Edit tour

Windows Analysis Report
SO2mdwWVvg.exe

Overview

General Information

Sample name:	SO2mdwWVvg.exe renamed because original name is a hash value
Original sample name:	f3b2f1ec49bf6fbd4fe9e28fb28e526da4c7fce85ac95f835d3dc343b872075d.exe
Analysis ID:	1535738
MD5:	bfa844f0be57643e3ebf11690e539a75
SHA1:	8495fd0110b642c66f49e3d30c543f5c730bc206
SHA256:	f3b2f1ec49bf6fbd4fe9e28fb28e526da4c7fce85ac95f835d3dc343b872075d
Tags:	exeimg-bilibili-buzzuser-JAMESWT_MHT
Infos:

Detection

CobaltStrike

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Detected potential crypto function

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SO2mdwWVvg.exe (PID: 7516 cmdline: "C:\Users\user\Desktop\SO2mdwWVvg.exe" MD5: BFA844F0BE57643E3EBF11690E539A75)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 2096, "SleepTime": 45000, "MaxGetSize": 1403644, "Jitter": 37, "MaxDNS": "Not Found", "C2Server": "img.bilibili.buzz,/jquery-3.3.1.min.js", "UserAgent": "Not Found", "HttpPostUri": "Not Found", "Malleable_C2_Instructions": "Not Found", "HttpGet_Metadata": "Not Found", "HttpPost_Metadata": "Not Found", "PipeName": "Not Found", "DNS_Idle": "Not Found", "DNS_Sleep": "Not Found", "SSH_Host": "Not Found", "SSH_Port": "Not Found", "SSH_Username": "Not Found", "SSH_Password_Plaintext": "Not Found", "SSH_Password_Pubkey": "Not Found", "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Config": "Not Found", "Proxy_User": "Not Found", "Proxy_Password": "Not Found", "Proxy_Behavior": "Not Found", "Watermark": 100000000, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": "Not Found", "bProcInject_StartRWX": "Not Found", "bProcInject_UseRWX": "Not Found", "bProcInject_MinAllocSize": "Not Found", "ProcInject_PrependAppend_x86": "Not Found", "ProcInject_PrependAppend_x64": "Not Found", "ProcInject_Execute": "Not Found", "ProcInject_AllocationMethod": "Not Found", "bUsesCookies": "Not Found", "HostHeader": "Not Found"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1770728678.000001DDE5E00000.00000010.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1770728678.000001DDE5E00000.00000010.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x164e3:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x17774:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x187e4:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0xfd75:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03 0xff0d:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16513:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x177a4:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Process Memory Space: SO2mdwWVvg.exe PID: 7516	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000003.1770728678.000001DDE5E00000.00000010.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 2096, "SleepTime": 45000, "MaxGetSize": 1403644, "Jitter": 37, "MaxDNS": "Not Found", "C2Server": "img.bilibili.buzz,/jquery-3.3.1.min.js", "UserAgent": "Not Found", "HttpPostUri": "Not Found", "Malleable_C2_Instructions": "Not Found", "HttpGet_Metadata": "Not Found", "HttpPost_Metadata": "Not Found", "PipeName": "Not Found", "DNS_Idle": "Not Found", "DNS_Sleep": "Not Found", "SSH_Host": "Not Found", "SSH_Port": "Not Found", "SSH_Username": "Not Found", "SSH_Password_Plaintext": "Not Found", "SSH_Password_Pubkey": "Not Found", "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe", "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe", "CryptoScheme": 0, "Proxy_Config": "Not Found", "Proxy_User": "Not Found", "Proxy_Password": "Not Found", "Proxy_Behavior": "Not Found", "Watermark": 100000000, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": "Not Found", "bProcInject_StartRWX": "Not Found", "bProcInject_UseRWX": "Not Found", "bProcInject_MinAllocSize": "Not Found", "ProcInject_PrependAppend_x86": "Not Found", "ProcInject_PrependAppend_x64": "Not Found", "ProcInject_Execute": "Not Found", "ProcInject_AllocationMethod": "Not Found", "bUsesCookies": "Not Found", "HostHeader": "Not Found"}

Multi AV Scanner detection for submitted file

Source: SO2mdwWVvg.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 80.6% probability

Source: SO2mdwWVvg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: img.bilibili.buzz

Source: global traffic

HTTP traffic detected: GET /Shorts/index.jpg HTTP/1.1accept: */*host: intl-web-1305970982.cos.ap-singapore.myqcloud.com

Source: Joe Sandbox View

IP Address: 43.152.64.207 43.152.64.207

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /Shorts/index.jpg HTTP/1.1accept: */*host: intl-web-1305970982.cos.ap-singapore.myqcloud.com

Source: global traffic	DNS traffic detected: DNS query: intl-web-1305970982.cos.ap-singapore.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: img.bilibili.buzz
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: SO2mdwWVvg.exe, 00000000.00000003.1771402299.000001DDE5EB0000.00000004.00000020.00020000.00000000.sdmp, SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/
Source: SO2mdwWVvg.exe	String found in binary or memory: http://intl-web-1305970982.cos.ap-singapore.myqcloud.com/Shorts/index.jpg
Source: SO2mdwWVvg.exe, 00000000.00000003.1770340224.000001DDE5E9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://intl-web-1305970982.cos.ap-singapore.myqcloud.com/Shorts/index.jpg(S
Source: SO2mdwWVvg.exe, 00000000.00000003.1770340224.000001DDE5E9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://intl-web-1305970982.cos.ap-singapore.myqcloud.com/Shorts/index.jpgvR
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp, SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz/
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz/i
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp, SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/3r9
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/Cri
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/J
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.js
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.js/
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.js011b87bd06T-
Source: SO2mdwWVvg.exe, 00000000.00000002.3567085298.000001DDE5F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.js1A
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.js9
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.js=
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsI
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsM
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsraphy
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsu
Source: SO2mdwWVvg.exe, 00000000.00000002.3567085298.000001DDE5F86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsy
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/m
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/m32
Source: SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.bilibili.buzz:2096/w

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000003.1770728678.000001DDE5E00000.00000010.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE60FFC3E	0_2_000001DDE60FFC3E
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE60FFDD6	0_2_000001DDE60FFDD6
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE610D384	0_2_000001DDE610D384
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE610C888	0_2_000001DDE610C888
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE61180B0	0_2_000001DDE61180B0
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE610C11C	0_2_000001DDE610C11C
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE610A708	0_2_000001DDE610A708
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE6117740	0_2_000001DDE6117740
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE6104820	0_2_000001DDE6104820

Source: SO2mdwWVvg.exe

Static PE information: invalid certificate

Source: SO2mdwWVvg.exe

Static PE information: Number of sections : 22 > 10

Source: SO2mdwWVvg.exe	Binary or memory string: OriginalFilename vs SO2mdwWVvg.exe
Source: SO2mdwWVvg.exe, 00000000.00000000.1699484601.00007FF63F8E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemsedge.exe8 vs SO2mdwWVvg.exe
Source: SO2mdwWVvg.exe	Binary or memory string: OriginalFilenamemsedge.exe8 vs SO2mdwWVvg.exe

Source: 00000000.00000003.1770728678.000001DDE5E00000.00000010.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13

Source: SO2mdwWVvg.exe	Binary string: AfdPollInfo\Device\Afd\Mio
Source: SO2mdwWVvg.exe	Binary string: Failed to open \Device\Afd\Mio:

Source: classification engine

Classification label: mal84.troj.evad.winEXE@2/0@8/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03

Source: SO2mdwWVvg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SO2mdwWVvg.exe

ReversingLabs: Detection: 36%

Source: SO2mdwWVvg.exe

String found in binary or memory: /load_hpack; header malformed -- pseudo not at head of block

Source: unknown	Process created: C:\Users\user\Desktop\SO2mdwWVvg.exe "C:\Users\user\Desktop\SO2mdwWVvg.exe"
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: SO2mdwWVvg.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SO2mdwWVvg.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SO2mdwWVvg.exe

Static file information: File size 8063016 > 1048576

Source: SO2mdwWVvg.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x29f200
Source: SO2mdwWVvg.exe	Static PE information: Raw size of /86 is bigger than: 0x100000 < 0x151200

Source: SO2mdwWVvg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: SO2mdwWVvg.exe

Static PE information: real checksum: 0x952f02 should be: 0x7b6c97

Source: SO2mdwWVvg.exe	Static PE information: section name: .xdata
Source: SO2mdwWVvg.exe	Static PE information: section name: /4
Source: SO2mdwWVvg.exe	Static PE information: section name: /19
Source: SO2mdwWVvg.exe	Static PE information: section name: /35
Source: SO2mdwWVvg.exe	Static PE information: section name: /47
Source: SO2mdwWVvg.exe	Static PE information: section name: /61
Source: SO2mdwWVvg.exe	Static PE information: section name: /73
Source: SO2mdwWVvg.exe	Static PE information: section name: /86
Source: SO2mdwWVvg.exe	Static PE information: section name: /97
Source: SO2mdwWVvg.exe	Static PE information: section name: /113
Source: SO2mdwWVvg.exe	Static PE information: section name: /127
Source: SO2mdwWVvg.exe	Static PE information: section name: /143

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E04C06 push esi; ret	0_3_000001DDE5E04C0F
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E003A0 push ebx; ret	0_3_000001DDE5E003A6
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E072F1 push esp; ret	0_3_000001DDE5E07322
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E05AF5 push edx; ret	0_3_000001DDE5E05ABE
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E072CE push ebx; ret	0_3_000001DDE5E072EE
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E04ACF push esp; ret	0_3_000001DDE5E04AD8
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E06265 push ebp; ret	0_3_000001DDE5E06269
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E05E20 push ecx; ret	0_3_000001DDE5E05E33
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E0849E push ebp; ret	0_3_000001DDE5E084A5
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E04486 push edx; ret	0_3_000001DDE5E0449E
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E0846F push es; ret	0_3_000001DDE5E08476
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E057C9 push eax; ret	0_3_000001DDE5E057AA
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E0678C push ebx; ret	0_3_000001DDE5E0679A
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E0579B push eax; ret	0_3_000001DDE5E057AA
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E0672C push ebx; ret	0_3_000001DDE5E0679A
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E0416D push esi; ret	0_3_000001DDE5E04172
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_3_000001DDE5E07900 push ecx; ret	0_3_000001DDE5E0791E
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE60FAD58 push ebp; iretd	0_2_000001DDE60FAD59
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE6106A40 push cs; ret	0_2_000001DDE6106A4B
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE60F935D push edi; iretd	0_2_000001DDE60F935E
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE6115BBB push ebp; iretd	0_2_000001DDE6115BBC
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE6115BDB push ebp; iretd	0_2_000001DDE6115BDC
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE6115C04 push ebp; iretd	0_2_000001DDE6115C05
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Code function: 0_2_000001DDE60F971E push cs; retf	0_2_000001DDE60F971F

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe TID: 7636	Thread sleep time: -34780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe TID: 7636	Thread sleep time: -40597s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe TID: 7636	Thread sleep time: -36804s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe TID: 7636	Thread sleep time: -31355s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Thread delayed: delay time: 34780	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Thread delayed: delay time: 40597	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Thread delayed: delay time: 36804	Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	Thread delayed: delay time: 31355	Jump to behavior

Source: SO2mdwWVvg.exe, 00000000.00000003.1770093925.000001DDE5EAE000.00000004.00000020.00020000.00000000.sdmp, SO2mdwWVvg.exe, 00000000.00000003.1771402299.000001DDE5EB0000.00000004.00000020.00020000.00000000.sdmp, SO2mdwWVvg.exe, 00000000.00000003.1769895816.000001DDE5EAD000.00000004.00000020.00020000.00000000.sdmp, SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5E9A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	NtDeviceIoControlFile: Indirect: 0x7FF63F6B75BE			Jump to behavior
Source: C:\Users\user\Desktop\SO2mdwWVvg.exe	NtCreateFile: Indirect: 0x7FF63F6BE714			Jump to behavior

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe

Code function: 0_2_000001DDE6102FA8 GetUserNameA,strrchr,_snprintf,

0_2_000001DDE6102FA8

Source: C:\Users\user\Desktop\SO2mdwWVvg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 00000000.00000003.1770728678.000001DDE5E00000.00000010.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SO2mdwWVvg.exe PID: 7516, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SO2mdwWVvg.exe	37%	ReversingLabs	Win64.Backdoor.Cobeacon

Name	IP	Active	Malicious	Reputation
sgp.file.myqcloud.com	43.152.64.207	true	false	unknown
img.bilibili.buzz	unknown	unknown	true	unknown
18.31.95.13.in-addr.arpa	unknown	unknown	true	unknown
intl-web-1305970982.cos.ap-singapore.myqcloud.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
img.bilibili.buzz	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://img.bilibili.buzz:2096/w	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://code.jquery.com/	SO2mdwWVvg.exe, 00000000.00000003.1771402299.000001DDE5EB0000.00000004.00000020.00020000.00000000.sdmp, SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/m32	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/m	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://intl-web-1305970982.cos.ap-singapore.myqcloud.com/Shorts/index.jpg	SO2mdwWVvg.exe	false	unknown
https://img.bilibili.buzz/i	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/Cri	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5E9A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/3r9	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5E9A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.js011b87bd06T-	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.js1A	SO2mdwWVvg.exe, 00000000.00000002.3567085298.000001DDE5F86000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz/	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp, SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.js9	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsy	SO2mdwWVvg.exe, 00000000.00000002.3567085298.000001DDE5F86000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.js=	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://intl-web-1305970982.cos.ap-singapore.myqcloud.com/Shorts/index.jpgvR	SO2mdwWVvg.exe, 00000000.00000003.1770340224.000001DDE5E9E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.js/	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsu	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/J	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsI	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://intl-web-1305970982.cos.ap-singapore.myqcloud.com/Shorts/index.jpg(S	SO2mdwWVvg.exe, 00000000.00000003.1770340224.000001DDE5E9E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsM	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.js	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/jquery-3.3.1.min.jsraphy	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5ED9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://img.bilibili.buzz:2096/	SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5EC2000.00000004.00000020.00020000.00000000.sdmp, SO2mdwWVvg.exe, 00000000.00000002.3566662494.000001DDE5E9A000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
43.152.64.207	sgp.file.myqcloud.com	Japan		4249	LILLY-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1535738
Start date and time:	2024-10-17 09:19:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SO2mdwWVvg.exe renamed because original name is a hash value
Original Sample Name:	f3b2f1ec49bf6fbd4fe9e28fb28e526da4c7fce85ac95f835d3dc343b872075d.exe
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@2/0@8/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SO2mdwWVvg.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
43.152.64.207	O6O7O5REot.exe	Get hash	malicious	CobaltStrike	Browse	/Shorts/1index.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sgp.file.myqcloud.com	O6O7O5REot.exe	Get hash	malicious	CobaltStrike	Browse	43.152.64.207
	O6O7O5REot.exe	Get hash	malicious	CobaltStrike	Browse	43.152.64.193
	LisectAVT_2403002B_132.exe	Get hash	malicious	Unknown	Browse	43.152.64.193
	LisectAVT_2403002B_132.exe	Get hash	malicious	Unknown	Browse	43.152.64.207
	LisectAVT_2403002B_185.exe	Get hash	malicious	Unknown	Browse	43.153.232.152
	LisectAVT_2403002B_185.exe	Get hash	malicious	Unknown	Browse	43.153.232.152
	LisectAVT_2403002B_246.exe	Get hash	malicious	Unknown	Browse	43.152.64.207
	LisectAVT_2403002B_246.exe	Get hash	malicious	Unknown	Browse	43.153.232.151
	LisectAVT_2403002B_295.exe	Get hash	malicious	Unknown	Browse	43.152.64.207

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LILLY-ASUS	mpsl.elf	Get hash	malicious	Mirai	Browse	43.9.28.141
	O6O7O5REot.exe	Get hash	malicious	CobaltStrike	Browse	43.152.64.207
	m68k.elf	Get hash	malicious	Mirai	Browse	43.110.37.159
	O6O7O5REot.exe	Get hash	malicious	CobaltStrike	Browse	43.152.64.193
	1kqLF3lHvm.elf	Get hash	malicious	Mirai	Browse	40.245.243.144
	JFX7sO1HHj.elf	Get hash	malicious	Mirai	Browse	43.2.146.57
	JJLOVjVrYv.elf	Get hash	malicious	Mirai, Gafgyt	Browse	43.223.172.145
	VysS7K9PPz.elf	Get hash	malicious	Mirai	Browse	43.87.11.124
	VDRitLeYgi.elf	Get hash	malicious	Mirai, Gafgyt	Browse	42.132.41.46

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.39827836007752
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SO2mdwWVvg.exe
File size:	8'063'016 bytes
MD5:	bfa844f0be57643e3ebf11690e539a75
SHA1:	8495fd0110b642c66f49e3d30c543f5c730bc206
SHA256:	f3b2f1ec49bf6fbd4fe9e28fb28e526da4c7fce85ac95f835d3dc343b872075d
SHA512:	c527259c31068ce4bcba4f88bd8f99745d43c4809b8c75f6242eccfa712bf2fcbf3e785294c94f65ee23397d44dda74b1ec02cc9b9a76e059b608d31c11c8317
SSDEEP:	49152:u/byhpYcDbYtlxFbY2zU6AoF01ms886E4xkkrtCMcrY0Eqh88RwTAJx6ZXdl71KB:eyoaZl3sqbwEJOfcOm4ZW
TLSH:	8F869D13E9946AF4D4ABCA34812F63317B317A9DD7108BB30A75C3716F52291EF0BA58
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......g..z..U....&....&..)...P................@..............................{....../....`... ............................

File Icon


Icon Hash:	0000000000000000

Static PE Info

General

Entrypoint:	0x1400014d0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6708D41F [Fri Oct 11 07:30:39 2024 UTC]
TLS Callbacks:	0x40254570, 0x1, 0x4029eff0, 0x1, 0x4029efc0, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	68496f0ecf5dcf9ad868bebe595b3bbb

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	19/10/2023 20:51:56 16/10/2024 20:51:56
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	87AC6386A8291ECF334EB3022D315F82
Thumbprint SHA-1:	05A822642CF64464460CB4684FF11C7F476873CA
Thumbprint SHA-256:	36305D4DDFD4756D17FCDFB742FD2031A3D5133BCE34BD8E3080BC803AE44D0B
Serial:	33000003A54111E8F07FBE0B750000000003A5

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00397365h]
mov dword ptr [eax], 00000000h
call 00007F500C7EB7DFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F500CA894E4h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
push esi
push edi
dec eax
sub esp, 28h
dec eax
mov esi, dword ptr [ecx]
dec eax
test esi, esi
je 00007F500C7EBB8Dh
dec eax
mov ecx, esi
call 00007F500C99370Fh
dec eax
mov eax, dword ptr [esi+10h]
dec eax
dec dword ptr [eax]
jne 00007F500C7EBB4Bh
dec eax
lea ecx, dword ptr [esi+10h]
call 00007F500C7ECDACh
dec eax
cmp dword ptr [esi+18h], 00000000h
je 00007F500C7EBB52h
dec eax
mov eax, dword ptr [esi+40h]
dec eax
test eax, eax
je 00007F500C7EBB49h
dec eax
mov ecx, dword ptr [esi+48h]
call dword ptr [eax+18h]
mov edx, 00000070h
inc ecx
mov eax, 00000008h
dec eax
mov ecx, esi
dec eax
add esp, 28h
pop edi
pop esi
jmp 00007F500C7F0EACh
nop
dec eax
add esp, 28h
pop edi
pop esi
ret
dec eax
mov edi, eax
jmp 00007F500C7EBB74h
dec eax
mov edi, eax
jmp 00007F500C7EBB58h
dec eax
mov edi, eax
dec eax
mov eax, dword ptr [esi+10h]
dec eax
dec dword ptr [eax]
jne 00007F500C7EBB4Bh
dec eax
lea ecx, dword ptr [esi+10h]
call 00007F500C7ECD54h
dec eax
cmp dword ptr [esi+18h], 00000000h
je 00007F500C7EBB52h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ed000	0x29a4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3f2000	0x4a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x399000	0x14898	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x7ae000	0x2828	/113
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f3000	0x6ae0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x398480	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3ed948	0x858	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f0a8	0x29f200	259b974f0ee51784bf597efc48bbbbbe	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2a1000	0x4b20	0x4c00	abdfe15562c55b90f2caf4c50a108ef8	False	0.19413034539473684	data	3.042317915133944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2a6000	0xf2940	0xf2a00	790c81429cc4502e5f79bf85173aa8bb	False	0.39405831401339514	8086 relocatable (Microsoft), "\001", 1st record data length 46, 2nd record type 0x72, 2nd record data length 28530	5.804525344969575	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x399000	0x14898	0x14a00	35892e9354d3515e9ba22c5b66ff4452	False	0.5371803977272728	data	6.285541568397713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x3ae000	0x3d1f8	0x3d200	5596f7921b7cbb1e5f7896c46d3fd1fa	False	0.3804999041411043	data	5.482057773775184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x3ec000	0x35c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3ed000	0x29a4	0x2a00	27e40ce0f006a359416d45289b69f5ba	False	0.26209077380952384	data	4.4450782274129645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x3f0000	0x70	0x200	eccf70b44811bcc4f44c36459f577362	False	0.08984375	data	0.4965832874032078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3f1000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3f2000	0x4a0	0x600	f106952f55bc10f0d669c8c5041ac8e9	False	0.3131510416666667	data	3.7177162859354107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3f3000	0x6ae0	0x6c00	a005c052707dc9389c58deea863a8fd8	False	0.3851634837962963	data	5.448662938188895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/4	0x3fa000	0x260	0x400	8517538435369095b38cab16045a1774	False	0.189453125	data	1.666147721952265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x3fb000	0x9b4d6	0x9b600	5ad3a155317bf826b2f573486a2a6b6d	False	0.12735694891391794	MIPSEB Ucode	5.0979263844548415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/35	0x497000	0xe2609	0xe2800	ce446b3f6eb446b7db86fce6ead5e19f	False	0.3802579159768212	data	5.526268967684696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/47	0x57a000	0x13f1	0x1400	937541e4121ed480a0a0fa607719bf64	False	0.2408203125	data	4.899277134046503	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/61	0x57c000	0x5b404	0x5b600	9d0f11493c72314e3e042d7b0897aa00	False	0.3966339988030096	data	5.962573754446139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/73	0x5d8000	0x2e0	0x400	85316995ff793b87845b81d67872b184	False	0.3447265625	data	2.880882175766859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/86	0x5d9000	0x15106b	0x151200	deef478bf5fb15e418fc3e2de1d539cf	False	0.17364852729885058	data	5.384084445449517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/97	0x72b000	0x10e	0x200	5c08cacbdf4071bce793c7c0e033b7a4	False	0.244140625	data	1.6221371847887087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/113	0x72c000	0x8eab0	0x8ec00	b62a07db96f4a7c8651b2eb44ed6f7a8	False	0.10461532672942207	data	2.4961799056096816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/127	0x7bb000	0x3e9	0x400	55ab218550afaef32cf682ad9b627bb9	False	0.5302734375	data	4.566407064601656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/143	0x7bc000	0x17	0x200	b2332f3b7c1b892bb88709de3af56034	False	0.064453125	Spectrum .TAP data "\005 " - BASIC program	0.2475781363955928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3f20e8	0x30	Device independent bitmap graphic, 1 x 2 x 24, image size 0, resolution 96 x 96 px/m	English	United States	0.6041666666666666
RT_GROUP_ICON	0x3f2118	0x14	data	English	United States	1.05
RT_VERSION	0x3f212c	0x374	data	English	United States	0.4095022624434389

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, InitializeCriticalSection, LeaveCriticalSection, RaiseException, RtlUnwindEx, VirtualProtect, VirtualQuery, __C_specific_handler
msvcrt.dll	__getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _commode, _fmode, _fpreset, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcmp, memcpy, memmove, memset, signal, strlen, strncmp, vfprintf
advapi32.dll	CryptAcquireContextW, CryptDestroyKey, CryptImportKey, CryptReleaseContext, OpenProcessToken, RegCloseKey, RegEnumKeyExW, RegEnumValueW, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExW, SystemFunction036
bcrypt.dll	BCryptGenRandom
crypt32.dll	CertAddCertificateContextToStore, CertAddEncodedCTLToStore, CertAddEncodedCertificateToStore, CertCloseStore, CertCreateCTLEntryFromCertificateContextProperties, CertCreateCertificateContext, CertDeleteCertificateFromStore, CertDuplicateCertificateChain, CertDuplicateCertificateContext, CertDuplicateStore, CertEnumCertificatesInStore, CertFreeCTLContext, CertFreeCertificateChain, CertFreeCertificateContext, CertGetCertificateChain, CertGetCertificateContextProperty, CertGetEnhancedKeyUsage, CertOpenStore, CertSetCertificateContextProperty, CertVerifyCertificateChainPolicy, CertVerifyTimeValidity, CryptAcquireCertificatePrivateKey, CryptBinaryToStringA, CryptDecodeObjectEx, CryptEncodeObjectEx, CryptHashCertificate, CryptMsgEncodeAndSignCTL, CryptStringToBinaryA, PFXExportCertStore, PFXImportCertStore
kernel32.dll	AcquireSRWLockExclusive, AcquireSRWLockShared, AddVectoredExceptionHandler, CancelIo, CancelIoEx, CloseHandle, CompareStringOrdinal, ConnectNamedPipe, CopyFileExW, CreateDirectoryW, CreateEventW, CreateFileMappingA, CreateFileW, CreateHardLinkW, CreateIoCompletionPort, CreateNamedPipeW, CreateProcessW, CreateSymbolicLinkW, CreateThread, CreateToolhelp32Snapshot, CreateWaitableTimerExW, DeleteFileW, DeleteProcThreadAttributeList, DeviceIoControl, DisconnectNamedPipe, DuplicateHandle, ExitProcess, FileTimeToSystemTime, FindClose, FindFirstFileW, FindNextFileW, FlushFileBuffers, FormatMessageW, FreeConsole, FreeEnvironmentStringsW, FreeLibrary, GetCommandLineW, GetConsoleMode, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNamedPipeInfo, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetProcessId, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempPathW, GetWindowsDirectoryW, HeapAlloc, HeapFree, HeapReAlloc, InitOnceBeginInitialize, InitOnceComplete, InitializeProcThreadAttributeList, LoadLibraryExW, LocalFree, MapViewOfFile, Module32FirstW, Module32NextW, MoveFileExW, MultiByteToWideChar, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, ReadConsoleW, ReadFile, ReadFileEx, ReleaseSRWLockExclusive, ReleaseSRWLockShared, RemoveDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetCurrentDirectoryW, SetEnvironmentVariableW, SetFileAttributesW, SetFileCompletionNotificationModes, SetFileInformationByHandle, SetFilePointerEx, SetFileTime, SetHandleInformation, SetLastError, SetThreadErrorMode, SetThreadStackGuarantee, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SleepConditionVariableSRW, SleepEx, SwitchToThread, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnmapViewOfFile, UpdateProcThreadAttribute, WaitForMultipleObjects, WaitForSingleObject, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile, WriteFileEx
ncrypt.dll	NCryptFreeObject
ntdll.dll	NtCancelIoFileEx, NtCreateFile, NtDeviceIoControlFile, NtReadFile, NtWriteFile, RtlNtStatusToDosError
secur32.dll	AcceptSecurityContext, AcquireCredentialsHandleA, ApplyControlToken, DecryptMessage, DeleteSecurityContext, EncryptMessage, FreeContextBuffer, FreeCredentialsHandle, InitializeSecurityContextW, QueryContextAttributesW
userenv.dll	GetUserProfileDirectoryW
ws2_32.dll	WSACleanup, WSADuplicateSocketW, WSAGetLastError, WSAIoctl, WSAPoll, WSARecv, WSARecvFrom, WSASend, WSASendMsg, WSASendTo, WSASocketW, WSAStartup, accept, bind, closesocket, connect, freeaddrinfo, getaddrinfo, getpeername, getsockname, getsockopt, ioctlsocket, listen, recv, recvfrom, select, send, sendto, setsockopt, shutdown, socket

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 09:20:09.474390030 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:10.489583015 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:12.489402056 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:12.552901030 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:12.552984953 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:12.554409981 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:12.621756077 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.010185957 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.010201931 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.010215044 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.010277987 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.011647940 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.011661053 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.011674881 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.011697054 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.011697054 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.011709929 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.011759996 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.013746023 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.014390945 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.014444113 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.073034048 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.073271990 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.073421955 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.075500011 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.130038023 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.136027098 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.136408091 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.136461020 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.138334036 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.139184952 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.139240026 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.139455080 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.143654108 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.143713951 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.143954039 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.148262024 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.148366928 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.148396969 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.152873039 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.152950048 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.153166056 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.178956032 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.179002047 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.179116964 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.181169987 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.181226015 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.258101940 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.258120060 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.258187056 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.260317087 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.260473967 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.260521889 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.264842033 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.264962912 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.265005112 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.269493103 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.269685030 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.269737005 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.273967028 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.274333954 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.274388075 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.299896002 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.300091982 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.300154924 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.302083015 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.302232981 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.302314043 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.376188993 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.376208067 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.376281023 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.378463984 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.379154921 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.379184961 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.379256964 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.383789062 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.383802891 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.383852005 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.388273954 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.388366938 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.388525009 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.393016100 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.393026114 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.393079996 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.422168016 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.422180891 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.422239065 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.424371958 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.424382925 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.424410105 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.473774910 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.500545025 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.500740051 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.500780106 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.502880096 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.503104925 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.503149986 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.507272005 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.507632017 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.507674932 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.511934996 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.512203932 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.512279034 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.516408920 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.516474962 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.516522884 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.520873070 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.540225029 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.540292025 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.540437937 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.542519093 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.542653084 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.542684078 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.583144903 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.624803066 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.624819040 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.624872923 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.627089024 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.627101898 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.627291918 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.631344080 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.631931067 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.632055044 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.635988951 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.636002064 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.636054039 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.640523911 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.640675068 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.640727043 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.645210028 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.671565056 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.671577930 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.671610117 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.674298048 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.674340010 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.674741030 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.723788977 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.756458998 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.756572008 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.756613970 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.758757114 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.759042978 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.759093046 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.763407946 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.763676882 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.763726950 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.767992973 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.768266916 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.768315077 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.772485971 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.772512913 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.772556067 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.777024031 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.784396887 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.784449100 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.784614086 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.786612988 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.786674023 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.786839962 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.791220903 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.791270971 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.864634991 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.864960909 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.865016937 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.866926908 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.867803097 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.867849112 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.868051052 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.872289896 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.872302055 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.872353077 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.882941008 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.882997990 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.883013010 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.885217905 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.885267019 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.885485888 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.889797926 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.889847994 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.908303022 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.908355951 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.908586025 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.911048889 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.911158085 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.911226034 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.914199114 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.914211988 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.914275885 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.918848991 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.973779917 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.993720055 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.993829966 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.993875027 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.995956898 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.996138096 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:14.996196032 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:14.999993086 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.008821964 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.008871078 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.008961916 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.010898113 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.010948896 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.011094093 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.014986992 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.015041113 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.032727003 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.032882929 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.033024073 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.034739971 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.034849882 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.034904957 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.038944006 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.075993061 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.076316118 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.076390028 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.078063011 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.078124046 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.110894918 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.111148119 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.111206055 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.112896919 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.114130020 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.114200115 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.114351988 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.117758036 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.117820024 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.129321098 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.129662037 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.129718065 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.131431103 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.131608009 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.131659985 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.135636091 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.149697065 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.149751902 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.149775982 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.151823997 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.151885986 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.152015924 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.155833006 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.155950069 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.194989920 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.195003033 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.196971893 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.197199106 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.197211027 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.197258949 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.231220007 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.231977940 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.232037067 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.232806921 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.234599113 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.234668970 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.235084057 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.236710072 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.236763000 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.248104095 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.248311043 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.248362064 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.249912024 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.250490904 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.250562906 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.250565052 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.253842115 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.253894091 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.272556067 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.272898912 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.272954941 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.274291992 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.274516106 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.274563074 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.277667999 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.315021038 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.315128088 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.315215111 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.316839933 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.316901922 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.350475073 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.350497007 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.351186991 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.352349997 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.352456093 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.352551937 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.354708910 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.354888916 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.354948044 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.358042002 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.365705013 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.365719080 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.365816116 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.367302895 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.367408991 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.370332003 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.370594978 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.370647907 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.372054100 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.391940117 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.391952991 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.393524885 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.393642902 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.393781900 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.397034883 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.399187088 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.434655905 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.434964895 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.435045004 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.436311960 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.470752954 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.470882893 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.471050978 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.472388983 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.472400904 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.472455978 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.475425005 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.475487947 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.476531029 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.476583958 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.476670027 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.479664087 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.493354082 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.493498087 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.494771957 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.494931936 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.494995117 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.495034933 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.498025894 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.498087883 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.516654968 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.516666889 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.516721964 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.518219948 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.518358946 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.518460989 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.521346092 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.558572054 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.558584929 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.558629036 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.559842110 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.560971022 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.598355055 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.598367929 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.598434925 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.599827051 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.600153923 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.600223064 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.603171110 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.604146004 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.604157925 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.604206085 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.607152939 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.607978106 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.615247011 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.615259886 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.615304947 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.616730928 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.616743088 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.616796017 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.619772911 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.623049021 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.623061895 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.623146057 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.624564886 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.628967047 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.648581982 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.648844004 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.650156021 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.650284052 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.650350094 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.653276920 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.691080093 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.691207886 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.691250086 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.691617966 CEST	49735	80	192.168.2.4	43.152.64.207
Oct 17, 2024 09:20:15.737890005 CEST	80	49735	43.152.64.207	192.168.2.4
Oct 17, 2024 09:20:15.737961054 CEST	49735	80	192.168.2.4	43.152.64.207

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 09:20:09.095582962 CEST	49828	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:20:09.468378067 CEST	53	49828	1.1.1.1	192.168.2.4
Oct 17, 2024 09:20:16.122220039 CEST	61799	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:20:16.173314095 CEST	53	61799	1.1.1.1	192.168.2.4
Oct 17, 2024 09:20:40.230952978 CEST	53	49762	162.159.36.2	192.168.2.4
Oct 17, 2024 09:20:40.855911016 CEST	52168	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:20:40.863260984 CEST	53	52168	1.1.1.1	192.168.2.4
Oct 17, 2024 09:20:45.225013018 CEST	59364	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:20:45.235436916 CEST	53	59364	1.1.1.1	192.168.2.4
Oct 17, 2024 09:21:20.022018909 CEST	63610	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:21:20.030700922 CEST	53	63610	1.1.1.1	192.168.2.4
Oct 17, 2024 09:22:00.634013891 CEST	55974	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:22:00.641715050 CEST	53	55974	1.1.1.1	192.168.2.4
Oct 17, 2024 09:22:37.459774971 CEST	60050	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:22:37.467211008 CEST	53	60050	1.1.1.1	192.168.2.4
Oct 17, 2024 09:23:08.835302114 CEST	50937	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:23:08.845695972 CEST	53	50937	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 17, 2024 09:20:09.095582962 CEST	192.168.2.4	1.1.1.1	0x9858	Standard query (0)	intl-web-1305970982.cos.ap-singapore.myqcloud.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:20:16.122220039 CEST	192.168.2.4	1.1.1.1	0xbe63	Standard query (0)	img.bilibili.buzz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:20:40.855911016 CEST	192.168.2.4	1.1.1.1	0x35e2	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 17, 2024 09:20:45.225013018 CEST	192.168.2.4	1.1.1.1	0xd2d1	Standard query (0)	img.bilibili.buzz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:21:20.022018909 CEST	192.168.2.4	1.1.1.1	0xa291	Standard query (0)	img.bilibili.buzz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:22:00.634013891 CEST	192.168.2.4	1.1.1.1	0x4f15	Standard query (0)	img.bilibili.buzz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:22:37.459774971 CEST	192.168.2.4	1.1.1.1	0x507	Standard query (0)	img.bilibili.buzz	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:23:08.835302114 CEST	192.168.2.4	1.1.1.1	0x85ac	Standard query (0)	img.bilibili.buzz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 17, 2024 09:20:09.468378067 CEST	1.1.1.1	192.168.2.4	0x9858	No error (0)	intl-web-1305970982.cos.ap-singapore.myqcloud.com	sgp.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 09:20:09.468378067 CEST	1.1.1.1	192.168.2.4	0x9858	No error (0)	sgp.file.myqcloud.com		43.152.64.207	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:20:09.468378067 CEST	1.1.1.1	192.168.2.4	0x9858	No error (0)	sgp.file.myqcloud.com		43.153.232.151	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:20:09.468378067 CEST	1.1.1.1	192.168.2.4	0x9858	No error (0)	sgp.file.myqcloud.com		43.153.232.152	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:20:09.468378067 CEST	1.1.1.1	192.168.2.4	0x9858	No error (0)	sgp.file.myqcloud.com		43.152.64.193	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:20:16.173314095 CEST	1.1.1.1	192.168.2.4	0xbe63	Name error (3)	img.bilibili.buzz	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:20:40.863260984 CEST	1.1.1.1	192.168.2.4	0x35e2	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 17, 2024 09:20:45.235436916 CEST	1.1.1.1	192.168.2.4	0xd2d1	Name error (3)	img.bilibili.buzz	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:21:20.030700922 CEST	1.1.1.1	192.168.2.4	0xa291	Name error (3)	img.bilibili.buzz	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:22:00.641715050 CEST	1.1.1.1	192.168.2.4	0x4f15	Name error (3)	img.bilibili.buzz	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:22:37.467211008 CEST	1.1.1.1	192.168.2.4	0x507	Name error (3)	img.bilibili.buzz	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:23:08.845695972 CEST	1.1.1.1	192.168.2.4	0x85ac	Name error (3)	img.bilibili.buzz	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

intl-web-1305970982.cos.ap-singapore.myqcloud.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	43.152.64.207	80	7516	C:\Users\user\Desktop\SO2mdwWVvg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:20:12.554409981 CEST	104	OUT	GET /Shorts/index.jpg HTTP/1.1 accept: / host: intl-web-1305970982.cos.ap-singapore.myqcloud.com
Oct 17, 2024 09:20:14.010185957 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 265737 Connection: keep-alive Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 17 Oct 2024 07:20:13 GMT ETag: "cb2adef84b6c2bc005f525170ecb07d1" Last-Modified: Wed, 16 Oct 2024 01:57:06 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 10551430607150370035 x-cos-request-id: NjcxMGJhYWRfODhlZjc4MGJfNjczZl9hYWYxYmNh Data Raw: e3 f1 fe f7 f6 e3 f1 fe f7 2b 29 20 3c 32 2e fa 84 26 e6 8a 53 61 6e 67 2e fe 7c 84 98 99 8c 29 e7 b8 2e f2 a2 2a 03 67 73 9e bd 26 de 83 d4 cc 31 0e 77 61 6e 67 3c 3b e8 97 98 b6 73 61 6e 67 66 73 61 6e 67 96 73 61 6e 42 87 b1 ca 63 f2 13 76 c2 90 af 00 ab 43 01 9e b5 2b 35 52 d8 aa fa 82 92 f3 bb 22 89 13 43 0c ca 2d 0c 4b 8d 34 1e 7a 00 8f e7 d7 c9 66 11 2e c8 51 cb cf 83 de 77 46 f4 3b f8 90 f5 9e fd 58 18 95 c1 17 e1 49 bf 76 1a f8 36 ea 4f 34 35 88 9a b1 10 de 25 cf 2d 33 dd 74 89 42 ce e3 eb b7 0e 36 2f ae 9a 21 87 4a 70 b0 51 58 ef 4f 4e 4e c2 83 66 63 0d 1b 6f fe 69 95 07 7c 7b 7f 3f e5 04 71 83 93 7b f6 d5 9b 3a 4a 99 48 fa 11 e9 94 c4 c8 70 fd fc 31 c3 03 b6 e8 22 65 71 91 96 4e e4 33 f2 82 57 71 be e8 81 63 b8 d7 5c 86 40 9d 28 3c 61 6e 03 e0 76 61 52 5d fb 12 61 6e 67 66 b0 9e 91 98 96 73 42 5e 6c 64 78 61 6e df 64 73 61 6e 65 66 73 61 6e 67 a6 9e 68 6e 67 76 73 61 6e 67 66 f3 60 6e 67 66 73 71 6e 67 66 71 61 6e 62 66 71 61 6e 67 66 73 64 6e 65 66 73 61 6e 67 66 53 26 6e 67 62 73 61 6e [TRUNCATED] Data Ascii: +) <2.&Sang.\|).*gs&1wang<;sangfsangsanBcvC+5R"C-K4zf.QwF;XIv6O45%-3tB6/!JpQXONNfcoi\|{?q{:JHp1"eqN3Wqc\@(<anvaR]angfsB^ldxandsanefsanghngvsangf`ngfsqngfqanbfqangfsdnefsangfS&ngbsangfscngsa~gfsangvsangfsanwfsangfcangfsangsqngfmg4sanpagfsangfsangfenFsangfsangfsjgfuangfsangfsangfsangfsangfsangfsangfmgsangfsangfsaef3gngfsangfsangfsangfsangfsanfsefsqngfcngbsangfsangfsangFsassgfslgfangqangfsangfsang&sa.fsgfsmgfUangpangfsangfsang&sasNgfsjgfQangpangfsangfsang&sa.sagfsjgfcangpangfsangfsang&sa,6\|_6zf/NU6}x`A-1\|AGI"MW5Pic}7:(IsP5
Oct 17, 2024 09:20:14.010201931 CEST	1236	IN	Data Raw: 32 25 7d 82 4b a5 b3 15 fc 8a 31 ac a8 f5 bc 2f e2 52 eb db a9 c6 da f7 60 9e 71 3c 8a 7b b6 9a 8e a3 25 de 28 32 f7 9e 0d d2 3d c6 b7 03 10 ab b0 34 a1 99 15 a0 3a d5 79 00 ee 89 69 09 a5 5b 1f 7a a7 4b 18 9f 4b cb e5 38 42 f0 79 5a 1d 0b 0c a5 Data Ascii: 2%}K1/R`q<{%(2=4:yi[zKK8ByZWC7pK%K=CgvI!9~(jO'$4wD\TAsVyO'3'ZpFnKGiX\!8m2}v"%<lHfsan.t$+9,
Oct 17, 2024 09:20:14.010215044 CEST	408	IN	Data Raw: a2 ad e5 2e 62 eb 26 6f e6 4f f6 93 84 20 70 d7 8a e7 2e f4 9c b9 2d 8a 39 e5 a9 21 65 ce b5 e5 29 ea b8 ea 86 53 2f f4 ac 55 5b 66 38 a3 e5 5b 64 8b fd a9 d8 55 83 62 e5 2f f9 94 e2 e5 2f c9 94 ea e5 2f d1 94 f2 e5 27 61 90 e3 f2 e5 fb ef 61 61 Data Ascii: .b&oO p.-9!e)S/U[f8[dUb///'aaah;f-$+93N.Y&;{/U)WL!e'E&=R']*wv;bZU;b(v5cFc )b&(v %-.g&i3c,ZbK)'[
Oct 17, 2024 09:20:14.011647940 CEST	1236	IN	Data Raw: e4 e6 e3 fa ec 26 5c fa e5 2f a0 9c 7b ae a4 ed 83 66 e5 2d e1 94 e2 e5 2f 5c f1 29 a4 ed 2e 69 e3 26 54 ed 3b 48 45 98 8e b0 a2 28 64 aa 35 44 ad a4 a5 f1 29 e4 a0 28 f1 5d 2e 5c da bf 25 7c a4 a5 b0 91 7f e5 2e 70 55 5c e0 2e 70 27 7f ab 20 0f Data Ascii: &\/{f-/\).i&T;HE(d5D)(].\%\|.pU\.p' Sq! p)'/,,/p)b&q-[wY 5T)&8=;meO pp)/r)pwy) !m;\.Z,
Oct 17, 2024 09:20:14.011661053 CEST	1236	IN	Data Raw: 94 e2 e5 2f c9 94 ea e5 2f d1 94 f2 e5 2f d9 94 fa e5 27 61 80 e3 f3 67 69 7c 6e e5 2d f9 94 aa e5 2d d1 94 b2 fa ec 26 5c 82 e5 2f 54 83 79 e5 29 98 39 c0 a9 a4 ed 3b ad e5 21 6c c4 ae e5 2f 73 58 1b 2a a6 a5 35 62 d9 ba 5a 73 ea 2e 63 f5 33 59 Data Ascii: ///'agi\|n--&\/Ty)9;!l/sX*5bZs.c3YD3jR..&tg.sIAhi\|$$'I&]k s/r/$qC~J'mOa._{;d'(^!mZseX!e[No)z(+eDjM1.s&
Oct 17, 2024 09:20:14.011674881 CEST	1236	IN	Data Raw: 8a e5 2d e1 94 82 45 80 8a b0 a2 9e 52 2e 68 27 6d ab 20 9e 5c 52 5b ec 3b ac 9e 76 5a a5 4b 2c a0 a5 35 62 a2 21 86 b1 a2 ad ec 28 fd 2a 52 b1 22 31 a6 ad 2f 7d 35 62 a2 21 a2 4e 5d 52 ec 2e f7 92 e5 2d 11 94 5a ad a4 a5 f8 2b 19 80 55 b0 a2 ad Data Ascii: -ER.h'm \R[;vZK,5b!(*R"1/}5b!N]R.-Z+U,E$ P;)/=-)z96t-!j),<m+9,4&,<+9,45&9.4$089&$/+99;-$$
Oct 17, 2024 09:20:14.011697054 CEST	1236	IN	Data Raw: 65 e5 2e 73 63 62 b2 a6 fc 86 f9 a7 74 71 6a a0 e5 2e 7b 91 55 af 6e f4 a1 6f e5 86 7a e7 ae 6c e4 3b 61 ec 2f 73 f1 91 7a e5 86 61 63 65 a6 96 48 e3 9e 72 e4 3b 61 8e 67 ae 78 e3 26 65 a6 49 e3 26 6d e4 b3 5a e9 29 23 14 20 92 36 64 78 a9 26 53 Data Ascii: e.scbtqj.{Unozl;a/szaceHr;agx&eI&mZ)# 6dx&Sdyl;cljqjm;e\|.{bemf@f`)jem].sjm)oT)g@cddxl;u)#es/g)[emvxs.vsll;mjqlrTi})\|/cqjbTc)jc\|m
Oct 17, 2024 09:20:14.011709929 CEST	816	IN	Data Raw: af 6c 71 6a a0 e0 a6 72 e6 9e 74 e4 93 6c ec a7 55 f1 29 6c e5 2e 63 63 65 a6 96 67 e6 9e 74 86 66 e3 26 63 e4 93 63 ec 97 76 bb 6a 26 62 e1 b3 73 26 6a 64 78 a9 e8 a7 75 71 6b b4 97 6d 3b 64 6c 6c a3 83 6a ae e9 29 b3 73 e9 29 26 7c 03 a1 80 e4 Data Ascii: lqjrtlU)l.ccegtf&ccvj&bs&jdxuqkm;dllj)s)&\|;`llo/r]s)wfcf;k\|hsm/gqj})lre.vtem&jzlm/.Yl;d/~qjm;aen4ace;h}igdH)n/s{gcezr;`gx&c{/ju(7
Oct 17, 2024 09:20:14.013746023 CEST	1236	IN	Data Raw: e4 3b 78 6c 6c a3 83 6a ec 2f 67 71 69 bb a7 e8 1c a1 7c 65 6d bd e3 26 6d 96 68 e3 a6 6e e1 b3 60 ec 87 6a f5 a1 5d e5 2e 72 29 7a 97 73 f1 81 7b 65 6d b2 91 75 97 72 f1 29 6c e5 86 72 a9 65 e5 2e 76 a1 74 e5 2e 7e e3 ae 7c e0 3d 21 5e af 45 76 Data Ascii: ;xllj/gqi\|em&mhn`j].r)zs{emur)lre.vt.~\|=!^Evce;ylmj/ccfdxl.sa&n{ce`}dH)nem\|;`gx&c{ll)bhcdx&cdxl.f #!xr;Yrqm.s{em\|])nr&r;illimZoza
Oct 17, 2024 09:20:14.014390945 CEST	1236	IN	Data Raw: 72 e3 a6 6a 86 7f e7 ae 7c e4 3b 64 ec 2f 77 83 71 ec 87 76 71 6a af e0 96 48 e3 9e 76 2e 76 e3 8e 62 ae 78 e3 26 67 e1 b3 5b ec 2f 6e f5 a1 55 e1 28 31 e9 cb be 0d 71 6b b4 65 6d bb 91 65 e5 2e 73 63 65 a2 96 78 a1 e0 40 a6 61 e6 ae 66 e4 b3 5a Data Ascii: rj\|;d/wqvqjHv.vbx&g[/nU(1qkeme.scex@afZ/j)jem&j;qelkcl~zv)jeml;dbj&ckll;mmqk(2&gj&c;sllj/dcgJudx/j}yflU)l.czsqj`w;edj&bs&jr)&
Oct 17, 2024 09:20:14.073034048 CEST	1236	IN	Data Raw: 81 6e af 6e f1 29 7b e5 86 7a e3 9e 73 ae 78 e3 8e 75 e4 3b 63 6c 6c ae f4 a1 4c e5 96 66 e7 ae 44 e4 3b 6b e9 29 23 ff 68 31 ff e0 3b 4e 6c 6d bc 83 6a ec 2f 64 f1 63 60 b2 64 78 a4 9e 6c e4 3b 66 ae e9 bd b3 73 ec 2f 6e f1 a9 61 65 6d bd e6 ae Data Ascii: nn){zsxu;cllLfD;k)#h1;Nlmj/dc`dxl;fs/naemfJor/aqjX&gfl;`Lqj.zLdy/bjd)or&qdxl.lnQjm)hq&hdxtocfh&adxt;f`c&orcdb$;allj)"^ ";/f)\|

Target ID:	0
Start time:	03:20:07
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\SO2mdwWVvg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SO2mdwWVvg.exe"
Imagebase:	0x7ff63f4f0000
File size:	8'063'016 bytes
MD5 hash:	BFA844F0BE57643E3EBF11690E539A75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1770728678.000001DDE5E00000.00000010.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.1770728678.000001DDE5E00000.00000010.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3566662494.000001DDE5F05000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:20:07
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	735
Total number of Limit Nodes:	49

Executed Functions

Function 000001DDE6102FA8 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001DDE610316C: malloc.LIBCMT ref: 000001DDE6103188

GetUserNameA.ADVAPI32(?,?,?,?,?,?,?,-00000001,00000000,-00000001,00000000,00000003,000001DDE60FBC2D), ref: 000001DDE610302F

Part of subcall function 000001DDE60FD570: WSASocketA.WS2_32 ref: 000001DDE60FD59E

strrchr.LIBCMT ref: 000001DDE610306D
_snprintf.LIBCMT ref: 000001DDE610311B

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: NameSocketUser_snprintfmallocstrrchr
String ID:
API String ID: 1789932928-0
Opcode ID: 2e9ec8b2910e25878f9df8f559a5a89517a6a7cf57a35c6dffffe13ea40c4c2d
Instruction ID: 77740aa019b340e6add9100d2e632c86b6c08a603e2feec14d8c37a455a3d74e
Opcode Fuzzy Hash: 2e9ec8b2910e25878f9df8f559a5a89517a6a7cf57a35c6dffffe13ea40c4c2d
Instruction Fuzzy Hash: 8151643071CA090FEB99AB7CA4567FA73D2E79D710F10492EE08AC7297DA74D842C781

Function 000001DDE60FFC3E Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE ref: 000001DDE60FFD0E

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 88e8bec169d31fc803aeef05fed04f98ffb8ac2501b92b4af572ff67ccb03544
Instruction ID: b1910887a85906b59e8af26a8396a496afa58602f1ce4e0f01a70eb8146ecaa2
Opcode Fuzzy Hash: 88e8bec169d31fc803aeef05fed04f98ffb8ac2501b92b4af572ff67ccb03544
Instruction Fuzzy Hash: 60512934244A598FC71CCE2CA5C1A3177D6F796305B15AABED99BCF26BC930D842C780

Function 000001DDE60FD570 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000001DDE60FD59E
WSAIoctl.WS2_32 ref: 000001DDE60FD5EB
closesocket.WS2_32 ref: 000001DDE60FD64A

Strings

_Cy, xrefs: 000001DDE60FD5FD

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: IoctlSocketclosesocket
String ID: _Cy
API String ID: 3445158922-1085951347
Opcode ID: a92242532cdd76a831474aee6315f72e21cb2840c0ed84f4820b0f016089d1a4
Instruction ID: f9c2687faad64857410c6f9ffdb2fe1911e0fa3784b3522078136e68d28bacad
Opcode Fuzzy Hash: a92242532cdd76a831474aee6315f72e21cb2840c0ed84f4820b0f016089d1a4
Instruction Fuzzy Hash: 9E316431658A584BDB54DF3898847AAB7E1FBE9315F110A3EE88EC71D1DB34C541C741

Function 000001DDE60FCCD4 Relevance: 6.2, APIs: 4, Instructions: 239
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 000001DDE60FCD6D

Part of subcall function 000001DDE6109B9C: _errno.LIBCMT ref: 000001DDE6109BD3
Part of subcall function 000001DDE6109B9C: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE6109BDE

_snprintf.LIBCMT ref: 000001DDE60FCDC7
_snprintf.LIBCMT ref: 000001DDE60FCDDE
InternetCloseHandle.WININET ref: 000001DDE60FCEA2

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _snprintf$CloseHandleInternet_errno_invalid_parameter_noinfo
String ID:
API String ID: 1304440831-0
Opcode ID: 70f0b2ca5af4e20061d35c5bca96a8600da3e808857c3dcbcfbd5e76383eb985
Instruction ID: 04ae9e50db02ab81041291e036b7cf9f312ddbf038429fa5f5e20d6328413cb4
Opcode Fuzzy Hash: 70f0b2ca5af4e20061d35c5bca96a8600da3e808857c3dcbcfbd5e76383eb985
Instruction Fuzzy Hash: E271D531658B184FEB95EB28E8867EAB7D5FB95311F004A2EE44BC7192EE34D901C781

Function 000001DDE60FD054 Relevance: 3.2, APIs: 2, Instructions: 157
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000001DDE60FD111
InternetConnectA.WININET ref: 000001DDE60FD17F

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: 44eed23d63fb0890720a6991a3b8969036aed2aac8f16f8d3a2fefc079dafb55
Instruction ID: e38b14064de517a1932d3f69b2b3ea0176a9e252f9b2ab42b8f88ba60b19c6a4
Opcode Fuzzy Hash: 44eed23d63fb0890720a6991a3b8969036aed2aac8f16f8d3a2fefc079dafb55
Instruction Fuzzy Hash: 7B5182302187144FEB89EF68E8957F977E6FB88300F15596EE04BC7292DA78D906C781

Function 000001DDE6105FA4 Relevance: 1.3, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 000001DDE6106005

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 035e5d67093643cf14d525f5db75048425cc0484b18a4d78cef9a8779f303f6a
Instruction ID: 6470689af08f5538704a2cfa2ddb6c143224e3a787eee8a8f99c75ce7e277bc5
Opcode Fuzzy Hash: 035e5d67093643cf14d525f5db75048425cc0484b18a4d78cef9a8779f303f6a
Instruction Fuzzy Hash: 8E11563064CB0A8BEFE5AB18B8847E97BE1EF94390F50492EE44AC6285DA34C845D781

Function 00007FF63F4F14D0 Relevance: .0, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3567608032.00007FF63F4F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63F4F0000, based on PE: true

Associated: 00000000.00000002.3567542559.00007FF63F4F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568192647.00007FF63F791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568220974.00007FF63F792000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568244093.00007FF63F795000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568272353.00007FF63F796000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568404896.00007FF63F8DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568427426.00007FF63F8DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3568452192.00007FF63F8E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63f4f0000_SO2mdwWVvg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed762f0d2334a47ece5161a1267dca78ac943e00402746a499079c5fb7e6798
Instruction ID: 9ba1e0e49ce13c18d73a923a27c6faeaae357bcbbcac18dde0f1b56ce48b04c4
Opcode Fuzzy Hash: aed762f0d2334a47ece5161a1267dca78ac943e00402746a499079c5fb7e6798
Instruction Fuzzy Hash: 30B01221E0830580E38C3F01D94131823B06B48741F414430C40C43393CF3C50006710

Non-executed Functions

Function 000001DDE610D384 Relevance: 32.5, APIs: 16, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001DDE610D3E5

Part of subcall function 000001DDE610C7E0: _getptd.LIBCMT ref: 000001DDE610C7F6
Part of subcall function 000001DDE610C7E0: __updatetlocinfo.LIBCMT ref: 000001DDE610C82B
Part of subcall function 000001DDE610C7E0: __updatetmbcinfo.LIBCMT ref: 000001DDE610C852

_errno.LIBCMT ref: 000001DDE610D3EA

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

_fileno.LIBCMT ref: 000001DDE610D417

Part of subcall function 000001DDE610FDB4: _errno.LIBCMT ref: 000001DDE610FDBD
Part of subcall function 000001DDE610FDB4: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE610FDC8

write_multi_char.LIBCMT ref: 000001DDE610DA53
write_string.LIBCMT ref: 000001DDE610DA70
write_multi_char.LIBCMT ref: 000001DDE610DA8D
write_string.LIBCMT ref: 000001DDE610DAEC
write_multi_char.LIBCMT ref: 000001DDE610DB45
free.LIBCMT ref: 000001DDE610DB59
_isleadbyte_l.LIBCMT ref: 000001DDE610DC2A
write_char.LIBCMT ref: 000001DDE610DC40
write_char.LIBCMT ref: 000001DDE610DC61
_errno.LIBCMT ref: 000001DDE610DD64
_invalid_parameter_noinfo.LIBCMT ref: 000001DDE610DD6F

Strings

, xrefs: 000001DDE610DA27
@, xrefs: 000001DDE610D403

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 2950348734-1077428164
Opcode ID: a13eea343652d2125984793768277ab6f7899e45437fecb40c09c16223446c0b
Instruction ID: 290bbb2ee6d37d130fc552558b24fc398541b94497bcd42241c56441c93a70a6
Opcode Fuzzy Hash: a13eea343652d2125984793768277ab6f7899e45437fecb40c09c16223446c0b
Instruction Fuzzy Hash: CB621830D18B598AFFAA9A58E4513F9B7E1FB96310F24592FD487CB1D2DA34D802C742

Function 000001DDE610C888 Relevance: 30.8, APIs: 16, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001DDE610C8E9

Part of subcall function 000001DDE610C7E0: _getptd.LIBCMT ref: 000001DDE610C7F6
Part of subcall function 000001DDE610C7E0: __updatetlocinfo.LIBCMT ref: 000001DDE610C82B
Part of subcall function 000001DDE610C7E0: __updatetmbcinfo.LIBCMT ref: 000001DDE610C852

_errno.LIBCMT ref: 000001DDE610C8EE

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

_fileno.LIBCMT ref: 000001DDE610C91B

Part of subcall function 000001DDE610FDB4: _errno.LIBCMT ref: 000001DDE610FDBD
Part of subcall function 000001DDE610FDB4: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE610FDC8

write_multi_char.LIBCMT ref: 000001DDE610CF4B
write_string.LIBCMT ref: 000001DDE610CF68
write_multi_char.LIBCMT ref: 000001DDE610CF85
write_string.LIBCMT ref: 000001DDE610CFE4
write_multi_char.LIBCMT ref: 000001DDE610D03D
free.LIBCMT ref: 000001DDE610D051
_isleadbyte_l.LIBCMT ref: 000001DDE610D122
write_char.LIBCMT ref: 000001DDE610D138
write_char.LIBCMT ref: 000001DDE610D159
_errno.LIBCMT ref: 000001DDE610D253
_invalid_parameter_noinfo.LIBCMT ref: 000001DDE610D25E

Strings

, xrefs: 000001DDE610CF1F

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 2950348734-3916222277
Opcode ID: c088f05b1c41bc5f40f79eacfff539743c0c701c9f0e97b8461aafc53f4e8f13
Instruction ID: 29233bb238aa7d17bae2e738b1b902c87dd03fb75145e99ec07d9fba93df2fee
Opcode Fuzzy Hash: c088f05b1c41bc5f40f79eacfff539743c0c701c9f0e97b8461aafc53f4e8f13
Instruction Fuzzy Hash: 5762E830D18B498AFFEA9A58E4553E9B7D1FB95300F244A1FD487CB1D2DA35D802CA82

Function 000001DDE6104820 Relevance: 13.3, APIs: 10, Instructions: 790COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001DDE610498D
_snprintf.LIBCMT ref: 000001DDE6104A4E
_snprintf.LIBCMT ref: 000001DDE6104A6B
_snprintf.LIBCMT ref: 000001DDE6104CC0
_snprintf.LIBCMT ref: 000001DDE6104DD0
_snprintf.LIBCMT ref: 000001DDE6104E8E
_snprintf.LIBCMT ref: 000001DDE6104F46
_snprintf.LIBCMT ref: 000001DDE6104CEA

Part of subcall function 000001DDE6109B9C: _errno.LIBCMT ref: 000001DDE6109BD3
Part of subcall function 000001DDE6109B9C: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE6109BDE

_snprintf.LIBCMT ref: 000001DDE6104F5E
_snprintf.LIBCMT ref: 000001DDE610501C

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: b0045474d1749a7287ab64cdf2928e642e754940ba2aba6c48bf8ce747efe894
Instruction ID: 858f3f295eda60fe4522677f78fd67286af8a1644525aed7277bb814494d3cd9
Opcode Fuzzy Hash: b0045474d1749a7287ab64cdf2928e642e754940ba2aba6c48bf8ce747efe894
Instruction Fuzzy Hash: 9652C73051CD859BFB9AAB2CE4417E5F3E0FFA8305F445A1AD985CB562EB34D982C780

Function 000001DDE610A708 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 000001DDE610A73C

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: 8cbed0600e1a0cd3663791481dac497ddfdb5fe5119e382b5240cae51cc170ff
Instruction ID: 711fd1a31317f6726959cf5de482ace0b694d05bf9323ed859e4b4a233f6b18c
Opcode Fuzzy Hash: 8cbed0600e1a0cd3663791481dac497ddfdb5fe5119e382b5240cae51cc170ff
Instruction Fuzzy Hash: 14A1F631619A099FFF85FFB5E888AAA37A2F768301711893B900AC7174DEBCD544CB41

Function 000001DDE60FFDD6 Relevance: 1.5, APIs: 1, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b964d68e6518deaae8e71beb8172e02235f27dbd0a2c1c82e9933f31d250ba5e
Instruction ID: e67bc4d2887fde223ad99ecde938219bce74279b807958381dd15655800b9f75
Opcode Fuzzy Hash: b964d68e6518deaae8e71beb8172e02235f27dbd0a2c1c82e9933f31d250ba5e
Instruction Fuzzy Hash: 7F81E330254A498FDB5CDE2CE4C4B6177E2FB56309F2496AED55ACF2A6DA30D843CB40

Function 000001DDE61180B0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d2024319736c82b3fb213a99edabd88fd33fc2dd5ac40e50a907bb907351a9
Instruction ID: 3f463587ac40304c0ee63598e6d1e18124d5ab03b5f4156fa461e42f5e8507a7
Opcode Fuzzy Hash: 17d2024319736c82b3fb213a99edabd88fd33fc2dd5ac40e50a907bb907351a9
Instruction Fuzzy Hash: 09620B312286558FD31CCB1CC5B1B7AB7E1FB8A340F44896DE287CB692C639D945CB91

Function 000001DDE6117740 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337786be687ad5e8f5ffca3d815a0aab4912f658854966903adbd25a668e3634
Instruction ID: e077f2bc8d497bd772232e4b621271e3aadde02e57b1bd505b209e0e24c769e0
Opcode Fuzzy Hash: 337786be687ad5e8f5ffca3d815a0aab4912f658854966903adbd25a668e3634
Instruction Fuzzy Hash: 0652ED312286558FD31CCF1CC5A1E7AB7E1FB8D340F448A6DE28ACB692C639D545CB91

Function 000001DDE611117C Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001DDE61111AE

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

__doserrno.LIBCMT ref: 000001DDE61111A5

Part of subcall function 000001DDE610BF60: _getptd_noexit.LIBCMT ref: 000001DDE610BF64

__doserrno.LIBCMT ref: 000001DDE611120B
_errno.LIBCMT ref: 000001DDE6111212
_invalid_parameter_noinfo.LIBCMT ref: 000001DDE6111276

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: cb682a384e9847fcd58d2a56c79d4b882a0455c15685cfbff69562d094508653
Instruction ID: c6cb87fddc3a668cbd58908b56f37b751b253737de46bc9ea2e9e12397ad9fb5
Opcode Fuzzy Hash: cb682a384e9847fcd58d2a56c79d4b882a0455c15685cfbff69562d094508653
Instruction Fuzzy Hash: E431C6302087084EE7566F78E8973E97795EB47320F250A5AE862CF2E3DA719C01C691

Function 000001DDE6111F68 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001DDE6111F93

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

__doserrno.LIBCMT ref: 000001DDE6111F8B

Part of subcall function 000001DDE610BF60: _getptd_noexit.LIBCMT ref: 000001DDE610BF64

__lock_fhandle.LIBCMT ref: 000001DDE6111FD7
_lseeki64_nolock.LIBCMT ref: 000001DDE6111FF0
_unlock_fhandle.LIBCMT ref: 000001DDE6112013

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 94c223365c994b111b2dc29acc6dc628d4905ebb8eba9f35d440403a8ac84c36
Instruction ID: 2b5eb6863b414cd6265b8830057a2fb5e3176fdcc6627e662125e36664ea9965
Opcode Fuzzy Hash: 94c223365c994b111b2dc29acc6dc628d4905ebb8eba9f35d440403a8ac84c36
Instruction Fuzzy Hash: B6213B31608A080EF75A7B6CF8623F973D1EB45321F150A5FE416CF1E7CAA45C41C6A2

Function 000001DDE6111DF0 Relevance: 15.1, APIs: 10, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001DDE6111E1B

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

__doserrno.LIBCMT ref: 000001DDE6111E13

Part of subcall function 000001DDE610BF60: _getptd_noexit.LIBCMT ref: 000001DDE610BF64

__lock_fhandle.LIBCMT ref: 000001DDE6111E5F
_lseek_nolock.LIBCMT ref: 000001DDE6111E78
_unlock_fhandle.LIBCMT ref: 000001DDE6111E99

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: a09234805fd2a9c6af106032af68e44df28ba4d40962d0ef7be1a13687e388c4
Instruction ID: 8be2fa9e2e3db0ac479ca0288f16056c3cd63fd0fe889e9643493ad52d3af01f
Opcode Fuzzy Hash: a09234805fd2a9c6af106032af68e44df28ba4d40962d0ef7be1a13687e388c4
Instruction Fuzzy Hash: 2E2129316096080EF75B6BA9F8973FD77D0EB85320F150A1AE416CF1D7C7A05C01C696

Function 000001DDE6110794 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001DDE61107BF

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

__doserrno.LIBCMT ref: 000001DDE61107B7

Part of subcall function 000001DDE610BF60: _getptd_noexit.LIBCMT ref: 000001DDE610BF64

__lock_fhandle.LIBCMT ref: 000001DDE6110803
_unlock_fhandle.LIBCMT ref: 000001DDE611083D

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: ba9d0298e89461305872d42ae689c17141045664cbdffe6ae79e365563c6fb79
Instruction ID: 996887796e37665f974ade1b244b3b3acdedda605c6099f3bc9111c332409572
Opcode Fuzzy Hash: ba9d0298e89461305872d42ae689c17141045664cbdffe6ae79e365563c6fb79
Instruction Fuzzy Hash: BD21F730E0C6044FF75A6B68F8923E977C0DB85322F150A1EE416CF1E7DEA45C01C696

Function 000001DDE610FFB8 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001DDE610FFD9

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

__doserrno.LIBCMT ref: 000001DDE610FFD1

Part of subcall function 000001DDE610BF60: _getptd_noexit.LIBCMT ref: 000001DDE610BF64

__lock_fhandle.LIBCMT ref: 000001DDE611001D
_close_nolock.LIBCMT ref: 000001DDE6110030
_unlock_fhandle.LIBCMT ref: 000001DDE6110049

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: bf5d551c04f4d35802267776e569c6e429d3d3e61a2abcb4f0089388d7e57412
Instruction ID: df2125d0a787ca236c17ff25845623e50d8e0e009eb6a43ca8d6c117f9e4202c
Opcode Fuzzy Hash: bf5d551c04f4d35802267776e569c6e429d3d3e61a2abcb4f0089388d7e57412
Instruction Fuzzy Hash: AE21E731908A084EF7566F74E8913E97791EF46362F260D2EE41ACF1E3CEB59840C755

Function 000001DDE610A4CC Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001DDE610A4FA

Part of subcall function 000001DDE610979C: RtlFreeHeap.NTDLL ref: 000001DDE61097B2
Part of subcall function 000001DDE610979C: _errno.LIBCMT ref: 000001DDE61097BC

free.LIBCMT ref: 000001DDE610A50F
free.LIBCMT ref: 000001DDE610A530
free.LIBCMT ref: 000001DDE610A545
free.LIBCMT ref: 000001DDE610A559
free.LIBCMT ref: 000001DDE610A565
free.LIBCMT ref: 000001DDE610A590
free.LIBCMT ref: 000001DDE610A5B1
free.LIBCMT ref: 000001DDE610A5CA
free.LIBCMT ref: 000001DDE610A5FB

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: b1f13390e6f73e290a8a85abc7660ad11c4dc8207aa777efcb903b5d7cfd6875
Instruction ID: a0c46b563e80cbaf98f7def848b93db60d9183bfb0ef007630133e71fa2dbcfb
Opcode Fuzzy Hash: b1f13390e6f73e290a8a85abc7660ad11c4dc8207aa777efcb903b5d7cfd6875
Instruction Fuzzy Hash: E14123352559098FFFE6EF58F8A5BE533D1FB58315F98482E940ACA1D2CE2C9846CB10

Function 000001DDE60F360C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001DDE60F36A9

Part of subcall function 000001DDE61097DC: _FF_MSGBANNER.LIBCMT ref: 000001DDE610980C
Part of subcall function 000001DDE61097DC: _NMSG_WRITE.LIBCMT ref: 000001DDE6109816
Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE610984A
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109855
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109860

malloc.LIBCMT ref: 000001DDE60F36B3

Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE6109870
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109875

malloc.LIBCMT ref: 000001DDE60F36BE
free.LIBCMT ref: 000001DDE60F387E
free.LIBCMT ref: 000001DDE60F3886
free.LIBCMT ref: 000001DDE60F388E

Part of subcall function 000001DDE60F44F0: malloc.LIBCMT ref: 000001DDE60F453A
Part of subcall function 000001DDE60F44F0: malloc.LIBCMT ref: 000001DDE60F4545
Part of subcall function 000001DDE60F44F0: free.LIBCMT ref: 000001DDE60F462C
Part of subcall function 000001DDE60F44F0: free.LIBCMT ref: 000001DDE60F4634

free.LIBCMT ref: 000001DDE60F389A
free.LIBCMT ref: 000001DDE60F38A7
free.LIBCMT ref: 000001DDE60F38B4

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: a7d75cbd17d150eb653f4607e705647d253ccc58468d39dc5f1f1e7ed33e4189
Instruction ID: c6bb776396f4dfccf3baa5df519ce66b8ff78da7e9243b56a727c2f386d94b65
Opcode Fuzzy Hash: a7d75cbd17d150eb653f4607e705647d253ccc58468d39dc5f1f1e7ed33e4189
Instruction Fuzzy Hash: 1791D430318B184FEB69AB2CA4517FA73D1EB95710F540A1FD48ACB282DE64DC07C6C2

Function 000001DDE611A090 Relevance: 10.6, APIs: 7, Instructions: 108COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001DDE611A0C4

Part of subcall function 000001DDE610C7E0: _getptd.LIBCMT ref: 000001DDE610C7F6
Part of subcall function 000001DDE610C7E0: __updatetlocinfo.LIBCMT ref: 000001DDE610C82B
Part of subcall function 000001DDE610C7E0: __updatetmbcinfo.LIBCMT ref: 000001DDE610C852

_errno.LIBCMT ref: 000001DDE611A0DF
_invalid_parameter_noinfo.LIBCMT ref: 000001DDE611A0EA

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 385a1d44e6221908d415fcab12e09315a634a94b3a546da79e2e89b056cffdd9
Instruction ID: a5e56dc5835a69cd40e95eb3a0ee32e907e78023be0f16ae3a118c406ddd31c0
Opcode Fuzzy Hash: 385a1d44e6221908d415fcab12e09315a634a94b3a546da79e2e89b056cffdd9
Instruction Fuzzy Hash: 7B316330618B084FDB96EF58E0857AA7BE1FB58320F510AAEE459CB2D6DA70DC41C781

Function 000001DDE610A370 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001DDE610A396

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

_invalid_parameter_noinfo.LIBCMT ref: 000001DDE610A3A2
__crtIsPackagedApp.LIBCMT ref: 000001DDE610A3B3
_dosmaperr.LIBCMT ref: 000001DDE610A3FD

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: e1cf21fb225296154490f39138421c0b816cea72f5091d5b4f407222838ca290
Instruction ID: c0d72a0000956dac41ad2a0d8af83851449b5793db51773198f811a5947c6a8d
Opcode Fuzzy Hash: e1cf21fb225296154490f39138421c0b816cea72f5091d5b4f407222838ca290
Instruction Fuzzy Hash: DC31C430614A094FFF99AF78A8193E977D1FB88315F14495EA44AC72D2DB78C841C742

Function 000001DDE6114AA8 Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001DDE6114AC1

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

__lock_fhandle.LIBCMT ref: 000001DDE6114B09
__doserrno.LIBCMT ref: 000001DDE6114B3E
_errno.LIBCMT ref: 000001DDE6114B45
_unlock_fhandle.LIBCMT ref: 000001DDE6114B55

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 1469c9bfab1e04d6f86bc4b468c36adadddded4816b8d2a384ffeeb2377a9677
Instruction ID: 5fd6336bb513de4dc89b08a12d7cd3d11e3e9f9b0f58beeba8c28e1a72fd48c7
Opcode Fuzzy Hash: 1469c9bfab1e04d6f86bc4b468c36adadddded4816b8d2a384ffeeb2377a9677
Instruction Fuzzy Hash: 3421D430608A094EF767AFA8F8E13ED7790EB45720F05495EE426CF2E7D6645800C799

Function 000001DDE610B070 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001DDE610B0AC

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

_invalid_parameter_noinfo.LIBCMT ref: 000001DDE610B0B7
memcpy_s.LIBCMT ref: 000001DDE610B17C
_fileno.LIBCMT ref: 000001DDE610B1E7
_filbuf.LIBCMT ref: 000001DDE610B215
_errno.LIBCMT ref: 000001DDE610B265

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 2f5209122fb759edfdff3039bf8fb0b2a88c46c8169eecef4dfdbe4bc70bf479
Instruction ID: fb2c4129894095aa0ad6e8edf650404727902e3b2f875dcfe3047ff54259e0bd
Opcode Fuzzy Hash: 2f5209122fb759edfdff3039bf8fb0b2a88c46c8169eecef4dfdbe4bc70bf479
Instruction Fuzzy Hash: B961D930218F094AFBAD562C78663B973D1E795720F140B2FE466C72D5DE61EC52C6C2

Function 000001DDE610AB80 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001DDE610AAD7

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

_invalid_parameter_noinfo.LIBCMT ref: 000001DDE610AAE2
_getstream.LIBCMT ref: 000001DDE610AB02
_errno.LIBCMT ref: 000001DDE610AB14
_errno.LIBCMT ref: 000001DDE610AB26
_openfile.LIBCMT ref: 000001DDE610AB54

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: da30a4fbe809b8ca67a8f5160054303a7165575a42b330f88a57f9d26e578010
Instruction ID: 73211a85cd4913376496403dc2399893ab03024b613830270e863e30b80bb9e3
Opcode Fuzzy Hash: da30a4fbe809b8ca67a8f5160054303a7165575a42b330f88a57f9d26e578010
Instruction Fuzzy Hash: 6C21A130618A4D8FFBD6AB38A4153AA77D1EB99310F144D6BA445CB2E2DE64CC41C792

Function 000001DDE60F3170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001DDE60F31BD

Part of subcall function 000001DDE61097DC: _FF_MSGBANNER.LIBCMT ref: 000001DDE610980C
Part of subcall function 000001DDE61097DC: _NMSG_WRITE.LIBCMT ref: 000001DDE6109816
Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE610984A
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109855
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109860

malloc.LIBCMT ref: 000001DDE60F31C8

Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE6109870
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109875

free.LIBCMT ref: 000001DDE60F32AF
free.LIBCMT ref: 000001DDE60F32B7
free.LIBCMT ref: 000001DDE60F32BF
free.LIBCMT ref: 000001DDE60F32CB
free.LIBCMT ref: 000001DDE60F32D8

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 8f27b9b8814d88eefaf0c30430a09405aaeaa2f49b6202366e2d2d11d21f24eb
Instruction ID: b60ad625351e9d2a2606122ef780abbc836f8778741b6e129cef78d4a3082311
Opcode Fuzzy Hash: 8f27b9b8814d88eefaf0c30430a09405aaeaa2f49b6202366e2d2d11d21f24eb
Instruction Fuzzy Hash: 9851A530718F195FEB9EAB28A4517BA77D0FB5A314F50092ED88AC7286EE10DC42C6C5

Function 000001DDE60FBA74 Relevance: 7.8, APIs: 6, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001DDE610316C: malloc.LIBCMT ref: 000001DDE6103188

malloc.LIBCMT ref: 000001DDE60FBB1E

Part of subcall function 000001DDE61097DC: _FF_MSGBANNER.LIBCMT ref: 000001DDE610980C
Part of subcall function 000001DDE61097DC: _NMSG_WRITE.LIBCMT ref: 000001DDE6109816
Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE610984A
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109855
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109860

Part of subcall function 000001DDE61091B4: malloc.LIBCMT ref: 000001DDE6109204

Part of subcall function 000001DDE61091B4: realloc.LIBCMT ref: 000001DDE6109213

malloc.LIBCMT ref: 000001DDE60FBBED
_snprintf.LIBCMT ref: 000001DDE60FBC6B
_snprintf.LIBCMT ref: 000001DDE60FBC93
_snprintf.LIBCMT ref: 000001DDE60FBCBA
free.LIBCMT ref: 000001DDE60FBE28

Part of subcall function 000001DDE6107898: malloc.LIBCMT ref: 000001DDE61078CC
Part of subcall function 000001DDE6107898: free.LIBCMT ref: 000001DDE6107A83

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errnofree$_callnewhrealloc
String ID:
API String ID: 2667508507-0
Opcode ID: 69ae3169a039df52091071606f3a1e8249e5672861753253b765f1f3427f6835
Instruction ID: b693fbcf2c4df96658c68d8e96a634af38a3f3d527967bee7eb6cf3b607a9dea
Opcode Fuzzy Hash: 69ae3169a039df52091071606f3a1e8249e5672861753253b765f1f3427f6835
Instruction Fuzzy Hash: 8AB16F302587144BEF9AFB74A8567FA73D5EB95310F404D2EA84ACB2D3EE349905C782

Function 000001DDE60FF14C Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000001DDE610316C: malloc.LIBCMT ref: 000001DDE6103188

Part of subcall function 000001DDE610AB80: _errno.LIBCMT ref: 000001DDE610AAD7
Part of subcall function 000001DDE610AB80: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE610AAE2

fseek.LIBCMT ref: 000001DDE60FF1E8

Part of subcall function 000001DDE610B404: _errno.LIBCMT ref: 000001DDE610B42C
Part of subcall function 000001DDE610B404: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE610B437

_ftelli64.LIBCMT ref: 000001DDE60FF1F0

Part of subcall function 000001DDE610B478: _errno.LIBCMT ref: 000001DDE610B496
Part of subcall function 000001DDE610B478: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE610B4A1

fseek.LIBCMT ref: 000001DDE60FF200

Part of subcall function 000001DDE610B404: _fseek_nolock.LIBCMT ref: 000001DDE610B455

malloc.LIBCMT ref: 000001DDE60FF240

Part of subcall function 000001DDE61097DC: _FF_MSGBANNER.LIBCMT ref: 000001DDE610980C
Part of subcall function 000001DDE61097DC: _NMSG_WRITE.LIBCMT ref: 000001DDE6109816
Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE610984A
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109855
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109860

fclose.LIBCMT ref: 000001DDE60FF2FD

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: ccde22759ef2e3f78cce72c2939bc019c04d076555ce75b1dc7219c434147f26
Instruction ID: 3de8b206026f3c76c8a93a34e40b636d40b16faa16f6c85a27b20507eb2093fe
Opcode Fuzzy Hash: ccde22759ef2e3f78cce72c2939bc019c04d076555ce75b1dc7219c434147f26
Instruction Fuzzy Hash: 2051F431668A084FE789EB3CA4567F973D1FB99300F504A6FE44BC72D7DE249906C681

Function 000001DDE61146B4 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001DDE61146E1

Part of subcall function 000001DDE610E1B8: _FF_MSGBANNER.LIBCMT ref: 000001DDE610E1D5
Part of subcall function 000001DDE610E1B8: _NMSG_WRITE.LIBCMT ref: 000001DDE610E1DF

_lock.LIBCMT ref: 000001DDE61146F4
_lock.LIBCMT ref: 000001DDE611474F
_calloc_crt.LIBCMT ref: 000001DDE6114806

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 8dddd40cba0b96657f5797606e885a34095d890d14caea9c99b50cb58fb4cd36
Instruction ID: 53bfc251ad44ed0a3029f19d8062f2daf846e68a021882da886f8ec03595f8b3
Opcode Fuzzy Hash: 8dddd40cba0b96657f5797606e885a34095d890d14caea9c99b50cb58fb4cd36
Instruction Fuzzy Hash: DE513770528B098FE715AF68E8853B5B3D0FB59710F114A5FE84ACB2A2D734D842CBC2

Function 000001DDE60F44F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001DDE60F453A

Part of subcall function 000001DDE61097DC: _FF_MSGBANNER.LIBCMT ref: 000001DDE610980C
Part of subcall function 000001DDE61097DC: _NMSG_WRITE.LIBCMT ref: 000001DDE6109816
Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE610984A
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109855
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109860

malloc.LIBCMT ref: 000001DDE60F4545

Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE6109870
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109875

free.LIBCMT ref: 000001DDE60F462C
free.LIBCMT ref: 000001DDE60F4634
free.LIBCMT ref: 000001DDE60F4640
free.LIBCMT ref: 000001DDE60F464D

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a45fc30acfc366bf9b051932b8caba1d9495d79fe219d51417d01d77f5c5bb34
Instruction ID: 726f3a92c683a9ec64a4c62d5afed04b6239f2ad0525802e99a1ba750356005a
Opcode Fuzzy Hash: a45fc30acfc366bf9b051932b8caba1d9495d79fe219d51417d01d77f5c5bb34
Instruction Fuzzy Hash: 6641E731358B1D0BEB69AA3C68557FA37D5E796321F14492EE887C7293ED20D807C781

Function 000001DDE610C654 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001DDE610C671

Part of subcall function 000001DDE610FDB4: _errno.LIBCMT ref: 000001DDE610FDBD
Part of subcall function 000001DDE610FDB4: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE610FDC8

_errno.LIBCMT ref: 000001DDE610C681

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

_errno.LIBCMT ref: 000001DDE610C69D
_isatty.LIBCMT ref: 000001DDE610C6FE
_getbuf.LIBCMT ref: 000001DDE610C70A

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: aa8b06c3288e952ecbdf324b898e62218ab50926b5a5fcb56ef63d4126ab63d5
Instruction ID: 822c8ceeae1fe1b5c498dba68744639c86b27d0a35103cf81693a1ee9438d6ab
Opcode Fuzzy Hash: aa8b06c3288e952ecbdf324b898e62218ab50926b5a5fcb56ef63d4126ab63d5
Instruction Fuzzy Hash: F9518F70114A494FEFEAEF28E4917EA77E0EB58310F140A9AE856CF2D6D774D841CB81

Function 000001DDE6105DE4 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001DDE6105E13

Part of subcall function 000001DDE61097DC: _FF_MSGBANNER.LIBCMT ref: 000001DDE610980C
Part of subcall function 000001DDE61097DC: _NMSG_WRITE.LIBCMT ref: 000001DDE6109816
Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE610984A
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109855
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109860

_snprintf.LIBCMT ref: 000001DDE6105E2B

Part of subcall function 000001DDE6109B9C: _errno.LIBCMT ref: 000001DDE6109BD3
Part of subcall function 000001DDE6109B9C: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE6109BDE

free.LIBCMT ref: 000001DDE6105E42

Part of subcall function 000001DDE610979C: RtlFreeHeap.NTDLL ref: 000001DDE61097B2
Part of subcall function 000001DDE610979C: _errno.LIBCMT ref: 000001DDE61097BC

malloc.LIBCMT ref: 000001DDE6105E92
_snprintf.LIBCMT ref: 000001DDE6105EAA
free.LIBCMT ref: 000001DDE6105ED2

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: ec25d155d64a04f5a4d69300301c4abe570cf977cc4f299410c5493cce9685bc
Instruction ID: 10ae3d3731410cc4c832fb24a97504254f628b642c1177833ae72656ba57151c
Opcode Fuzzy Hash: ec25d155d64a04f5a4d69300301c4abe570cf977cc4f299410c5493cce9685bc
Instruction Fuzzy Hash: 0F41933031CA480FEE9AAB2C78157F477D2E789310F449A5ED0CEC7297DA259C42CB85

Function 000001DDE60FE024 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001DDE60FE045

Part of subcall function 000001DDE61097DC: _FF_MSGBANNER.LIBCMT ref: 000001DDE610980C
Part of subcall function 000001DDE61097DC: _NMSG_WRITE.LIBCMT ref: 000001DDE6109816
Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE610984A
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109855
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109860

free.LIBCMT ref: 000001DDE60FE080
fwrite.LIBCMT ref: 000001DDE60FE0C1
fclose.LIBCMT ref: 000001DDE60FE0C9
free.LIBCMT ref: 000001DDE60FE0D6

Part of subcall function 000001DDE610979C: RtlFreeHeap.NTDLL ref: 000001DDE61097B2
Part of subcall function 000001DDE610979C: _errno.LIBCMT ref: 000001DDE61097BC

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errno$free$FreeHeap_callnewhfclosefwritemalloc
String ID:
API String ID: 415550720-0
Opcode ID: 1ec553c66c746d099e6808a9a78dd35a746a31c899afe7e7e07bb86eb44d6d70
Instruction ID: a83a410d7e784652427c476ef598cd62c2ff19dadd0fdd134ab31a5cbb8cee9f
Opcode Fuzzy Hash: 1ec553c66c746d099e6808a9a78dd35a746a31c899afe7e7e07bb86eb44d6d70
Instruction Fuzzy Hash: D9218031228A194BEB96FB3CA4617EEB3D1FB98340F544D6EB44AC73C2DD249945C781

Function 000001DDE6114958 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001DDE6114969

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

__doserrno.LIBCMT ref: 000001DDE6114961

Part of subcall function 000001DDE610BF60: _getptd_noexit.LIBCMT ref: 000001DDE610BF64

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 1a9f3c273fde667eee1e28420fd08ba4f6fdad69626380ca01bd7ea3b71185bb
Instruction ID: 53a6043c4fc7a1a647b7b1c833b46da07ab4402cb14d52c9c6ee5b4caaa3a3ee
Opcode Fuzzy Hash: 1a9f3c273fde667eee1e28420fd08ba4f6fdad69626380ca01bd7ea3b71185bb
Instruction Fuzzy Hash: 3A01F43022080D4EFA9BAB74EA713E83394FF19325F644E46E419CF1EBCB781840CA52

Function 000001DDE6109698 Relevance: 6.3, APIs: 5, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001DDE61096BB

Part of subcall function 000001DDE61097DC: _FF_MSGBANNER.LIBCMT ref: 000001DDE610980C
Part of subcall function 000001DDE61097DC: _NMSG_WRITE.LIBCMT ref: 000001DDE6109816
Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE610984A
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109855
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109860

malloc.LIBCMT ref: 000001DDE61096C9

Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE6109870
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109875

malloc.LIBCMT ref: 000001DDE61096EB
_snprintf.LIBCMT ref: 000001DDE6109706

Part of subcall function 000001DDE6109B9C: _errno.LIBCMT ref: 000001DDE6109BD3
Part of subcall function 000001DDE6109B9C: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE6109BDE

malloc.LIBCMT ref: 000001DDE6109721

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: e42e8bb37c17fb866d7ab9e581f67a34594f586a0dca43f1649d0ab14eded3ec
Instruction ID: 72f9981d7cf5392373f4e44c59f1d0851aef4aed774c4b75af1bbc41385b01cc
Opcode Fuzzy Hash: e42e8bb37c17fb866d7ab9e581f67a34594f586a0dca43f1649d0ab14eded3ec
Instruction Fuzzy Hash: 7A114F31618B044FEBA9AF68A45579676E1F78C310F54595EE08AC3296DA349C4287C1

Function 000001DDE610AB8C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001DDE610ABC4

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

_invalid_parameter_noinfo.LIBCMT ref: 000001DDE610ABCF
_flush.LIBCMT ref: 000001DDE610AC81
_fileno.LIBCMT ref: 000001DDE610ACA2

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 0aeef574da07145cfdd41d53376bf3e81e49c591176030f61e29d107625eec6d
Instruction ID: d337b9e497603fffd4ee0e7c658340c16cf59516097bc31a871e4ad887934f50
Opcode Fuzzy Hash: 0aeef574da07145cfdd41d53376bf3e81e49c591176030f61e29d107625eec6d
Instruction Fuzzy Hash: C0511C30218F0D0BEEEA6A6DB45A3B573D1E758310F254A2FD45AC72D3EA60DC52C6C2

Function 000001DDE60F00D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001DDE60F0117
clock.LIBCMT ref: 000001DDE60F0124
clock.LIBCMT ref: 000001DDE60F012D
clock.LIBCMT ref: 000001DDE60F013A

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 7862a7d32f1c9ad9b973ef17a076326fdf486dc74a254423f992730849a2d722
Instruction ID: 17b5f281288eea61b142535045d04ee3b96ec77497267179caf0570733474f09
Opcode Fuzzy Hash: 7862a7d32f1c9ad9b973ef17a076326fdf486dc74a254423f992730849a2d722
Instruction Fuzzy Hash: 6421F63144C71C4AE768AAA8A4422A6B7D4E786350F150A2FE9DBC7153F5509D42C2C2

Function 000001DDE6119A98 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001DDE6119ABC

Part of subcall function 000001DDE610C7E0: _getptd.LIBCMT ref: 000001DDE610C7F6
Part of subcall function 000001DDE610C7E0: __updatetlocinfo.LIBCMT ref: 000001DDE610C82B
Part of subcall function 000001DDE610C7E0: __updatetmbcinfo.LIBCMT ref: 000001DDE610C852

_errno.LIBCMT ref: 000001DDE6119AC8

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

_invalid_parameter_noinfo.LIBCMT ref: 000001DDE6119AD3
strchr.LIBCMT ref: 000001DDE6119AE9

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 6fcaa51569f33512e2090195287e243e2f4399f94586e7a5485698e02a016b7c
Instruction ID: f6d8e90d42ec011ab2ab9ccc6ba83791fb010628e6e67ab0e5bc9afdc99fe65a
Opcode Fuzzy Hash: 6fcaa51569f33512e2090195287e243e2f4399f94586e7a5485698e02a016b7c
Instruction Fuzzy Hash: 8321387061C6A94FEBA6E728E0D47BA77C0E789355F444E6FE0A6CF1D1D9608841C345

Function 000001DDE61083D0 Relevance: 5.4, APIs: 4, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001DDE6108443
malloc.LIBCMT ref: 000001DDE6108667
malloc.LIBCMT ref: 000001DDE6108765

Part of subcall function 000001DDE610BA74: _getptd.LIBCMT ref: 000001DDE610BA93

free.LIBCMT ref: 000001DDE610874D

Part of subcall function 000001DDE610979C: RtlFreeHeap.NTDLL ref: 000001DDE61097B2
Part of subcall function 000001DDE610979C: _errno.LIBCMT ref: 000001DDE61097BC

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: malloc$FreeHeap_errno_getptdfree
String ID:
API String ID: 3311824342-0
Opcode ID: d0a27817efde19c6f8d87261e0c14dccd853f4b6914fa58adb41ed9447b39478
Instruction ID: 49214ae9c4ddead304b703244c7096ae32e3c6fa645bf0e7eccdd77b60aa0de6
Opcode Fuzzy Hash: d0a27817efde19c6f8d87261e0c14dccd853f4b6914fa58adb41ed9447b39478
Instruction Fuzzy Hash: 8AC19730628A448FFFEAEB18B8517B573E1F75A321F60452BD446C71A5DA789843C782

Function 000001DDE6109DC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001DDE6109E11

Part of subcall function 000001DDE610BFD0: _getptd_noexit.LIBCMT ref: 000001DDE610BFD4

_invalid_parameter_noinfo.LIBCMT ref: 000001DDE6109E1C

Strings

B, xrefs: 000001DDE6109E48

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 6354dd7fc53b9600f59efb332da70efbe254211307fc8429e275f3790f02590a
Instruction ID: f2506c5862b5c0c843cfd16bc1de2ff4e2e511110abc98b76c884ee3880ce080
Opcode Fuzzy Hash: 6354dd7fc53b9600f59efb332da70efbe254211307fc8429e275f3790f02590a
Instruction Fuzzy Hash: 95118F30618A088FDB95EF59A4857A6B7D1FB98324F504BAEA419C72A1CB74C944CB82

Function 000001DDE6107898 Relevance: 5.2, APIs: 4, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001DDE61078CC

Part of subcall function 000001DDE61097DC: _FF_MSGBANNER.LIBCMT ref: 000001DDE610980C
Part of subcall function 000001DDE61097DC: _NMSG_WRITE.LIBCMT ref: 000001DDE6109816
Part of subcall function 000001DDE61097DC: _callnewh.LIBCMT ref: 000001DDE610984A
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109855
Part of subcall function 000001DDE61097DC: _errno.LIBCMT ref: 000001DDE6109860

free.LIBCMT ref: 000001DDE6107A13
free.LIBCMT ref: 000001DDE6107A77
free.LIBCMT ref: 000001DDE6107A83

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: dd038f529a1152db983726e88818db10f6b0a149fc053e6d5e168077c86b9374
Instruction ID: 9431355be1b4227132fe047b909c173ae63f22b90072580022f1403640e94096
Opcode Fuzzy Hash: dd038f529a1152db983726e88818db10f6b0a149fc053e6d5e168077c86b9374
Instruction Fuzzy Hash: EC615F31318A084BEF9AEB28A4917ED77D1EB94310F240E1EE44BCB1D7DE24DA46C791

Function 000001DDE60FD208 Relevance: 5.2, APIs: 4, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001DDE60FD2A5

Part of subcall function 000001DDE6109B9C: _errno.LIBCMT ref: 000001DDE6109BD3
Part of subcall function 000001DDE6109B9C: _invalid_parameter_noinfo.LIBCMT ref: 000001DDE6109BDE

_snprintf.LIBCMT ref: 000001DDE60FD2C1
_snprintf.LIBCMT ref: 000001DDE60FD337
_snprintf.LIBCMT ref: 000001DDE60FD34E

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: fc51f4615cf0e27a482f6b22ff4d87c06e4feeef8bc37e62b75beb2dd9a3da3a
Instruction ID: 877fda3f505ef10e6ef50b45d8c907ec2ee78214862a117d6937c77cd3ceb11e
Opcode Fuzzy Hash: fc51f4615cf0e27a482f6b22ff4d87c06e4feeef8bc37e62b75beb2dd9a3da3a
Instruction Fuzzy Hash: 7E61CA30518A488FEB85EF68E8857EA77E5FB98305F00496BE44AC71D2DF34D945CB81

Function 000001DDE60F3300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001DDE60F3363

Memory Dump Source

Source File: 00000000.00000002.3567175661.000001DDE60F0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001DDE60F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dde60f0000_SO2mdwWVvg.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0ccdd68a0240799a77ae4be0c48a7008bd312d06eef73861b9d961f3f66470dc
Instruction ID: a055f08c31a5ea0317cf1a825cc6b5621fbcafceefc5aaab2d7f7fddd8736ef3
Opcode Fuzzy Hash: 0ccdd68a0240799a77ae4be0c48a7008bd312d06eef73861b9d961f3f66470dc
Instruction Fuzzy Hash: 8851B731218A154FDB5DDF3CA4916BA73D1FB96310F44496EE88BC7286EE20FC42C685

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SO2mdwWVvg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

Windows Analysis Report
SO2mdwWVvg.exe

Function 000001DDE6102FA8 Relevance: 4.7, APIs: 3, Instructions: 190
stringCOMMONLIBRARYCODE

Function 000001DDE60FFC3E Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Function 000001DDE60FD570 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Function 000001DDE60FCCD4 Relevance: 6.2, APIs: 4, Instructions: 239
networkCOMMONLIBRARYCODE

Function 000001DDE60FD054 Relevance: 3.2, APIs: 2, Instructions: 157
networkCOMMONLIBRARYCODE

Function 000001DDE6105FA4 Relevance: 1.3, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Function 00007FF63F4F14D0 Relevance: .0, Instructions: 4
COMMON

Function 000001DDE611117C Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Function 000001DDE6111F68 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Function 000001DDE6111DF0 Relevance: 15.1, APIs: 10, Instructions: 89
COMMONLIBRARYCODE