a038223d9
Instruction Fuzzy Hash: 87D1CC76610641CFE348CF69EC856793BF0F784312710802AE856DBEB0EB3D9A41EB45

Function 000D70E6 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a4334fd4b2e2cc938c74d7e23b40fb8f5ff0eb7b802ed257cc5d050e5bc15b
Instruction ID: 8ac066cc20c9a9cb1d467c930c00f3518f1e6bd1475e65f1a96d3627767f417a
Opcode Fuzzy Hash: 83a4334fd4b2e2cc938c74d7e23b40fb8f5ff0eb7b802ed257cc5d050e5bc15b
Instruction Fuzzy Hash: 1EC1E175A087418FE764CF28EC826BA37F4FB14710B14411BE94AC6A71E77C9980EB66

Function 000DA805 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 1e074014ce38d4921be473b94e3d1359620e9cd240e73641f614d990483b6e1e
Instruction ID: bc6bf7891ac4d265c464f52a8531b06dc87e1eea5de7ae3fe032cec67ff4dd24
Opcode Fuzzy Hash: 1e074014ce38d4921be473b94e3d1359620e9cd240e73641f614d990483b6e1e
Instruction Fuzzy Hash: 32B1AA796142418BE348CF68FCA257677F1FB59312304401AE84AC7E72EB3D9981FB66

Function 000E5F1E Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f293d30cb0c9cd84ef5620c37323cc6b9e798329e8403d18e3f46f0159fc0670
Instruction ID: 7cf4735b237f5b88b392a263858d572f7da97c55a1e9c26e9b034a15341fb874
Opcode Fuzzy Hash: f293d30cb0c9cd84ef5620c37323cc6b9e798329e8403d18e3f46f0159fc0670
Instruction Fuzzy Hash: BAB166B26056508FF358CF29FD9053A77F4FB99342314852AE816C6E31E73DA981EB41

Function 000C774C Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1b7c40aca5e4b21cb2fce41df90a5a3b9fd2dfb0a8fcfb4c70a2cbd479e615
Instruction ID: 58a2319b913f81be95daa07733a627de6b62ae624aca650de95fe3eeb167fa2e
Opcode Fuzzy Hash: 9d1b7c40aca5e4b21cb2fce41df90a5a3b9fd2dfb0a8fcfb4c70a2cbd479e615
Instruction Fuzzy Hash: 68B10C726196408FF744CF28EC82A797BF0FB65301744811EE949CBA71EB3C9A45EB52

Function 000CA928 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 015405222a94e8a017db98842f5afd36cfaf456ea4770dafb04abd2d5817a09b
Instruction ID: 8f10b3631841bb3235034b7237bae4ca928bb6ac69ac959460b46408cc856d63
Opcode Fuzzy Hash: 015405222a94e8a017db98842f5afd36cfaf456ea4770dafb04abd2d5817a09b
Instruction Fuzzy Hash: D281FF72A152058BF358CF68ED81A7A3BF4FB55311B04451AE809C7A72E77CC941FB46

Function 000EDFCC Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438af959dfd8cd4313425da3c2f6630689d1404d045420ab25a3789c4578f5fa
Instruction ID: 8fa2f1d4126f39b2b1aa8cdda45c39f7e964a7c6a553d0c96ace3ec4b26a98ce
Opcode Fuzzy Hash: 438af959dfd8cd4313425da3c2f6630689d1404d045420ab25a3789c4578f5fa
Instruction Fuzzy Hash: A271B9312046818FF348CF29ED956763BF5FB59302714812ED94ACAE71EB3D9981EB02

Function 000D3285 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637e6835dfff7f3cf7b04346372a860d7e438e0f448ae459b498cf93a4beef42
Instruction ID: 9789e4d9d858706cbf1da78c157ec5b1f2b6c5d4e1c855362a8863177d721584
Opcode Fuzzy Hash: 637e6835dfff7f3cf7b04346372a860d7e438e0f448ae459b498cf93a4beef42
Instruction Fuzzy Hash:

Function 000CC9ED Relevance: 12.2, APIs: 8, Instructions: 196registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 000CCAF2
SetServiceStatus.ADVAPI32(000FB2DC), ref: 000CCB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 000CCB78
SetServiceStatus.ADVAPI32(000FB2DC), ref: 000CCBE5
WaitForSingleObject.KERNEL32(00001388), ref: 000CCC62
SetServiceStatus.ADVAPI32(000FB2DC), ref: 000CCCAF
CloseHandle.KERNEL32 ref: 000CCCC5
SetServiceStatus.ADVAPI32(000FB2DC), ref: 000CCD8F

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 324aeba198ad10ffea55526eb4eb62dbedcc2c92a83d3b957d039de272cde8a3
Instruction ID: 40162f28cbd0f43fed072c83d7e9d15eba0478c0b0805e0ba5e25ba099c10ecf
Opcode Fuzzy Hash: 324aeba198ad10ffea55526eb4eb62dbedcc2c92a83d3b957d039de272cde8a3
Instruction Fuzzy Hash: 0D913E701112028BF758DF28ED99A7A3BF4FB09315310412AE80ACAE70DB7D9886FF45

Function 000DB046 Relevance: 9.2, APIs: 6, Instructions: 184filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 000DB104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 000DB16D
CloseHandle.KERNEL32(00000000), ref: 000DB1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000DB25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 000DB2AB
CloseHandle.KERNEL32(00000000), ref: 000DB2D8

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: c5a24f57f6c0984965800fa3c6362b9071fdca63125732eb7cfe54f43bce9389
Instruction ID: 00107956fdde6e92fd02d487df28e396361a2f14da60fb55699cfdad34cf0d5b
Opcode Fuzzy Hash: c5a24f57f6c0984965800fa3c6362b9071fdca63125732eb7cfe54f43bce9389
Instruction Fuzzy Hash: 4E71C876600205DBE354DF68ED8297A3BF8F745316715422AE906C6E60E73C9A81FB22

Function 000E4589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,000CD583,Function_0000AD87,00000002,00000000), ref: 000E4637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 000E4655
CloseHandle.KERNEL32(00000000,?,00000002,?,000CD583,Function_0000AD87,00000002,00000000), ref: 000E468D
WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,000CD583,Function_0000AD87,00000002,00000000), ref: 000E46A1
CloseHandle.KERNEL32(?,00000002,?,000CD583,Function_0000AD87,00000002,00000000), ref: 000E4712

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: af1a2bfc7a3ea4e8cef43563eb251a0a23b8746b48d5e021b6e450644b679ce5
Instruction ID: df6820bacbaaa26fd2395ec20d6bc9c8c45d8deb072c1aa64f466de01895d5f0
Opcode Fuzzy Hash: af1a2bfc7a3ea4e8cef43563eb251a0a23b8746b48d5e021b6e450644b679ce5
Instruction Fuzzy Hash: 3C419875115680DFE328DF29EC899363BF5F78A712314442AE94AD6E31E7399801EF12

Function 000E4927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 000E4CBC

Part of subcall function 000D074E: wvsprintfA.USER32(?,?,?), ref: 000D07C3

Sleep.KERNEL32(00015F90), ref: 000E4E60
DeleteFileA.KERNEL32(?), ref: 000E4E7F

Strings

KU, xrefs: 000E4A26

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: 64b633eb3ba29f7af26f1e976776db87d5114674fdb6a3f23544cf60759f033d
Instruction ID: c773bd8461b82435633c4411181a19ba401df00eeb24e7d959bd1123bb1ef88a
Opcode Fuzzy Hash: 64b633eb3ba29f7af26f1e976776db87d5114674fdb6a3f23544cf60759f033d
Instruction Fuzzy Hash: 14D103716146448FF718DF64EC92AB637F8FB44311B04401AE90ADBEB2DB3C9981EB52

Function 000D9B78 Relevance: 6.2, APIs: 4, Instructions: 201fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000D9C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 000D9CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 000D9DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 000D9E86

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: bf9c47768ae2daaf215fd855f7adfcc0390af7e65a3c8914400ad28718fd4a92
Instruction ID: c590a3708b5746c577f4165e4ce6a15269f505cdb5ed2cb347d9c128d3d7e6b4
Opcode Fuzzy Hash: bf9c47768ae2daaf215fd855f7adfcc0390af7e65a3c8914400ad28718fd4a92
Instruction Fuzzy Hash: 3781D175614200DBF714DF64EC82ABA37F9FB44711F00041AE90AD6AA1EB7C9981EB66

Function 000E90F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,000D8146,00000000,?,?,?,?,?,000CF85A,?,?,?,000E9573), ref: 000E9143
RtlReAllocateHeap.NTDLL(00000000,?,000D8146,00000000), ref: 000E914A
GetProcessHeap.KERNEL32(00000000,00000000,?,000D8146,00000000,?,?,?,?,?,000CF85A,?,?,?,000E9573,?), ref: 000E9174
HeapAlloc.KERNEL32(00000000,?,000D8146,00000000,?,?,?,?,?,000CF85A,?,?,?,000E9573,?,00000001), ref: 000E917B

Memory Dump Source

Source File: 00000001.00000002.1517705687.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000001.00000002.1517689490.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517730913.00000000000EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517745310.00000000000F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517760104.00000000000F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1517781625.00000000000FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c0000_7qBBKk0P4l.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 2ea3a75f32555cb028c674f5f9fe5643fca41f417d9c876d0d37c535977af1c4
Instruction ID: 6ee52a05d3972bcfe3507dd55b3e3c92e587c7d60e1df81b0c729d15dce869c2
Opcode Fuzzy Hash: 2ea3a75f32555cb028c674f5f9fe5643fca41f417d9c876d0d37c535977af1c4
Instruction Fuzzy Hash: 1F010476540604DFEB449FA0FC89A793BA4FB08702F844015FA0ACAA62EB7DA450EB41

Analysis Process: psjpq2i82ktsjq0yguk.exePID: 6892, Parent PID: 1824COMMON

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	1341
Total number of Limit Nodes:	6

Executed Functions

Function 009288A8 Relevance: 30.6, APIs: 12, Strings: 5, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(0095B028), ref: 0092893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00928AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 00928D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 00928D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00928DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00928E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00929158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 009291F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 0092936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 009294DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 0092963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 009297B0

Strings

C:\hjflhukc\, xrefs: 00928DF6, 00929174, 0092947F, 00929666
h)N^, xrefs: 00928A54, 00928A77
\, xrefs: 009293D0
C:\Users\user, xrefs: 00929016, 0092908E
gKV`, xrefs: 00928CE7

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\hjflhukc\$\$gKV`$h)N^
API String ID: 1691758827-1793791328
Opcode ID: 01c0a82bda414126406af9849950415a7e3066d74ce1552f96a92a5c628a16e8
Instruction ID: 8c79724b8408aabb7829b235db8c56f66a9055d9a8dd8fe6478979fbcb31eade
Opcode Fuzzy Hash: 01c0a82bda414126406af9849950415a7e3066d74ce1552f96a92a5c628a16e8
Instruction Fuzzy Hash: 5682027153D314DBD708DF66FC92AAA77B8FB44303B00412AE506D62B1EB349A85EF15

Function 009484D7 Relevance: 26.9, APIs: 13, Strings: 2, Instructions: 688
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000,00000100), ref: 009486E1
LoadLibraryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000,00000100), ref: 0094876A
GetProcAddress.KERNEL32(00000000,00000000), ref: 00948854
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000,00000100), ref: 00948891
HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000), ref: 009488DD
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000,00000100), ref: 00948908
GetAdaptersInfo.IPHLPAPI(00000000,00000100,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000,00000100), ref: 00948935
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000), ref: 0094897A
HeapAlloc.KERNEL32(?,00000000,00000100,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000), ref: 009489C3
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000,00000100), ref: 00948A10
GetAdaptersInfo.IPHLPAPI(00000000,00000100,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000,00000100), ref: 00948A78
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000), ref: 009490B2
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0093B7C4,?,?,00000000,00000100), ref: 009490D7

Strings

SAcA, xrefs: 00948614
Q:3q, xrefs: 009485DB

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: Free$HeapLibrary$AdaptersAllocInfo$AddressLoadProcProcess
String ID: Q:3q$SAcA
API String ID: 2633798829-494069912
Opcode ID: d107d072fe1058bfc95f24c68753aac4ca31b1e3bf17e1a80b721b3d4b53da2b
Instruction ID: a24828422ca9d5900ecf50485fa0838cbc3c0f96437f3371b9e05c97430a7b26
Opcode Fuzzy Hash: d107d072fe1058bfc95f24c68753aac4ca31b1e3bf17e1a80b721b3d4b53da2b
Instruction Fuzzy Hash: 7D52967653C700CBD748CF6AFC92A6A77B4FB58313B10451AE802DB2B1EB349981EB15

Function 0093FF2A Relevance: 19.9, APIs: 6, Strings: 5, Instructions: 627
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^d/, xrefs: 00940102
~z0, xrefs: 009406C2
241, xrefs: 00940787
hM6, xrefs: 00940706
C:\Users\user, xrefs: 0094058A

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID:
String ID: 241$C:\Users\user$^d/$hM6$~z0
API String ID: 0-2828660445
Opcode ID: 604f5e8e86839b08bd1ad4f49d713961ac0eba1796e6ac8ccb42739e3f2d0f86
Instruction ID: ef951346ac9d59f61920fcc5e8da0487703fa14ce00c40b0ed5aedde8aa56e93
Opcode Fuzzy Hash: 604f5e8e86839b08bd1ad4f49d713961ac0eba1796e6ac8ccb42739e3f2d0f86
Instruction Fuzzy Hash: 9C42DD7153D300EFE748DF67FC96A363BB4FB84716B10411AE6059A2B1EB708881EB15

Function 009435AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST(00000000,00000000,00000002), ref: 00943685
CreateServiceA.ADVAPI32(00000000,0165FC78,0165FC78,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 009436D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00943728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0094374C
CloseServiceHandle.ADVAPI32(00000000), ref: 0094375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 009437D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00943836
CloseServiceHandle.ADVAPI32(00000000), ref: 00943847
CloseServiceHandle.ADVAPI32(00000000), ref: 009438B1

Strings

3ch, xrefs: 00943701
qh~B, xrefs: 0094360F

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: 71959f1e12a275422dfba4c3d1235d429a920c0f8f218aee2abac8f4a2a46fab
Instruction ID: 8f836497303f5c4b2f2fab2291e8592d7687ba4216f036f4004962b4e8438056
Opcode Fuzzy Hash: 71959f1e12a275422dfba4c3d1235d429a920c0f8f218aee2abac8f4a2a46fab
Instruction Fuzzy Hash: BC9184B553C700EBD7088F6AFD9693977B8F748303741811AE8029B2B1EB749A81FB54

Function 0093B3DB Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 588
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,?), ref: 0093B528

Part of subcall function 009442B6: lstrlen.KERNEL32(?,?,00922347,?), ref: 00944320

Strings

myiW, xrefs: 0093B70F
K]g[, xrefs: 0093B819

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: ComputerNamelstrlen
String ID: K]g[$myiW
API String ID: 4141851928-3148350528
Opcode ID: b1fdce82efc8136708ddc4e555edac62f694b3ca6b3ae4e5a27dbce11ce67c22
Instruction ID: 65df62d66a2b5a764a2819cea290139b7fde12feb5bfa4040b112504a6a186ad
Opcode Fuzzy Hash: b1fdce82efc8136708ddc4e555edac62f694b3ca6b3ae4e5a27dbce11ce67c22
Instruction Fuzzy Hash: 3142BF71928315CBDB04EFA6FD92ABA73B8FB54306F40011AE506E71B1EB309A45EF51

Function 0092BECE Relevance: 4.7, APIs: 3, Instructions: 222
libraryloaderencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0092C004
GetProcAddress.KERNEL32(00000000), ref: 0092C080
CryptGenRandom.ADVAPI32(00000004,009266DE,-AF16B4FB,?,0093AEAC,009266DE), ref: 0092C1D3

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: AddressProc$CryptRandom
String ID:
API String ID: 646182245-0
Opcode ID: 86155718653e45debacc9fc974e7734977ac7d649f7ee83f43d2d2fff4ffb172
Instruction ID: d761243f22a95a34a41598a6a40378d8c44458433c6d24b8070be1c72da2dc2f
Opcode Fuzzy Hash: 86155718653e45debacc9fc974e7734977ac7d649f7ee83f43d2d2fff4ffb172
Instruction Fuzzy Hash: 1991BA7153C311CBEB18CF66FC56A2A37E5FB48363B50421AE816C66B5EB708980FB45

Function 00935498 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,0092DA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00935628
CloseHandle.KERNEL32(0092DA33,?,?,?,?,00000000), ref: 00935652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00935665

Strings

D, xrefs: 009355A3

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 783f25a9a7523b7a0efb51159080f3854a0831d5adbc09d80aa26060236b52d9
Instruction ID: 7759acc9d7cd3876342c915a6269bbe3eefeb451ad76020c8784ce4fc8f184b3
Opcode Fuzzy Hash: 783f25a9a7523b7a0efb51159080f3854a0831d5adbc09d80aa26060236b52d9
Instruction Fuzzy Hash: A1411172528740CBC758DFA6FDA6ABA77B8FB88316B10411EE902CB171E7349804FB15

Function 009354D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,0092DA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00935628
CloseHandle.KERNEL32(0092DA33,?,?,?,?,00000000), ref: 00935652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00935665

Strings

D, xrefs: 009355A3

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 2dcd8e6b17485bb3bb65629a73edccfffa977f6b06857966adc6e7585050706d
Instruction ID: 6e11bda67059366b22091a31ff7aa94e38defd6627a734f88942a0fe5c35a463
Opcode Fuzzy Hash: 2dcd8e6b17485bb3bb65629a73edccfffa977f6b06857966adc6e7585050706d
Instruction Fuzzy Hash: A141017142D704DBDB58DFA7FDAAA7A37B8FB88706B01411AE502961B1EB309840FF15

Function 00939B78 Relevance: 6.2, APIs: 4, Instructions: 201
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00939C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00939CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00939DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00939E86

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: f91c32ef6332f451924b97e463cfd904fd79034d251c5bd14eaaf80170068f5e
Instruction ID: 30a0e3fc86c5048f4b98682c4a114c5623cabd4aa698370ccf0344e3ac09544e
Opcode Fuzzy Hash: f91c32ef6332f451924b97e463cfd904fd79034d251c5bd14eaaf80170068f5e
Instruction Fuzzy Hash: E081C875539300CBDB10EF66FC92B7A37B9FB44303F00051AE906C62A1EB748981EB55

Function 0092C622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0092B7CD: WaitForSingleObject.KERNEL32(0093AEAC,00004E20,00000001,?,0092BFA2,00000001,-AF16B4FB,?,0093AEAC,009266DE), ref: 0092B81D

CreateFileA.KERNELBASE(00000004,40000000,00000000,00000000,00000002,00000000,00000000,?,009267E3,?,00000004,?,00000000,?), ref: 0092C746
WriteFile.KERNELBASE(00000000,?,00000001,00000001,00000000,?,?,?,?,?,00000001), ref: 0092C90B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,00000001), ref: 0092C983

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationObjectSingleWaitWrite
String ID:
API String ID: 2552625159-0
Opcode ID: e197fc8ab820518c91365bdfd9375e5c1b7d4095adedb080de4b87de0d464afb
Instruction ID: 76732f4c1c2392b4b30b497b60e02c0e7e17a3b289151b168098e460b1978927
Opcode Fuzzy Hash: e197fc8ab820518c91365bdfd9375e5c1b7d4095adedb080de4b87de0d464afb
Instruction Fuzzy Hash: B491A8B553C301DBD748CF6AFDA592A7BB8FB88316B50811AE406CB2B5E7349941EF04

Function 0092E769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00928954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00928954), ref: 0092E865
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 0092E895
FreeSid.ADVAPI32(?), ref: 0092E8DC

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 1c501299f9deac488f0768493c3805bdedc6a221ad16a70f9ae499d212f9a6f9
Instruction ID: 19c934c8f8b77b3e4b23d5bb4ef66904302ec0e60c83cf38f857d69d465db7e0
Opcode Fuzzy Hash: 1c501299f9deac488f0768493c3805bdedc6a221ad16a70f9ae499d212f9a6f9
Instruction Fuzzy Hash: 2941657492D304EFDB04CFA7FC9566AB7B8FB08307B80445AE902D7261E7349A80EB55

Function 009320D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,009309C2,?,?,?), ref: 009320F0
CharLowerBuffA.USER32(?,00000000,?,009309C2,?,?,?), ref: 00932131

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: ad20e0a472b1a464d18d5ca1a52033da6983b036f385cbbeee4a29384c7696c3
Instruction ID: b2e7f42002f11081e02e1a79f070d273e3de02f3ed289a92e9703dfb8d4a0390
Opcode Fuzzy Hash: ad20e0a472b1a464d18d5ca1a52033da6983b036f385cbbeee4a29384c7696c3
Instruction Fuzzy Hash: 30F0673153C304DBDB098F87ED464363BF2F7547027504419F9068A670E7349D90BB56

Function 009423A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,0094A3A7,?,?,?,0094D0BE), ref: 009423F6
RtlAllocateHeap.NTDLL(00000000,?,0094A3A7,?,?,?,0094D0BE), ref: 009423FD

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: aae9efdeec3abea18ba2e6e6a507d4416d78026b24078caf9edce7cb38c71896
Instruction ID: f00eb7d1a84b6d199b28aa83a7db1d31198eb9bca371ffdd7138257dea725af7
Opcode Fuzzy Hash: aae9efdeec3abea18ba2e6e6a507d4416d78026b24078caf9edce7cb38c71896
Instruction Fuzzy Hash: 2AF065365293019FCB108FAAFD5AE5A3774F75575AB640012F009DA0B5D778E844AFA0

Function 0092DE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00938109,?,00938109,00000000), ref: 0092DE6C
RtlFreeHeap.NTDLL(00000000,?,00938109,00000000), ref: 0092DE73

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 238fce795d957242268c7b1034c52ad3b0c718464ec36591456b8981c7c79dcb
Instruction ID: c8050f8fa14fdf1c0177c78f3a13ebe97fcf93a42c5335edc7744dbaf78062c8
Opcode Fuzzy Hash: 238fce795d957242268c7b1034c52ad3b0c718464ec36591456b8981c7c79dcb
Instruction Fuzzy Hash: 6EE08C3256D3449BEE408BE7FC4AA053BE8FB21346F008510F109CA170C7219580AB84

Function 00923B2C Relevance: 1.6, APIs: 1, Instructions: 104
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00923BF6

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 008d5297080d6932774a5eac6ac76a66027dd2ea3f51a9e0b314f1f68cbb5872
Instruction ID: 928b0ec18fb0bbe2b0dca67997e5d3e2ec0884abb9ea317872c985ac906b42d2
Opcode Fuzzy Hash: 008d5297080d6932774a5eac6ac76a66027dd2ea3f51a9e0b314f1f68cbb5872
Instruction Fuzzy Hash: 3941C372979304DBC364DF6BFC56AA677B8E744317F04812AEA05D7261DA308A81EF90

Function 009315E5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0093160D

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 368187959c17c49147fd308aa256943e53e9b680da9d610695518760cb09aa80
Instruction ID: 538020b19e5244ccbd70304e9d18286a50419591057c48f4e0ac7ae757a1d939
Opcode Fuzzy Hash: 368187959c17c49147fd308aa256943e53e9b680da9d610695518760cb09aa80
Instruction Fuzzy Hash: 42D0126442C3549B87107FB7AD064263BB4FF04602B411111E941D9030DB70D900EB5F

Non-executed Functions

Function 0094D831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388pipeprocessfileCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,?,?,00000000,?,00000001,?), ref: 0094D98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0094D9F9
CreatePipe.KERNEL32(?,?,?,00000000), ref: 0094DA48
SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 0094DA7E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 0094DBCC
WriteFile.KERNEL32(?,?,00000020,00000020,00000000), ref: 0094DC1C
CloseHandle.KERNEL32(?), ref: 0094DC33
CloseHandle.KERNEL32(?), ref: 0094DC66
CloseHandle.KERNEL32(?), ref: 0094DC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 0094DD4F
CloseHandle.KERNEL32(?), ref: 0094DD9F
CloseHandle.KERNEL32(?), ref: 0094DDB2
CloseHandle.KERNEL32(?), ref: 0094DE41
CloseHandle.KERNEL32(00000000), ref: 0094DE67
CloseHandle.KERNEL32(?), ref: 0094DE7E

Strings

D, xrefs: 0094DB1A

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: e4a24dc9ec912dd6d86fa682310167e2c9653fe3b93552776f124de6a5b4f3b6
Instruction ID: 7b6edcd266032a779d2260ac3cb4451852a7bbc3a04f5cf32d9cfa17bafd6528
Opcode Fuzzy Hash: e4a24dc9ec912dd6d86fa682310167e2c9653fe3b93552776f124de6a5b4f3b6
Instruction Fuzzy Hash: 8F02867A53E704DBDB04CF6AFC92A6A7BF8FB08306710451AE802D7271E7349981EB55

Function 0093111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009311F7
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00931267
CloseHandle.KERNEL32(00000000), ref: 0093128B
GetTickCount.KERNEL32 ref: 009312D1
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0093153B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0093157E
CloseHandle.KERNEL32(00000000), ref: 0093158F

Strings

Ra);, xrefs: 00931514

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID: Ra);
API String ID: 3478262135-4229484525
Opcode ID: ae5a08f46d9ad0b533b7d0bfc872c1c843339ffecb5b6de46710939209491d31
Instruction ID: e87c29febbf38ab6df0f2cf05634c472d151b93a035179b6e0a16c8514e065d9
Opcode Fuzzy Hash: ae5a08f46d9ad0b533b7d0bfc872c1c843339ffecb5b6de46710939209491d31
Instruction Fuzzy Hash: 66B1BCB153D700DBE7188F6AFC96A7A37B8FB48357B50011AF905C62B1EB348941EB19

Function 00931636 Relevance: 10.8, APIs: 7, Instructions: 279processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009316B2
Process32First.KERNEL32(00000000,00000128), ref: 009317BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00931932
Module32First.KERNEL32(00000000,00000224), ref: 00931991
CloseHandle.KERNEL32(?,0000000A), ref: 00931A6A
Process32Next.KERNEL32(00000000,00000128), ref: 00931ACE
CloseHandle.KERNEL32(00000000), ref: 00931AF5

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: 08a45d01d67d327062cb0ab2b6ebc62621354c83a2285c3233f521ab1a220aa8
Instruction ID: 249b8de77e29de28da7e7993cbb9ac265be6915765f0e29b73911c4e2c62eb45
Opcode Fuzzy Hash: 08a45d01d67d327062cb0ab2b6ebc62621354c83a2285c3233f521ab1a220aa8
Instruction Fuzzy Hash: 9CC1CD7652D700CBD708DF66FC966AA33B8FB54317F00411AE906C62B1EB749981EF45

Function 00939F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00939FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 0093A049
GetLastError.KERNEL32 ref: 0093A061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 0093A162
CloseServiceHandle.ADVAPI32(00000000), ref: 0093A3B6

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: 2df7b6d53438691bc1b90d30fbb38453cfdd5d3abfc28448a3c8c4a54c9c0a5c
Instruction ID: 812a67c86106ad5c20a65d0fda30a0dc38e33f3df8e1f6d17181296b0228d20d
Opcode Fuzzy Hash: 2df7b6d53438691bc1b90d30fbb38453cfdd5d3abfc28448a3c8c4a54c9c0a5c
Instruction Fuzzy Hash: CAD1FD7692C700DFC708CFA6FC95A6A77F4FB54313B15411AE8029B2B0EB349A81EB41

Function 00925C39 Relevance: 7.7, APIs: 5, Instructions: 247filesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00925DEC
FindFirstFileA.KERNEL32(?,?), ref: 00925EB2
DeleteFileA.KERNEL32(?), ref: 00925FE2
FindNextFileA.KERNEL32(00000000,?), ref: 00926020
FindClose.KERNEL32(00000000), ref: 00926042

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: 24976d42402ea07f7ff60ed4af5345d4f289eac043311aba1282720e03840eac
Instruction ID: 548b8e97f91bf05f8f2441fdd70f293373b703242388c29cc6a994760495127b
Opcode Fuzzy Hash: 24976d42402ea07f7ff60ed4af5345d4f289eac043311aba1282720e03840eac
Instruction Fuzzy Hash: 81A1CDB153DB14CBD748CF67FC966A937B8F748303B10011AE906CA6B1EB349981EB85

Function 0093571F Relevance: 6.2, APIs: 4, Instructions: 213processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00935804
Process32First.KERNEL32(00000000,00000128), ref: 009358E2
Process32Next.KERNEL32(00000000,00000128), ref: 009359E8
CloseHandle.KERNEL32(00000000), ref: 00935A7E

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 66e78881ed29dea81f1b83171c8b8756ac619bac0b17db2e39a0f0522ee8923f
Instruction ID: b061db91418efd3e2ef13193e85d73e3be9479326d789ce2700592859f6af383
Opcode Fuzzy Hash: 66e78881ed29dea81f1b83171c8b8756ac619bac0b17db2e39a0f0522ee8923f
Instruction Fuzzy Hash: 2A91987662D700CBD748DB6BFCAA56A77F8F748313B11451AE906C62B0EB349A41EF01

Function 0093AE3B Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c84360fe667dd33fde9d5f1a61b8b421a18eeb2784db202f526d3433e4e71e
Instruction ID: 6583474bfe70aa8df64c7a02effac56954a42181381500c15576bdccf00fbbee
Opcode Fuzzy Hash: 23c84360fe667dd33fde9d5f1a61b8b421a18eeb2784db202f526d3433e4e71e
Instruction Fuzzy Hash: 1F111971138300CBD359CF6AFD8152437B4B754347B61981AE552DB6B1EB209581EF06

Function 0092C9ED Relevance: 12.2, APIs: 8, Instructions: 196registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 0092CAF2
SetServiceStatus.ADVAPI32(0095B2DC), ref: 0092CB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0092CB78
SetServiceStatus.ADVAPI32(0095B2DC), ref: 0092CBE5
WaitForSingleObject.KERNEL32(00001388), ref: 0092CC62
SetServiceStatus.ADVAPI32(0095B2DC), ref: 0092CCAF
CloseHandle.KERNEL32 ref: 0092CCC5
SetServiceStatus.ADVAPI32(0095B2DC), ref: 0092CD8F

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: b2f6b2c00370bd64485e742e40b0b6b771bf30321437122fd61d7523716747ec
Instruction ID: 92e02a7b656cb0b9639c95d8e7991808c5579047442943740eb03bf32ee89ea5
Opcode Fuzzy Hash: b2f6b2c00370bd64485e742e40b0b6b771bf30321437122fd61d7523716747ec
Instruction Fuzzy Hash: EC9131B003D3118BD754CF6BFD9A92A7BF8F71830B740451AE5468A2B1EB309882FB55

Function 00930806 Relevance: 10.7, APIs: 7, Instructions: 195processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009308C2
Process32First.KERNEL32(00000000,00000128), ref: 00930966
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00930A15
TerminateProcess.KERNEL32(00000000,000000FF), ref: 00930A64
CloseHandle.KERNEL32(00000000), ref: 00930A82
Process32Next.KERNEL32(00000000,00000128), ref: 00930AD2
CloseHandle.KERNEL32(00000000), ref: 00930B10

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 869d7122863b514be2ed18c5125d7ebf8fd0487eae603bee152f2b24d36bef96
Instruction ID: 9234fa16e5fa372aecf2b804aad149b470eafa9880df069214d860a55a733a62
Opcode Fuzzy Hash: 869d7122863b514be2ed18c5125d7ebf8fd0487eae603bee152f2b24d36bef96
Instruction Fuzzy Hash: B581B97253C7019BD344CF6BFCA2A7A73B8FB48313B40411AE806D66B1EB348981EB44

Function 0093B046 Relevance: 9.2, APIs: 6, Instructions: 184filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0093B104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0093B16D
CloseHandle.KERNEL32(00000000), ref: 0093B1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0093B25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 0093B2AB
CloseHandle.KERNEL32(00000000), ref: 0093B2D8

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 5aa7b0a031f3e3f204a4f3b402cd4cbad387e84a28142ceac36e6d5a5f23a4e7
Instruction ID: a46c2b3cf955f9ef332703b35eb8e74120eb3e98b1b363a2d78524ee9ffb76da
Opcode Fuzzy Hash: 5aa7b0a031f3e3f204a4f3b402cd4cbad387e84a28142ceac36e6d5a5f23a4e7
Instruction Fuzzy Hash: 2471A93163D304CBD744CF6AFD9297A7BB8F708327B50061AE952C76A0E3349A81EB15

Function 00944589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,0092D583,Function_0000AD87,00000002,00000000), ref: 00944637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00944655
CloseHandle.KERNEL32(00000000,?,00000002,?,0092D583,Function_0000AD87,00000002,00000000), ref: 0094468D
WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,0092D583,Function_0000AD87,00000002,00000000), ref: 009446A1
CloseHandle.KERNEL32(?,00000002,?,0092D583,Function_0000AD87,00000002,00000000), ref: 00944712

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 730a68243a6680daa7bca0f867538d9233e002fca2ebc83a4bd0f411902eefcc
Instruction ID: 49858082caec1407205fde7909d0bc4a1bdf036f2838ae0ed376b512d0a755aa
Opcode Fuzzy Hash: 730a68243a6680daa7bca0f867538d9233e002fca2ebc83a4bd0f411902eefcc
Instruction Fuzzy Hash: 54417635439340DFC714CF6AFD85A2A7BF6F7997177A1441AE806C6671E330A842EB11

Function 00944927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00944CBC

Part of subcall function 0093074E: wvsprintfA.USER32(?,?,?), ref: 009307C3

Sleep.KERNEL32(00015F90), ref: 00944E60
DeleteFileA.KERNEL32(?), ref: 00944E7F

Strings

KU, xrefs: 00944A26

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: afab1c89f7e06779df01518e111bfb301c4f7bde721a179bc4d04ea389b22473
Instruction ID: 2c3e6a43b7346ea7d537ed251e0bf10a14ab3b99a3276043862110a6eac1046a
Opcode Fuzzy Hash: afab1c89f7e06779df01518e111bfb301c4f7bde721a179bc4d04ea389b22473
Instruction Fuzzy Hash: BBD1E07553C704DED708DF66FC92AA677B8FB48302B40050AE906DB2B1EB349A81EB55

Function 009490F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00938146,00000000,?,?,?,?,?,0092F85A,?,?,?,00949573), ref: 00949143
RtlReAllocateHeap.NTDLL(00000000,?,00938146,00000000), ref: 0094914A
GetProcessHeap.KERNEL32(00000000,00000000,?,00938146,00000000,?,?,?,?,?,0092F85A,?,?,?,00949573,?), ref: 00949174
HeapAlloc.KERNEL32(00000000,?,00938146,00000000,?,?,?,?,?,0092F85A,?,?,?,00949573,?,00000001), ref: 0094917B

Memory Dump Source

Source File: 00000002.00000002.1501190890.0000000000921000.00000020.00000001.01000000.00000004.sdmp, Offset: 00920000, based on PE: true

Associated: 00000002.00000002.1500960187.0000000000920000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501214717.000000000094F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501226749.0000000000950000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501242274.0000000000953000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1501255782.000000000095C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_920000_psjpq2i82ktsjq0yguk.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 2b312b86d07a0b5d5020e9604707a9cca724b7293469acdd3e2b8b0e4620316c
Instruction ID: 7f87cb442f44dadded5d7e8e0b5699518c8a3eb8fbbbfc20c0340c2a7286f22f
Opcode Fuzzy Hash: 2b312b86d07a0b5d5020e9604707a9cca724b7293469acdd3e2b8b0e4620316c
Instruction Fuzzy Hash: B5014F76568704DFDB049FA6FC69A293BB4FB09302F854015FA1AC7672E775A440EB40

Analysis Process: yanidfx.exePID: 2768, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	19.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1503
Total number of Limit Nodes:	22

Executed Functions

Function 006FFF2A Relevance: 68.5, APIs: 29, Strings: 9, Instructions: 2026synchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 00700590
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 007005E4
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00700629
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00700649
GetTickCount.KERNEL32 ref: 007006E6
GetCommandLineA.KERNEL32 ref: 00700873

Strings

$}\N, xrefs: 007013B4
HO, xrefs: 00701893
241, xrefs: 00700787
C:\Windows\system32\config\systemprofile, xrefs: 0070058A
wb_m, xrefs: 00701FC6
tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe", xrefs: 0070204C, 0070205D, 007020B6
C:\hjflhukc\xxxniijvj.exe, xrefs: 0070187E, 00701883, 007018C6, 00701E76, 00701E94, 00701EAE, 007020C8
~z0, xrefs: 007006C2
^d/, xrefs: 00700102

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CreateMutex$CommandCountEnvironmentLineTickVariable
String ID: $}\N$241$C:\Windows\system32\config\systemprofile$C:\hjflhukc\xxxniijvj.exe$HO$^d/$tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"$wb_m$~z0
API String ID: 3327569919-2039580995
Opcode ID: 17797059419fb3c61bd7669142564b569e9fba1c1c56f6308d705395b899ee1b
Instruction ID: 2e3ee24ea039e9ae000fe3fc675072ef79b44a8e7a0d3c89c776d4fb59986b0b
Opcode Fuzzy Hash: 17797059419fb3c61bd7669142564b569e9fba1c1c56f6308d705395b899ee1b
Instruction Fuzzy Hash: 9A039771605204DBD748DF6CEC96AFA37F5FB48711B10C21AE9028A2E1EB3C9981CB5D

Function 006E88A8 Relevance: 30.6, APIs: 12, Strings: 5, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(0071B028), ref: 006E893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 006E8AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 006E8D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 006E8D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 006E8DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 006E8E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 006E9158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 006E91F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 006E936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 006E94DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 006E963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 006E97B0

Strings

C:\hjflhukc\, xrefs: 006E8DF6, 006E9174, 006E947F, 006E9666
\, xrefs: 006E93D0
C:\Windows\system32\config\systemprofile, xrefs: 006E9016, 006E908E
gKV`, xrefs: 006E8CE7
h)N^, xrefs: 006E8A54, 006E8A77

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\hjflhukc\$\$gKV`$h)N^
API String ID: 1691758827-4224816522
Opcode ID: 08fbe189352bd912b15d668c85a30f205a2e38a6bffee895818c3075c7e7aea1
Instruction ID: 00f4b4968db0ca244334dd44df3b101a23cd8d80053d011cfd0d73d7c2504618
Opcode Fuzzy Hash: 08fbe189352bd912b15d668c85a30f205a2e38a6bffee895818c3075c7e7aea1
Instruction Fuzzy Hash: 6782D0B1515244DFC748DB6DEC969EA37BAFB44300B00C06AE906DB2E1EB3C9946CB5D

Function 007084D7 Relevance: 26.9, APIs: 13, Strings: 2, Instructions: 688
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100,00000009), ref: 007086E1
LoadLibraryA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100,00000009), ref: 0070876A
GetProcAddress.KERNEL32(00000000,00000000), ref: 00708854
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100,00000009), ref: 00708891
HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100), ref: 007088DD
FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100,00000009), ref: 00708908
GetAdaptersInfo.IPHLPAPI(00000000,00000009,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100,00000009), ref: 00708935
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100), ref: 0070897A
HeapAlloc.KERNEL32(?,00000000,00000009,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100), ref: 007089C3
FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100,00000009), ref: 00708A10
GetAdaptersInfo.IPHLPAPI(00000000,00000009,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100,00000009), ref: 00708A78
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100), ref: 007090B2
FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,?,006FB7C4,?,?,00000000,00000100,00000009), ref: 007090D7

Strings

Q:3q, xrefs: 007085DB
SAcA, xrefs: 00708614

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Free$HeapLibrary$AdaptersAllocInfo$AddressLoadProcProcess
String ID: Q:3q$SAcA
API String ID: 2633798829-494069912
Opcode ID: f5d5dd539d52b5b2cc155bef9f85d3bc3ff954688a30b5f75c1f483ca4c17d05
Instruction ID: 6d182f48da7504beead1c137bb28f39578c622fb14f349ac78cbcfaa79c55111
Opcode Fuzzy Hash: f5d5dd539d52b5b2cc155bef9f85d3bc3ff954688a30b5f75c1f483ca4c17d05
Instruction Fuzzy Hash: 345298B6614600CBC798CF6CEC966E937F5FB58311B10C51AE942CA2E1EB3C9941CB5E

Function 006F8695 Relevance: 22.0, APIs: 10, Strings: 2, Instructions: 1045networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 006F9154
setsockopt.WS2_32(00000000,0000FFFF,00001006,00000000,00000004), ref: 006F91DB
gethostbyname.WS2_32(?), ref: 006F9261
inet_ntoa.WS2_32(?), ref: 006F92CF
inet_addr.WS2_32(00000000), ref: 006F92D6
htons.WS2_32(00000050), ref: 006F92FB
connect.WS2_32(00000000,?,00000010), ref: 006F9316
send.WS2_32(00000000,00000000,00000000,00000000), ref: 006F93A1
recv.WS2_32(0000000B,?,00000400,00000000), ref: 006F947C
closesocket.WS2_32(0000000B), ref: 006F97C6

Strings

;$Rb, xrefs: 006F8C35
/, xrefs: 006F8982

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonsinet_addrinet_ntoarecvsendsetsockoptsocket
String ID: /$;$Rb
API String ID: 4203722200-1076244922
Opcode ID: 05365ffa9a11ca0734a9b0a4970e7f682981dc119086dcc5ff0eee04a6e60353
Instruction ID: 20462a92ebb583e8f86417e0124be6b2963ff35006ebe43868b57013692801de
Opcode Fuzzy Hash: 05365ffa9a11ca0734a9b0a4970e7f682981dc119086dcc5ff0eee04a6e60353
Instruction Fuzzy Hash: 2392BB72915204DBD718DF6CEC92AF937B6FB44710B10C41AEA06DA2E1EB389942CB5D

Function 006E5C39 Relevance: 7.7, APIs: 5, Instructions: 247
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 006E5DEC
FindFirstFileA.KERNELBASE(?,?), ref: 006E5EB2
DeleteFileA.KERNELBASE(?), ref: 006E5FE2
FindNextFileA.KERNELBASE(00000000,?), ref: 006E6020
FindClose.KERNEL32(00000000), ref: 006E6042

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: b3d5af76ce10cbcb263ccc258168687bcfde46c4a7cea0648c0651c52dfebeca
Instruction ID: 8120b14192bac12e49f8d7ba682d463b9b7520fffd7fad5b39083314e252fc14
Opcode Fuzzy Hash: b3d5af76ce10cbcb263ccc258168687bcfde46c4a7cea0648c0651c52dfebeca
Instruction Fuzzy Hash: 22A1CE75512695DBC748CF6DEC969E933B9FB48301710C11AE906CA2E0EB3C9946CB8E

Function 006F571F Relevance: 6.2, APIs: 4, Instructions: 213
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006F5804
Process32First.KERNEL32(00000000,00000128), ref: 006F58E2
Process32Next.KERNEL32(00000000,00000128), ref: 006F59E8
FindCloseChangeNotification.KERNELBASE(00000000), ref: 006F5A7E

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 1fa510e856e178a374fff8757bc94637e799d012254f62487e0f59f3cd360d92
Instruction ID: bc290aacd7b4cfcfce43ad551b03d73b634e148baa46426790f2fcb56d41a9ab
Opcode Fuzzy Hash: 1fa510e856e178a374fff8757bc94637e799d012254f62487e0f59f3cd360d92
Instruction Fuzzy Hash: 6F91A976A05604DBC748DF2DECA65F937B5FB48311B10C11AEA02CA2E0EB38D952CF59

Function 006FB3DB Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 588
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,?), ref: 006FB528

Part of subcall function 007042B6: lstrlen.KERNEL32(?,?,006E5DCE,?,00000104,?), ref: 00704320

Strings

myiW, xrefs: 006FB70F
K]g[, xrefs: 006FB819

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: ComputerNamelstrlen
String ID: K]g[$myiW
API String ID: 4141851928-3148350528
Opcode ID: 4740af226a9709320071b075b1ea83dc9df3f924d17954e8781ff7450dd6235a
Instruction ID: 93556f1a5aa643aff0bb748f6256cd09778cc0ba6732fd94ef6b1fea8d0b060a
Opcode Fuzzy Hash: 4740af226a9709320071b075b1ea83dc9df3f924d17954e8781ff7450dd6235a
Instruction Fuzzy Hash: DF42B271901249DBCB58EF6CED929FA73B9FB14704B00C01AE606E71E1EB389A45CB5D

Function 007024D3 Relevance: 5.0, APIs: 1, Strings: 2, Instructions: 520
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000008AE), ref: 00702D0A

Strings

tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe", xrefs: 00702D94
C:\hjflhukc\xxxniijvj.exe, xrefs: 00702D9E

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Sleep
String ID: C:\hjflhukc\xxxniijvj.exe$tgtbxnf8r33w "c:\hjflhukc\yanidfx.exe"
API String ID: 3472027048-2520137044
Opcode ID: 802665fddc49b84fd1f0010ef0710b71107792ded40de1e439a23687b7bccd91
Instruction ID: 631ca4a9bf425850c120a0d4cb1e58557dfa525cdf0b3f098f29c0c9e6c9b94b
Opcode Fuzzy Hash: 802665fddc49b84fd1f0010ef0710b71107792ded40de1e439a23687b7bccd91
Instruction Fuzzy Hash: 89329872914244DFD748DF6CED96AEA37F5FB08700B10C11AE506DA2E1EB3C9A42CB59

Function 006EBECE Relevance: 4.7, APIs: 3, Instructions: 222
libraryloaderencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,00000000), ref: 006EC004
GetProcAddress.KERNEL32(00000000), ref: 006EC080
CryptGenRandom.ADVAPI32(00000004,?,00000000,?,00704797,?,007027D6,?), ref: 006EC1D3

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: AddressProc$CryptRandom
String ID:
API String ID: 646182245-0
Opcode ID: 0ca80509c85dfb5524be0ab19fd7d2103ce5f4d33b16625fcb43d3a5d367c10f
Instruction ID: ccd96711f9dd600067ab4e92ab46c9b1f744e325a9c80fdb127a51a4918c05f3
Opcode Fuzzy Hash: 0ca80509c85dfb5524be0ab19fd7d2103ce5f4d33b16625fcb43d3a5d367c10f
Instruction Fuzzy Hash: 8391B771615341DBD7688F6DEC929E937B6FB04760710C21AE916CA2F0EB7C8982CB4D

Function 007074E8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00707525

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: d740df0969aaadd8265c96f9916899da2c7ae0b05c71b25ce6cda5ac8017630c
Instruction ID: fde33b9fcb026758d3d843945e41ca61816ae8670ca047f3a23ac2e4f70d6918
Opcode Fuzzy Hash: d740df0969aaadd8265c96f9916899da2c7ae0b05c71b25ce6cda5ac8017630c
Instruction Fuzzy Hash: C4F0FEB2A112089FD704DF5CE94A6E97BF8F714316F04C65AD415D3290E7799614CF84

Function 006EC9ED Relevance: 12.2, APIs: 8, Instructions: 196
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 006ECAF2
SetServiceStatus.SECHOST(0071B2DC), ref: 006ECB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006ECB78
SetServiceStatus.ADVAPI32(0071B2DC), ref: 006ECBE5
WaitForSingleObject.KERNEL32(00001388), ref: 006ECC62
SetServiceStatus.ADVAPI32(0071B2DC), ref: 006ECCAF
CloseHandle.KERNEL32 ref: 006ECCC5
SetServiceStatus.ADVAPI32(0071B2DC), ref: 006ECD8F

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: a344687968a283f9f8015dbcbb2886c43efb2e8cf7f8f7f9f379c6bce3486bdc
Instruction ID: d982c6ad5bbca6b240020caf87787ee305263d181ed6d2590ad014427053aad3
Opcode Fuzzy Hash: a344687968a283f9f8015dbcbb2886c43efb2e8cf7f8f7f9f379c6bce3486bdc
Instruction Fuzzy Hash: D9913071112241DBC708CF6DED999E93BFAFB18711310C52AE4068A2F0EB3C9846CB9D

Function 006F5485 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,006EDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 006F5628
CloseHandle.KERNEL32(006EDA33,?,?,?,?,00000000), ref: 006F5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 006F5665

Strings

D, xrefs: 006F55A3

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: fac7abe0959c2a42f72901857e608ea22e9418d526e2d740c1ac5adc8243a2b6
Instruction ID: 65570c3b931488c9f594c3508d5491c8f3cdb35a053c1ef575b277ead8eccb0c
Opcode Fuzzy Hash: fac7abe0959c2a42f72901857e608ea22e9418d526e2d740c1ac5adc8243a2b6
Instruction Fuzzy Hash: C441BD715016489BCB58CFADFD969FA77B5FB84310710C11AEA02CA1F1E7388911CB59

Function 006F54D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,006EDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 006F5628
CloseHandle.KERNEL32(006EDA33,?,?,?,?,00000000), ref: 006F5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 006F5665

Strings

D, xrefs: 006F55A3

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 6d2b41910a09a1fb03a673512df6dee85bbd2940372aef04c5c7525235927a6b
Instruction ID: 685b72a7d3157c9928683b09b8cb0f25b55ea544cacdd1ed2a10cbd3441db475
Opcode Fuzzy Hash: 6d2b41910a09a1fb03a673512df6dee85bbd2940372aef04c5c7525235927a6b
Instruction Fuzzy Hash: 7941B071501648DBCB58DFADFD969FA77B6FB84700B00C01AE6129A1F0EB384941DB5E

Function 006EC622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006EB7CD: WaitForSingleObject.KERNEL32(007027D6,00004E20,00000000,?,006EBFA2,00000000,00000000,?,00704797,?,007027D6,?), ref: 006EB81D

CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000000,00000000,00000000,006ED913,00000000,00000000,?,00000000), ref: 006EC746
WriteFile.KERNELBASE(00000000,?,?,?,00000000,?,?,?,?,00000000,?), ref: 006EC90B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000000,?), ref: 006EC983

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationObjectSingleWaitWrite
String ID:
API String ID: 2552625159-0
Opcode ID: 36f3a1f0702ba95698376821fc792d9d40ae6ff0c4a5b3857fd7ccef6997fd37
Instruction ID: 44ce94528c574599b449f15b6f3a0761a4e841e4a6f7a30a5b9c9ca82d20676a
Opcode Fuzzy Hash: 36f3a1f0702ba95698376821fc792d9d40ae6ff0c4a5b3857fd7ccef6997fd37
Instruction Fuzzy Hash: FA91A9B5512245DBC708CF2DED959EA7BB6FB88320710C11AE506CA2F1E73C9942DB4D

Function 006EE769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(006E8954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,006E8954), ref: 006EE865
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 006EE895
FreeSid.ADVAPI32(?), ref: 006EE8DC

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 045115efb78367cec7ee7f972e90c90c3caef70d89eae4b71c861a7617e017fb
Instruction ID: b383f77fa1fcedae6b1e9147683392bedaf3adf54f1efaf4c1a4a8469d3a5346
Opcode Fuzzy Hash: 045115efb78367cec7ee7f972e90c90c3caef70d89eae4b71c861a7617e017fb
Instruction Fuzzy Hash: AD417AB5916244EFCB04CFADEC856E977B5FB08705B40C01AE501D62E0E73D9942DB1E

Function 006F20D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,006F5997,?,?,?), ref: 006F20F0
CharLowerBuffA.USER32(?,00000000,?,006F5997,?,?,?), ref: 006F2131

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: aabf4ceb2c550f687b7e85c8fa428aa8b03b9745a0d2c53ecfc863fab3d9e886
Instruction ID: 446279b9a227a95df9f6fabe4b785613226209f7dea4ae1ed389d461d8e64a63
Opcode Fuzzy Hash: aabf4ceb2c550f687b7e85c8fa428aa8b03b9745a0d2c53ecfc863fab3d9e886
Instruction Fuzzy Hash: 1AF067316142089BCB49CF4EEC564F637F2FB54700700C019EA068A6F0E7389D80ABAE

Function 007023A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,0070A3A7,?,?,?,0070D0BE), ref: 007023F6
RtlAllocateHeap.NTDLL(00000000,?,0070A3A7,?,?,?,0070D0BE), ref: 007023FD

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 2d7802f62c20eee9add9b3000b690703d8fbb8ea55a574b93aa61a21229c5c0a
Instruction ID: 847560d3545337d173c155d460bd00f08fd5554ee88cd439ba8d43f8c8abaaff
Opcode Fuzzy Hash: 2d7802f62c20eee9add9b3000b690703d8fbb8ea55a574b93aa61a21229c5c0a
Instruction Fuzzy Hash: CEF03076500201EBCA108FADFD8D99A37B4F314318B64C112F445DA0E5D77CE8458B58

Function 006EDE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000002,?,006F82CB,000036E2,000036E2,00000000,-00000002,?,006E5E87,00000002,00000000,?,00000000,000036E2,00000002), ref: 006EDE6C
RtlFreeHeap.NTDLL(00000000,?,006F82CB,000036E2,000036E2,00000000,-00000002,?,006E5E87,00000002,00000000,?,00000000,000036E2,00000002,?), ref: 006EDE73

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 329d4712ef1fe065440913516ce00941ab4e000d1d0264055f39414b58dca61d
Instruction ID: 92202daab6305684a98f6fd0d08b2a6f28ee4f3d77fae2b31085c73c8006297a
Opcode Fuzzy Hash: 329d4712ef1fe065440913516ce00941ab4e000d1d0264055f39414b58dca61d
Instruction Fuzzy Hash: E3E08C32641248EBEE108BEEFC4A6843BE8FB21741B00C110F145CA6B0C72995408A8C

Function 007075CE Relevance: 1.7, APIs: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(007027D6,80000000,00000000,00000000,00000003,00000000,00000000,00000000,00000000,00000000,?,007047E5,007027D6,00000000,00003571,00000003), ref: 0070770C

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 57055acdae95accc8667b0e805845f25a4ee30152af9a0c01601ec8c40a00fe2
Instruction ID: e2610c3d74323e9071237c1bd64f91a785ed86476b77e7620552baa1dfc82f81
Opcode Fuzzy Hash: 57055acdae95accc8667b0e805845f25a4ee30152af9a0c01601ec8c40a00fe2
Instruction Fuzzy Hash: B951EE75A19241DBD3188B6CFD926B237F8FB50321B10C12AE906CA5F0E76DA941CB5D

Function 006E3B2C Relevance: 1.6, APIs: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 006E3BF6

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 351abd3de1fd012bd1a49913eca9467662e16251e12964c4d07a6fb4c889c53d
Instruction ID: 161cb4c1cc0627966f9ef674f8694be8fd2dd8721bc8c5b4894e6ca444fa067e
Opcode Fuzzy Hash: 351abd3de1fd012bd1a49913eca9467662e16251e12964c4d07a6fb4c889c53d
Instruction Fuzzy Hash: 3441E472941349DBC368DF6EEC4B9E237B8E784714B04C16AE601DB2E0DA389581CF9D

Function 0070473B Relevance: 1.4, APIs: 1, Instructions: 107sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8,?,00000000,00000000,?,007027D6,?), ref: 00704859

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: acb18d99d2de796516402d8167d2c0e14390fe3e763dd4186db69f7c48a933a0
Instruction ID: b98b208b42d0f8fa24f587cd179b11e2a2172c95d68617c852bc396a612e9344
Opcode Fuzzy Hash: acb18d99d2de796516402d8167d2c0e14390fe3e763dd4186db69f7c48a933a0
Instruction Fuzzy Hash: 0941DEB1550200DBD3689F6CFC47AA237B5FB84711B00C00EEA059A2E1EB7C9541CBAE

Non-executed Functions

Function 0070D831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388pipeprocessfileCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,00000000), ref: 0070D98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0070D9F9
CreatePipe.KERNEL32(?,00000000,?,00000000), ref: 0070DA48
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0070DA7E
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 0070DBCC
WriteFile.KERNEL32(00000000,?,00000020,00000020,00000000), ref: 0070DC1C
CloseHandle.KERNEL32(00000000), ref: 0070DC33
CloseHandle.KERNEL32(00000000), ref: 0070DC66
CloseHandle.KERNEL32(00000000), ref: 0070DC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 0070DD4F
CloseHandle.KERNEL32(?), ref: 0070DD9F
CloseHandle.KERNEL32(?), ref: 0070DDB2
CloseHandle.KERNEL32(?), ref: 0070DE41
CloseHandle.KERNEL32(00000000), ref: 0070DE67
CloseHandle.KERNEL32(00000000), ref: 0070DE7E

Strings

D, xrefs: 0070DB1A

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: d120fc259a19dc91d5c200932ece4df6a9a33f4c44b44d7db685c3eff5f703f1
Instruction ID: 0af8a96887c7f7b90285ffb18031809ab0890c1ade274844db3f90ac8b980d30
Opcode Fuzzy Hash: d120fc259a19dc91d5c200932ece4df6a9a33f4c44b44d7db685c3eff5f703f1
Instruction Fuzzy Hash: 91026576611205DBCB18CFACEC869EA7BF5FB48700714C21AE902D62F0EB3C9951CB59

Function 007035AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00703685
CreateServiceA.ADVAPI32(00000000,00A46118,00A46118,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 007036D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00703728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0070374C
CloseServiceHandle.ADVAPI32(00000000), ref: 0070375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 007037D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00703836
CloseServiceHandle.ADVAPI32(00000000), ref: 00703847
CloseServiceHandle.ADVAPI32(00000000), ref: 007038B1

Strings

3ch, xrefs: 00703701
qh~B, xrefs: 0070360F

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: 082b8d9dc0395f5996b55e1382fd4b63a425adbfa9529ddfc23d476c4c698b22
Instruction ID: 51f7b0fc490c4abbdb2ea00594c80215a6efe10129ba002d5d08c72c648e5775
Opcode Fuzzy Hash: 082b8d9dc0395f5996b55e1382fd4b63a425adbfa9529ddfc23d476c4c698b22
Instruction Fuzzy Hash: 829166B5524600EBC7088F6CED959F977F9FB49701700C11AE8029A2F1EB7D9A42CB6D

Function 006F111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006F11F7
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 006F1267
CloseHandle.KERNEL32(00000000), ref: 006F128B
GetTickCount.KERNEL32 ref: 006F12D1
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006F153B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 006F157E
CloseHandle.KERNEL32(00000000), ref: 006F158F

Strings

Ra);, xrefs: 006F1514

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID: Ra);
API String ID: 3478262135-4229484525
Opcode ID: 334d49256a5de17ba64e4952063abc55265b1e22853813b116ee7a1d188751d0
Instruction ID: b11d1b2e1b51388a2c52b8293039ea513a9150fa67d8d571278ba44730876ba6
Opcode Fuzzy Hash: 334d49256a5de17ba64e4952063abc55265b1e22853813b116ee7a1d188751d0
Instruction Fuzzy Hash: 78B1DFB1515204EED7588F6CEC929FA37F9FB49754710C11AEA01CA2E0EB3C9942CB1E

Function 006F1636 Relevance: 10.8, APIs: 7, Instructions: 279processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006F16B2
Process32First.KERNEL32(00000000,00000128), ref: 006F17BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 006F1932
Module32First.KERNEL32(00000000,00000224), ref: 006F1991
CloseHandle.KERNEL32(?,0000000A,00000000), ref: 006F1A6A
Process32Next.KERNEL32(00000000,00000128), ref: 006F1ACE
CloseHandle.KERNEL32(00000000), ref: 006F1AF5

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: 1bc4c8e651d208d9b6ce584518e9dbf488b333c3fd3196930b1ad111f0748ab8
Instruction ID: 536c8d78223c7f582635571d776085b5985622a07ab0aa9ec78531569f5fc3fb
Opcode Fuzzy Hash: 1bc4c8e651d208d9b6ce584518e9dbf488b333c3fd3196930b1ad111f0748ab8
Instruction Fuzzy Hash: 18C1EF76505604DBD718DF6CEC966F933B5FB55311B00C11AEA06CA2E0EB7C9942CB8D

Function 006F9F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 006F9FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 006FA049
GetLastError.KERNEL32 ref: 006FA061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 006FA162
CloseServiceHandle.ADVAPI32(00000000), ref: 006FA3B6

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: 93de15114c75c973664fc1a9a81375b8f22cc8d3fc5312005676b74d42627ca1
Instruction ID: 1ee07b34093fc8025a93baa15c58787790792f0abb4007a261ee91604fd70303
Opcode Fuzzy Hash: 93de15114c75c973664fc1a9a81375b8f22cc8d3fc5312005676b74d42627ca1
Instruction Fuzzy Hash: 44D1BCB6905604DBC708CFACED959F977F6FB44310B15C01AE905DA2E0EB3CAA81CB59

Function 006F0806 Relevance: 10.7, APIs: 7, Instructions: 195processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006F08C2
Process32First.KERNEL32(00000000,00000128), ref: 006F0966
OpenProcess.KERNEL32(00000001,00000000,?,?,?,?,?,000000B3), ref: 006F0A15
TerminateProcess.KERNEL32(00000000,000000FF,?,?,?,?,000000B3), ref: 006F0A64
CloseHandle.KERNEL32(00000000,?,?,?,?,000000B3), ref: 006F0A82
Process32Next.KERNEL32(00000000,00000128), ref: 006F0AD2
CloseHandle.KERNEL32(00000000), ref: 006F0B10

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 72fb489fd8e327bd18464b866246b37d8a19727076fe42507835c848a084f966
Instruction ID: 69c723c71cbd42d3a11ea41a7e180b5ef819feedea103dfcf7359953b7b7454a
Opcode Fuzzy Hash: 72fb489fd8e327bd18464b866246b37d8a19727076fe42507835c848a084f966
Instruction Fuzzy Hash: 8A819776511615DBD348CB6CFC92AF933B9FB48702B00C11AE941D66E1EB3C9981CB4D

Function 006FB046 Relevance: 9.2, APIs: 6, Instructions: 184filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 006FB104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 006FB16D
CloseHandle.KERNEL32(00000000), ref: 006FB1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006FB25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 006FB2AB
CloseHandle.KERNEL32(00000000), ref: 006FB2D8

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 059fc79415b1605b349729b29649caa8b20b4f325d61d707f5f228feb066ced9
Instruction ID: 98ed90dfab68b7a7c89c8d3a877680fa0fb15681efcaf38f973fb601a04484cb
Opcode Fuzzy Hash: 059fc79415b1605b349729b29649caa8b20b4f325d61d707f5f228feb066ced9
Instruction Fuzzy Hash: 7471AB75515208DBC318CF6CED928FA37B9FB48315710D61AEA52C66E0E73C9A42CB1D

Function 00704589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000009,00000002,?,006ED583,006EAD87,00000002,00000000), ref: 00704637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00704655
CloseHandle.KERNEL32(00000000,?,006ED583,006EAD87,00000002,00000000,?,?,?,?,?,?,?,00000009,?,?), ref: 0070468D
WaitForSingleObject.KERNEL32(?,000000FF,?,006ED583,006EAD87,00000002,00000000,?,?,?,?,?,?,?,00000009,?), ref: 007046A1
CloseHandle.KERNEL32(?,006ED583,006EAD87,00000002,00000000,?,?,?,?,?,?,?,00000009,?,?), ref: 00704712

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 69b09566c52901683c734c580b85b03aec288c6ad52d3ada374a6b5cdd61ed8f
Instruction ID: 09c3e3572029f347cf32351aac684f7f09887acf7bf3aa9d86bed90ad55db331
Opcode Fuzzy Hash: 69b09566c52901683c734c580b85b03aec288c6ad52d3ada374a6b5cdd61ed8f
Instruction Fuzzy Hash: 684158B6111240DFC328CF6CED899A63BFAFB89711710C51AE946C66F0E73C9852CB19

Function 00704927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00704CBC

Part of subcall function 006F074E: wvsprintfA.USER32(?,?,00000000), ref: 006F07C3

Sleep.KERNEL32(00015F90), ref: 00704E60
DeleteFileA.KERNEL32(?), ref: 00704E7F

Strings

KU, xrefs: 00704A26

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: c28b9d40edbf6a3007595a83a5770e7f63c8a823424721bbaccea842b0fb386e
Instruction ID: 3ee5e147dee393b28c0d422bb7a22c1709291f829748d30c868956ec0b8efa11
Opcode Fuzzy Hash: c28b9d40edbf6a3007595a83a5770e7f63c8a823424721bbaccea842b0fb386e
Instruction Fuzzy Hash: A0D1ADB5611208DAC718DF6CEC969E637F9FB48710B00C51AEA05CA2F1DB3C9A81CB5D

Function 006F9B78 Relevance: 6.2, APIs: 4, Instructions: 201fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006F9C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 006F9CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 006F9DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 006F9E86

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: b749289b804920d445166028ef2603beabf580b529154c83b378f152dc8c5335
Instruction ID: 80cf1d29010d93e3db4533f86b972eeb3a9dd4c45ed9ccb7a69fd3adb90a6782
Opcode Fuzzy Hash: b749289b804920d445166028ef2603beabf580b529154c83b378f152dc8c5335
Instruction Fuzzy Hash: EE81BC75611204DBC714DF6CEC86AFA37BAFB44711B10C419EA02D62E1EB3C9982CB6D

Function 007090F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,006F8146,00000000,?,00000000,?,006EF85A,0070970E,?,?,00709573,0070970E,00000001), ref: 00709143
RtlReAllocateHeap.NTDLL(00000000,?,006F8146,00000000), ref: 0070914A
GetProcessHeap.KERNEL32(00000000,00000000,?,006F8146,00000000,?,00000000,?,006EF85A,0070970E,?,?,00709573,0070970E,00000001,?), ref: 00709174
HeapAlloc.KERNEL32(00000000,?,006F8146,00000000,?,00000000,?,006EF85A,0070970E,?,?,00709573,0070970E,00000001,?), ref: 0070917B

Memory Dump Source

Source File: 00000003.00000002.2246668141.00000000006E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000003.00000002.2246641320.00000000006E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246701399.000000000070F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246720509.0000000000710000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246738863.0000000000713000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2246758326.000000000071C000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_yanidfx.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: dd7e56b58759708e72e694a2ce2a68e46365ffa2f3a62f063c90cdb504d30aa6
Instruction ID: df38a904b6569e63d4a6d5f31aa332377223e75193f96d832ddbfc7db75b2e8b
Opcode Fuzzy Hash: dd7e56b58759708e72e694a2ce2a68e46365ffa2f3a62f063c90cdb504d30aa6
Instruction Fuzzy Hash: B5011A76580604DFCB089FA8FC996A93BB4FB48701B44C115F90A866E1EB7D94418B4C

Analysis Process: xxxniijvj.exePID: 3552, Parent PID: 2768COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1498
Total number of Limit Nodes:	7

Executed Functions

Function 000FFF2A Relevance: 63.3, APIs: 29, Strings: 6, Instructions: 2026synchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 00100590
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 001005E4
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00100629
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00100649
GetTickCount.KERNEL32 ref: 001006E6
GetCommandLineA.KERNEL32 ref: 00100873

Strings

C:\Windows\system32\config\systemprofile, xrefs: 0010058A
HO, xrefs: 00101893
~z0, xrefs: 001006C2
wb_m, xrefs: 00101FC6
^d/, xrefs: 00100102
241, xrefs: 00100787

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: CreateMutex$CommandCountEnvironmentLineTickVariable
String ID: 241$C:\Windows\system32\config\systemprofile$HO$^d/$wb_m$~z0
API String ID: 3327569919-55223334
Opcode ID: 42bbb80f14f4a43bf0af0210a827c7f96492bb0ee31ca16abbd35ace3591e53d
Instruction ID: 9d2dbb1851abc239425e7abadcacecdfb75496e367249fd488d4b1d48e0f3e03
Opcode Fuzzy Hash: 42bbb80f14f4a43bf0af0210a827c7f96492bb0ee31ca16abbd35ace3591e53d
Instruction Fuzzy Hash: 9303B775609205DBD70CDBA8FE86AFA37B5FB48700B40C11AE502CAEB1EB7598C1CB51

Function 000E88A8 Relevance: 30.6, APIs: 12, Strings: 5, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(0011B028), ref: 000E893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 000E8AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 000E8D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 000E8D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 000E8DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 000E8E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 000E9158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 000E91F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 000E936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 000E94DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 000E963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 000E97B0

Strings

C:\Windows\system32\config\systemprofile, xrefs: 000E9016, 000E908E
C:\hjflhukc\, xrefs: 000E8DF6, 000E9174, 000E947F, 000E9666
Ua-W, xrefs: 000E9341, 000E9347
\, xrefs: 000E93D0
gKV`, xrefs: 000E8CE7

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\hjflhukc\$Ua-W$\$gKV`
API String ID: 1691758827-3231860264
Opcode ID: 2d317b047f7a5f65652db276c16e0922a587014bbd40a0b8f4e0120dbd804d99
Instruction ID: c087d86031cf0d2ddd7a8e3e30bf07b41ad48fef4233cb90b6c6c8621d1348df
Opcode Fuzzy Hash: 2d317b047f7a5f65652db276c16e0922a587014bbd40a0b8f4e0120dbd804d99
Instruction Fuzzy Hash: 2582EEB1505244CFC70CDB65FE829FA37B9FB54700B40C02AE906EAEA2EB3499C5CB55

Function 000F571F Relevance: 6.2, APIs: 4, Instructions: 213
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000F5804
Process32First.KERNEL32(00000000,00000128), ref: 000F58E2
Process32Next.KERNEL32(00000000,00000128), ref: 000F59E8
FindCloseChangeNotification.KERNELBASE(00000000), ref: 000F5A7E

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 2b9f7100e9ce70ed40785931d0a369c460551cb9301f6724895e53e0f9b73697
Instruction ID: fc6c9230d320e1dd87c1c5f29069c19d72ea9701d54688a4adeb1acb3cfde805
Opcode Fuzzy Hash: 2b9f7100e9ce70ed40785931d0a369c460551cb9301f6724895e53e0f9b73697
Instruction Fuzzy Hash: F091A975609604CBC75CDB69FEA55F937F5FB48311B14C11AEA02C6EA0EB3499C2CB41

Function 000F0806 Relevance: 10.7, APIs: 7, Instructions: 195
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000F08C2
Process32First.KERNEL32(00000000,00000128), ref: 000F0966
OpenProcess.KERNEL32(00000001,00000000,?), ref: 000F0A15
TerminateProcess.KERNELBASE(00000000,000000FF), ref: 000F0A64
CloseHandle.KERNEL32(00000000), ref: 000F0A82
Process32Next.KERNEL32(00000000,00000128), ref: 000F0AD2
CloseHandle.KERNEL32(00000000), ref: 000F0B10

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: c893d011d2fe8477b62773bf3cb1687b68a3defb7e535b655a24a4db3300dbf3
Instruction ID: 57cc137ff696516eb6274e7f2591aa788e0051b0c5bffedfb7ab2ee287f902ca
Opcode Fuzzy Hash: c893d011d2fe8477b62773bf3cb1687b68a3defb7e535b655a24a4db3300dbf3
Instruction Fuzzy Hash: 9481A776515615DBC34CCB68FF91AFA37B9FB48702B40C11AE902C6EA2EB3499C1CB45

Function 000FB046 Relevance: 9.2, APIs: 6, Instructions: 184
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 000FB104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 000FB16D
CloseHandle.KERNEL32(00000000), ref: 000FB1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000FB25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 000FB2AB
CloseHandle.KERNEL32(00000000), ref: 000FB2D8

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 9af741e65bc4267d95a3e92981789f024ddbd4c92892ccead3e68e7c40bd7536
Instruction ID: d9f985dec16b2453105995e00b57d8ba45715851329dd2f3cc244d4c5c5b2b7e
Opcode Fuzzy Hash: 9af741e65bc4267d95a3e92981789f024ddbd4c92892ccead3e68e7c40bd7536
Instruction Fuzzy Hash: A771B731515209DBC358CF68EE918FA3BF9FB48315754C21AE912C7EA0E7348AC1DB15

Function 000F54A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,000EDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 000F5628
CloseHandle.KERNEL32(000EDA33,?,?,?,?,00000000), ref: 000F5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 000F5665

Strings

D, xrefs: 000F55A3

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 0a63b8400a5282baad110721a8814aebdb881121d323bfc0f410f1b0d54dbab8
Instruction ID: fdc786bea8d15680b074419a515cfde334d53758aeb0f314a9ef94430b8b9dca
Opcode Fuzzy Hash: 0a63b8400a5282baad110721a8814aebdb881121d323bfc0f410f1b0d54dbab8
Instruction Fuzzy Hash: 2B41EF32500648DBC71CDBA5FF959FA37B6FB84701B00C01AEA12CBD61E7358881DB15

Function 000F54D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,000EDA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 000F5628
CloseHandle.KERNEL32(000EDA33,?,?,?,?,00000000), ref: 000F5652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 000F5665

Strings

D, xrefs: 000F55A3

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: c935e2ad0a91b4798000639ad7c06350a6f7b792dd49cca9c6bbbf33082c45c3
Instruction ID: b727ee1e2574e595bc7eeedc739876a6ea61a69f809b17c0f2465148c27e6a97
Opcode Fuzzy Hash: c935e2ad0a91b4798000639ad7c06350a6f7b792dd49cca9c6bbbf33082c45c3
Instruction Fuzzy Hash: E941AC71501608DBCB5CDBA5FF9A9FA37B6FB84B01B40C01AE6129AD71EB3048C1DB55

Function 000EC622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000EB7CD: WaitForSingleObject.KERNEL32(000FAEAC,00004E20,00000001,?,000EBFA2,00000001,-AF16B4FB,?,000FAEAC,000E66DE), ref: 000EB81D

CreateFileA.KERNELBASE(00000004,40000000,00000000,00000000,00000002,00000000,00000000,?,000E67E3,?,00000004,?,00000000,?), ref: 000EC746
WriteFile.KERNELBASE(00000000,?,00000001,00000001,00000000,?,?,?,?,?,00000001), ref: 000EC90B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,00000001), ref: 000EC983

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationObjectSingleWaitWrite
String ID:
API String ID: 2552625159-0
Opcode ID: 0c0ca85a838f39819cbff8e8d4e41a046f748a700f92c941ed8726a5512b9d99
Instruction ID: e9c977e8bbefa09e549da43eebb1211de546f2e3bcdb83e41a7913e1cadd7ccf
Opcode Fuzzy Hash: 0c0ca85a838f39819cbff8e8d4e41a046f748a700f92c941ed8726a5512b9d99
Instruction Fuzzy Hash: EF91B7B5515245DFC70CCF69FF959EA3BB5FB88720710C01AE402DAAB1E7328982CB45

Function 000EE769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(000E8954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,000E8954), ref: 000EE865
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 000EE895
FreeSid.ADVAPI32(?), ref: 000EE8DC

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 4956f64bf68ca402eab2f67301913d670d1c51647f9f06a8fa89002222f20a55
Instruction ID: 8e0657fe7a7176570260365dbeb354e97c1db23ba39c63569845c29fad331acd
Opcode Fuzzy Hash: 4956f64bf68ca402eab2f67301913d670d1c51647f9f06a8fa89002222f20a55
Instruction Fuzzy Hash: 2C4186B5919248EFCB0CCFA5EF846E977F5FB08305B80C01AE406D6AA0EB3499C1CB55

Function 000F20D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,000F09C2,?,?,?), ref: 000F20F0
CharLowerBuffA.USER32(?,00000000,?,000F09C2,?,?,?), ref: 000F2131

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 795f59e1bebaf8387dfd66094fa16321d07468035315261b4795af236e75fdcb
Instruction ID: 2e66132089d9686fc2b8f90ebe7fe38258d65c6b875ca3cc6a0fa57200f8bfe9
Opcode Fuzzy Hash: 795f59e1bebaf8387dfd66094fa16321d07468035315261b4795af236e75fdcb
Instruction Fuzzy Hash: 5CF067315142089BCB4D8F86EA564FA3BF2FB54700740C01AE9168AE70E7319DC0ABA6

Function 001023A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,0010A3A7,?,?,?,0010D0BE), ref: 001023F6
RtlAllocateHeap.NTDLL(00000000,?,0010A3A7,?,?,?,0010D0BE), ref: 001023FD

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: d4f0cc64bef9702dec386ca91395e7e9cc790b44c2981346b5c6c20a0e508161
Instruction ID: 44990d12c6d7d91da55cc7c4204ee2b295cab7d44d8bf8e7d8deeefc1256e445
Opcode Fuzzy Hash: d4f0cc64bef9702dec386ca91395e7e9cc790b44c2981346b5c6c20a0e508161
Instruction Fuzzy Hash: 1CF0A0761002049BCE148FA8FE4A98A3764B318718B648012F485DE9E5D3B8E8858B90

Function 000EDE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,000F8109,?,000F8109,00000000), ref: 000EDE6C
RtlFreeHeap.NTDLL(00000000,?,000F8109,00000000), ref: 000EDE73

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 08d26db757c9be9a5afdd0abe27f07b4e53aaea21b269adeaac2c145c1f04c7f
Instruction ID: b8cf3f73d2e9d7f5151593246b2856df95f30d297429ec68dd8bb5580316f6c9
Opcode Fuzzy Hash: 08d26db757c9be9a5afdd0abe27f07b4e53aaea21b269adeaac2c145c1f04c7f
Instruction Fuzzy Hash: 16E0C232540244EFEE08CBD6FE4B6843BE8FB21B41F00C111F145DAE30C72195C18A84

Function 000F15E5 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 000F160D

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e9b313c16b8435ca6ad17e65b3305f7cd306c3b0a216d5cf14ce87070ebb18aa
Instruction ID: d91846bbdf11585e4dfff974fca257b8a86d1f6e1bf0bc11eba31e28e139a5eb
Opcode Fuzzy Hash: e9b313c16b8435ca6ad17e65b3305f7cd306c3b0a216d5cf14ce87070ebb18aa
Instruction Fuzzy Hash: C1D012240043489A87186F64EE064E53FB5FF047007859021E9409AC31DB70D980DB5B

Non-executed Functions

Function 0010D831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388
pipeprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32(00000000,?,?,00000000,?,00000001,?), ref: 0010D98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0010D9F9
CreatePipe.KERNEL32(?,?,?,00000000), ref: 0010DA48
SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 0010DA7E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 0010DBCC
WriteFile.KERNEL32(?,?,00000020,00000020,00000000), ref: 0010DC1C
CloseHandle.KERNEL32(?), ref: 0010DC33
CloseHandle.KERNEL32(?), ref: 0010DC66
CloseHandle.KERNEL32(?), ref: 0010DC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 0010DD4F
CloseHandle.KERNEL32(?), ref: 0010DD9F
CloseHandle.KERNEL32(?), ref: 0010DDB2
CloseHandle.KERNEL32(?), ref: 0010DE41
CloseHandle.KERNEL32(00000000), ref: 0010DE67
CloseHandle.KERNEL32(?), ref: 0010DE7E

Strings

D, xrefs: 0010DB1A

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: 189d053d075bb01adfea44ecf01236252d0a52b19d8efd9e13640ef3a9974ed4
Instruction ID: 0e7b6a3063224ac2b15138043e766c65b2a675c4592aa77c411e715061d77c7c
Opcode Fuzzy Hash: 189d053d075bb01adfea44ecf01236252d0a52b19d8efd9e13640ef3a9974ed4
Instruction Fuzzy Hash: 55028576A15605DBCB0CCFA8FE819EA7BB5FB48700710C11AE842D7AB0EB7199C1CB55

Function 001035AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00103685
CreateServiceA.ADVAPI32(00000000,015DE438,015DE438,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 001036D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00103728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0010374C
CloseServiceHandle.ADVAPI32(00000000), ref: 0010375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 001037D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00103836
CloseServiceHandle.ADVAPI32(00000000), ref: 00103847
CloseServiceHandle.ADVAPI32(00000000), ref: 001038B1

Strings

3ch, xrefs: 00103701
qh~B, xrefs: 0010360F

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: f14ddfc8e4165b92f3df8de31987c6afb5be1c9673a400f0f69543da002d909c
Instruction ID: d4647d43a4a7849d4fc7dcaf1a8a492f24e529431ace55aec9a4484a16b51100
Opcode Fuzzy Hash: f14ddfc8e4165b92f3df8de31987c6afb5be1c9673a400f0f69543da002d909c
Instruction Fuzzy Hash: 559186B95156009BC70C8F68FF959F97BB9FB49701340C01AE82297EA0E7B599C2CB51

Function 000F111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000F11F7
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 000F1267
CloseHandle.KERNEL32(00000000), ref: 000F128B
GetTickCount.KERNEL32 ref: 000F12D1
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 000F153B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 000F157E
CloseHandle.KERNEL32(00000000), ref: 000F158F

Strings

Ra);, xrefs: 000F1514

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID: Ra);
API String ID: 3478262135-4229484525
Opcode ID: 7dd707b594ab0138438c65e7bf06a848868e3d07a8af0e3be4b004a471fc1dfe
Instruction ID: 726423eac2426fa888e4e7d4a06bd127d8ee6c066b6aead42b1317688ec5dfc7
Opcode Fuzzy Hash: 7dd707b594ab0138438c65e7bf06a848868e3d07a8af0e3be4b004a471fc1dfe
Instruction Fuzzy Hash: 2DB1DAB2519605DED71C9F68FE919FA37F8FB48714700C01AEA11CAEA1EB3499C1CB19

Function 000F1636 Relevance: 10.8, APIs: 7, Instructions: 279processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000F16B2
Process32First.KERNEL32(00000000,00000128), ref: 000F17BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 000F1932
Module32First.KERNEL32(00000000,00000224), ref: 000F1991
CloseHandle.KERNEL32(?,0000000A), ref: 000F1A6A
Process32Next.KERNEL32(00000000,00000128), ref: 000F1ACE
CloseHandle.KERNEL32(00000000), ref: 000F1AF5

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: 2a532f17b9cb6b8bbe6be17875d1c3c0267749af35bb99ae4f721a6c9daf3d54
Instruction ID: 14ea47faee0cd7c5f5ad0522f9fa9484f78828f5e1ecd8c4c1c277c57ea960b8
Opcode Fuzzy Hash: 2a532f17b9cb6b8bbe6be17875d1c3c0267749af35bb99ae4f721a6c9daf3d54
Instruction Fuzzy Hash: 96C10D76609604CBC70CDFA4FE966F937B4FB18311B00C11AEA06C6EA1EB7499C1CB85

Function 000F9F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 000F9FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 000FA049
GetLastError.KERNEL32 ref: 000FA061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 000FA162
CloseServiceHandle.ADVAPI32(00000000), ref: 000FA3B6

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: 049ad88a4a26a0abf3f876cf3cc5c8dbd9a6e27b68ed9a39c6d9f336b85a7d0d
Instruction ID: 64864d5c6ef2c7ab455c89343e6cd958a86965c7bcd0b46a509267d691e19735
Opcode Fuzzy Hash: 049ad88a4a26a0abf3f876cf3cc5c8dbd9a6e27b68ed9a39c6d9f336b85a7d0d
Instruction Fuzzy Hash: DED1CAB6A05604DBC70CCF64FE91AF97BF5FB48710B14C01AE9159AEA0EB34A9C1DB41

Function 000E5C39 Relevance: 7.7, APIs: 5, Instructions: 247filesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 000E5DEC
FindFirstFileA.KERNEL32(?,?), ref: 000E5EB2
DeleteFileA.KERNEL32(?), ref: 000E5FE2
FindNextFileA.KERNEL32(00000000,?), ref: 000E6020
FindClose.KERNEL32(00000000), ref: 000E6042

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: 62b7f4968a1b3a6b2e3759bba540f5287a9818afc90944863bdf83b4aaf13274
Instruction ID: b76e27ef3b233eb516fea97b26ce29acc1601ea23d344e682f152f75246b00df
Opcode Fuzzy Hash: 62b7f4968a1b3a6b2e3759bba540f5287a9818afc90944863bdf83b4aaf13274
Instruction Fuzzy Hash: DEA1DCB5515A55CFC71CCB65FE929E937B8FB48706710C41AE806CAEB0EB3499C2CB41

Function 000EC9ED Relevance: 12.2, APIs: 8, Instructions: 196registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 000ECAF2
SetServiceStatus.ADVAPI32(0011B2DC), ref: 000ECB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 000ECB78
SetServiceStatus.ADVAPI32(0011B2DC), ref: 000ECBE5
WaitForSingleObject.KERNEL32(00001388), ref: 000ECC62
SetServiceStatus.ADVAPI32(0011B2DC), ref: 000ECCAF
CloseHandle.KERNEL32 ref: 000ECCC5
SetServiceStatus.ADVAPI32(0011B2DC), ref: 000ECD8F

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: dad04817d0fdf5ac7507079fa4e4e6af673880dc0d53d0d2a7cdfa20f4b37bdd
Instruction ID: a09aa2524654feed6b034f4962142dca8bb37cf1f29bc630b4b795c96e6ee88e
Opcode Fuzzy Hash: dad04817d0fdf5ac7507079fa4e4e6af673880dc0d53d0d2a7cdfa20f4b37bdd
Instruction Fuzzy Hash: B7912F7001A2518FD70CCF29EF99AEA3BF5FB18705340C52AE41686EB0EB3598C6CB45

Function 00104589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,000ED583,Function_0000AD87,00000002,00000000), ref: 00104637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00104655
CloseHandle.KERNEL32(00000000,?,00000002,?,000ED583,Function_0000AD87,00000002,00000000), ref: 0010468D
WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,000ED583,Function_0000AD87,00000002,00000000), ref: 001046A1
CloseHandle.KERNEL32(?,00000002,?,000ED583,Function_0000AD87,00000002,00000000), ref: 00104712

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 0a5f7deba29eda39133ee71851719e0b7fd4c7f0c87729d87a77d4fe9d965e06
Instruction ID: c46c5de2506160dc88429bdfedae152b62e677ffba05797fea639fcc8049c40d
Opcode Fuzzy Hash: 0a5f7deba29eda39133ee71851719e0b7fd4c7f0c87729d87a77d4fe9d965e06
Instruction Fuzzy Hash: 2D415579106240DBC32C8F68FF859AA7BB6FB9A711750C41AE546C6EB0E37198C1CB11

Function 00104927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00104CBC

Part of subcall function 000F074E: wvsprintfA.USER32(?,?,?), ref: 000F07C3

Sleep.KERNEL32(00015F90), ref: 00104E60
DeleteFileA.KERNEL32(?), ref: 00104E7F

Strings

KU, xrefs: 00104A26

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: 9ab6c43b5a61eea99b4623bc0995d045ee96b934d346e6585f7623ab4fb35537
Instruction ID: a586c32f1a99ee52c7e04eb9fb721cbb6337f32b399268efc877fe369331e34b
Opcode Fuzzy Hash: 9ab6c43b5a61eea99b4623bc0995d045ee96b934d346e6585f7623ab4fb35537
Instruction Fuzzy Hash: 3DD1CD75614208DFC70CDB64EE92AE637B9FB58710B40C41AEA06CBEB1EB7499C1CB51

Function 000F9B78 Relevance: 6.2, APIs: 4, Instructions: 201fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000F9C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 000F9CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 000F9DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 000F9E86

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: b22efa76a59408e79bcda7ce9bf31b38042eff5664fc867fee32f5acf3233c49
Instruction ID: 5be8c028ec0d4b42a096b42dfc7c599e60ab5fa0274bb3db81aaa009e21d827d
Opcode Fuzzy Hash: b22efa76a59408e79bcda7ce9bf31b38042eff5664fc867fee32f5acf3233c49
Instruction Fuzzy Hash: 8A81B975615205DBC71CDF60FE92AFA3BB9FB48711B00801AEA02D6EA2E73498C1DB55

Function 001090F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,000F8146,00000000,?,?,?,?,?,000EF85A,?,?,?,00109573), ref: 00109143
RtlReAllocateHeap.NTDLL(00000000,?,000F8146,00000000), ref: 0010914A
GetProcessHeap.KERNEL32(00000000,00000000,?,000F8146,00000000,?,?,?,?,?,000EF85A,?,?,?,00109573,?), ref: 00109174
HeapAlloc.KERNEL32(00000000,?,000F8146,00000000,?,?,?,?,?,000EF85A,?,?,?,00109573,?,00000001), ref: 0010917B

Memory Dump Source

Source File: 00000004.00000002.2257348732.00000000000E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000004.00000002.2257331439.00000000000E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257377180.000000000010F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257392988.0000000000110000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257408969.0000000000113000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2257425715.000000000011C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e0000_xxxniijvj.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 8071ef979285a36948b9d4ddb3f96298dca35dc0658cd77cd3bb35fa4eb5fe10
Instruction ID: f352e6e877448edab87a973ac2e3300673e3c7abf3a3c9dfe1397e354bee9da2
Opcode Fuzzy Hash: 8071ef979285a36948b9d4ddb3f96298dca35dc0658cd77cd3bb35fa4eb5fe10
Instruction Fuzzy Hash: DD011676680604DFCB089FA4FE99AA937B6FB48301F44C115F94A87E62EB7994C1CB40

Analysis Process: xxxniijvj.exePID: 764, Parent PID: 3392COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1494
Total number of Limit Nodes:	6

Executed Functions

Function 00E3FF25 Relevance: 63.3, APIs: 29, Strings: 6, Instructions: 2027synchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 00E40590
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00E405E4
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00E40629
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00E40649
GetTickCount.KERNEL32 ref: 00E406E6
GetCommandLineA.KERNEL32 ref: 00E40873

Strings

C:\Windows\system32\config\systemprofile, xrefs: 00E4058A
wb_m, xrefs: 00E41FC6
^d/, xrefs: 00E40102
241, xrefs: 00E40787
HO, xrefs: 00E41893
~z0, xrefs: 00E406C2

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: CreateMutex$CommandCountEnvironmentLineTickVariable
String ID: 241$C:\Windows\system32\config\systemprofile$HO$^d/$wb_m$~z0
API String ID: 3327569919-55223334
Opcode ID: 66f77002b8374a8446bf543dfe05c8b552c4a88e9e820c5473f837c7b82e1921
Instruction ID: fdba1d0eecd5ea52e35fd1ba2cc64e9dd3b892f730208bad5abce052eedc70e1
Opcode Fuzzy Hash: 66f77002b8374a8446bf543dfe05c8b552c4a88e9e820c5473f837c7b82e1921
Instruction Fuzzy Hash: 570396B6504300DFD70CDF66FD9696A37F4FB44307B54192AE902BA2B1EB709988CB15

Function 00E288A8 Relevance: 30.6, APIs: 12, Strings: 5, Instructions: 877
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00E5B028), ref: 00E2893E
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00E28AB6
DeleteFileA.KERNELBASE(?,00000000), ref: 00E28D05
RemoveDirectoryA.KERNELBASE(00000000), ref: 00E28D5F
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00E28DD9
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00E28E9C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00E29158
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00E291F4
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000), ref: 00E2936E
CreateDirectoryA.KERNEL32(0000005C,00000000,?,?,?,?,?,?,00000000), ref: 00E294DA
GetTempPathA.KERNEL32(00000104,0000005C,?,?,?,00000000), ref: 00E2963F
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,00000000), ref: 00E297B0

Strings

C:\Windows\system32\config\systemprofile, xrefs: 00E29016, 00E2908E
\, xrefs: 00E293D0
Ua-W, xrefs: 00E29341, 00E29347
gKV`, xrefs: 00E28CE7
C:\hjflhukc\, xrefs: 00E28DF6, 00E29174, 00E2947F, 00E29666

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\hjflhukc\$Ua-W$\$gKV`
API String ID: 1691758827-3231860264
Opcode ID: eadfd9fbbaf1472ff634a6d8c105211fbe28589ceed56c8c99c780ff6f350ecd
Instruction ID: f5e3910b0c2fb98ca37e89baca95eb9794afeb62cd0538c559ff5df04e6b6c6a
Opcode Fuzzy Hash: eadfd9fbbaf1472ff634a6d8c105211fbe28589ceed56c8c99c780ff6f350ecd
Instruction Fuzzy Hash: 0682DFB2501314CFC70CDB66FD969AA37B8FB54303B44592AE502F62B2EB34998DCB15

Function 00E3571F Relevance: 6.2, APIs: 4, Instructions: 213
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E35804
Process32First.KERNEL32(00000000,00000128), ref: 00E358E2
Process32Next.KERNEL32(00000000,00000128), ref: 00E359E8
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00E35A7E

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: b9a7f258e4d2fcb2f51aeda892c00b21f6675bff8e2ed16c3d4650f0e37fca3b
Instruction ID: 442f836800f7d896626e547f3c62b497cfcf89bee8a084da918aac289294e74d
Opcode Fuzzy Hash: b9a7f258e4d2fcb2f51aeda892c00b21f6675bff8e2ed16c3d4650f0e37fca3b
Instruction Fuzzy Hash: E391A876605700CFC70C9B2AFDAA5A93BF4B748317B105D2AE846F62A1EB309959CB10

Function 00E3B046 Relevance: 9.2, APIs: 6, Instructions: 184
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00E3B104
GetFileTime.KERNEL32(00000000,?,?,?), ref: 00E3B16D
CloseHandle.KERNEL32(00000000), ref: 00E3B1B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E3B25F
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00E3B2AB
CloseHandle.KERNEL32(00000000), ref: 00E3B2D8

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3236713533-0
Opcode ID: 4fe4bbadac858d17a5374dbde906a7043c80b65cbc1e98a651de2bd68524dcc4
Instruction ID: 9845d2e1adaa769df6e6c18216bed0e434c5112af9786bb994b967561ab68eb9
Opcode Fuzzy Hash: 4fe4bbadac858d17a5374dbde906a7043c80b65cbc1e98a651de2bd68524dcc4
Instruction Fuzzy Hash: 2571A876601300CFC74CCF2AED958BA3BB4F74431BB101A1AE956F76A1E7348988CB11

Function 00E2C622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E2B7CD: WaitForSingleObject.KERNEL32(00E3AEAC,00004E20,00000001,?,00E2BFA2,00000001,-AF16B4FB,?,00E3AEAC,00E266DE), ref: 00E2B81D

CreateFileA.KERNELBASE(00000004,40000000,00000000,00000000,00000002,00000000,00000000,?,00E267E3,?,00000004,?,00000000,?), ref: 00E2C746
WriteFile.KERNELBASE(00000000,?,00000001,00000001,00000000,?,?,?,?,?,00000001), ref: 00E2C90B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,00000001), ref: 00E2C983

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationObjectSingleWaitWrite
String ID:
API String ID: 2552625159-0
Opcode ID: 93b1877ed281e71d7750d3947a5b675d07b4d0b45115b940a5eaec643396c655
Instruction ID: c7581e62e0ac5efa7e2655004ac6c578585ccb86fd262b97df7e4936b9fd7eed
Opcode Fuzzy Hash: 93b1877ed281e71d7750d3947a5b675d07b4d0b45115b940a5eaec643396c655
Instruction Fuzzy Hash: 4F91A7B2511311DFC70CCF2AFE955697BB4FB88316B60591AE506FB2B1E7309948CB14

Function 00E2E769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00E28954,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00E28954), ref: 00E2E865
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00E2E895
FreeSid.ADVAPI32(?), ref: 00E2E8DC

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: a3271e3b3040c1f39cd54a7fb8a51c01c7888464c461c787cfbbd2c159e122ee
Instruction ID: 4e5e806a36f5119159ab528cc0e97a0d3302532ade72a94ea69e1f650f5a4753
Opcode Fuzzy Hash: a3271e3b3040c1f39cd54a7fb8a51c01c7888464c461c787cfbbd2c159e122ee
Instruction Fuzzy Hash: FA415275905314EFCB0CCFA7FD856A977B4FB08306B84581AE442F7261E7349988CB65

Function 00E320D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?,?,00E309C2,?,?,?), ref: 00E320F0
CharLowerBuffA.USER32(?,00000000,?,00E309C2,?,?,?), ref: 00E32131

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: a833a050c4fd9b65a682ee5720566d0465ea0f156c6b90f22cb870d6121fc40f
Instruction ID: 4560b4d4b240ce72ee4cdd20f05e9ac5fecd183e99490c3d45fc817dd097c7e7
Opcode Fuzzy Hash: a833a050c4fd9b65a682ee5720566d0465ea0f156c6b90f22cb870d6121fc40f
Instruction Fuzzy Hash: 2FF0C731110300CFCB0C8F47EA0A4763BF2F704302B50081AF806AA231E7349D88EB62

Function 00E423A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00E4A3A7,?,?,?,00E4D0BE), ref: 00E423F6
RtlAllocateHeap.NTDLL(00000000,?,00E4A3A7,?,?,?,00E4D0BE), ref: 00E423FD

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 0019a10b51494a3b621f93de86a3eb9e38f932968cceb57cfe3731f719a2b4ec
Instruction ID: cd98e8a27ba0cae2d46f4c1561701368d84739e1451b4a16c77bffdf501a506a
Opcode Fuzzy Hash: 0019a10b51494a3b621f93de86a3eb9e38f932968cceb57cfe3731f719a2b4ec
Instruction Fuzzy Hash: 07F0E5765003019FCB048FABFC4A94A37B4F39470AB610802F145FA0B1D778E85C8FA0

Function 00E2DE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00E38109,?,00E38109,00000000), ref: 00E2DE6C
RtlFreeHeap.NTDLL(00000000,?,00E38109,00000000), ref: 00E2DE73

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 436c4e54945f4fc9e72a78d26d0b02ad1e5445340a3a37ad6b1207ba5c510361
Instruction ID: 6a10078fb418b0ea3be3db1746f41642909ddfae293800aff382342156b3433f
Opcode Fuzzy Hash: 436c4e54945f4fc9e72a78d26d0b02ad1e5445340a3a37ad6b1207ba5c510361
Instruction Fuzzy Hash: 54E08C729053449FEE088BE7FD4AA053BE8FB2174AB008911F205EA1B1C72195888A84

Non-executed Functions

Function 00E4D831 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 388
pipeprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32(00000000,?,?,00000000,?,00000001,?), ref: 00E4D98F
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00E4D9F9
CreatePipe.KERNEL32(?,?,?,00000000), ref: 00E4DA48
SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 00E4DA7E
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00E4DBCC
WriteFile.KERNEL32(?,?,00000020,00000020,00000000), ref: 00E4DC1C
CloseHandle.KERNEL32(?), ref: 00E4DC33
CloseHandle.KERNEL32(?), ref: 00E4DC66
CloseHandle.KERNEL32(?), ref: 00E4DC89
WaitForSingleObject.KERNEL32(?,00002710), ref: 00E4DD4F
CloseHandle.KERNEL32(?), ref: 00E4DD9F
CloseHandle.KERNEL32(?), ref: 00E4DDB2
CloseHandle.KERNEL32(?), ref: 00E4DE41
CloseHandle.KERNEL32(00000000), ref: 00E4DE67
CloseHandle.KERNEL32(?), ref: 00E4DE7E

Strings

D, xrefs: 00E4DB1A

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: D
API String ID: 1130065513-2746444292
Opcode ID: 1f57556406250252b280d72b1557c1dc7ee10297fecc49294e560273c75c3e12
Instruction ID: 6f359919072893aeb6ba5dd88d8467f61a6958aca5747ab0d00b757a7af422c1
Opcode Fuzzy Hash: 1f57556406250252b280d72b1557c1dc7ee10297fecc49294e560273c75c3e12
Instruction Fuzzy Hash: 24028776914704DFCB0CCF6AFD929A97BB4FB48306B14591AE802F7271EB309998CB11

Function 00E435AD Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00E43685
CreateServiceA.ADVAPI32(00000000,009A2F68,009A2F68,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00E436D6
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00E43728
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00E4374C
CloseServiceHandle.ADVAPI32(00000000), ref: 00E4375D
OpenServiceA.ADVAPI32(00000000,00000010), ref: 00E437D1
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00E43836
CloseServiceHandle.ADVAPI32(00000000), ref: 00E43847
CloseServiceHandle.ADVAPI32(00000000), ref: 00E438B1

Strings

3ch, xrefs: 00E43701
qh~B, xrefs: 00E4360F

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID: 3ch$qh~B
API String ID: 3525021261-274300185
Opcode ID: b938b0dcc4ef0adffb0ec82bcd06c4ed41d67db6a23de5a1dd7b6a2f090ad87d
Instruction ID: 076064c58267f2b5ba1db27ff78b9f12a7baebde2917f0141f69c404ae85b193
Opcode Fuzzy Hash: b938b0dcc4ef0adffb0ec82bcd06c4ed41d67db6a23de5a1dd7b6a2f090ad87d
Instruction Fuzzy Hash: 469185BA514700DEC70C8F2AFD96979B7B8F7483077444D1AE902BB2B1EB749989CB50

Function 00E3111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E311F7
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00E31267
CloseHandle.KERNEL32(00000000), ref: 00E3128B
GetTickCount.KERNEL32 ref: 00E312D1
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00E3153B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00E3157E
CloseHandle.KERNEL32(00000000), ref: 00E3158F

Strings

Ra);, xrefs: 00E31514

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID: Ra);
API String ID: 3478262135-4229484525
Opcode ID: a69dda924ea5afc35171ba6b283ed71b267f1dff2cc0cd86221ea84ef4c68a9e
Instruction ID: 832c22a9a193ec84256a07aa2e98ba146b578f1b381fe2a22604438d9639a049
Opcode Fuzzy Hash: a69dda924ea5afc35171ba6b283ed71b267f1dff2cc0cd86221ea84ef4c68a9e
Instruction Fuzzy Hash: EAB1EDB2505700DED71C8F2AFD9697A3BF8FB48317B10091AE501F62B2EB748948CB25

Function 00E31636 Relevance: 10.8, APIs: 7, Instructions: 279
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E316B2
Process32First.KERNEL32(00000000,00000128), ref: 00E317BE
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00E31932
Module32First.KERNEL32(00000000,00000224), ref: 00E31991
CloseHandle.KERNEL32(?,0000000A), ref: 00E31A6A
Process32Next.KERNEL32(00000000,00000128), ref: 00E31ACE
CloseHandle.KERNEL32(00000000), ref: 00E31AF5

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
String ID:
API String ID: 930127669-0
Opcode ID: c1b1f0bf965d6c6ddde096b2c83832190a1f6b3b957385f6e5a3558771602451
Instruction ID: bdc91f667e0a37ef9179566c5dcf2f74ea53df9c3722ef390978f3541cbc6353
Opcode Fuzzy Hash: c1b1f0bf965d6c6ddde096b2c83832190a1f6b3b957385f6e5a3558771602451
Instruction Fuzzy Hash: AFC1FDB6501700CFD70CCB66FD9AAB937B4FB44317F04195AE906F62A1EB349988CB44

Function 00E39F24 Relevance: 7.8, APIs: 5, Instructions: 329serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00E39FF7
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,?), ref: 00E3A049
GetLastError.KERNEL32 ref: 00E3A061
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,?), ref: 00E3A162
CloseServiceHandle.ADVAPI32(00000000), ref: 00E3A3B6

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
String ID:
API String ID: 1579346331-0
Opcode ID: b5816311642071612d5d187abe2efc2963fe3a0fd5f71039cbd0e3183b07b4e4
Instruction ID: 0a4f38691cf00507ce4284dce37fbbeb05c5cc1a271e274142b13187698e1694
Opcode Fuzzy Hash: b5816311642071612d5d187abe2efc2963fe3a0fd5f71039cbd0e3183b07b4e4
Instruction Fuzzy Hash: 97D1CCB6901700DFC70CCF66FD99A697BF4FB54316B19192AE801B72B0EB349988CB51

Function 00E25C39 Relevance: 7.7, APIs: 5, Instructions: 247filesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00E25DEC
FindFirstFileA.KERNEL32(?,?), ref: 00E25EB2
DeleteFileA.KERNEL32(?), ref: 00E25FE2
FindNextFileA.KERNEL32(00000000,?), ref: 00E26020
FindClose.KERNEL32(00000000), ref: 00E26042

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleep
String ID:
API String ID: 1528862845-0
Opcode ID: b6e647c30c41142dac67b4c0591a7f821a60aae3b2e4c3a1332c0814d70ef158
Instruction ID: 360eb872d3cc9380faff206afa7752dfad24c14d9b7442f807258f1c2dd897f4
Opcode Fuzzy Hash: b6e647c30c41142dac67b4c0591a7f821a60aae3b2e4c3a1332c0814d70ef158
Instruction Fuzzy Hash: 55A1DFB6611B14CFC30CCB67FE965A937B8F708307B04191AE406FA6B1EB349989CB51

Function 00E2C9ED Relevance: 12.2, APIs: 8, Instructions: 196
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(Function_0000BA72), ref: 00E2CAF2
SetServiceStatus.ADVAPI32(00E5B2DC), ref: 00E2CB64
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E2CB78
SetServiceStatus.ADVAPI32(00E5B2DC), ref: 00E2CBE5
WaitForSingleObject.KERNEL32(00001388), ref: 00E2CC62
SetServiceStatus.ADVAPI32(00E5B2DC), ref: 00E2CCAF
CloseHandle.KERNEL32 ref: 00E2CCC5
SetServiceStatus.ADVAPI32(00E5B2DC), ref: 00E2CD8F

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: e9e21bf4ff3ae0afd32d73c117cbabeb20d334b56696180bee9bf36c2fab1a4b
Instruction ID: edc1536ffec7e1cc6f89d158f77b6a2dad5bcdc433b4d57697c76326da211665
Opcode Fuzzy Hash: e9e21bf4ff3ae0afd32d73c117cbabeb20d334b56696180bee9bf36c2fab1a4b
Instruction Fuzzy Hash: 32910CB51113118FC31CCF2BFE9A8297BB5F70830B7505D2AE446BA2B1EB709889CB10

Function 00E30806 Relevance: 10.7, APIs: 7, Instructions: 195processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E308C2
Process32First.KERNEL32(00000000,00000128), ref: 00E30966
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E30A15
TerminateProcess.KERNEL32(00000000,000000FF), ref: 00E30A64
CloseHandle.KERNEL32(00000000), ref: 00E30A82
Process32Next.KERNEL32(00000000,00000128), ref: 00E30AD2
CloseHandle.KERNEL32(00000000), ref: 00E30B10

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 101d1f0149dd85fb4654c73f51c3f3e17820ef0df32e3768d5c89e6e0a9ae315
Instruction ID: 6d3dc2bee3e2b8aeafd35499fd6a96c8b486f3612a01ec59eb056c120b76c906
Opcode Fuzzy Hash: 101d1f0149dd85fb4654c73f51c3f3e17820ef0df32e3768d5c89e6e0a9ae315
Instruction Fuzzy Hash: 6281A9725117119FC30CCF2AFD96A6A77B8FB48317B40091AE846F66B1EB348998CB44

Function 00E44589 Relevance: 7.6, APIs: 5, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000002,?,00E2D583,Function_0000AD87,00000002,00000000), ref: 00E44637
CreateThread.KERNEL32(00000000,00000000,00000002,?,00000000,00000000), ref: 00E44655
CloseHandle.KERNEL32(00000000,?,00000002,?,00E2D583,Function_0000AD87,00000002,00000000), ref: 00E4468D
WaitForSingleObject.KERNEL32(?,000000FF,?,00000002,?,00E2D583,Function_0000AD87,00000002,00000000), ref: 00E446A1
CloseHandle.KERNEL32(?,00000002,?,00E2D583,Function_0000AD87,00000002,00000000), ref: 00E44712

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 3e94680a8e10043c0290aa5ba3c83fbb07c27b13dc3ac593860b65732bfba043
Instruction ID: c7add2c1db95b83b0f9089aeb741071b052acf4d72a7f651aa1e105100fac328
Opcode Fuzzy Hash: 3e94680a8e10043c0290aa5ba3c83fbb07c27b13dc3ac593860b65732bfba043
Instruction Fuzzy Hash: DE4174B6111340DFC31C8F2AFD899263BB5F7897177604C2AE456E66B1E330A85ACB11

Function 00E44927 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00E44CBC

Part of subcall function 00E3074E: wvsprintfA.USER32(?,?,?), ref: 00E307C3

Sleep.KERNEL32(00015F90), ref: 00E44E60
DeleteFileA.KERNEL32(?), ref: 00E44E7F

Strings

KU, xrefs: 00E44A26

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: File$DeleteModuleNameSleepwvsprintf
String ID: KU
API String ID: 4183770253-1793860563
Opcode ID: b09bae2435004d7b55420c3db02da010316b1930d4d4aacf3a5191242bffcf98
Instruction ID: 90df0b8c3a6e6614baefdf31e3617fe45b02a1ea52d283b2bcdf03992c499705
Opcode Fuzzy Hash: b09bae2435004d7b55420c3db02da010316b1930d4d4aacf3a5191242bffcf98
Instruction Fuzzy Hash: 7CD1D1766107048EC70CDF66FD96AA577F8FB44302B441D1AE906FB2B1EB349988CB51

Function 00E354D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,00E2DA33,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00E35628
CloseHandle.KERNEL32(00E2DA33,?,?,?,?,00000000), ref: 00E35652
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00E35665

Strings

D, xrefs: 00E355A3

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: a5aed7ae42c47f0e66f46b5cf9c1b43dd91487e257f60e813c60e51d34bdbe2a
Instruction ID: 6d3a1083af13643b7c14c8a6c877bdd6c51b6e88c56bfcbe0a4581d49b821e84
Opcode Fuzzy Hash: a5aed7ae42c47f0e66f46b5cf9c1b43dd91487e257f60e813c60e51d34bdbe2a
Instruction Fuzzy Hash: CD41B072501705DFCB1CDF97FE9A9BA7BB4FB84306B00581AE502B62B1EB705848DB11

Function 00E39B78 Relevance: 6.2, APIs: 4, Instructions: 201fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E39C43
ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00E39CA8
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00E39DC7
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00E39E86

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: CloseFileHandle$CreateRead
String ID:
API String ID: 2564258376-0
Opcode ID: 6a90d49a9483e444d8a4e6b72c5242241cd4cc5ff2fe71817f8b7aae07d2d540
Instruction ID: 8dc7a7f5a04d483ff998d094efafcb3b372c7ed68f2774742cef6193a8ab1bc0
Opcode Fuzzy Hash: 6a90d49a9483e444d8a4e6b72c5242241cd4cc5ff2fe71817f8b7aae07d2d540
Instruction Fuzzy Hash: 3581A9756013008FC718EF62FD9667A37E8FB44307F10291AE506B62A2EB748888CB55

Function 00E490F1 Relevance: 6.0, APIs: 4, Instructions: 38memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00E38146,00000000,?,?,?,?,?,00E2F85A,?,?,?,00E49573), ref: 00E49143
RtlReAllocateHeap.NTDLL(00000000,?,00E38146,00000000), ref: 00E4914A
GetProcessHeap.KERNEL32(00000000,00000000,?,00E38146,00000000,?,?,?,?,?,00E2F85A,?,?,?,00E49573,?), ref: 00E49174
HeapAlloc.KERNEL32(00000000,?,00E38146,00000000,?,?,?,?,?,00E2F85A,?,?,?,00E49573,?,00000001), ref: 00E4917B

Memory Dump Source

Source File: 0000000B.00000002.2721684791.0000000000E21000.00000020.00000001.01000000.00000007.sdmp, Offset: 00E20000, based on PE: true

Associated: 0000000B.00000002.2721656789.0000000000E20000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721735736.0000000000E4F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721765279.0000000000E50000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721795710.0000000000E53000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2721825615.0000000000E5C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e20000_xxxniijvj.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 467804b0b927c0805b365f659dcb042cf92dee564e77881c7abdb9a9eb15e606
Instruction ID: 4d035da7cb33316534fff7edc7ab02cfa8d67c2accf67a7f990b507cd8de476f
Opcode Fuzzy Hash: 467804b0b927c0805b365f659dcb042cf92dee564e77881c7abdb9a9eb15e606
Instruction Fuzzy Hash: 73011A7A540704DFDB0C9FA2FC696693BA4FB09306F844815F90AA6672E775A44CCB40

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7qBBKk0P4l.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\hjflhukc\hhziccmdjsti

C:\hjflhukc\hhziccmdjsti

C:\hjflhukc\psjpq2i82ktsjq0yguk.exe

C:\hjflhukc\xxxniijvj.exe

C:\hjflhukc\yanidfx.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
7qBBKk0P4l.exe

Function 000C88A8 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 877
fileCOMMON

Function 000D111E Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289
fileCOMMON

Function 000C5C39 Relevance: 7.7, APIs: 5, Instructions: 247
filesleepCOMMON

Function 000CE769 Relevance: 4.6, APIs: 3, Instructions: 101
memoryCOMMON

Function 000CDE5A Relevance: 3.0, APIs: 2, Instructions: 17
memoryCOMMONLIBRARYCODE

Function 000D5498 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110
processCOMMON

Function 000D54D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
processCOMMON

Function 000CC622 Relevance: 4.7, APIs: 3, Instructions: 206
fileCOMMON

Function 000D20D8 Relevance: 3.0, APIs: 2, Instructions: 27
stringCOMMON

Function 000E23A6 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMONLIBRARYCODE

Function 000D15E5 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre