Edit tour

Windows Analysis Report
66HKNPT1fl.exe

Overview

General Information

Sample name:	66HKNPT1fl.exe renamed because original name is a hash value
Original sample name:	93469d74887267a8fbeed3a59094ddfbe12c991d800b4011b1ce5be62f6e27f3.exe
Analysis ID:	1551208
MD5:	f0d9a1e7385ed0ea2ece3d30915163d5
SHA1:	fa25bb798e084ddfa0ad97b659b49a405fa19b22
SHA256:	93469d74887267a8fbeed3a59094ddfbe12c991d800b4011b1ce5be62f6e27f3
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to resolve many domain names, but no domain seems valid

Connects to many different domains

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Executes massive DNS lookups (> 100)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

66HKNPT1fl.exe (PID: 4784 cmdline: "C:\Users\user\Desktop\66HKNPT1fl.exe" MD5: F0D9A1E7385ED0EA2ECE3D30915163D5)

ew4bjmdlid9hjn8.exe (PID: 3960 cmdline: "C:\daxjjwrfm\ew4bjmdlid9hjn8.exe" MD5: F0D9A1E7385ED0EA2ECE3D30915163D5)

qbpabupgx.exe (PID: 7084 cmdline: "C:\daxjjwrfm\qbpabupgx.exe" MD5: F0D9A1E7385ED0EA2ECE3D30915163D5)

qbpabupgx.exe (PID: 6216 cmdline: C:\daxjjwrfm\qbpabupgx.exe MD5: F0D9A1E7385ED0EA2ECE3D30915163D5)

tkjnbticppc.exe (PID: 7120 cmdline: mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe" MD5: F0D9A1E7385ED0EA2ECE3D30915163D5)

qbpabupgx.exe (PID: 3708 cmdline: "c:\daxjjwrfm\qbpabupgx.exe" MD5: F0D9A1E7385ED0EA2ECE3D30915163D5)

tkjnbticppc.exe (PID: 1540 cmdline: mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe" MD5: F0D9A1E7385ED0EA2ECE3D30915163D5)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:42:08.521365+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	61217	TCP
2024-11-07T15:42:36.798438+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	54000	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:41:57.817092+0100	2018141	1	A Network Trojan was detected	18.143.155.63	80	192.168.2.6	61164	TCP
2024-11-07T15:42:00.835671+0100	2018141	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.6	61185	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:41:57.817092+0100	2037771	1	A Network Trojan was detected	18.143.155.63	80	192.168.2.6	61164	TCP
2024-11-07T15:42:00.835671+0100	2037771	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.6	61185	TCP

ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:41:54.378741+0100	2018316	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.6	57769	UDP
2024-11-07T15:43:42.679237+0100	2018316	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.6	54598	UDP

ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:41:54.258875+0100	2811542	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.6	57116	UDP
2024-11-07T15:43:55.894056+0100	2811542	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.6	52210	UDP

ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:41:57.420782+0100	2815568	1	A Network Trojan was detected	192.168.2.6	61164	18.143.155.63	80	TCP
2024-11-07T15:43:37.556413+0100	2815568	1	A Network Trojan was detected	192.168.2.6	54125	18.143.155.63	80	TCP

ETPRO MALWARE W32/Bayrob Attempted Checkin 2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T15:41:55.658532+0100	2820680	1	Malware Command and Control Activity Detected	192.168.2.6	61162	199.59.243.227	80	TCP
2024-11-07T15:43:37.556413+0100	2820680	1	Malware Command and Control Activity Detected	192.168.2.6	54125	18.143.155.63	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 66HKNPT1fl.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\daxjjwrfm\qbpabupgx.exe	Avira: detection malicious, Label: HEUR/AGEN.1318578
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Avira: detection malicious, Label: HEUR/AGEN.1318578
Source: C:\daxjjwrfm\tkjnbticppc.exe	Avira: detection malicious, Label: HEUR/AGEN.1318578

Multi AV Scanner detection for dropped file

Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	ReversingLabs: Detection: 89%
Source: C:\daxjjwrfm\qbpabupgx.exe	ReversingLabs: Detection: 89%
Source: C:\daxjjwrfm\tkjnbticppc.exe	ReversingLabs: Detection: 89%

Multi AV Scanner detection for submitted file

Source: 66HKNPT1fl.exe

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\daxjjwrfm\qbpabupgx.exe	Joe Sandbox ML: detected
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Joe Sandbox ML: detected
Source: C:\daxjjwrfm\tkjnbticppc.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 66HKNPT1fl.exe

Joe Sandbox ML: detected

Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00077040 GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,		2_2_00077040
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C47040 GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptGenRandom,		3_2_00C47040

Source: 66HKNPT1fl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003660A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003660A0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000560A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_000560A0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C260A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00C260A0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000A60A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_000A60A0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C260A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	5_2_00C260A0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001060A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_001060A0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2820680 - Severity 1 - ETPRO MALWARE W32/Bayrob Attempted Checkin 2 : 192.168.2.6:61162 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2820680 - Severity 1 - ETPRO MALWARE W32/Bayrob Attempted Checkin 2 : 192.168.2.6:54125 -> 18.143.155.63:80

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: heavydivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreemanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenbottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavendivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requirebusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderbottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returndivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heaveninside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glasspeople.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerbrown.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerdaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavybusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarymanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leadermanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarybusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardpeople.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlestream.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavystream.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returninstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requirebright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requiremanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreebright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlenothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answeranother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlemanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousnothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlebusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heaveninstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answermanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreebrown.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlebottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardbrown.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavymanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnnothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavynothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreebusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessarybright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ordermanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderdivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necessaryanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerpeople.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousbottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenstream.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavybottle.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leadernothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavybright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavyinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousdivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentlebright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassbrown.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreepeople.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returninside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leaderbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentleexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: requireexplain.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassready.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavennothing.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwarddaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heardbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: answerbusiness.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnstream.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: variousinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pleasantanother.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: difficultappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: forwardappear.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeinstead.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glassdaughter.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: returnbright.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: heavenmanner.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: degreeinside.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gentledivide.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orderanother.net replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 170

Source: global traffic

DNS traffic detected: number of DNS queries: 170

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentleanother.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glassbright.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantinstead.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: degreedaughter.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net

Source: Joe Sandbox View	IP Address: 18.143.155.63 18.143.155.63
Source: Joe Sandbox View	IP Address: 85.214.228.140 85.214.228.140
Source: Joe Sandbox View	IP Address: 199.59.243.227 199.59.243.227

Source: Network traffic	Suricata IDS: 2811542 - Severity 1 - ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) : 1.1.1.1:53 -> 192.168.2.6:57116
Source: Network traffic	Suricata IDS: 2018316 - Severity 1 - ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses : 1.1.1.1:53 -> 192.168.2.6:57769
Source: Network traffic	Suricata IDS: 2815568 - Severity 1 - ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort : 192.168.2.6:61164 -> 18.143.155.63:80
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.143.155.63:80 -> 192.168.2.6:61164
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.6:61185
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.6:61185
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.143.155.63:80 -> 192.168.2.6:61164
Source: Network traffic	Suricata IDS: 2815568 - Severity 1 - ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort : 192.168.2.6:54125 -> 18.143.155.63:80
Source: Network traffic	Suricata IDS: 2811542 - Severity 1 - ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) : 1.1.1.1:53 -> 192.168.2.6:52210
Source: Network traffic	Suricata IDS: 2018316 - Severity 1 - ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses : 1.1.1.1:53 -> 192.168.2.6:54598
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:61217
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:54000

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_003801B0 socket,setsockopt,gethostbyname,inet_ntoa,inet_addr,htons,connect,send,recv,closesocket,

0_2_003801B0

Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: gentleanother.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: glassbright.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: pleasantinstead.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: degreedaughter.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: variousstream.net
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.0Accept: /Connection: closeHost: returnbottle.net

Source: global traffic	DNS traffic detected: DNS query: leaderstream.net
Source: global traffic	DNS traffic detected: DNS query: heavenstream.net
Source: global traffic	DNS traffic detected: DNS query: leadernothing.net
Source: global traffic	DNS traffic detected: DNS query: heavennothing.net
Source: global traffic	DNS traffic detected: DNS query: leaderbottle.net
Source: global traffic	DNS traffic detected: DNS query: heavenbottle.net
Source: global traffic	DNS traffic detected: DNS query: leaderdivide.net
Source: global traffic	DNS traffic detected: DNS query: heavendivide.net
Source: global traffic	DNS traffic detected: DNS query: heavystream.net
Source: global traffic	DNS traffic detected: DNS query: gentlestream.net
Source: global traffic	DNS traffic detected: DNS query: heavynothing.net
Source: global traffic	DNS traffic detected: DNS query: gentlenothing.net
Source: global traffic	DNS traffic detected: DNS query: heavybottle.net
Source: global traffic	DNS traffic detected: DNS query: gentlebottle.net
Source: global traffic	DNS traffic detected: DNS query: heavydivide.net
Source: global traffic	DNS traffic detected: DNS query: gentledivide.net
Source: global traffic	DNS traffic detected: DNS query: variousstream.net
Source: global traffic	DNS traffic detected: DNS query: returnstream.net
Source: global traffic	DNS traffic detected: DNS query: variousnothing.net
Source: global traffic	DNS traffic detected: DNS query: returnnothing.net
Source: global traffic	DNS traffic detected: DNS query: variousbottle.net
Source: global traffic	DNS traffic detected: DNS query: returnbottle.net
Source: global traffic	DNS traffic detected: DNS query: variousdivide.net
Source: global traffic	DNS traffic detected: DNS query: returndivide.net
Source: global traffic	DNS traffic detected: DNS query: degreemanner.net
Source: global traffic	DNS traffic detected: DNS query: forwardmanner.net
Source: global traffic	DNS traffic detected: DNS query: degreeanother.net
Source: global traffic	DNS traffic detected: DNS query: forwardanother.net
Source: global traffic	DNS traffic detected: DNS query: degreebusiness.net
Source: global traffic	DNS traffic detected: DNS query: forwardbusiness.net
Source: global traffic	DNS traffic detected: DNS query: degreeappear.net
Source: global traffic	DNS traffic detected: DNS query: forwardappear.net
Source: global traffic	DNS traffic detected: DNS query: answermanner.net
Source: global traffic	DNS traffic detected: DNS query: glassmanner.net
Source: global traffic	DNS traffic detected: DNS query: answeranother.net
Source: global traffic	DNS traffic detected: DNS query: glassanother.net
Source: global traffic	DNS traffic detected: DNS query: answerbusiness.net
Source: global traffic	DNS traffic detected: DNS query: glassbusiness.net
Source: global traffic	DNS traffic detected: DNS query: answerappear.net
Source: global traffic	DNS traffic detected: DNS query: glassappear.net
Source: global traffic	DNS traffic detected: DNS query: difficultmanner.net
Source: global traffic	DNS traffic detected: DNS query: heardmanner.net
Source: global traffic	DNS traffic detected: DNS query: difficultanother.net
Source: global traffic	DNS traffic detected: DNS query: heardanother.net
Source: global traffic	DNS traffic detected: DNS query: difficultbusiness.net
Source: global traffic	DNS traffic detected: DNS query: heardbusiness.net
Source: global traffic	DNS traffic detected: DNS query: difficultappear.net
Source: global traffic	DNS traffic detected: DNS query: heardappear.net
Source: global traffic	DNS traffic detected: DNS query: pleasantmanner.net
Source: global traffic	DNS traffic detected: DNS query: necessarymanner.net
Source: global traffic	DNS traffic detected: DNS query: pleasantanother.net
Source: global traffic	DNS traffic detected: DNS query: necessaryanother.net
Source: global traffic	DNS traffic detected: DNS query: pleasantbusiness.net
Source: global traffic	DNS traffic detected: DNS query: necessarybusiness.net
Source: global traffic	DNS traffic detected: DNS query: pleasantappear.net
Source: global traffic	DNS traffic detected: DNS query: necessaryappear.net
Source: global traffic	DNS traffic detected: DNS query: ordermanner.net
Source: global traffic	DNS traffic detected: DNS query: requiremanner.net
Source: global traffic	DNS traffic detected: DNS query: orderanother.net
Source: global traffic	DNS traffic detected: DNS query: requireanother.net
Source: global traffic	DNS traffic detected: DNS query: orderbusiness.net
Source: global traffic	DNS traffic detected: DNS query: requirebusiness.net
Source: global traffic	DNS traffic detected: DNS query: orderappear.net
Source: global traffic	DNS traffic detected: DNS query: requireappear.net
Source: global traffic	DNS traffic detected: DNS query: leadermanner.net
Source: global traffic	DNS traffic detected: DNS query: heavenmanner.net
Source: global traffic	DNS traffic detected: DNS query: leaderanother.net
Source: global traffic	DNS traffic detected: DNS query: heavenanother.net
Source: global traffic	DNS traffic detected: DNS query: leaderbusiness.net
Source: global traffic	DNS traffic detected: DNS query: heavenbusiness.net
Source: global traffic	DNS traffic detected: DNS query: leaderappear.net
Source: global traffic	DNS traffic detected: DNS query: heavenappear.net
Source: global traffic	DNS traffic detected: DNS query: heavymanner.net
Source: global traffic	DNS traffic detected: DNS query: gentlemanner.net
Source: global traffic	DNS traffic detected: DNS query: heavyanother.net
Source: global traffic	DNS traffic detected: DNS query: gentleanother.net
Source: global traffic	DNS traffic detected: DNS query: heavybusiness.net
Source: global traffic	DNS traffic detected: DNS query: gentlebusiness.net
Source: global traffic	DNS traffic detected: DNS query: heavyappear.net
Source: global traffic	DNS traffic detected: DNS query: gentleappear.net
Source: global traffic	DNS traffic detected: DNS query: variousmanner.net
Source: global traffic	DNS traffic detected: DNS query: returnmanner.net
Source: global traffic	DNS traffic detected: DNS query: variousanother.net
Source: global traffic	DNS traffic detected: DNS query: returnanother.net
Source: global traffic	DNS traffic detected: DNS query: variousbusiness.net
Source: global traffic	DNS traffic detected: DNS query: returnbusiness.net
Source: global traffic	DNS traffic detected: DNS query: variousappear.net
Source: global traffic	DNS traffic detected: DNS query: returnappear.net
Source: global traffic	DNS traffic detected: DNS query: degreeinstead.net
Source: global traffic	DNS traffic detected: DNS query: forwardinstead.net
Source: global traffic	DNS traffic detected: DNS query: degreeexplain.net
Source: global traffic	DNS traffic detected: DNS query: forwardexplain.net
Source: global traffic	DNS traffic detected: DNS query: degreebright.net
Source: global traffic	DNS traffic detected: DNS query: forwardbright.net
Source: global traffic	DNS traffic detected: DNS query: degreeinside.net
Source: global traffic	DNS traffic detected: DNS query: forwardinside.net
Source: global traffic	DNS traffic detected: DNS query: answerinstead.net
Source: global traffic	DNS traffic detected: DNS query: glassinstead.net
Source: global traffic	DNS traffic detected: DNS query: answerexplain.net
Source: global traffic	DNS traffic detected: DNS query: glassexplain.net

Source: qbpabupgx.exe, 00000003.00000002.2929888001.000000000138A000.00000004.00000020.00020000.00000000.sdmp, qbpabupgx.exe, 00000008.00000002.3398382691.0000000000F6F000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: https://www.google.com

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	File created: C:\Windows\daxjjwrfm\	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	File created: C:\Windows\daxjjwrfm\nozyy3rc2p	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	File created: C:\Windows\daxjjwrfm\nozyy3rc2p	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	File created: C:\Windows\daxjjwrfm\nozyy3rc2p	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe	File created: C:\Windows\daxjjwrfm\nozyy3rc2p	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	File created: C:\Windows\daxjjwrfm\nozyy3rc2p	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	File created: C:\Windows\daxjjwrfm\nozyy3rc2p	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe	File created: C:\Windows\daxjjwrfm\nozyy3rc2p	Jump to behavior

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

File deleted: C:\Windows\daxjjwrfm\nozyy3rc2p

Jump to behavior

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00383060	0_2_00383060
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00372490	0_2_00372490
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003700C8	0_2_003700C8
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0037B744	0_2_0037B744
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00374420	0_2_00374420
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0038A050	0_2_0038A050
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00390850	0_2_00390850
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003644A0	0_2_003644A0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00365894	0_2_00365894
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00375520	0_2_00375520
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00385950	0_2_00385950
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00382950	0_2_00382950
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003801B0	0_2_003801B0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003845A0	0_2_003845A0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003885E0	0_2_003885E0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00388DD6	0_2_00388DD6
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003619C0	0_2_003619C0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00374A29	0_2_00374A29
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0038FE10	0_2_0038FE10
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0037C640	0_2_0037C640
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0038EEB0	0_2_0038EEB0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00383AF0	0_2_00383AF0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0037D2C0	0_2_0037D2C0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00365730	0_2_00365730
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00375F50	0_2_00375F50
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0038DB50	0_2_0038DB50
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003803B9	0_2_003803B9
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0038ABB0	0_2_0038ABB0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003777A1	0_2_003777A1
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00388BA0	0_2_00388BA0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00385B98	0_2_00385B98
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00362F90	0_2_00362F90
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00385B96	0_2_00385B96
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003777F0	0_2_003777F0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0038B7F0	0_2_0038B7F0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0038CBE0	0_2_0038CBE0
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00387BD0	0_2_00387BD0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00073060	2_2_00073060
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00062490	2_2_00062490
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000600C8	2_2_000600C8
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0006B744	2_2_0006B744
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0007DB50	2_2_0007DB50
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0007CBE0	2_2_0007CBE0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00064420	2_2_00064420
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0007A050	2_2_0007A050
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00080850	2_2_00080850
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00055894	2_2_00055894
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000544A0	2_2_000544A0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00065520	2_2_00065520
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00075950	2_2_00075950
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00072950	2_2_00072950
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000745A0	2_2_000745A0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000701B0	2_2_000701B0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000519C0	2_2_000519C0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00078DD6	2_2_00078DD6
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000785E0	2_2_000785E0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0007FE10	2_2_0007FE10
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00064A29	2_2_00064A29
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0006C640	2_2_0006C640
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0007EEB0	2_2_0007EEB0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0006D2C0	2_2_0006D2C0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00073AF0	2_2_00073AF0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00055730	2_2_00055730
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00065F50	2_2_00065F50
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00075B96	2_2_00075B96
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00052F90	2_2_00052F90
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00075B98	2_2_00075B98
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00078BA0	2_2_00078BA0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000677A1	2_2_000677A1
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0007ABB0	2_2_0007ABB0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000703B9	2_2_000703B9
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00077BD0	2_2_00077BD0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000677F0	2_2_000677F0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0007B7F0	2_2_0007B7F0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C300C1	3_2_00C300C1
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C32490	3_2_00C32490
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C43060	3_2_00C43060
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C401B0	3_2_00C401B0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C4FE10	3_2_00C4FE10
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C4CBE0	3_2_00C4CBE0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C4DB50	3_2_00C4DB50
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C3B73A	3_2_00C3B73A
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C25894	3_2_00C25894
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C244A0	3_2_00C244A0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C4A050	3_2_00C4A050
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C50850	3_2_00C50850
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C34420	3_2_00C34420
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C219C0	3_2_00C219C0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C48DD6	3_2_00C48DD6
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C485E0	3_2_00C485E0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C445A0	3_2_00C445A0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C45950	3_2_00C45950
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C42950	3_2_00C42950
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C35520	3_2_00C35520
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C3D2C0	3_2_00C3D2C0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C43AF0	3_2_00C43AF0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C4EEB0	3_2_00C4EEB0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C3C640	3_2_00C3C640
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C34A29	3_2_00C34A29
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C47BD0	3_2_00C47BD0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C377F0	3_2_00C377F0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C4B7F0	3_2_00C4B7F0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C22F90	3_2_00C22F90
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C45B96	3_2_00C45B96
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C45B98	3_2_00C45B98
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C377A1	3_2_00C377A1
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C48BA0	3_2_00C48BA0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C4ABB0	3_2_00C4ABB0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C403B9	3_2_00C403B9
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C35F50	3_2_00C35F50
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C25730	3_2_00C25730
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C3060	4_2_000C3060
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000B2490	4_2_000B2490
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000B4420	4_2_000B4420
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000CA050	4_2_000CA050
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000D0850	4_2_000D0850
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000A5894	4_2_000A5894
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000A44A0	4_2_000A44A0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000B5520	4_2_000B5520
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C5950	4_2_000C5950
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C2950	4_2_000C2950
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C45A0	4_2_000C45A0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C01B0	4_2_000C01B0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000A19C0	4_2_000A19C0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C85E0	4_2_000C85E0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000CFE10	4_2_000CFE10
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000BC640	4_2_000BC640
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000CEEB0	4_2_000CEEB0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000BD2C0	4_2_000BD2C0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C3AF0	4_2_000C3AF0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000A5730	4_2_000A5730
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000B5F50	4_2_000B5F50
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000CDB50	4_2_000CDB50
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000A2F90	4_2_000A2F90
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C8BA0	4_2_000C8BA0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000CABB0	4_2_000CABB0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C7BD0	4_2_000C7BD0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000CCBE0	4_2_000CCBE0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000B77F0	4_2_000B77F0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000CB7F0	4_2_000CB7F0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C300C1	5_2_00C300C1
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C32490	5_2_00C32490
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C43060	5_2_00C43060
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C3B73A	5_2_00C3B73A
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C25894	5_2_00C25894
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C244A0	5_2_00C244A0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C4A050	5_2_00C4A050
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C50850	5_2_00C50850
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C34420	5_2_00C34420
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C219C0	5_2_00C219C0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C48DD6	5_2_00C48DD6
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C485E0	5_2_00C485E0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C445A0	5_2_00C445A0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C401B0	5_2_00C401B0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C45950	5_2_00C45950
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C42950	5_2_00C42950
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C35520	5_2_00C35520
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C3D2C0	5_2_00C3D2C0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C43AF0	5_2_00C43AF0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C4EEB0	5_2_00C4EEB0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C3C640	5_2_00C3C640
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C4FE10	5_2_00C4FE10
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C34A29	5_2_00C34A29
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C47BD0	5_2_00C47BD0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C4CBE0	5_2_00C4CBE0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C377F0	5_2_00C377F0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C4B7F0	5_2_00C4B7F0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C22F90	5_2_00C22F90
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C45B96	5_2_00C45B96
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C45B98	5_2_00C45B98
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C377A1	5_2_00C377A1
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C48BA0	5_2_00C48BA0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C4ABB0	5_2_00C4ABB0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C403B9	5_2_00C403B9
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C35F50	5_2_00C35F50
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C4DB50	5_2_00C4DB50
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C25730	5_2_00C25730
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00123060	9_2_00123060
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00112490	9_2_00112490
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001100C8	9_2_001100C8
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0011B744	9_2_0011B744
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00114420	9_2_00114420
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0012A050	9_2_0012A050
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00130850	9_2_00130850
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00105894	9_2_00105894
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001044A0	9_2_001044A0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00115520	9_2_00115520
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00125950	9_2_00125950
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00122950	9_2_00122950
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001201B0	9_2_001201B0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001245A0	9_2_001245A0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00128DD6	9_2_00128DD6
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001019C0	9_2_001019C0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001285E0	9_2_001285E0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0012FE10	9_2_0012FE10
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00114A29	9_2_00114A29
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0011C640	9_2_0011C640
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0012EEB0	9_2_0012EEB0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0011D2C0	9_2_0011D2C0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00123AF0	9_2_00123AF0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00105730	9_2_00105730
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00115F50	9_2_00115F50
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0012DB50	9_2_0012DB50
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00102F90	9_2_00102F90
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00125B96	9_2_00125B96
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00125B98	9_2_00125B98
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0012ABB0	9_2_0012ABB0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001203B9	9_2_001203B9
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001177A1	9_2_001177A1
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00128BA0	9_2_00128BA0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00127BD0	9_2_00127BD0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001177F0	9_2_001177F0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0012B7F0	9_2_0012B7F0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0012CBE0	9_2_0012CBE0

Source: 66HKNPT1fl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 66HKNPT1fl.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ew4bjmdlid9hjn8.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: qbpabupgx.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: tkjnbticppc.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal96.troj.winEXE@12/5@255/4

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	0_2_00378200
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	2_2_00068200
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	3_2_00C38200
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	4_2_000B8200
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	5_2_00C38200
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,	9_2_00118200

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_0037C250 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_0037C250

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_00385010 StartServiceCtrlDispatcherA,

0_2_00385010

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00385010 StartServiceCtrlDispatcherA,	0_2_00385010
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00075010 StartServiceCtrlDispatcherA,	2_2_00075010
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C45010 StartServiceCtrlDispatcherA,	3_2_00C45010
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000C5010 StartServiceCtrlDispatcherA,	4_2_000C5010
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C45010 StartServiceCtrlDispatcherA,	5_2_00C45010
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00125010 StartServiceCtrlDispatcherA,	9_2_00125010

Source: C:\daxjjwrfm\tkjnbticppc.exe

Mutant created: NULL

Source: 66HKNPT1fl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 66HKNPT1fl.exe

ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

File read: C:\Users\user\Desktop\66HKNPT1fl.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\66HKNPT1fl.exe "C:\Users\user\Desktop\66HKNPT1fl.exe"
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Process created: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe "C:\daxjjwrfm\ew4bjmdlid9hjn8.exe"
Source: unknown	Process created: C:\daxjjwrfm\qbpabupgx.exe C:\daxjjwrfm\qbpabupgx.exe
Source: C:\daxjjwrfm\qbpabupgx.exe	Process created: C:\daxjjwrfm\tkjnbticppc.exe mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe"
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Process created: C:\daxjjwrfm\qbpabupgx.exe "C:\daxjjwrfm\qbpabupgx.exe"
Source: C:\daxjjwrfm\tkjnbticppc.exe	Process created: C:\daxjjwrfm\qbpabupgx.exe "c:\daxjjwrfm\qbpabupgx.exe"
Source: C:\daxjjwrfm\qbpabupgx.exe	Process created: C:\daxjjwrfm\tkjnbticppc.exe mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe"
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Process created: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe "C:\daxjjwrfm\ew4bjmdlid9hjn8.exe"	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Process created: C:\daxjjwrfm\qbpabupgx.exe "C:\daxjjwrfm\qbpabupgx.exe"	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Process created: C:\daxjjwrfm\tkjnbticppc.exe mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe"	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe	Process created: C:\daxjjwrfm\qbpabupgx.exe "c:\daxjjwrfm\qbpabupgx.exe"	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Process created: C:\daxjjwrfm\tkjnbticppc.exe mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_0038DB50 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

0_2_0038DB50

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_00368075 push edi; iretd	0_2_00368082
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_0036948D push ebx; ret	0_2_0036949F
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_00058075 push edi; iretd	2_2_00058082
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_0005948D push ebx; ret	2_2_0005949F
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C2948D push ebx; ret	3_2_00C2949F
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C28075 push edi; iretd	3_2_00C28082
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000A8075 push edi; iretd	4_2_000A8082
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000A948D push ebx; ret	4_2_000A949F
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000AC55B pushfd ; iretd	4_2_000AC568
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C2948D push ebx; ret	5_2_00C2949F
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C28075 push edi; iretd	5_2_00C28082
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_00108075 push edi; iretd	9_2_00108082
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_0010948D push ebx; ret	9_2_0010949F

Source: 66HKNPT1fl.exe	Static PE information: section name: .text entropy: 6.914886364886215
Source: ew4bjmdlid9hjn8.exe.0.dr	Static PE information: section name: .text entropy: 6.914886364886215
Source: qbpabupgx.exe.2.dr	Static PE information: section name: .text entropy: 6.914886364886215
Source: tkjnbticppc.exe.3.dr	Static PE information: section name: .text entropy: 6.914886364886215

Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	File created: C:\daxjjwrfm\qbpabupgx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	File created: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Jump to dropped file
Source: C:\daxjjwrfm\qbpabupgx.exe	File created: C:\daxjjwrfm\tkjnbticppc.exe	Jump to dropped file

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_00385010 StartServiceCtrlDispatcherA,

0_2_00385010

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	0_2_0038A050
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	2_2_0007A050
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	3_2_00C4A050
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	4_2_000CA050
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	5_2_00C4A050
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,	9_2_0012A050

Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		2_2_0007DB50
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,		3_2_00C4DB50

Source: C:\daxjjwrfm\tkjnbticppc.exe	Window / User API: threadDelayed 678	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe	Window / User API: threadDelayed 1196	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Window / User API: threadDelayed 354	Jump to behavior

Source: C:\daxjjwrfm\qbpabupgx.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_3-11111
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-11325
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_2-11379
Source: C:\daxjjwrfm\tkjnbticppc.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_4-8223

Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_2-9333
Source: C:\daxjjwrfm\tkjnbticppc.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_4-7495
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-9767
Source: C:\daxjjwrfm\qbpabupgx.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_3-10336

Source: C:\daxjjwrfm\qbpabupgx.exe TID: 6880	Thread sleep time: -37774s >= -30000s	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe TID: 7116	Thread sleep count: 678 > 30	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe TID: 7116	Thread sleep time: -678000s >= -30000s	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe TID: 7116	Thread sleep count: 1196 > 30	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe TID: 7116	Thread sleep time: -1196000s >= -30000s	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe TID: 3852	Thread sleep count: 354 > 30	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe TID: 3852	Thread sleep time: -17700000s >= -30000s	Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe TID: 3852	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe TID: 1016	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\daxjjwrfm\tkjnbticppc.exe TID: 1016	Thread sleep time: -44000s >= -30000s	Jump to behavior

Source: C:\daxjjwrfm\qbpabupgx.exe	Last function: Thread delayed
Source: C:\daxjjwrfm\qbpabupgx.exe	Last function: Thread delayed
Source: C:\daxjjwrfm\qbpabupgx.exe	Last function: Thread delayed
Source: C:\daxjjwrfm\tkjnbticppc.exe	Last function: Thread delayed
Source: C:\daxjjwrfm\tkjnbticppc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	Code function: 0_2_003660A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003660A0
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	Code function: 2_2_000560A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_000560A0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 3_2_00C260A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00C260A0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 4_2_000A60A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_000A60A0
Source: C:\daxjjwrfm\qbpabupgx.exe	Code function: 5_2_00C260A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	5_2_00C260A0
Source: C:\daxjjwrfm\tkjnbticppc.exe	Code function: 9_2_001060A0 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_001060A0

Source: C:\daxjjwrfm\qbpabupgx.exe	Thread delayed: delay time: 50000			Jump to behavior
Source: C:\daxjjwrfm\qbpabupgx.exe	Thread delayed: delay time: 50000			Jump to behavior

Source: qbpabupgx.exe, 00000003.00000002.2929888001.000000000138A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS
Source: ew4bjmdlid9hjn8.exe, 00000002.00000002.2169583902.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, qbpabupgx.exe, 00000008.00000002.3398382691.0000000000F6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\66HKNPT1fl.exe	API call chain: ExitProcess graph end node	graph_0-9389
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	API call chain: ExitProcess graph end node	graph_0-9349
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	API call chain: ExitProcess graph end node	graph_0-9401
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	API call chain: ExitProcess graph end node	graph_0-9502
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	API call chain: ExitProcess graph end node	graph_0-10301
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	API call chain: ExitProcess graph end node	graph_0-9513
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	API call chain: ExitProcess graph end node	graph_0-9331
Source: C:\Users\user\Desktop\66HKNPT1fl.exe	API call chain: ExitProcess graph end node	graph_0-9546
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	API call chain: ExitProcess graph end node	graph_2-9379
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	API call chain: ExitProcess graph end node	graph_2-9338
Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	API call chain: ExitProcess graph end node	graph_2-9364
Source: C:\daxjjwrfm\qbpabupgx.exe	API call chain: ExitProcess graph end node	graph_3-9435
Source: C:\daxjjwrfm\qbpabupgx.exe	API call chain: ExitProcess graph end node	graph_3-9417
Source: C:\daxjjwrfm\qbpabupgx.exe	API call chain: ExitProcess graph end node	graph_3-9378
Source: C:\daxjjwrfm\qbpabupgx.exe	API call chain: ExitProcess graph end node	graph_3-9583
Source: C:\daxjjwrfm\qbpabupgx.exe	API call chain: ExitProcess graph end node	graph_3-9403
Source: C:\daxjjwrfm\qbpabupgx.exe	API call chain: ExitProcess graph end node	graph_5-9408
Source: C:\daxjjwrfm\qbpabupgx.exe	API call chain: ExitProcess graph end node	graph_5-9424
Source: C:\daxjjwrfm\qbpabupgx.exe	API call chain: ExitProcess graph end node	graph_5-9370
Source: C:\daxjjwrfm\qbpabupgx.exe	API call chain: ExitProcess graph end node	graph_5-9395
Source: C:\daxjjwrfm\tkjnbticppc.exe	API call chain: ExitProcess graph end node
Source: C:\daxjjwrfm\tkjnbticppc.exe	API call chain: ExitProcess graph end node
Source: C:\daxjjwrfm\tkjnbticppc.exe	API call chain: ExitProcess graph end node
Source: C:\daxjjwrfm\tkjnbticppc.exe	API call chain: ExitProcess graph end node
Source: C:\daxjjwrfm\tkjnbticppc.exe	API call chain: ExitProcess graph end node
Source: C:\daxjjwrfm\tkjnbticppc.exe	API call chain: ExitProcess graph end node
Source: C:\daxjjwrfm\tkjnbticppc.exe	API call chain: ExitProcess graph end node
Source: C:\daxjjwrfm\tkjnbticppc.exe	API call chain: ExitProcess graph end node

Source: C:\daxjjwrfm\qbpabupgx.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_0038DB50 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,

0_2_0038DB50

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_0037C520 GetProcessHeap,RtlFreeHeap,

0_2_0037C520

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_0038C640 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0038C640

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_003899B0 GetSystemTime,GetTickCount,

0_2_003899B0

Source: C:\Users\user\Desktop\66HKNPT1fl.exe

Code function: 0_2_00372490 GetVersionExA,CreateDirectoryA,DeleteFileA,RemoveDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,GetTempPathA,CreateDirectoryA,GetTempPathA,SetFileAttributesA,

0_2_00372490

Source: C:\daxjjwrfm\ew4bjmdlid9hjn8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Service Execution	4 Windows Service	4 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Service Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	4 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
66HKNPT1fl.exe	89%	ReversingLabs	Win32.Trojan.Bayrob
66HKNPT1fl.exe	100%	Avira	HEUR/AGEN.1318578
66HKNPT1fl.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\daxjjwrfm\qbpabupgx.exe	100%	Avira	HEUR/AGEN.1318578
C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	100%	Avira	HEUR/AGEN.1318578
C:\daxjjwrfm\tkjnbticppc.exe	100%	Avira	HEUR/AGEN.1318578
C:\daxjjwrfm\qbpabupgx.exe	100%	Joe Sandbox ML
C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	100%	Joe Sandbox ML
C:\daxjjwrfm\tkjnbticppc.exe	100%	Joe Sandbox ML
C:\daxjjwrfm\ew4bjmdlid9hjn8.exe	89%	ReversingLabs	Win32.Trojan.Bayrob
C:\daxjjwrfm\qbpabupgx.exe	89%	ReversingLabs	Win32.Trojan.Bayrob
C:\daxjjwrfm\tkjnbticppc.exe	89%	ReversingLabs	Win32.Trojan.Bayrob

Name	IP	Active	Malicious	Reputation
degreedaughter.net	85.214.228.140	true	false	high
7450.bodis.com	199.59.243.227	true	false	high
gentleanother.net	54.244.188.177	true	false	high
returnbottle.net	18.143.155.63	true	false	high
pleasantinstead.net	18.143.155.63	true	false	high
leaderstream.net	unknown	unknown	true	unknown
forwardpeople.net	unknown	unknown	true	unknown
degreeanother.net	unknown	unknown	true	unknown
degreeexplain.net	unknown	unknown	true	unknown
heaveninside.net	unknown	unknown	true	unknown
answerappear.net	unknown	unknown	true	unknown
heavybusiness.net	unknown	unknown	true	unknown
pleasantinside.net	unknown	unknown	true	unknown
requirebusiness.net	unknown	unknown	true	unknown
forwardinside.net	unknown	unknown	true	unknown
glassmanner.net	unknown	unknown	true	unknown
answerexplain.net	unknown	unknown	true	unknown
orderinside.net	unknown	unknown	true	unknown
variousappear.net	unknown	unknown	true	unknown
returnbright.net	unknown	unknown	true	unknown
difficultanother.net	unknown	unknown	true	unknown
heavyinside.net	unknown	unknown	true	unknown
forwardready.net	unknown	unknown	true	unknown
glassdaughter.net	unknown	unknown	true	unknown
necessarymanner.net	unknown	unknown	true	unknown
leadernothing.net	unknown	unknown	true	unknown
answeranother.net	unknown	unknown	true	unknown
leadermanner.net	unknown	unknown	true	unknown
heavybottle.net	unknown	unknown	true	unknown
heavenbright.net	unknown	unknown	true	unknown
heavydivide.net	unknown	unknown	true	unknown
degreebrown.net	unknown	unknown	true	unknown
gentleinstead.net	unknown	unknown	true	unknown
glassanother.net	unknown	unknown	true	unknown
heavenanother.net	unknown	unknown	true	unknown
difficultmanner.net	unknown	unknown	true	unknown
glassexplain.net	unknown	unknown	true	unknown
requireinside.net	unknown	unknown	true	unknown
heavenexplain.net	unknown	unknown	true	unknown
forwardbusiness.net	unknown	unknown	true	unknown
difficultexplain.net	unknown	unknown	true	unknown
gentleappear.net	unknown	unknown	true	unknown
pleasantbright.net	unknown	unknown	true	unknown
returnexplain.net	unknown	unknown	true	unknown
gentlemanner.net	unknown	unknown	true	unknown
answerdaughter.net	unknown	unknown	true	unknown
heardinside.net	unknown	unknown	true	unknown
requiremanner.net	unknown	unknown	true	unknown
gentleexplain.net	unknown	unknown	true	unknown
glassappear.net	unknown	unknown	true	unknown
necessaryanother.net	unknown	unknown	true	unknown
glassinside.net	unknown	unknown	true	unknown
difficultbright.net	unknown	unknown	true	unknown
glasspeople.net	unknown	unknown	true	unknown
requireinstead.net	unknown	unknown	true	unknown
necessaryinside.net	unknown	unknown	true	unknown
returndivide.net	unknown	unknown	true	unknown
heardinstead.net	unknown	unknown	true	unknown
variousbright.net	unknown	unknown	true	unknown
degreebusiness.net	unknown	unknown	true	unknown
answerbusiness.net	unknown	unknown	true	unknown
heavenbusiness.net	unknown	unknown	true	unknown
gentledivide.net	unknown	unknown	true	unknown
variousinstead.net	unknown	unknown	true	unknown
gentlestream.net	unknown	unknown	true	unknown
pleasantmanner.net	unknown	unknown	true	unknown
necessaryappear.net	unknown	unknown	true	unknown
pleasantbusiness.net	unknown	unknown	true	unknown
heardbright.net	unknown	unknown	true	unknown
heavenbottle.net	unknown	unknown	true	unknown
heavynothing.net	unknown	unknown	true	unknown
gentlebusiness.net	unknown	unknown	true	unknown
ordermanner.net	unknown	unknown	true	unknown
leaderbottle.net	unknown	unknown	true	unknown
pleasantanother.net	unknown	unknown	true	unknown
heavyanother.net	unknown	unknown	true	unknown
degreeinstead.net	unknown	unknown	true	unknown
degreepeople.net	unknown	unknown	true	unknown
answerready.net	unknown	unknown	true	unknown
answerbright.net	unknown	unknown	true	unknown
heavennothing.net	unknown	unknown	true	unknown
returninside.net	unknown	unknown	true	unknown
forwardbright.net	unknown	unknown	true	unknown
difficultinside.net	unknown	unknown	true	unknown
heavybright.net	unknown	unknown	true	unknown
leaderanother.net	unknown	unknown	true	unknown
returninstead.net	unknown	unknown	true	unknown
difficultinstead.net	unknown	unknown	true	unknown
heavenappear.net	unknown	unknown	true	unknown
answerinside.net	unknown	unknown	true	unknown
degreebright.net	unknown	unknown	true	unknown
forwardbrown.net	unknown	unknown	true	unknown
heavyinstead.net	unknown	unknown	true	unknown
gentleinside.net	unknown	unknown	true	unknown
heardexplain.net	unknown	unknown	true	unknown
heavyappear.net	unknown	unknown	true	unknown
answerpeople.net	unknown	unknown	true	unknown
pleasantexplain.net	unknown	unknown	true	unknown
requireexplain.net	unknown	unknown	true	unknown
orderappear.net	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	qbpabupgx.exe, 00000003.00000002.2929888001.000000000138A000.00000004.00000020.00020000.00000000.sdmp, qbpabupgx.exe, 00000008.00000002.3398382691.0000000000F6F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.143.155.63	returnbottle.net	United States	16509	AMAZON-02US	false
85.214.228.140	degreedaughter.net	Germany	6724	STRATOSTRATOAGDE	false
199.59.243.227	7450.bodis.com	United States	395082	BODIS-NJUS	false
54.244.188.177	gentleanother.net	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551208
Start date and time:	2024-11-07 15:40:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	66HKNPT1fl.exe renamed because original name is a hash value
Original Sample Name:	93469d74887267a8fbeed3a59094ddfbe12c991d800b4011b1ce5be62f6e27f3.exe
Detection:	MAL
Classification:	mal96.troj.winEXE@12/5@255/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 80 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: 66HKNPT1fl.exe

Simulations

Behavior and APIs

Time	Type	Description
09:42:24	API Interceptor	1856x Sleep call for process: tkjnbticppc.exe modified
09:43:10	API Interceptor	417x Sleep call for process: qbpabupgx.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.143.155.63	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	pleasantinstead.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	pleasantinstead.net/index.php
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	returnbottle.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	returnbottle.net/index.php
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	returnbottle.net/index.php
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	returnbottle.net/index.php
85.214.228.140	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	degreedaughter.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	degreedaughter.net/index.php
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	degreedaughter.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	degreedaughter.net/index.php
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	dlynankz.biz/mfjpaqkdwglsvxqo
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	dlynankz.biz/rgkgvuyxljjatio
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	dlynankz.biz/pio
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	dlynankz.biz/og
	SetupRST.exe	Get hash	malicious	Unknown	Browse	dlynankz.biz/u
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	dlynankz.biz/eoefw
199.59.243.227	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	glassbright.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	glassbright.net/index.php
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	variousstream.net/index.php
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	variousstream.net/index.php
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	variousstream.net/index.php
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	glassbright.net/index.php
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	www.adsdomain-195.click/xene/
	Wc7HGBGZfE.exe	Get hash	malicious	FormBook	Browse	www.care-for-baby-1107.xyz/ev0s/
	XhAQ0Rk63O.exe	Get hash	malicious	FormBook	Browse	www.migraine-massages.pro/ym43/
	BkZqIS5vlv.exe	Get hash	malicious	FormBook	Browse	www.deepfy.xyz/jlkn/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gentleanother.net	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
returnbottle.net	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
degreedaughter.net	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
pleasantinstead.net	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	18.143.155.63
7450.bodis.com	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	25XrVZw56S.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	25XrVZw56S.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	oUc5lyEzJy.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	JUHGSyleu7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	ch89yHIa99.exe	Get hash	malicious	Ducktail	Browse	13.35.58.111
	ub7ZX9i3k6.exe	Get hash	malicious	Ducktail	Browse	13.35.58.86
	uupEsxBhAI.exe	Get hash	malicious	Ducktail	Browse	13.35.58.78
	yfM67N9UUL.exe	Get hash	malicious	Ducktail	Browse	13.35.58.67
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	54.112.121.173
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	13.127.145.74
STRATOSTRATOAGDE	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	85.214.228.140
	http://googe.de	Get hash	malicious	Unknown	Browse	85.214.62.112
	debug.dbg.elf	Get hash	malicious	Mirai	Browse	85.215.233.6
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	81.169.145.95
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	85.214.228.140
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	85.214.228.140
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	85.214.228.140
BODIS-NJUS	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DBROG0eWH7.exe	Get hash	malicious	Unknown	Browse	199.59.243.227
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Wc7HGBGZfE.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	XhAQ0Rk63O.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	BkZqIS5vlv.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
AMAZON-02US	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	BNGj6QoBjK.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	ch89yHIa99.exe	Get hash	malicious	Ducktail	Browse	13.35.58.111
	ub7ZX9i3k6.exe	Get hash	malicious	Ducktail	Browse	13.35.58.86
	uupEsxBhAI.exe	Get hash	malicious	Ducktail	Browse	13.35.58.78
	yfM67N9UUL.exe	Get hash	malicious	Ducktail	Browse	13.35.58.67
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	54.112.121.173
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	13.127.145.74

Process:	C:\Users\user\Desktop\66HKNPT1fl.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:ej:ej
MD5:	2D0985C59DB9049A2394A00B369922BA
SHA1:	CDC3557373CD4FB044D4D63C30DC1C07FCE6EC97
SHA-256:	A22E9689649DCADDAB2A6FCE1A88B715EC53B59E48FD29B526E16E7FFA8A0CA7
SHA-512:	C2119D490AC9105DC0E488CDC1A6397E0F4F20AF9B60EF02164C1989B8B5DAD0F4F478DF909DB528E68F77087C2875E60A6FCEB7072E67C59B938F48B6A41283
Malicious:	false
Reputation:	low
Preview:	..H{y._J

C:\daxjjwrfm\ew4bjmdlid9hjn8.exe

Download File

Process:	C:\Users\user\Desktop\66HKNPT1fl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	248320
Entropy (8bit):	7.1562498967433505
Encrypted:	false
SSDEEP:	3072:r/FjWEUzcSG8sGAVlElIY68MjAshfv6FKzFn8kysCdxYcYQ6OZadi6IyngAUexv6:ZF86JOvshn6FulCjl6cMWyJip
MD5:	F0D9A1E7385ED0EA2ECE3D30915163D5
SHA1:	FA25BB798E084DDFA0AD97B659B49A405FA19B22
SHA-256:	93469D74887267A8FBEED3A59094DDFBE12C991D800B4011B1CE5BE62F6E27F3
SHA-512:	50D640BB92E2E98AFD47D14DFAB9855D9F9C2D2F9CF7346FFF6F69B195F8A98232A9BCA964CF51C384F389B4FACD3CE9577E739BDF709D1F2E918A2EBB408C26
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...]..]..].V&..]..\..].....].....].Rich..].........................PE..L...d_5S.....................@.......m....... ....@..........................p............@.................................\"..P...............................tu................................................... ..h............................text............................... ..`.rdata....... ......................@..@.data........0...>..................@....reloc...v.......x...R..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\daxjjwrfm\nozyy3rc2p

Download File

Process:	C:\Users\user\Desktop\66HKNPT1fl.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:ej:ej
MD5:	2D0985C59DB9049A2394A00B369922BA
SHA1:	CDC3557373CD4FB044D4D63C30DC1C07FCE6EC97
SHA-256:	A22E9689649DCADDAB2A6FCE1A88B715EC53B59E48FD29B526E16E7FFA8A0CA7
SHA-512:	C2119D490AC9105DC0E488CDC1A6397E0F4F20AF9B60EF02164C1989B8B5DAD0F4F478DF909DB528E68F77087C2875E60A6FCEB7072E67C59B938F48B6A41283
Malicious:	false
Reputation:	low
Preview:	..H{y._J

C:\daxjjwrfm\qbpabupgx.exe

Download File

Process:	C:\daxjjwrfm\ew4bjmdlid9hjn8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	248320
Entropy (8bit):	7.1562498967433505
Encrypted:	false
SSDEEP:	3072:r/FjWEUzcSG8sGAVlElIY68MjAshfv6FKzFn8kysCdxYcYQ6OZadi6IyngAUexv6:ZF86JOvshn6FulCjl6cMWyJip
MD5:	F0D9A1E7385ED0EA2ECE3D30915163D5
SHA1:	FA25BB798E084DDFA0AD97B659B49A405FA19B22
SHA-256:	93469D74887267A8FBEED3A59094DDFBE12C991D800B4011B1CE5BE62F6E27F3
SHA-512:	50D640BB92E2E98AFD47D14DFAB9855D9F9C2D2F9CF7346FFF6F69B195F8A98232A9BCA964CF51C384F389B4FACD3CE9577E739BDF709D1F2E918A2EBB408C26
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...]..]..].V&..]..\..].....].....].Rich..].........................PE..L...d_5S.....................@.......m....... ....@..........................p............@.................................\"..P...............................tu................................................... ..h............................text............................... ..`.rdata....... ......................@..@.data........0...>..................@....reloc...v.......x...R..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\daxjjwrfm\tkjnbticppc.exe

Download File

Process:	C:\daxjjwrfm\qbpabupgx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	248320
Entropy (8bit):	7.1562498967433505
Encrypted:	false
SSDEEP:	3072:r/FjWEUzcSG8sGAVlElIY68MjAshfv6FKzFn8kysCdxYcYQ6OZadi6IyngAUexv6:ZF86JOvshn6FulCjl6cMWyJip
MD5:	F0D9A1E7385ED0EA2ECE3D30915163D5
SHA1:	FA25BB798E084DDFA0AD97B659B49A405FA19B22
SHA-256:	93469D74887267A8FBEED3A59094DDFBE12C991D800B4011B1CE5BE62F6E27F3
SHA-512:	50D640BB92E2E98AFD47D14DFAB9855D9F9C2D2F9CF7346FFF6F69B195F8A98232A9BCA964CF51C384F389B4FACD3CE9577E739BDF709D1F2E918A2EBB408C26
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...]..]..].V&..]..\..].....].....].Rich..].........................PE..L...d_5S.....................@.......m....... ....@..........................p............@.................................\"..P...............................tu................................................... ..h............................text............................... ..`.rdata....... ......................@..@.data........0...>..................@....reloc...v.......x...R..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.1562498967433505
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	66HKNPT1fl.exe
File size:	248'320 bytes
MD5:	f0d9a1e7385ed0ea2ece3d30915163d5
SHA1:	fa25bb798e084ddfa0ad97b659b49a405fa19b22
SHA256:	93469d74887267a8fbeed3a59094ddfbe12c991d800b4011b1ce5be62f6e27f3
SHA512:	50d640bb92e2e98afd47d14dfab9855d9f9c2d2f9cf7346fff6f69b195f8a98232a9bca964cf51c384f389b4facd3ce9577e739bdf709d1f2e918a2ebb408c26
SSDEEP:	3072:r/FjWEUzcSG8sGAVlElIY68MjAshfv6FKzFn8kysCdxYcYQ6OZadi6IyngAUexv6:ZF86JOvshn6FulCjl6cMWyJip
TLSH:	FE34AD66D6100137DC5125FD866C3BB2EA5E9278BF1811C3839636E82CB0AD9DA3774F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...]...]...]..V&...]...\...].......].......].Rich..].........................PE..L...d_5S.....................@.......m.....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x426d10
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x53355F64 [Fri Mar 28 11:39:16 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	24940cd2712c7c6b52de6089584e9809

Entrypoint Preview

Instruction
mov ax, word ptr [00447212h]
mov ecx, dword ptr [0043CA38h]
cwde
push esi
or esi, FFFFFFFFh
add word ptr [00447212h], si
add ecx, eax
cmp ecx, B13E0982h
jl 00007F4FD4F38C9Bh
mov dx, word ptr [0044DE84h]
mov ecx, dword ptr [00444F1Ch]
movsx eax, dx
and ecx, eax
mov word ptr [0044DE84h], cx
call 00007F4FD4F14E25h
add dword ptr [0043DF88h], DEFAFFFCh
call 00007F4FD4F14006h
add dword ptr [00441E54h], esi
inc word ptr [0044C23Eh]
mov dx, word ptr [0044C23Eh]
mov ecx, dword ptr [00441E54h]
movsx eax, dx
add eax, 6DA8752Dh
or ecx, eax
cmp ecx, 40440043h
jnle 00007F4FD4F38CACh
mov eax, dword ptr [004381ECh]
mov edx, dword ptr [00438A5Ch]
and eax, F5B7F8B7h
xor eax, C6284EF0h
sub edx, 4E4EEEC7h
cmp eax, edx
jnl 00007F4FD4F38C8Dh
mov eax, dword ptr [004432A4h]
mov ecx, dword ptr [0044634Ch]
push 00432170h
push 00432168h
call 00007F4FD4F372C1h
and dword ptr [00443E18h], 6DD9F72Ah
add esp, 08h
call 00007F4FD4F2A50Fh
mov ax, word ptr [eax]

Rich Headers

Programming Language:

[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3225c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4f000	0x7574	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x168	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x302ca	0x30400	21f0700076e95abb4de47cbbef8cda48	False	0.7262437257124352	data	6.914886364886215	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0xa04	0xc00	fbf38fd25ffe3b995354a30109bba30b	False	0.3968098958333333	data	4.798427724315568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x33000	0x1bb84	0x3e00	8fb1345fac8c46c706ce75db7ee26be4	False	0.9133064516129032	data	7.277764464021273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x4f000	0x76c8	0x7800	0e5310d3716de90a99d1ab24adebaa09	False	0.7573893229166667	data	6.814004846803548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	UpdateColors, GetBkColor, GetFontUnicodeRanges, GetFontLanguageInfo, GetTextCharset, SetTextJustification, GetTextAlign, GetStretchBltMode, SetTextAlign, GetClipRgn, GetSystemPaletteUse, GetRandomRgn, SetPixel, GetPolyFillMode, GetDCPenColor, SetTextColor, GetPixelFormat, GetMetaRgn, GetNearestColor, GetTextColor, GetNearestPaletteIndex, GetDeviceCaps, GetMapMode, GetTextCharsetInfo, GetObjectType, GetGraphicsMode, GetTextCharacterExtra
USER32.dll	SetFocus, LoadIconA, DrawTextA, GetDlgItem, GetDlgItemInt, GetPropA, GetMenuItemID, EndPaint, GetWindowDC, EnableWindow, SetWindowTextA, GetInputState, GetMenu, MoveWindow, CheckDlgButton, GetMenuCheckMarkDimensions, EndDialog, WindowFromDC, RemovePropA, IsWindowUnicode, SetDlgItemTextA, PostMessageA, GetScrollPos, BeginPaint, SendMessageA, IsWindowEnabled, GetWindowContextHelpId, GetWindowLongA, GetKeyboardType, GetMenuContextHelpId, GetMenuItemCount
KERNEL32.dll	GetProcAddress, GetFileType, GetCurrentProcessId, CloseHandle, GlobalHandle, GetCurrentThreadId, IsDebuggerPresent, SetFilePointer, IsProcessorFeaturePresent, LocalFlags, LockResource, GetCurrentProcess, GetModuleHandleA, MoveFileA, DeleteFileA, QueryPerformanceCounter, GlobalSize, GetTickCount, GlobalFlags, GetFileTime, GetLastError, FindResourceA, FindClose, FlushFileBuffers, GlobalAlloc, LoadResource, GetStdHandle, GetProcessHeap, HeapAlloc

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T15:41:54.258875+0100	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	1	1.1.1.1	53	192.168.2.6	57116	UDP
2024-11-07T15:41:54.378741+0100	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	1	1.1.1.1	53	192.168.2.6	57769	UDP
2024-11-07T15:41:55.658532+0100	2820680	ETPRO MALWARE W32/Bayrob Attempted Checkin 2	1	192.168.2.6	61162	199.59.243.227	80	TCP
2024-11-07T15:41:57.420782+0100	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	1	192.168.2.6	61164	18.143.155.63	80	TCP
2024-11-07T15:41:57.817092+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.143.155.63	80	192.168.2.6	61164	TCP
2024-11-07T15:41:57.817092+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.143.155.63	80	192.168.2.6	61164	TCP
2024-11-07T15:42:00.835671+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.6	61185	TCP
2024-11-07T15:42:00.835671+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.6	61185	TCP
2024-11-07T15:42:08.521365+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	61217	TCP
2024-11-07T15:42:36.798438+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	54000	TCP
2024-11-07T15:43:37.556413+0100	2815568	ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort	1	192.168.2.6	54125	18.143.155.63	80	TCP
2024-11-07T15:43:37.556413+0100	2820680	ETPRO MALWARE W32/Bayrob Attempted Checkin 2	1	192.168.2.6	54125	18.143.155.63	80	TCP
2024-11-07T15:43:42.679237+0100	2018316	ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses	1	1.1.1.1	53	192.168.2.6	54598	UDP
2024-11-07T15:43:55.894056+0100	2811542	ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)	1	1.1.1.1	53	192.168.2.6	52210	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 15:41:54.844553947 CET	61162	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:41:54.850521088 CET	80	61162	199.59.243.227	192.168.2.6
Nov 7, 2024 15:41:54.850614071 CET	61162	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:41:54.850847960 CET	61162	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:41:54.855875015 CET	80	61162	199.59.243.227	192.168.2.6
Nov 7, 2024 15:41:55.658045053 CET	80	61162	199.59.243.227	192.168.2.6
Nov 7, 2024 15:41:55.658428907 CET	80	61162	199.59.243.227	192.168.2.6
Nov 7, 2024 15:41:55.658531904 CET	61162	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:41:55.658590078 CET	80	61162	199.59.243.227	192.168.2.6
Nov 7, 2024 15:41:55.658647060 CET	61162	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:41:55.658699036 CET	61162	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:41:55.663583040 CET	80	61162	199.59.243.227	192.168.2.6
Nov 7, 2024 15:41:55.912197113 CET	61164	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:41:55.917197943 CET	80	61164	18.143.155.63	192.168.2.6
Nov 7, 2024 15:41:55.917280912 CET	61164	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:41:55.917365074 CET	61164	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:41:55.922625065 CET	80	61164	18.143.155.63	192.168.2.6
Nov 7, 2024 15:41:57.377079010 CET	80	61164	18.143.155.63	192.168.2.6
Nov 7, 2024 15:41:57.420782089 CET	61164	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:41:57.817091942 CET	80	61164	18.143.155.63	192.168.2.6
Nov 7, 2024 15:41:57.817190886 CET	61164	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:41:57.817192078 CET	61164	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:41:57.822119951 CET	80	61164	18.143.155.63	192.168.2.6
Nov 7, 2024 15:41:59.841775894 CET	61185	80	192.168.2.6	54.244.188.177
Nov 7, 2024 15:41:59.847269058 CET	80	61185	54.244.188.177	192.168.2.6
Nov 7, 2024 15:41:59.847400904 CET	61185	80	192.168.2.6	54.244.188.177
Nov 7, 2024 15:41:59.847522974 CET	61185	80	192.168.2.6	54.244.188.177
Nov 7, 2024 15:41:59.852287054 CET	80	61185	54.244.188.177	192.168.2.6
Nov 7, 2024 15:42:00.718555927 CET	80	61185	54.244.188.177	192.168.2.6
Nov 7, 2024 15:42:00.764575005 CET	61185	80	192.168.2.6	54.244.188.177
Nov 7, 2024 15:42:00.835670948 CET	80	61185	54.244.188.177	192.168.2.6
Nov 7, 2024 15:42:00.835767984 CET	61185	80	192.168.2.6	54.244.188.177
Nov 7, 2024 15:42:00.835849047 CET	61185	80	192.168.2.6	54.244.188.177
Nov 7, 2024 15:42:00.841044903 CET	80	61185	54.244.188.177	192.168.2.6
Nov 7, 2024 15:42:01.808871031 CET	61196	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:42:01.813946962 CET	80	61196	199.59.243.227	192.168.2.6
Nov 7, 2024 15:42:01.814026117 CET	61196	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:42:01.814074039 CET	61196	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:42:01.819205046 CET	80	61196	199.59.243.227	192.168.2.6
Nov 7, 2024 15:42:02.470746994 CET	80	61196	199.59.243.227	192.168.2.6
Nov 7, 2024 15:42:02.470777035 CET	80	61196	199.59.243.227	192.168.2.6
Nov 7, 2024 15:42:02.470973969 CET	61196	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:42:02.473345995 CET	80	61196	199.59.243.227	192.168.2.6
Nov 7, 2024 15:42:02.473407030 CET	61196	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:42:02.473450899 CET	61196	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:42:02.480953932 CET	80	61196	199.59.243.227	192.168.2.6
Nov 7, 2024 15:42:03.294503927 CET	61201	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:42:03.299477100 CET	80	61201	18.143.155.63	192.168.2.6
Nov 7, 2024 15:42:03.299637079 CET	61201	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:42:03.299684048 CET	61201	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:42:03.304487944 CET	80	61201	18.143.155.63	192.168.2.6
Nov 7, 2024 15:42:04.784287930 CET	80	61201	18.143.155.63	192.168.2.6
Nov 7, 2024 15:42:04.827020884 CET	61201	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:42:05.230200052 CET	80	61201	18.143.155.63	192.168.2.6
Nov 7, 2024 15:42:05.230439901 CET	61201	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:42:05.230503082 CET	61201	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:42:05.235357046 CET	80	61201	18.143.155.63	192.168.2.6
Nov 7, 2024 15:42:06.446270943 CET	61213	80	192.168.2.6	85.214.228.140
Nov 7, 2024 15:42:06.451636076 CET	80	61213	85.214.228.140	192.168.2.6
Nov 7, 2024 15:42:06.451745033 CET	61213	80	192.168.2.6	85.214.228.140
Nov 7, 2024 15:42:06.453412056 CET	61213	80	192.168.2.6	85.214.228.140
Nov 7, 2024 15:42:06.458467007 CET	80	61213	85.214.228.140	192.168.2.6
Nov 7, 2024 15:42:07.339715004 CET	80	61213	85.214.228.140	192.168.2.6
Nov 7, 2024 15:42:07.340455055 CET	61213	80	192.168.2.6	85.214.228.140
Nov 7, 2024 15:42:07.346086979 CET	80	61213	85.214.228.140	192.168.2.6
Nov 7, 2024 15:42:07.346136093 CET	61213	80	192.168.2.6	85.214.228.140
Nov 7, 2024 15:43:30.001475096 CET	54124	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:43:30.006447077 CET	80	54124	199.59.243.227	192.168.2.6
Nov 7, 2024 15:43:30.006525040 CET	54124	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:43:30.006602049 CET	54124	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:43:30.011634111 CET	80	54124	199.59.243.227	192.168.2.6
Nov 7, 2024 15:43:30.690996885 CET	80	54124	199.59.243.227	192.168.2.6
Nov 7, 2024 15:43:30.691035032 CET	80	54124	199.59.243.227	192.168.2.6
Nov 7, 2024 15:43:30.691104889 CET	54124	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:43:30.722445011 CET	80	54124	199.59.243.227	192.168.2.6
Nov 7, 2024 15:43:30.722558022 CET	54124	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:43:30.722615004 CET	54124	80	192.168.2.6	199.59.243.227
Nov 7, 2024 15:43:30.727543116 CET	80	54124	199.59.243.227	192.168.2.6
Nov 7, 2024 15:43:36.108063936 CET	54125	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:43:36.113018036 CET	80	54125	18.143.155.63	192.168.2.6
Nov 7, 2024 15:43:36.113085985 CET	54125	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:43:36.113943100 CET	54125	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:43:36.118774891 CET	80	54125	18.143.155.63	192.168.2.6
Nov 7, 2024 15:43:37.556240082 CET	80	54125	18.143.155.63	192.168.2.6
Nov 7, 2024 15:43:37.556412935 CET	54125	80	192.168.2.6	18.143.155.63
Nov 7, 2024 15:43:37.562424898 CET	80	54125	18.143.155.63	192.168.2.6
Nov 7, 2024 15:43:37.562490940 CET	54125	80	192.168.2.6	18.143.155.63

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 15:41:53.506658077 CET	54582	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:53.543107986 CET	53	54582	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:53.544981956 CET	55160	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:53.555422068 CET	53	55160	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:53.556427002 CET	53476	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:53.588172913 CET	53	53476	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:53.588982105 CET	59697	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:53.595844030 CET	53	59697	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.232904911 CET	60332	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.243195057 CET	53	60332	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.248635054 CET	57116	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.258874893 CET	53	57116	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.263756037 CET	51554	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.276308060 CET	53	51554	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.282855034 CET	50200	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.314434052 CET	53	50200	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.319019079 CET	62948	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.330238104 CET	53	62948	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.337842941 CET	58412	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.347049952 CET	53	58412	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.349253893 CET	49923	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.358637094 CET	53	49923	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.368004084 CET	57769	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.378741026 CET	53	57769	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.379426956 CET	57108	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.389899969 CET	53	57108	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.390434980 CET	52967	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.416484118 CET	53	52967	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.430154085 CET	64563	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.439172029 CET	53	64563	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.444452047 CET	64900	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.475759029 CET	53	64900	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:54.512857914 CET	62622	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:54.829195023 CET	53	62622	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:55.659338951 CET	57604	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:55.670730114 CET	53	57604	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:55.671514034 CET	59169	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:55.681399107 CET	53	59169	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:55.682008028 CET	62245	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:55.692348003 CET	53	62245	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:55.692894936 CET	49280	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:55.724601984 CET	53	49280	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:55.725229979 CET	53824	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:55.911421061 CET	53	53824	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.817819118 CET	64054	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.828553915 CET	53	64054	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.829165936 CET	64243	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.840790033 CET	53	64243	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.841368914 CET	63763	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.850421906 CET	53	63763	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.851160049 CET	51010	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.866318941 CET	53	51010	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.866940975 CET	49620	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.876775980 CET	53	49620	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.877368927 CET	51499	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.908783913 CET	53	51499	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.909492016 CET	49919	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.918889046 CET	53	49919	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.919434071 CET	50790	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.928412914 CET	53	50790	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.928946018 CET	65201	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.959700108 CET	53	65201	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.960274935 CET	62188	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:57.970865965 CET	53	62188	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:57.971513033 CET	59137	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.001770973 CET	53	59137	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.002605915 CET	50401	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.012409925 CET	53	50401	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.013202906 CET	61944	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.044363022 CET	53	61944	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.045164108 CET	61520	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.054833889 CET	53	61520	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.055454016 CET	58125	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.065419912 CET	53	58125	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.066004038 CET	56418	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.075436115 CET	53	56418	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.075938940 CET	65260	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.107876062 CET	53	65260	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.108573914 CET	51712	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.264873981 CET	53	51712	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.265629053 CET	51279	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.296588898 CET	53	51279	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.297272921 CET	56484	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.304090977 CET	53	56484	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.304574013 CET	64414	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.313775063 CET	53	64414	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.314344883 CET	57047	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.346585035 CET	53	57047	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.354036093 CET	55104	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.386097908 CET	53	55104	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.387094975 CET	61629	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.396900892 CET	53	61629	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.397530079 CET	65370	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.428978920 CET	53	65370	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.429656982 CET	63172	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.442555904 CET	53	63172	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.443128109 CET	57873	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.453717947 CET	53	57873	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.454363108 CET	63396	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.464113951 CET	53	63396	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.464747906 CET	53253	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.474076986 CET	53	53253	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.474767923 CET	54401	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.484527111 CET	53	54401	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.485228062 CET	53370	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.516268969 CET	53	53370	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.518723011 CET	51185	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.527909994 CET	53	51185	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.529160023 CET	61578	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.696866035 CET	53	61578	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.698390961 CET	53629	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.709086895 CET	53	53629	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.709846020 CET	60825	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.723721027 CET	53	60825	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.724337101 CET	57913	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.735677958 CET	53	57913	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.736354113 CET	58843	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.747745991 CET	53	58843	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.748291969 CET	57983	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.765239000 CET	53	57983	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.765824080 CET	61694	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.798336983 CET	53	61694	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.799072981 CET	61442	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:58.832793951 CET	53	61442	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:58.833936930 CET	53089	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.188870907 CET	53	53089	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.189964056 CET	51883	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.220474958 CET	53	51883	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.221791029 CET	62539	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.384079933 CET	53	62539	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.397233963 CET	62258	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.407087088 CET	53	62258	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.408514023 CET	54953	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.418261051 CET	53	54953	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.425976992 CET	52427	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.458400965 CET	53	52427	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.459321976 CET	64927	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.489969015 CET	53	64927	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.490938902 CET	58392	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.524666071 CET	53	58392	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.525670052 CET	64236	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.536775112 CET	53	64236	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.537642956 CET	57938	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.570112944 CET	53	57938	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.571193933 CET	53243	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.603425980 CET	53	53243	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.604568958 CET	61696	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.615341902 CET	53	61696	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.616296053 CET	53017	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.647249937 CET	53	53017	1.1.1.1	192.168.2.6
Nov 7, 2024 15:41:59.648407936 CET	54766	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:41:59.840943098 CET	53	54766	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.836661100 CET	62361	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:00.867495060 CET	53	62361	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.868488073 CET	60636	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:00.900161982 CET	53	60636	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.901371002 CET	63680	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:00.912790060 CET	53	63680	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.913538933 CET	54101	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:00.924434900 CET	53	54101	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.925321102 CET	61332	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:00.940551043 CET	53	61332	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.941373110 CET	51671	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:00.950934887 CET	53	51671	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.951792955 CET	60039	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:00.961421967 CET	53	60039	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.962095976 CET	56336	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:00.972805977 CET	53	56336	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.973738909 CET	52242	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:00.989516020 CET	53	52242	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:00.990161896 CET	51251	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.021161079 CET	53	51251	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.022108078 CET	65155	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.031016111 CET	53	65155	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.031712055 CET	60163	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.044020891 CET	53	60163	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.044601917 CET	51260	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.054066896 CET	53	51260	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.054757118 CET	59530	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.085321903 CET	53	59530	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.086224079 CET	52066	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.096111059 CET	53	52066	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.097312927 CET	52969	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.108268023 CET	53	52969	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.121191025 CET	52594	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.151448011 CET	53	52594	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.152260065 CET	64128	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.312693119 CET	53	64128	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.313704014 CET	53290	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.323566914 CET	53	53290	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.324220896 CET	65113	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.334382057 CET	53	65113	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.334898949 CET	52385	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.350759983 CET	53	52385	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.351377010 CET	52887	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.362658024 CET	53	52887	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.363173962 CET	62597	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.394521952 CET	53	62597	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.395379066 CET	55344	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.405895948 CET	53	55344	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.406482935 CET	55208	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.416650057 CET	53	55208	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:01.417210102 CET	62696	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:01.805315018 CET	53	62696	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.474060059 CET	61739	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.507220030 CET	53	61739	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.511351109 CET	54476	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.541723013 CET	53	54476	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.542598963 CET	58569	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.573909998 CET	53	58569	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.574980974 CET	64753	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.584532976 CET	53	64753	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.585282087 CET	53070	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.595499992 CET	53	53070	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.596122980 CET	62083	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.609965086 CET	53	62083	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.610929012 CET	61088	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.851505995 CET	53	61088	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.852314949 CET	63701	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.861774921 CET	53	63701	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.862653017 CET	51877	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.876271963 CET	53	51877	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.879086971 CET	49958	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:02.912797928 CET	53	49958	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:02.919193029 CET	51580	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:03.117065907 CET	53	51580	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.231203079 CET	64332	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.238532066 CET	53	64332	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.239267111 CET	49394	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.270049095 CET	53	49394	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.296817064 CET	50792	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.330167055 CET	53	50792	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.330936909 CET	64644	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.343450069 CET	53	64644	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.344223976 CET	60201	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.376176119 CET	53	60201	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.376954079 CET	62669	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.387470007 CET	53	62669	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.388268948 CET	52609	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.398643017 CET	53	52609	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.399561882 CET	62774	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.430944920 CET	53	62774	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.431803942 CET	52666	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.441553116 CET	53	52666	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.442267895 CET	59731	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.452076912 CET	53	59731	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.452877998 CET	57267	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.463351965 CET	53	57267	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.463956118 CET	64106	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.474698067 CET	53	64106	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.475404978 CET	64429	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.486880064 CET	53	64429	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.487477064 CET	52472	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.498019934 CET	53	52472	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.498653889 CET	51799	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.507431030 CET	53	51799	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.508066893 CET	62630	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.520091057 CET	53	62630	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.520708084 CET	50503	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.530713081 CET	53	50503	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.531266928 CET	54728	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.540957928 CET	53	54728	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.541481018 CET	63209	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.572529078 CET	53	63209	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.573386908 CET	52292	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.583734035 CET	53	52292	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.584635019 CET	63659	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.594752073 CET	53	63659	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.595367908 CET	52993	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.605401039 CET	53	52993	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.606190920 CET	59728	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.618357897 CET	53	59728	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.634835958 CET	65387	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.666467905 CET	53	65387	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.667608976 CET	59072	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.674981117 CET	53	59072	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.675825119 CET	58853	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.706729889 CET	53	58853	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.707603931 CET	56972	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.717257977 CET	53	56972	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.718173027 CET	61062	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.729911089 CET	53	61062	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.730417013 CET	49381	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.761569977 CET	53	49381	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.762610912 CET	57422	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.772382975 CET	53	57422	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.773071051 CET	50679	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.784383059 CET	53	50679	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.784909964 CET	51556	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.794369936 CET	53	51556	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.794914007 CET	65176	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.826064110 CET	53	65176	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.826957941 CET	52185	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.836395025 CET	53	52185	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.837161064 CET	51551	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.846688032 CET	53	51551	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.909682989 CET	60678	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.920953035 CET	53	60678	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.959589958 CET	51984	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:05.991071939 CET	53	51984	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:05.998435020 CET	62095	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:06.007891893 CET	53	62095	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:06.013880014 CET	61646	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:06.024072886 CET	53	61646	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:06.028636932 CET	53060	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:06.037777901 CET	53	53060	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:06.065294981 CET	57434	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:06.076098919 CET	53	57434	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:06.101950884 CET	58426	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:06.133517981 CET	53	58426	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:06.154905081 CET	55244	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:06.165941000 CET	53	55244	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:06.187683105 CET	56226	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:06.195358992 CET	53	56226	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:06.196180105 CET	59125	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:06.206001997 CET	53	59125	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:06.208935976 CET	49570	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:06.298192978 CET	53	49570	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.341170073 CET	63664	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.350570917 CET	53	63664	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.351458073 CET	63089	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.362273932 CET	53	63089	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.363214016 CET	65341	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.373131990 CET	53	65341	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.373986006 CET	55876	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.381449938 CET	53	55876	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.382261038 CET	52038	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.393147945 CET	53	52038	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.393755913 CET	57160	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.553627968 CET	53	57160	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.554506063 CET	62417	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.565201998 CET	53	62417	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.565824986 CET	58869	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.597084045 CET	53	58869	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.597865105 CET	51465	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.609004021 CET	53	51465	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.609813929 CET	51773	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.620984077 CET	53	51773	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:07.621617079 CET	60206	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:42:07.631449938 CET	53	60206	1.1.1.1	192.168.2.6
Nov 7, 2024 15:42:34.631880045 CET	53	60861	162.159.36.2	192.168.2.6
Nov 7, 2024 15:42:35.258991003 CET	53	54641	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:14.115783930 CET	58666	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:14.125332117 CET	53	58666	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:15.140620947 CET	63316	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:15.150748968 CET	53	63316	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:16.221878052 CET	57477	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:16.252557993 CET	53	57477	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:17.265491962 CET	57204	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:17.276210070 CET	53	57204	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:18.292524099 CET	55553	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:18.312746048 CET	55553	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:18.447458982 CET	53	55553	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:18.447485924 CET	53	55553	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:19.473737001 CET	62746	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:19.499171972 CET	62746	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:19.505630970 CET	53	62746	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:19.506145954 CET	53	62746	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:20.515742064 CET	51885	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:20.526391029 CET	53	51885	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:21.619050026 CET	62902	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:21.629300117 CET	53	62902	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:22.641386032 CET	58266	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:22.651343107 CET	53	58266	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:23.656169891 CET	54382	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:23.667277098 CET	53	54382	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:24.842623949 CET	56810	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:24.865039110 CET	56810	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:24.874732971 CET	53	56810	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:24.874749899 CET	53	56810	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:25.906321049 CET	57742	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:25.916416883 CET	53	57742	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:26.921778917 CET	63235	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:26.929193974 CET	53	63235	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:27.937464952 CET	61216	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:27.967884064 CET	61216	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:27.969069958 CET	53	61216	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:27.975379944 CET	53	61216	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:28.984153986 CET	60183	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:28.995719910 CET	53	60183	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:31.734087944 CET	61903	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:31.744566917 CET	53	61903	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:32.749819994 CET	57492	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:32.760966063 CET	53	57492	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:33.765551090 CET	56157	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:33.796114922 CET	56157	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:33.909955978 CET	53	56157	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:33.909981012 CET	53	56157	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:34.922061920 CET	58269	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:34.952421904 CET	58269	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:34.953933001 CET	53	58269	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:34.959440947 CET	53	58269	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:38.572472095 CET	53717	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:38.581660986 CET	53	53717	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:39.593841076 CET	65409	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:39.603759050 CET	53	65409	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:40.609422922 CET	53851	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:40.619654894 CET	53	53851	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:41.625169039 CET	62965	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:41.632752895 CET	53	62965	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:42.640528917 CET	54598	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:42.671125889 CET	54598	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:42.674387932 CET	53	54598	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:42.679236889 CET	53	54598	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:43.687500954 CET	54418	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:43.718087912 CET	54418	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:43.720408916 CET	53	54418	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:43.725275993 CET	53	54418	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:44.734496117 CET	51323	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:44.764806986 CET	51323	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:44.765461922 CET	53	51323	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:44.771636963 CET	53	51323	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:45.781469107 CET	54182	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:45.811789036 CET	54182	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:45.812875986 CET	53	54182	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:45.819344044 CET	53	54182	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:46.828219891 CET	63939	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:46.838902950 CET	53	63939	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:47.909003019 CET	60641	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:47.923378944 CET	53	60641	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:49.063409090 CET	55185	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:49.074929953 CET	53	55185	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:50.046789885 CET	63600	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:50.077416897 CET	63600	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:50.078346968 CET	53	63600	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:50.085731030 CET	53	63600	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:51.015631914 CET	63118	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:51.025511026 CET	53	63118	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:51.937378883 CET	58056	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:51.967885017 CET	58056	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:52.094109058 CET	53	58056	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:52.094227076 CET	53	58056	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:52.968643904 CET	56790	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:52.999638081 CET	56790	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:52.999736071 CET	53	56790	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:53.006853104 CET	53	56790	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:53.859247923 CET	52753	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:53.869788885 CET	53	52753	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:54.687422991 CET	54529	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:54.698144913 CET	53	54529	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.577853918 CET	59010	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.585814953 CET	53	59010	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.586328030 CET	63924	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.608727932 CET	63924	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.616806030 CET	53	63924	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.616846085 CET	53	63924	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.617536068 CET	53905	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.627713919 CET	53	53905	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.628247976 CET	62012	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.638164997 CET	53	62012	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.638608932 CET	53515	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.648478985 CET	53	53515	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.648983955 CET	62635	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.659259081 CET	53	62635	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.659866095 CET	51178	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.670146942 CET	53	51178	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.670752048 CET	63142	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.681123018 CET	53	63142	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.681590080 CET	60593	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.702215910 CET	60593	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.713984966 CET	53	60593	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.714024067 CET	53	60593	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.714850903 CET	52727	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.724735022 CET	53	52727	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.725353003 CET	62466	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.736336946 CET	53	62466	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.736797094 CET	61422	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.764694929 CET	61422	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.768152952 CET	53	61422	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.768954039 CET	57461	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.771770954 CET	53	61422	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.777060986 CET	53	57461	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.777558088 CET	63721	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.788003922 CET	53	63721	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.788743973 CET	60943	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.811563015 CET	60943	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.820233107 CET	53	60943	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.820415020 CET	53	60943	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.821124077 CET	57163	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.832729101 CET	53	57163	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.833384037 CET	59737	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.843116045 CET	53	59737	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.843619108 CET	57176	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.851432085 CET	53	57176	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.851938009 CET	60313	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.874041080 CET	60313	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.884104013 CET	53	60313	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.884135008 CET	53	60313	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.884608984 CET	52210	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.894056082 CET	53	52210	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.894685030 CET	51182	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.920989990 CET	51182	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.926999092 CET	53	51182	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.927609921 CET	51344	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.928174019 CET	53	51182	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.938483953 CET	53	51344	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.938896894 CET	50098	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.948695898 CET	53	50098	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.949161053 CET	52386	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.967808962 CET	52386	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.981246948 CET	53	52386	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.981264114 CET	53	52386	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:55.982069016 CET	49665	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:55.999038935 CET	49665	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:56.013346910 CET	53	49665	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:56.013364077 CET	53	49665	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:56.014215946 CET	58211	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:56.023665905 CET	53	58211	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:56.024429083 CET	51354	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:56.033694029 CET	53	51354	1.1.1.1	192.168.2.6
Nov 7, 2024 15:43:56.034334898 CET	49300	53	192.168.2.6	1.1.1.1
Nov 7, 2024 15:43:56.044936895 CET	53	49300	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 15:41:53.506658077 CET	192.168.2.6	1.1.1.1	0x3f95	Standard query (0)	leaderstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:53.544981956 CET	192.168.2.6	1.1.1.1	0xa49a	Standard query (0)	heavenstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:53.556427002 CET	192.168.2.6	1.1.1.1	0xcef9	Standard query (0)	leadernothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:53.588982105 CET	192.168.2.6	1.1.1.1	0x258a	Standard query (0)	heavennothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.232904911 CET	192.168.2.6	1.1.1.1	0xece6	Standard query (0)	leaderbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.248635054 CET	192.168.2.6	1.1.1.1	0x2eef	Standard query (0)	heavenbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.263756037 CET	192.168.2.6	1.1.1.1	0x4c1d	Standard query (0)	leaderdivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.282855034 CET	192.168.2.6	1.1.1.1	0x50d	Standard query (0)	heavendivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.319019079 CET	192.168.2.6	1.1.1.1	0x55f5	Standard query (0)	heavystream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.337842941 CET	192.168.2.6	1.1.1.1	0xe935	Standard query (0)	gentlestream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.349253893 CET	192.168.2.6	1.1.1.1	0x9a31	Standard query (0)	heavynothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.368004084 CET	192.168.2.6	1.1.1.1	0x44bd	Standard query (0)	gentlenothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.379426956 CET	192.168.2.6	1.1.1.1	0x3f66	Standard query (0)	heavybottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.390434980 CET	192.168.2.6	1.1.1.1	0xe2f7	Standard query (0)	gentlebottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.430154085 CET	192.168.2.6	1.1.1.1	0xee75	Standard query (0)	heavydivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.444452047 CET	192.168.2.6	1.1.1.1	0x6a61	Standard query (0)	gentledivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.512857914 CET	192.168.2.6	1.1.1.1	0x92a4	Standard query (0)	variousstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.659338951 CET	192.168.2.6	1.1.1.1	0x6274	Standard query (0)	returnstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.671514034 CET	192.168.2.6	1.1.1.1	0x629a	Standard query (0)	variousnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.682008028 CET	192.168.2.6	1.1.1.1	0xc785	Standard query (0)	returnnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.692894936 CET	192.168.2.6	1.1.1.1	0x78e8	Standard query (0)	variousbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.725229979 CET	192.168.2.6	1.1.1.1	0x3618	Standard query (0)	returnbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.817819118 CET	192.168.2.6	1.1.1.1	0x5b2a	Standard query (0)	variousdivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.829165936 CET	192.168.2.6	1.1.1.1	0xe04d	Standard query (0)	returndivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.841368914 CET	192.168.2.6	1.1.1.1	0xb284	Standard query (0)	degreemanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.851160049 CET	192.168.2.6	1.1.1.1	0x4012	Standard query (0)	forwardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.866940975 CET	192.168.2.6	1.1.1.1	0x5c16	Standard query (0)	degreeanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.877368927 CET	192.168.2.6	1.1.1.1	0x783	Standard query (0)	forwardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.909492016 CET	192.168.2.6	1.1.1.1	0xb912	Standard query (0)	degreebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.919434071 CET	192.168.2.6	1.1.1.1	0xce6d	Standard query (0)	forwardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.928946018 CET	192.168.2.6	1.1.1.1	0x923	Standard query (0)	degreeappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.960274935 CET	192.168.2.6	1.1.1.1	0x9cdb	Standard query (0)	forwardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.971513033 CET	192.168.2.6	1.1.1.1	0x2ce2	Standard query (0)	answermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.002605915 CET	192.168.2.6	1.1.1.1	0xad02	Standard query (0)	glassmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.013202906 CET	192.168.2.6	1.1.1.1	0x5d1f	Standard query (0)	answeranother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.045164108 CET	192.168.2.6	1.1.1.1	0x7623	Standard query (0)	glassanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.055454016 CET	192.168.2.6	1.1.1.1	0x1698	Standard query (0)	answerbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.066004038 CET	192.168.2.6	1.1.1.1	0x2a2a	Standard query (0)	glassbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.075938940 CET	192.168.2.6	1.1.1.1	0x3bb9	Standard query (0)	answerappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.108573914 CET	192.168.2.6	1.1.1.1	0x492a	Standard query (0)	glassappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.265629053 CET	192.168.2.6	1.1.1.1	0x1199	Standard query (0)	difficultmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.297272921 CET	192.168.2.6	1.1.1.1	0x17c5	Standard query (0)	heardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.304574013 CET	192.168.2.6	1.1.1.1	0x5b3e	Standard query (0)	difficultanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.314344883 CET	192.168.2.6	1.1.1.1	0x4486	Standard query (0)	heardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.354036093 CET	192.168.2.6	1.1.1.1	0xdb80	Standard query (0)	difficultbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.387094975 CET	192.168.2.6	1.1.1.1	0xe013	Standard query (0)	heardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.397530079 CET	192.168.2.6	1.1.1.1	0x59f8	Standard query (0)	difficultappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.429656982 CET	192.168.2.6	1.1.1.1	0x14a4	Standard query (0)	heardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.443128109 CET	192.168.2.6	1.1.1.1	0x4e75	Standard query (0)	pleasantmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.454363108 CET	192.168.2.6	1.1.1.1	0x11b6	Standard query (0)	necessarymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.464747906 CET	192.168.2.6	1.1.1.1	0x8834	Standard query (0)	pleasantanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.474767923 CET	192.168.2.6	1.1.1.1	0x5f9	Standard query (0)	necessaryanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.485228062 CET	192.168.2.6	1.1.1.1	0x39a5	Standard query (0)	pleasantbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.518723011 CET	192.168.2.6	1.1.1.1	0xc756	Standard query (0)	necessarybusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.529160023 CET	192.168.2.6	1.1.1.1	0x9c6e	Standard query (0)	pleasantappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.698390961 CET	192.168.2.6	1.1.1.1	0xc432	Standard query (0)	necessaryappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.709846020 CET	192.168.2.6	1.1.1.1	0x5057	Standard query (0)	ordermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.724337101 CET	192.168.2.6	1.1.1.1	0x97ca	Standard query (0)	requiremanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.736354113 CET	192.168.2.6	1.1.1.1	0x5dab	Standard query (0)	orderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.748291969 CET	192.168.2.6	1.1.1.1	0x3f4a	Standard query (0)	requireanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.765824080 CET	192.168.2.6	1.1.1.1	0x85a8	Standard query (0)	orderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.799072981 CET	192.168.2.6	1.1.1.1	0xa003	Standard query (0)	requirebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.833936930 CET	192.168.2.6	1.1.1.1	0xd19c	Standard query (0)	orderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.189964056 CET	192.168.2.6	1.1.1.1	0xadd1	Standard query (0)	requireappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.221791029 CET	192.168.2.6	1.1.1.1	0xff8b	Standard query (0)	leadermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.397233963 CET	192.168.2.6	1.1.1.1	0x7b96	Standard query (0)	heavenmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.408514023 CET	192.168.2.6	1.1.1.1	0x8e51	Standard query (0)	leaderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.425976992 CET	192.168.2.6	1.1.1.1	0x326e	Standard query (0)	heavenanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.459321976 CET	192.168.2.6	1.1.1.1	0x521b	Standard query (0)	leaderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.490938902 CET	192.168.2.6	1.1.1.1	0x74ff	Standard query (0)	heavenbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.525670052 CET	192.168.2.6	1.1.1.1	0x5d00	Standard query (0)	leaderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.537642956 CET	192.168.2.6	1.1.1.1	0x9e08	Standard query (0)	heavenappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.571193933 CET	192.168.2.6	1.1.1.1	0x9455	Standard query (0)	heavymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.604568958 CET	192.168.2.6	1.1.1.1	0x1bf	Standard query (0)	gentlemanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.616296053 CET	192.168.2.6	1.1.1.1	0x72a5	Standard query (0)	heavyanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.648407936 CET	192.168.2.6	1.1.1.1	0x8369	Standard query (0)	gentleanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.836661100 CET	192.168.2.6	1.1.1.1	0x43b6	Standard query (0)	heavybusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.868488073 CET	192.168.2.6	1.1.1.1	0x4d36	Standard query (0)	gentlebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.901371002 CET	192.168.2.6	1.1.1.1	0xb1b2	Standard query (0)	heavyappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.913538933 CET	192.168.2.6	1.1.1.1	0x89e	Standard query (0)	gentleappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.925321102 CET	192.168.2.6	1.1.1.1	0x748b	Standard query (0)	variousmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.941373110 CET	192.168.2.6	1.1.1.1	0x29da	Standard query (0)	returnmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.951792955 CET	192.168.2.6	1.1.1.1	0xc77	Standard query (0)	variousanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.962095976 CET	192.168.2.6	1.1.1.1	0x2d64	Standard query (0)	returnanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.973738909 CET	192.168.2.6	1.1.1.1	0xb08	Standard query (0)	variousbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.990161896 CET	192.168.2.6	1.1.1.1	0xeb5e	Standard query (0)	returnbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.022108078 CET	192.168.2.6	1.1.1.1	0x9f2a	Standard query (0)	variousappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.031712055 CET	192.168.2.6	1.1.1.1	0xfe86	Standard query (0)	returnappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.044601917 CET	192.168.2.6	1.1.1.1	0xc50e	Standard query (0)	degreeinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.054757118 CET	192.168.2.6	1.1.1.1	0x1beb	Standard query (0)	forwardinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.086224079 CET	192.168.2.6	1.1.1.1	0x365f	Standard query (0)	degreeexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.097312927 CET	192.168.2.6	1.1.1.1	0x5153	Standard query (0)	forwardexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.121191025 CET	192.168.2.6	1.1.1.1	0x1173	Standard query (0)	degreebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.152260065 CET	192.168.2.6	1.1.1.1	0xe4d	Standard query (0)	forwardbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.313704014 CET	192.168.2.6	1.1.1.1	0x676f	Standard query (0)	degreeinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.324220896 CET	192.168.2.6	1.1.1.1	0x7948	Standard query (0)	forwardinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.334898949 CET	192.168.2.6	1.1.1.1	0xfc94	Standard query (0)	answerinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.351377010 CET	192.168.2.6	1.1.1.1	0xe7c6	Standard query (0)	glassinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.363173962 CET	192.168.2.6	1.1.1.1	0xf059	Standard query (0)	answerexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.395379066 CET	192.168.2.6	1.1.1.1	0xf159	Standard query (0)	glassexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.406482935 CET	192.168.2.6	1.1.1.1	0xd7b6	Standard query (0)	answerbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.417210102 CET	192.168.2.6	1.1.1.1	0xd32b	Standard query (0)	glassbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.474060059 CET	192.168.2.6	1.1.1.1	0xb414	Standard query (0)	answerinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.511351109 CET	192.168.2.6	1.1.1.1	0x5ea2	Standard query (0)	glassinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.542598963 CET	192.168.2.6	1.1.1.1	0x6c1a	Standard query (0)	difficultinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.574980974 CET	192.168.2.6	1.1.1.1	0x39c	Standard query (0)	heardinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.585282087 CET	192.168.2.6	1.1.1.1	0x3c20	Standard query (0)	difficultexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.596122980 CET	192.168.2.6	1.1.1.1	0x82f5	Standard query (0)	heardexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.610929012 CET	192.168.2.6	1.1.1.1	0xbc59	Standard query (0)	difficultbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.852314949 CET	192.168.2.6	1.1.1.1	0x19b5	Standard query (0)	heardbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.862653017 CET	192.168.2.6	1.1.1.1	0x968	Standard query (0)	difficultinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.879086971 CET	192.168.2.6	1.1.1.1	0xdf5a	Standard query (0)	heardinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.919193029 CET	192.168.2.6	1.1.1.1	0x5c09	Standard query (0)	pleasantinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.231203079 CET	192.168.2.6	1.1.1.1	0x4447	Standard query (0)	necessaryinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.239267111 CET	192.168.2.6	1.1.1.1	0x9226	Standard query (0)	pleasantexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.296817064 CET	192.168.2.6	1.1.1.1	0x5d6d	Standard query (0)	necessaryexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.330936909 CET	192.168.2.6	1.1.1.1	0x2630	Standard query (0)	pleasantbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.344223976 CET	192.168.2.6	1.1.1.1	0x2ec1	Standard query (0)	necessarybright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.376954079 CET	192.168.2.6	1.1.1.1	0xf397	Standard query (0)	pleasantinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.388268948 CET	192.168.2.6	1.1.1.1	0x7d32	Standard query (0)	necessaryinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.399561882 CET	192.168.2.6	1.1.1.1	0x5a85	Standard query (0)	orderinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.431803942 CET	192.168.2.6	1.1.1.1	0x7536	Standard query (0)	requireinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.442267895 CET	192.168.2.6	1.1.1.1	0x4180	Standard query (0)	orderexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.452877998 CET	192.168.2.6	1.1.1.1	0x4e14	Standard query (0)	requireexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.463956118 CET	192.168.2.6	1.1.1.1	0xb295	Standard query (0)	orderbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.475404978 CET	192.168.2.6	1.1.1.1	0x92d5	Standard query (0)	requirebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.487477064 CET	192.168.2.6	1.1.1.1	0x52d1	Standard query (0)	orderinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.498653889 CET	192.168.2.6	1.1.1.1	0x1f6f	Standard query (0)	requireinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.508066893 CET	192.168.2.6	1.1.1.1	0x9f60	Standard query (0)	leaderinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.520708084 CET	192.168.2.6	1.1.1.1	0x842c	Standard query (0)	heaveninstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.531266928 CET	192.168.2.6	1.1.1.1	0x62b6	Standard query (0)	leaderexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.541481018 CET	192.168.2.6	1.1.1.1	0xe965	Standard query (0)	heavenexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.573386908 CET	192.168.2.6	1.1.1.1	0x5c7b	Standard query (0)	leaderbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.584635019 CET	192.168.2.6	1.1.1.1	0xf365	Standard query (0)	heavenbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.595367908 CET	192.168.2.6	1.1.1.1	0xfa57	Standard query (0)	leaderinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.606190920 CET	192.168.2.6	1.1.1.1	0xf032	Standard query (0)	heaveninside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.634835958 CET	192.168.2.6	1.1.1.1	0xa621	Standard query (0)	heavyinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.667608976 CET	192.168.2.6	1.1.1.1	0xcb31	Standard query (0)	gentleinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.675825119 CET	192.168.2.6	1.1.1.1	0x8e69	Standard query (0)	heavyexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.707603931 CET	192.168.2.6	1.1.1.1	0x878a	Standard query (0)	gentleexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.718173027 CET	192.168.2.6	1.1.1.1	0x109e	Standard query (0)	heavybright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.730417013 CET	192.168.2.6	1.1.1.1	0x3a7a	Standard query (0)	gentlebright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.762610912 CET	192.168.2.6	1.1.1.1	0xd915	Standard query (0)	heavyinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.773071051 CET	192.168.2.6	1.1.1.1	0xb03f	Standard query (0)	gentleinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.784909964 CET	192.168.2.6	1.1.1.1	0xf7f9	Standard query (0)	variousinstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.794914007 CET	192.168.2.6	1.1.1.1	0x8e75	Standard query (0)	returninstead.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.826957941 CET	192.168.2.6	1.1.1.1	0x9ff8	Standard query (0)	variousexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.837161064 CET	192.168.2.6	1.1.1.1	0x6758	Standard query (0)	returnexplain.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.909682989 CET	192.168.2.6	1.1.1.1	0x210d	Standard query (0)	variousbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.959589958 CET	192.168.2.6	1.1.1.1	0x566a	Standard query (0)	returnbright.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.998435020 CET	192.168.2.6	1.1.1.1	0x9596	Standard query (0)	variousinside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.013880014 CET	192.168.2.6	1.1.1.1	0x7c62	Standard query (0)	returninside.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.028636932 CET	192.168.2.6	1.1.1.1	0xf89	Standard query (0)	degreeready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.065294981 CET	192.168.2.6	1.1.1.1	0x5ec6	Standard query (0)	forwardready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.101950884 CET	192.168.2.6	1.1.1.1	0x5735	Standard query (0)	degreebrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.154905081 CET	192.168.2.6	1.1.1.1	0x2db8	Standard query (0)	forwardbrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.187683105 CET	192.168.2.6	1.1.1.1	0x7149	Standard query (0)	degreepeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.196180105 CET	192.168.2.6	1.1.1.1	0xd749	Standard query (0)	forwardpeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.208935976 CET	192.168.2.6	1.1.1.1	0x919e	Standard query (0)	degreedaughter.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.341170073 CET	192.168.2.6	1.1.1.1	0xde9c	Standard query (0)	forwarddaughter.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.351458073 CET	192.168.2.6	1.1.1.1	0xb71f	Standard query (0)	answerready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.363214016 CET	192.168.2.6	1.1.1.1	0x88c4	Standard query (0)	glassready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.373986006 CET	192.168.2.6	1.1.1.1	0xc457	Standard query (0)	answerbrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.382261038 CET	192.168.2.6	1.1.1.1	0x66dd	Standard query (0)	glassbrown.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.393755913 CET	192.168.2.6	1.1.1.1	0x5e4f	Standard query (0)	answerpeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.554506063 CET	192.168.2.6	1.1.1.1	0x7f33	Standard query (0)	glasspeople.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.565824986 CET	192.168.2.6	1.1.1.1	0x1f6f	Standard query (0)	answerdaughter.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.597865105 CET	192.168.2.6	1.1.1.1	0x14f4	Standard query (0)	glassdaughter.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.609813929 CET	192.168.2.6	1.1.1.1	0xcd4	Standard query (0)	difficultready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.621617079 CET	192.168.2.6	1.1.1.1	0x92b8	Standard query (0)	heardready.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:14.115783930 CET	192.168.2.6	1.1.1.1	0x77fc	Standard query (0)	heavenstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:15.140620947 CET	192.168.2.6	1.1.1.1	0xd6fd	Standard query (0)	leadernothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:16.221878052 CET	192.168.2.6	1.1.1.1	0x7b8f	Standard query (0)	heavennothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:17.265491962 CET	192.168.2.6	1.1.1.1	0xdd23	Standard query (0)	leaderbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:18.292524099 CET	192.168.2.6	1.1.1.1	0xfde	Standard query (0)	heavenbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:18.312746048 CET	192.168.2.6	1.1.1.1	0xfde	Standard query (0)	heavenbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:19.473737001 CET	192.168.2.6	1.1.1.1	0xd6f6	Standard query (0)	leaderdivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:19.499171972 CET	192.168.2.6	1.1.1.1	0xd6f6	Standard query (0)	leaderdivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:20.515742064 CET	192.168.2.6	1.1.1.1	0xccae	Standard query (0)	heavendivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:21.619050026 CET	192.168.2.6	1.1.1.1	0x9cf9	Standard query (0)	heavystream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:22.641386032 CET	192.168.2.6	1.1.1.1	0x44cf	Standard query (0)	gentlestream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:23.656169891 CET	192.168.2.6	1.1.1.1	0x582	Standard query (0)	heavynothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:24.842623949 CET	192.168.2.6	1.1.1.1	0x9426	Standard query (0)	gentlenothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:24.865039110 CET	192.168.2.6	1.1.1.1	0x9426	Standard query (0)	gentlenothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:25.906321049 CET	192.168.2.6	1.1.1.1	0xa933	Standard query (0)	heavybottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:26.921778917 CET	192.168.2.6	1.1.1.1	0xca77	Standard query (0)	gentlebottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:27.937464952 CET	192.168.2.6	1.1.1.1	0x2480	Standard query (0)	heavydivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:27.967884064 CET	192.168.2.6	1.1.1.1	0x2480	Standard query (0)	heavydivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:28.984153986 CET	192.168.2.6	1.1.1.1	0xf7e2	Standard query (0)	gentledivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:31.734087944 CET	192.168.2.6	1.1.1.1	0x3751	Standard query (0)	returnstream.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:32.749819994 CET	192.168.2.6	1.1.1.1	0xe96d	Standard query (0)	variousnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:33.765551090 CET	192.168.2.6	1.1.1.1	0x6ea7	Standard query (0)	returnnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:33.796114922 CET	192.168.2.6	1.1.1.1	0x6ea7	Standard query (0)	returnnothing.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:34.922061920 CET	192.168.2.6	1.1.1.1	0x122	Standard query (0)	variousbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:34.952421904 CET	192.168.2.6	1.1.1.1	0x122	Standard query (0)	variousbottle.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:38.572472095 CET	192.168.2.6	1.1.1.1	0x7c35	Standard query (0)	variousdivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:39.593841076 CET	192.168.2.6	1.1.1.1	0xe0f2	Standard query (0)	returndivide.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:40.609422922 CET	192.168.2.6	1.1.1.1	0x12e	Standard query (0)	degreemanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:41.625169039 CET	192.168.2.6	1.1.1.1	0x8d14	Standard query (0)	forwardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:42.640528917 CET	192.168.2.6	1.1.1.1	0x847b	Standard query (0)	degreeanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:42.671125889 CET	192.168.2.6	1.1.1.1	0x847b	Standard query (0)	degreeanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:43.687500954 CET	192.168.2.6	1.1.1.1	0x2f5a	Standard query (0)	forwardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:43.718087912 CET	192.168.2.6	1.1.1.1	0x2f5a	Standard query (0)	forwardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:44.734496117 CET	192.168.2.6	1.1.1.1	0xccce	Standard query (0)	degreebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:44.764806986 CET	192.168.2.6	1.1.1.1	0xccce	Standard query (0)	degreebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:45.781469107 CET	192.168.2.6	1.1.1.1	0xfec3	Standard query (0)	forwardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:45.811789036 CET	192.168.2.6	1.1.1.1	0xfec3	Standard query (0)	forwardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:46.828219891 CET	192.168.2.6	1.1.1.1	0xd05f	Standard query (0)	degreeappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:47.909003019 CET	192.168.2.6	1.1.1.1	0x7e49	Standard query (0)	forwardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:49.063409090 CET	192.168.2.6	1.1.1.1	0xbdab	Standard query (0)	answermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:50.046789885 CET	192.168.2.6	1.1.1.1	0xec06	Standard query (0)	glassmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:50.077416897 CET	192.168.2.6	1.1.1.1	0xec06	Standard query (0)	glassmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:51.015631914 CET	192.168.2.6	1.1.1.1	0xbdfe	Standard query (0)	answeranother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:51.937378883 CET	192.168.2.6	1.1.1.1	0x2956	Standard query (0)	glassanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:51.967885017 CET	192.168.2.6	1.1.1.1	0x2956	Standard query (0)	glassanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:52.968643904 CET	192.168.2.6	1.1.1.1	0xbc04	Standard query (0)	answerbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:52.999638081 CET	192.168.2.6	1.1.1.1	0xbc04	Standard query (0)	answerbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:53.859247923 CET	192.168.2.6	1.1.1.1	0x654d	Standard query (0)	glassbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:54.687422991 CET	192.168.2.6	1.1.1.1	0x3511	Standard query (0)	answerappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.577853918 CET	192.168.2.6	1.1.1.1	0x7194	Standard query (0)	glassappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.586328030 CET	192.168.2.6	1.1.1.1	0x4232	Standard query (0)	difficultmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.608727932 CET	192.168.2.6	1.1.1.1	0x4232	Standard query (0)	difficultmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.617536068 CET	192.168.2.6	1.1.1.1	0xd012	Standard query (0)	heardmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.628247976 CET	192.168.2.6	1.1.1.1	0x87d	Standard query (0)	difficultanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.638608932 CET	192.168.2.6	1.1.1.1	0xc059	Standard query (0)	heardanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.648983955 CET	192.168.2.6	1.1.1.1	0xe004	Standard query (0)	difficultbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.659866095 CET	192.168.2.6	1.1.1.1	0x1b2b	Standard query (0)	heardbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.670752048 CET	192.168.2.6	1.1.1.1	0xb398	Standard query (0)	difficultappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.681590080 CET	192.168.2.6	1.1.1.1	0x4a8b	Standard query (0)	heardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.702215910 CET	192.168.2.6	1.1.1.1	0x4a8b	Standard query (0)	heardappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.714850903 CET	192.168.2.6	1.1.1.1	0xd4c9	Standard query (0)	pleasantmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.725353003 CET	192.168.2.6	1.1.1.1	0x7f95	Standard query (0)	necessarymanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.736797094 CET	192.168.2.6	1.1.1.1	0xf553	Standard query (0)	pleasantanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.764694929 CET	192.168.2.6	1.1.1.1	0xf553	Standard query (0)	pleasantanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.768954039 CET	192.168.2.6	1.1.1.1	0xa6eb	Standard query (0)	necessaryanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.777558088 CET	192.168.2.6	1.1.1.1	0x737f	Standard query (0)	pleasantbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.788743973 CET	192.168.2.6	1.1.1.1	0x7427	Standard query (0)	necessarybusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.811563015 CET	192.168.2.6	1.1.1.1	0x7427	Standard query (0)	necessarybusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.821124077 CET	192.168.2.6	1.1.1.1	0x5f8d	Standard query (0)	pleasantappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.833384037 CET	192.168.2.6	1.1.1.1	0x8517	Standard query (0)	necessaryappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.843619108 CET	192.168.2.6	1.1.1.1	0x5ad8	Standard query (0)	ordermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.851938009 CET	192.168.2.6	1.1.1.1	0x395c	Standard query (0)	requiremanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.874041080 CET	192.168.2.6	1.1.1.1	0x395c	Standard query (0)	requiremanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.884608984 CET	192.168.2.6	1.1.1.1	0x1fa3	Standard query (0)	orderanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.894685030 CET	192.168.2.6	1.1.1.1	0xfcdd	Standard query (0)	requireanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.920989990 CET	192.168.2.6	1.1.1.1	0xfcdd	Standard query (0)	requireanother.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.927609921 CET	192.168.2.6	1.1.1.1	0x4269	Standard query (0)	orderbusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.938896894 CET	192.168.2.6	1.1.1.1	0xe9e3	Standard query (0)	requirebusiness.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.949161053 CET	192.168.2.6	1.1.1.1	0x892c	Standard query (0)	orderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.967808962 CET	192.168.2.6	1.1.1.1	0x892c	Standard query (0)	orderappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.982069016 CET	192.168.2.6	1.1.1.1	0x1e2d	Standard query (0)	requireappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.999038935 CET	192.168.2.6	1.1.1.1	0x1e2d	Standard query (0)	requireappear.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:56.014215946 CET	192.168.2.6	1.1.1.1	0x32d0	Standard query (0)	leadermanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:56.024429083 CET	192.168.2.6	1.1.1.1	0x88d9	Standard query (0)	heavenmanner.net	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:56.034334898 CET	192.168.2.6	1.1.1.1	0x69cd	Standard query (0)	leaderanother.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 15:41:53.555422068 CET	1.1.1.1	192.168.2.6	0xa49a	Name error (3)	heavenstream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:53.588172913 CET	1.1.1.1	192.168.2.6	0xcef9	Name error (3)	leadernothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.243195057 CET	1.1.1.1	192.168.2.6	0xece6	Name error (3)	leaderbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.258874893 CET	1.1.1.1	192.168.2.6	0x2eef	Name error (3)	heavenbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.276308060 CET	1.1.1.1	192.168.2.6	0x4c1d	Name error (3)	leaderdivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.314434052 CET	1.1.1.1	192.168.2.6	0x50d	Name error (3)	heavendivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.330238104 CET	1.1.1.1	192.168.2.6	0x55f5	Name error (3)	heavystream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.347049952 CET	1.1.1.1	192.168.2.6	0xe935	Name error (3)	gentlestream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.358637094 CET	1.1.1.1	192.168.2.6	0x9a31	Name error (3)	heavynothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.378741026 CET	1.1.1.1	192.168.2.6	0x44bd	Name error (3)	gentlenothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.389899969 CET	1.1.1.1	192.168.2.6	0x3f66	Name error (3)	heavybottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.416484118 CET	1.1.1.1	192.168.2.6	0xe2f7	Name error (3)	gentlebottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.439172029 CET	1.1.1.1	192.168.2.6	0xee75	Name error (3)	heavydivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.475759029 CET	1.1.1.1	192.168.2.6	0x6a61	Name error (3)	gentledivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:54.829195023 CET	1.1.1.1	192.168.2.6	0x92a4	No error (0)	variousstream.net	7450.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:41:54.829195023 CET	1.1.1.1	192.168.2.6	0x92a4	No error (0)	7450.bodis.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.670730114 CET	1.1.1.1	192.168.2.6	0x6274	Name error (3)	returnstream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.681399107 CET	1.1.1.1	192.168.2.6	0x629a	Name error (3)	variousnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.692348003 CET	1.1.1.1	192.168.2.6	0xc785	Name error (3)	returnnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.724601984 CET	1.1.1.1	192.168.2.6	0x78e8	Name error (3)	variousbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:55.911421061 CET	1.1.1.1	192.168.2.6	0x3618	No error (0)	returnbottle.net		18.143.155.63	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.828553915 CET	1.1.1.1	192.168.2.6	0x5b2a	Name error (3)	variousdivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.840790033 CET	1.1.1.1	192.168.2.6	0xe04d	Name error (3)	returndivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.850421906 CET	1.1.1.1	192.168.2.6	0xb284	Name error (3)	degreemanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.866318941 CET	1.1.1.1	192.168.2.6	0x4012	Name error (3)	forwardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.876775980 CET	1.1.1.1	192.168.2.6	0x5c16	Name error (3)	degreeanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.908783913 CET	1.1.1.1	192.168.2.6	0x783	Name error (3)	forwardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.918889046 CET	1.1.1.1	192.168.2.6	0xb912	Name error (3)	degreebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.928412914 CET	1.1.1.1	192.168.2.6	0xce6d	Name error (3)	forwardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.959700108 CET	1.1.1.1	192.168.2.6	0x923	Name error (3)	degreeappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:57.970865965 CET	1.1.1.1	192.168.2.6	0x9cdb	Name error (3)	forwardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.001770973 CET	1.1.1.1	192.168.2.6	0x2ce2	Name error (3)	answermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.012409925 CET	1.1.1.1	192.168.2.6	0xad02	Name error (3)	glassmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.044363022 CET	1.1.1.1	192.168.2.6	0x5d1f	Name error (3)	answeranother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.054833889 CET	1.1.1.1	192.168.2.6	0x7623	Name error (3)	glassanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.065419912 CET	1.1.1.1	192.168.2.6	0x1698	Name error (3)	answerbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.075436115 CET	1.1.1.1	192.168.2.6	0x2a2a	Name error (3)	glassbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.107876062 CET	1.1.1.1	192.168.2.6	0x3bb9	Name error (3)	answerappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.264873981 CET	1.1.1.1	192.168.2.6	0x492a	Name error (3)	glassappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.296588898 CET	1.1.1.1	192.168.2.6	0x1199	Name error (3)	difficultmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.304090977 CET	1.1.1.1	192.168.2.6	0x17c5	Name error (3)	heardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.313775063 CET	1.1.1.1	192.168.2.6	0x5b3e	Name error (3)	difficultanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.346585035 CET	1.1.1.1	192.168.2.6	0x4486	Name error (3)	heardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.386097908 CET	1.1.1.1	192.168.2.6	0xdb80	Name error (3)	difficultbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.396900892 CET	1.1.1.1	192.168.2.6	0xe013	Name error (3)	heardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.428978920 CET	1.1.1.1	192.168.2.6	0x59f8	Name error (3)	difficultappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.442555904 CET	1.1.1.1	192.168.2.6	0x14a4	Name error (3)	heardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.453717947 CET	1.1.1.1	192.168.2.6	0x4e75	Name error (3)	pleasantmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.464113951 CET	1.1.1.1	192.168.2.6	0x11b6	Name error (3)	necessarymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.474076986 CET	1.1.1.1	192.168.2.6	0x8834	Name error (3)	pleasantanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.484527111 CET	1.1.1.1	192.168.2.6	0x5f9	Name error (3)	necessaryanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.516268969 CET	1.1.1.1	192.168.2.6	0x39a5	Name error (3)	pleasantbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.527909994 CET	1.1.1.1	192.168.2.6	0xc756	Name error (3)	necessarybusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.696866035 CET	1.1.1.1	192.168.2.6	0x9c6e	Name error (3)	pleasantappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.709086895 CET	1.1.1.1	192.168.2.6	0xc432	Name error (3)	necessaryappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.723721027 CET	1.1.1.1	192.168.2.6	0x5057	Name error (3)	ordermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.735677958 CET	1.1.1.1	192.168.2.6	0x97ca	Name error (3)	requiremanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.747745991 CET	1.1.1.1	192.168.2.6	0x5dab	Name error (3)	orderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.765239000 CET	1.1.1.1	192.168.2.6	0x3f4a	Name error (3)	requireanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.798336983 CET	1.1.1.1	192.168.2.6	0x85a8	Name error (3)	orderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:58.832793951 CET	1.1.1.1	192.168.2.6	0xa003	Name error (3)	requirebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.188870907 CET	1.1.1.1	192.168.2.6	0xd19c	Name error (3)	orderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.220474958 CET	1.1.1.1	192.168.2.6	0xadd1	Name error (3)	requireappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.384079933 CET	1.1.1.1	192.168.2.6	0xff8b	Name error (3)	leadermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.407087088 CET	1.1.1.1	192.168.2.6	0x7b96	Name error (3)	heavenmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.418261051 CET	1.1.1.1	192.168.2.6	0x8e51	Name error (3)	leaderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.458400965 CET	1.1.1.1	192.168.2.6	0x326e	Name error (3)	heavenanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.489969015 CET	1.1.1.1	192.168.2.6	0x521b	Name error (3)	leaderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.524666071 CET	1.1.1.1	192.168.2.6	0x74ff	Name error (3)	heavenbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.536775112 CET	1.1.1.1	192.168.2.6	0x5d00	Name error (3)	leaderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.570112944 CET	1.1.1.1	192.168.2.6	0x9e08	Name error (3)	heavenappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.603425980 CET	1.1.1.1	192.168.2.6	0x9455	Name error (3)	heavymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.615341902 CET	1.1.1.1	192.168.2.6	0x1bf	Name error (3)	gentlemanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.647249937 CET	1.1.1.1	192.168.2.6	0x72a5	Name error (3)	heavyanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:41:59.840943098 CET	1.1.1.1	192.168.2.6	0x8369	No error (0)	gentleanother.net		54.244.188.177	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.867495060 CET	1.1.1.1	192.168.2.6	0x43b6	Name error (3)	heavybusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.900161982 CET	1.1.1.1	192.168.2.6	0x4d36	Name error (3)	gentlebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.912790060 CET	1.1.1.1	192.168.2.6	0xb1b2	Name error (3)	heavyappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.924434900 CET	1.1.1.1	192.168.2.6	0x89e	Name error (3)	gentleappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.940551043 CET	1.1.1.1	192.168.2.6	0x748b	Name error (3)	variousmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.950934887 CET	1.1.1.1	192.168.2.6	0x29da	Name error (3)	returnmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.961421967 CET	1.1.1.1	192.168.2.6	0xc77	Name error (3)	variousanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.972805977 CET	1.1.1.1	192.168.2.6	0x2d64	Name error (3)	returnanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:00.989516020 CET	1.1.1.1	192.168.2.6	0xb08	Name error (3)	variousbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.021161079 CET	1.1.1.1	192.168.2.6	0xeb5e	Name error (3)	returnbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.031016111 CET	1.1.1.1	192.168.2.6	0x9f2a	Name error (3)	variousappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.044020891 CET	1.1.1.1	192.168.2.6	0xfe86	Name error (3)	returnappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.054066896 CET	1.1.1.1	192.168.2.6	0xc50e	Name error (3)	degreeinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.085321903 CET	1.1.1.1	192.168.2.6	0x1beb	Name error (3)	forwardinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.096111059 CET	1.1.1.1	192.168.2.6	0x365f	Name error (3)	degreeexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.108268023 CET	1.1.1.1	192.168.2.6	0x5153	Name error (3)	forwardexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.151448011 CET	1.1.1.1	192.168.2.6	0x1173	Name error (3)	degreebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.312693119 CET	1.1.1.1	192.168.2.6	0xe4d	Name error (3)	forwardbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.323566914 CET	1.1.1.1	192.168.2.6	0x676f	Name error (3)	degreeinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.334382057 CET	1.1.1.1	192.168.2.6	0x7948	Name error (3)	forwardinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.350759983 CET	1.1.1.1	192.168.2.6	0xfc94	Name error (3)	answerinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.362658024 CET	1.1.1.1	192.168.2.6	0xe7c6	Name error (3)	glassinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.394521952 CET	1.1.1.1	192.168.2.6	0xf059	Name error (3)	answerexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.405895948 CET	1.1.1.1	192.168.2.6	0xf159	Name error (3)	glassexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.416650057 CET	1.1.1.1	192.168.2.6	0xd7b6	Name error (3)	answerbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:01.805315018 CET	1.1.1.1	192.168.2.6	0xd32b	No error (0)	glassbright.net	7450.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 15:42:01.805315018 CET	1.1.1.1	192.168.2.6	0xd32b	No error (0)	7450.bodis.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.507220030 CET	1.1.1.1	192.168.2.6	0xb414	Name error (3)	answerinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.541723013 CET	1.1.1.1	192.168.2.6	0x5ea2	Name error (3)	glassinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.573909998 CET	1.1.1.1	192.168.2.6	0x6c1a	Name error (3)	difficultinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.584532976 CET	1.1.1.1	192.168.2.6	0x39c	Name error (3)	heardinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.595499992 CET	1.1.1.1	192.168.2.6	0x3c20	Name error (3)	difficultexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.609965086 CET	1.1.1.1	192.168.2.6	0x82f5	Name error (3)	heardexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.851505995 CET	1.1.1.1	192.168.2.6	0xbc59	Name error (3)	difficultbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.861774921 CET	1.1.1.1	192.168.2.6	0x19b5	Name error (3)	heardbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.876271963 CET	1.1.1.1	192.168.2.6	0x968	Name error (3)	difficultinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:02.912797928 CET	1.1.1.1	192.168.2.6	0xdf5a	Name error (3)	heardinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:03.117065907 CET	1.1.1.1	192.168.2.6	0x5c09	No error (0)	pleasantinstead.net		18.143.155.63	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.238532066 CET	1.1.1.1	192.168.2.6	0x4447	Name error (3)	necessaryinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.270049095 CET	1.1.1.1	192.168.2.6	0x9226	Name error (3)	pleasantexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.330167055 CET	1.1.1.1	192.168.2.6	0x5d6d	Name error (3)	necessaryexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.343450069 CET	1.1.1.1	192.168.2.6	0x2630	Name error (3)	pleasantbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.376176119 CET	1.1.1.1	192.168.2.6	0x2ec1	Name error (3)	necessarybright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.387470007 CET	1.1.1.1	192.168.2.6	0xf397	Name error (3)	pleasantinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.398643017 CET	1.1.1.1	192.168.2.6	0x7d32	Name error (3)	necessaryinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.430944920 CET	1.1.1.1	192.168.2.6	0x5a85	Name error (3)	orderinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.441553116 CET	1.1.1.1	192.168.2.6	0x7536	Name error (3)	requireinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.452076912 CET	1.1.1.1	192.168.2.6	0x4180	Name error (3)	orderexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.463351965 CET	1.1.1.1	192.168.2.6	0x4e14	Name error (3)	requireexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.474698067 CET	1.1.1.1	192.168.2.6	0xb295	Name error (3)	orderbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.486880064 CET	1.1.1.1	192.168.2.6	0x92d5	Name error (3)	requirebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.498019934 CET	1.1.1.1	192.168.2.6	0x52d1	Name error (3)	orderinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.507431030 CET	1.1.1.1	192.168.2.6	0x1f6f	Name error (3)	requireinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.520091057 CET	1.1.1.1	192.168.2.6	0x9f60	Name error (3)	leaderinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.530713081 CET	1.1.1.1	192.168.2.6	0x842c	Name error (3)	heaveninstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.540957928 CET	1.1.1.1	192.168.2.6	0x62b6	Name error (3)	leaderexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.572529078 CET	1.1.1.1	192.168.2.6	0xe965	Name error (3)	heavenexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.583734035 CET	1.1.1.1	192.168.2.6	0x5c7b	Name error (3)	leaderbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.594752073 CET	1.1.1.1	192.168.2.6	0xf365	Name error (3)	heavenbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.605401039 CET	1.1.1.1	192.168.2.6	0xfa57	Name error (3)	leaderinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.618357897 CET	1.1.1.1	192.168.2.6	0xf032	Name error (3)	heaveninside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.666467905 CET	1.1.1.1	192.168.2.6	0xa621	Name error (3)	heavyinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.674981117 CET	1.1.1.1	192.168.2.6	0xcb31	Name error (3)	gentleinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.706729889 CET	1.1.1.1	192.168.2.6	0x8e69	Name error (3)	heavyexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.717257977 CET	1.1.1.1	192.168.2.6	0x878a	Name error (3)	gentleexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.729911089 CET	1.1.1.1	192.168.2.6	0x109e	Name error (3)	heavybright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.761569977 CET	1.1.1.1	192.168.2.6	0x3a7a	Name error (3)	gentlebright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.772382975 CET	1.1.1.1	192.168.2.6	0xd915	Name error (3)	heavyinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.784383059 CET	1.1.1.1	192.168.2.6	0xb03f	Name error (3)	gentleinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.794369936 CET	1.1.1.1	192.168.2.6	0xf7f9	Name error (3)	variousinstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.826064110 CET	1.1.1.1	192.168.2.6	0x8e75	Name error (3)	returninstead.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.836395025 CET	1.1.1.1	192.168.2.6	0x9ff8	Name error (3)	variousexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.846688032 CET	1.1.1.1	192.168.2.6	0x6758	Name error (3)	returnexplain.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.920953035 CET	1.1.1.1	192.168.2.6	0x210d	Name error (3)	variousbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:05.991071939 CET	1.1.1.1	192.168.2.6	0x566a	Name error (3)	returnbright.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.007891893 CET	1.1.1.1	192.168.2.6	0x9596	Name error (3)	variousinside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.024072886 CET	1.1.1.1	192.168.2.6	0x7c62	Name error (3)	returninside.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.037777901 CET	1.1.1.1	192.168.2.6	0xf89	Name error (3)	degreeready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.076098919 CET	1.1.1.1	192.168.2.6	0x5ec6	Name error (3)	forwardready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.133517981 CET	1.1.1.1	192.168.2.6	0x5735	Name error (3)	degreebrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.165941000 CET	1.1.1.1	192.168.2.6	0x2db8	Name error (3)	forwardbrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.195358992 CET	1.1.1.1	192.168.2.6	0x7149	Name error (3)	degreepeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.206001997 CET	1.1.1.1	192.168.2.6	0xd749	Name error (3)	forwardpeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:06.298192978 CET	1.1.1.1	192.168.2.6	0x919e	No error (0)	degreedaughter.net		85.214.228.140	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.350570917 CET	1.1.1.1	192.168.2.6	0xde9c	Name error (3)	forwarddaughter.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.362273932 CET	1.1.1.1	192.168.2.6	0xb71f	Name error (3)	answerready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.373131990 CET	1.1.1.1	192.168.2.6	0x88c4	Name error (3)	glassready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.381449938 CET	1.1.1.1	192.168.2.6	0xc457	Name error (3)	answerbrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.393147945 CET	1.1.1.1	192.168.2.6	0x66dd	Name error (3)	glassbrown.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.553627968 CET	1.1.1.1	192.168.2.6	0x5e4f	Name error (3)	answerpeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.565201998 CET	1.1.1.1	192.168.2.6	0x7f33	Name error (3)	glasspeople.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.597084045 CET	1.1.1.1	192.168.2.6	0x1f6f	Name error (3)	answerdaughter.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.609004021 CET	1.1.1.1	192.168.2.6	0x14f4	Name error (3)	glassdaughter.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.620984077 CET	1.1.1.1	192.168.2.6	0xcd4	Name error (3)	difficultready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:42:07.631449938 CET	1.1.1.1	192.168.2.6	0x92b8	Name error (3)	heardready.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:14.125332117 CET	1.1.1.1	192.168.2.6	0x77fc	Name error (3)	heavenstream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:15.150748968 CET	1.1.1.1	192.168.2.6	0xd6fd	Name error (3)	leadernothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:16.252557993 CET	1.1.1.1	192.168.2.6	0x7b8f	Name error (3)	heavennothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:17.276210070 CET	1.1.1.1	192.168.2.6	0xdd23	Name error (3)	leaderbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:18.447458982 CET	1.1.1.1	192.168.2.6	0xfde	Name error (3)	heavenbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:18.447485924 CET	1.1.1.1	192.168.2.6	0xfde	Name error (3)	heavenbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:19.505630970 CET	1.1.1.1	192.168.2.6	0xd6f6	Name error (3)	leaderdivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:19.506145954 CET	1.1.1.1	192.168.2.6	0xd6f6	Name error (3)	leaderdivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:20.526391029 CET	1.1.1.1	192.168.2.6	0xccae	Name error (3)	heavendivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:21.629300117 CET	1.1.1.1	192.168.2.6	0x9cf9	Name error (3)	heavystream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:22.651343107 CET	1.1.1.1	192.168.2.6	0x44cf	Name error (3)	gentlestream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:23.667277098 CET	1.1.1.1	192.168.2.6	0x582	Name error (3)	heavynothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:24.874732971 CET	1.1.1.1	192.168.2.6	0x9426	Name error (3)	gentlenothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:24.874749899 CET	1.1.1.1	192.168.2.6	0x9426	Name error (3)	gentlenothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:25.916416883 CET	1.1.1.1	192.168.2.6	0xa933	Name error (3)	heavybottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:26.929193974 CET	1.1.1.1	192.168.2.6	0xca77	Name error (3)	gentlebottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:27.969069958 CET	1.1.1.1	192.168.2.6	0x2480	Name error (3)	heavydivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:27.975379944 CET	1.1.1.1	192.168.2.6	0x2480	Name error (3)	heavydivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:28.995719910 CET	1.1.1.1	192.168.2.6	0xf7e2	Name error (3)	gentledivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:31.744566917 CET	1.1.1.1	192.168.2.6	0x3751	Name error (3)	returnstream.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:32.760966063 CET	1.1.1.1	192.168.2.6	0xe96d	Name error (3)	variousnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:33.909955978 CET	1.1.1.1	192.168.2.6	0x6ea7	Name error (3)	returnnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:33.909981012 CET	1.1.1.1	192.168.2.6	0x6ea7	Name error (3)	returnnothing.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:34.953933001 CET	1.1.1.1	192.168.2.6	0x122	Name error (3)	variousbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:34.959440947 CET	1.1.1.1	192.168.2.6	0x122	Name error (3)	variousbottle.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:38.581660986 CET	1.1.1.1	192.168.2.6	0x7c35	Name error (3)	variousdivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:39.603759050 CET	1.1.1.1	192.168.2.6	0xe0f2	Name error (3)	returndivide.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:40.619654894 CET	1.1.1.1	192.168.2.6	0x12e	Name error (3)	degreemanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:41.632752895 CET	1.1.1.1	192.168.2.6	0x8d14	Name error (3)	forwardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:42.674387932 CET	1.1.1.1	192.168.2.6	0x847b	Name error (3)	degreeanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:42.679236889 CET	1.1.1.1	192.168.2.6	0x847b	Name error (3)	degreeanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:43.720408916 CET	1.1.1.1	192.168.2.6	0x2f5a	Name error (3)	forwardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:43.725275993 CET	1.1.1.1	192.168.2.6	0x2f5a	Name error (3)	forwardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:44.765461922 CET	1.1.1.1	192.168.2.6	0xccce	Name error (3)	degreebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:44.771636963 CET	1.1.1.1	192.168.2.6	0xccce	Name error (3)	degreebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:45.812875986 CET	1.1.1.1	192.168.2.6	0xfec3	Name error (3)	forwardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:45.819344044 CET	1.1.1.1	192.168.2.6	0xfec3	Name error (3)	forwardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:46.838902950 CET	1.1.1.1	192.168.2.6	0xd05f	Name error (3)	degreeappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:47.923378944 CET	1.1.1.1	192.168.2.6	0x7e49	Name error (3)	forwardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:49.074929953 CET	1.1.1.1	192.168.2.6	0xbdab	Name error (3)	answermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:50.078346968 CET	1.1.1.1	192.168.2.6	0xec06	Name error (3)	glassmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:50.085731030 CET	1.1.1.1	192.168.2.6	0xec06	Name error (3)	glassmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:51.025511026 CET	1.1.1.1	192.168.2.6	0xbdfe	Name error (3)	answeranother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:52.094109058 CET	1.1.1.1	192.168.2.6	0x2956	Name error (3)	glassanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:52.094227076 CET	1.1.1.1	192.168.2.6	0x2956	Name error (3)	glassanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:52.999736071 CET	1.1.1.1	192.168.2.6	0xbc04	Name error (3)	answerbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:53.006853104 CET	1.1.1.1	192.168.2.6	0xbc04	Name error (3)	answerbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:53.869788885 CET	1.1.1.1	192.168.2.6	0x654d	Name error (3)	glassbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:54.698144913 CET	1.1.1.1	192.168.2.6	0x3511	Name error (3)	answerappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.585814953 CET	1.1.1.1	192.168.2.6	0x7194	Name error (3)	glassappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.616806030 CET	1.1.1.1	192.168.2.6	0x4232	Name error (3)	difficultmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.616846085 CET	1.1.1.1	192.168.2.6	0x4232	Name error (3)	difficultmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.627713919 CET	1.1.1.1	192.168.2.6	0xd012	Name error (3)	heardmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.638164997 CET	1.1.1.1	192.168.2.6	0x87d	Name error (3)	difficultanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.648478985 CET	1.1.1.1	192.168.2.6	0xc059	Name error (3)	heardanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.659259081 CET	1.1.1.1	192.168.2.6	0xe004	Name error (3)	difficultbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.670146942 CET	1.1.1.1	192.168.2.6	0x1b2b	Name error (3)	heardbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.681123018 CET	1.1.1.1	192.168.2.6	0xb398	Name error (3)	difficultappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.713984966 CET	1.1.1.1	192.168.2.6	0x4a8b	Name error (3)	heardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.714024067 CET	1.1.1.1	192.168.2.6	0x4a8b	Name error (3)	heardappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.724735022 CET	1.1.1.1	192.168.2.6	0xd4c9	Name error (3)	pleasantmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.736336946 CET	1.1.1.1	192.168.2.6	0x7f95	Name error (3)	necessarymanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.768152952 CET	1.1.1.1	192.168.2.6	0xf553	Name error (3)	pleasantanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.771770954 CET	1.1.1.1	192.168.2.6	0xf553	Name error (3)	pleasantanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.777060986 CET	1.1.1.1	192.168.2.6	0xa6eb	Name error (3)	necessaryanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.788003922 CET	1.1.1.1	192.168.2.6	0x737f	Name error (3)	pleasantbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.820233107 CET	1.1.1.1	192.168.2.6	0x7427	Name error (3)	necessarybusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.820415020 CET	1.1.1.1	192.168.2.6	0x7427	Name error (3)	necessarybusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.832729101 CET	1.1.1.1	192.168.2.6	0x5f8d	Name error (3)	pleasantappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.843116045 CET	1.1.1.1	192.168.2.6	0x8517	Name error (3)	necessaryappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.851432085 CET	1.1.1.1	192.168.2.6	0x5ad8	Name error (3)	ordermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.884104013 CET	1.1.1.1	192.168.2.6	0x395c	Name error (3)	requiremanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.884135008 CET	1.1.1.1	192.168.2.6	0x395c	Name error (3)	requiremanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.894056082 CET	1.1.1.1	192.168.2.6	0x1fa3	Name error (3)	orderanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.926999092 CET	1.1.1.1	192.168.2.6	0xfcdd	Name error (3)	requireanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.928174019 CET	1.1.1.1	192.168.2.6	0xfcdd	Name error (3)	requireanother.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.938483953 CET	1.1.1.1	192.168.2.6	0x4269	Name error (3)	orderbusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.948695898 CET	1.1.1.1	192.168.2.6	0xe9e3	Name error (3)	requirebusiness.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.981246948 CET	1.1.1.1	192.168.2.6	0x892c	Name error (3)	orderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:55.981264114 CET	1.1.1.1	192.168.2.6	0x892c	Name error (3)	orderappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:56.013346910 CET	1.1.1.1	192.168.2.6	0x1e2d	Name error (3)	requireappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:56.013364077 CET	1.1.1.1	192.168.2.6	0x1e2d	Name error (3)	requireappear.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:56.023665905 CET	1.1.1.1	192.168.2.6	0x32d0	Name error (3)	leadermanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:56.033694029 CET	1.1.1.1	192.168.2.6	0x88d9	Name error (3)	heavenmanner.net	none	none	A (IP address)	IN (0x0001)	false
Nov 7, 2024 15:43:56.044936895 CET	1.1.1.1	192.168.2.6	0x69cd	Name error (3)	leaderanother.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

variousstream.net

returnbottle.net

gentleanother.net

glassbright.net

pleasantinstead.net

degreedaughter.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	61162	199.59.243.227	80	6216	C:\daxjjwrfm\qbpabupgx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:41:54.850847960 CET	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: variousstream.net
Nov 7, 2024 15:41:55.658045053 CET	1236	IN	HTTP/1.1 200 OK date: Thu, 07 Nov 2024 14:41:55 GMT content-type: text/html; charset=utf-8 content-length: 1066 x-request-id: 13cfa952-6027-4e59-bcfe-bc6ea3f00c47 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ== set-cookie: parking_session=13cfa952-6027-4e59-bcfe-bc6ea3f00c47; expires=Thu, 07 Nov 2024 14:56:55 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 53 48 57 78 4b 61 44 77 6f 44 6f 77 66 36 4c 4b 38 37 48 37 43 67 61 6e 64 75 64 43 5a 44 6d 51 47 5a 44 66 75 6c 48 7a 46 33 2b 71 61 37 37 57 52 36 7a 53 41 4f 70 32 47 6e 6f 6d 44 4b 45 7a 61 45 62 64 50 67 46 4f 47 31 48 77 38 41 67 68 7a 4e 4e 74 45 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 7, 2024 15:41:55.658428907 CET	519	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTNjZmE5NTItNjAyNy00ZTU5LWJjZmUtYmM2ZWEzZjAwYzQ3IiwicGFnZV90aW1lIjoxNzMwOTkwNT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	61164	18.143.155.63	80	6216	C:\daxjjwrfm\qbpabupgx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:41:55.917365074 CET	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnbottle.net
Nov 7, 2024 15:41:57.377079010 CET	387	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:41:57 GMT Content-Type: text/html Connection: close Set-Cookie: btst=cd2635dbd9d522f28e306e5768c6e0c3\|173.254.250.79\|1730990517\|1730990517\|0\|1\|0; path=/; domain=.returnbottle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	61185	54.244.188.177	80	6216	C:\daxjjwrfm\qbpabupgx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:41:59.847522974 CET	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: gentleanother.net
Nov 7, 2024 15:42:00.718555927 CET	388	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:42:00 GMT Content-Type: text/html Connection: close Set-Cookie: btst=509ee42c23247409006dd0ed2b8d1eeb\|173.254.250.79\|1730990520\|1730990520\|0\|1\|0; path=/; domain=.gentleanother.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	61196	199.59.243.227	80	6216	C:\daxjjwrfm\qbpabupgx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:42:01.814074039 CET	82	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: glassbright.net
Nov 7, 2024 15:42:02.470746994 CET	1236	IN	HTTP/1.1 200 OK date: Thu, 07 Nov 2024 14:42:01 GMT content-type: text/html; charset=utf-8 content-length: 1062 x-request-id: b6dd4001-c41a-44db-a809-2b71c3a0bde1 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_s1OLzxnUOnEH716kBpk/hwkQW3g8J3psjBCQ57GUAZtZS2F4eueKl4iEoqmB9qt7hkS99NIC/yKfNwi3+MVPyg== set-cookie: parking_session=b6dd4001-c41a-44db-a809-2b71c3a0bde1; expires=Thu, 07 Nov 2024 14:57:02 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 73 31 4f 4c 7a 78 6e 55 4f 6e 45 48 37 31 36 6b 42 70 6b 2f 68 77 6b 51 57 33 67 38 4a 33 70 73 6a 42 43 51 35 37 47 55 41 5a 74 5a 53 32 46 34 65 75 65 4b 6c 34 69 45 6f 71 6d 42 39 71 74 37 68 6b 53 39 39 4e 49 43 2f 79 4b 66 4e 77 69 33 2b 4d 56 50 79 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_s1OLzxnUOnEH716kBpk/hwkQW3g8J3psjBCQ57GUAZtZS2F4eueKl4iEoqmB9qt7hkS99NIC/yKfNwi3+MVPyg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 7, 2024 15:42:02.470777035 CET	515	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYjZkZDQwMDEtYzQxYS00NGRiLWE4MDktMmI3MWMzYTBiZGUxIiwicGFnZV90aW1lIjoxNzMwOTkwNT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	61201	18.143.155.63	80	6216	C:\daxjjwrfm\qbpabupgx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:42:03.299684048 CET	86	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: pleasantinstead.net
Nov 7, 2024 15:42:04.784287930 CET	390	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:42:04 GMT Content-Type: text/html Connection: close Set-Cookie: btst=77c86db442ef3f4a34723b9933944f7a\|173.254.250.79\|1730990524\|1730990524\|0\|1\|0; path=/; domain=.pleasantinstead.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	61213	85.214.228.140	80	6216	C:\daxjjwrfm\qbpabupgx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:42:06.453412056 CET	85	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: degreedaughter.net
Nov 7, 2024 15:42:07.339715004 CET	176	IN	HTTP/1.0 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 07 Nov 2024 14:42:07 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	54124	199.59.243.227	80	3708	C:\daxjjwrfm\qbpabupgx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:43:30.006602049 CET	84	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: variousstream.net
Nov 7, 2024 15:43:30.690996885 CET	1236	IN	HTTP/1.1 200 OK date: Thu, 07 Nov 2024 14:43:30 GMT content-type: text/html; charset=utf-8 content-length: 1066 x-request-id: 10bb1350-d489-4482-86a2-e3d1bf3db72c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ== set-cookie: parking_session=10bb1350-d489-4482-86a2-e3d1bf3db72c; expires=Thu, 07 Nov 2024 14:58:30 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 53 48 57 78 4b 61 44 77 6f 44 6f 77 66 36 4c 4b 38 37 48 37 43 67 61 6e 64 75 64 43 5a 44 6d 51 47 5a 44 66 75 6c 48 7a 46 33 2b 71 61 37 37 57 52 36 7a 53 41 4f 70 32 47 6e 6f 6d 44 4b 45 7a 61 45 62 64 50 67 46 4f 47 31 48 77 38 41 67 68 7a 4e 4e 74 45 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 7, 2024 15:43:30.691035032 CET	519	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTBiYjEzNTAtZDQ4OS00NDgyLTg2YTItZTNkMWJmM2RiNzJjIiwicGFnZV90aW1lIjoxNzMwOTkwNj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	54125	18.143.155.63	80	3708	C:\daxjjwrfm\qbpabupgx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 15:43:36.113943100 CET	83	OUT	GET /index.php HTTP/1.0 Accept: / Connection: close Host: returnbottle.net
Nov 7, 2024 15:43:37.556240082 CET	387	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 07 Nov 2024 14:43:37 GMT Content-Type: text/html Connection: close Set-Cookie: btst=a89907aea6476eb1005333d55caab224\|173.254.250.79\|1730990617\|1730990617\|0\|1\|0; path=/; domain=.returnbottle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT

Target ID:	0
Start time:	09:41:48
Start date:	07/11/2024
Path:	C:\Users\user\Desktop\66HKNPT1fl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\66HKNPT1fl.exe"
Imagebase:	0x360000
File size:	248'320 bytes
MD5 hash:	F0D9A1E7385ED0EA2ECE3D30915163D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:41:49
Start date:	07/11/2024
Path:	C:\daxjjwrfm\ew4bjmdlid9hjn8.exe
Wow64 process (32bit):	true
Commandline:	"C:\daxjjwrfm\ew4bjmdlid9hjn8.exe"
Imagebase:	0x50000
File size:	248'320 bytes
MD5 hash:	F0D9A1E7385ED0EA2ECE3D30915163D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:41:49
Start date:	07/11/2024
Path:	C:\daxjjwrfm\qbpabupgx.exe
Wow64 process (32bit):	true
Commandline:	C:\daxjjwrfm\qbpabupgx.exe
Imagebase:	0xc20000
File size:	248'320 bytes
MD5 hash:	F0D9A1E7385ED0EA2ECE3D30915163D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:41:50
Start date:	07/11/2024
Path:	C:\daxjjwrfm\tkjnbticppc.exe
Wow64 process (32bit):	true
Commandline:	mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe"
Imagebase:	0xa0000
File size:	248'320 bytes
MD5 hash:	F0D9A1E7385ED0EA2ECE3D30915163D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:41:51
Start date:	07/11/2024
Path:	C:\daxjjwrfm\qbpabupgx.exe
Wow64 process (32bit):	true
Commandline:	"C:\daxjjwrfm\qbpabupgx.exe"
Imagebase:	0xc20000
File size:	248'320 bytes
MD5 hash:	F0D9A1E7385ED0EA2ECE3D30915163D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:43:09
Start date:	07/11/2024
Path:	C:\daxjjwrfm\qbpabupgx.exe
Wow64 process (32bit):	true
Commandline:	"c:\daxjjwrfm\qbpabupgx.exe"
Imagebase:	0xc20000
File size:	248'320 bytes
MD5 hash:	F0D9A1E7385ED0EA2ECE3D30915163D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:43:10
Start date:	07/11/2024
Path:	C:\daxjjwrfm\tkjnbticppc.exe
Wow64 process (32bit):	true
Commandline:	mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe"
Imagebase:	0x100000
File size:	248'320 bytes
MD5 hash:	F0D9A1E7385ED0EA2ECE3D30915163D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	51.6%
Total number of Nodes:	1932
Total number of Limit Nodes:	18

Executed Functions

Function 003700C8 Relevance: 56.1, APIs: 29, Strings: 2, Instructions: 1861sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 003703F9
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00370427
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0037046A
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00370496
GetTickCount.KERNEL32 ref: 00370587
GetCommandLineA.KERNEL32 ref: 0037063E
Sleep.KERNEL32(000003E8), ref: 00370CDF

Part of subcall function 0036B150: CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0036B1D7

Sleep.KERNEL32(00000D05), ref: 00370BD2

Part of subcall function 0036B150: GetFileTime.KERNEL32(00000000,?,?,?), ref: 0036B256
Part of subcall function 0036B150: CloseHandle.KERNEL32(00000000), ref: 0036B26B

Sleep.KERNEL32(000007D0), ref: 00370DD1
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00370EA8
SetFileAttributesA.KERNEL32(?,00000080), ref: 00370ECC
CopyFileA.KERNEL32(?,?,00000000), ref: 00370EFE
SetFileAttributesA.KERNEL32(?,00000002), ref: 003710B9
SetFileAttributesA.KERNEL32(?,00000080), ref: 003710E7
GetCommandLineA.KERNEL32(00000000), ref: 0037120E
GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 0037132B

Part of subcall function 00372290: lstrlen.KERNEL32(?), ref: 003722A2
Part of subcall function 00372290: CharLowerBuffA.USER32(?,00000000), ref: 003722BE

MessageBoxA.USER32(00000000,00000004,00000005,00000000), ref: 00371663

Part of subcall function 003672E0: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00367452

CloseHandle.KERNEL32(00000000), ref: 00371AC5
SetFileAttributesA.KERNEL32(?,00000080), ref: 00371AE1
CopyFileA.KERNEL32(?,?,00000000), ref: 00371B07
SetFileAttributesA.KERNEL32(?,00000002), ref: 00371B43
Sleep.KERNEL32(000003E8), ref: 00371CAC
WSAStartup.WS2_32(00000202,?), ref: 00371947

Part of subcall function 00382780: ExitProcess.KERNEL32 ref: 003827B0

Sleep.KERNEL32(000007D0), ref: 00371DFC
SetFileAttributesA.KERNEL32(003A6680,00000080), ref: 00371E27
CopyFileA.KERNEL32(?,003A6680,00000000), ref: 00371E45
SetFileAttributesA.KERNEL32(003A6680,00000002), ref: 00371E7B

Part of subcall function 0038C080: Sleep.KERNEL32(000003E8), ref: 0038C1C3

Part of subcall function 0036BBA0: wvsprintfA.USER32(00000000,?,003809D1), ref: 0036BBEB

CreateThread.KERNEL32(00000000,00000000,Function_0002FE10,00000000,00000000,00000000), ref: 00372194
Sleep.KERNEL32(0000C350), ref: 00372210

Strings

C:\Users\user, xrefs: 003703F3
x7;C, xrefs: 00370C47

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: File$AttributesSleep$Create$CopyMutex$CloseCommandHandleLineModuleName$BuffCharCountEnvironmentExitLowerMessageProcessStartupThreadTickTimeVariablelstrlenwvsprintf
String ID: C:\Users\user$x7;C
API String ID: 1500488346-3147083300
Opcode ID: b5e2e2979dbb7beb24ba365ab71441c79239ebc73a4ecaa6162e691b2e9f4ea1
Instruction ID: c701f8f9de7c62fc00a0b8effdee3f7868e1c0609e66772defc6698373696cb9
Opcode Fuzzy Hash: b5e2e2979dbb7beb24ba365ab71441c79239ebc73a4ecaa6162e691b2e9f4ea1
Instruction Fuzzy Hash: 7203FF76A10200CFD71BDF68ED92A6A77BDFB96300F04812AE406CB2B5E7799941CF51

Function 00372490 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 918
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(003AEAC8), ref: 00372572
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 003726EF
DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00372843
RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 0037289F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0037293F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003729E1
CreateDirectoryA.KERNEL32(?,00000000), ref: 00372CAC
CreateDirectoryA.KERNEL32(?,00000000), ref: 00372D6E
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00372EB0
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0037307B
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 003731FA
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 0037344D

Strings

C:\Users\user, xrefs: 00372B0A, 00372BCC
Wq0O, xrefs: 00372FE3
C:\daxjjwrfm\, xrefs: 00372960, 00372CC9, 00373032, 0037321C
\, xrefs: 00372F41

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\daxjjwrfm\$Wq0O$\
API String ID: 1691758827-149769076
Opcode ID: a4c3dba0503179f5da3ec809ff52adde025eaa0de62205d024280e693be8cb7d
Instruction ID: dd89c378a1b4d8366f69426044dadfe87d270923949190b6d10dc6e7962612ec
Opcode Fuzzy Hash: a4c3dba0503179f5da3ec809ff52adde025eaa0de62205d024280e693be8cb7d
Instruction Fuzzy Hash: E28225B1A00205CFD71BDF28ED82AA677BDFB56710F00812BE406CB2B5E77A9941CB51

Function 003660A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003640B0: lstrlen.KERNEL32(?,?,00361038,?), ref: 003640DD

Sleep.KERNELBASE(000003E8), ref: 00366189
FindFirstFileA.KERNELBASE(?,?), ref: 00366274
DeleteFileA.KERNELBASE(?), ref: 0036632E
FindNextFileA.KERNELBASE(?,?), ref: 00366384
FindClose.KERNEL32(?), ref: 003663AA

Strings

xsh, xrefs: 00366159, 00366169

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleeplstrlen
String ID: xsh
API String ID: 3282225923-3135071692
Opcode ID: baec97785920ce0e83f699ee0cab5ecddd222c302950ac1f3686fb92f114ece4
Instruction ID: b440c16b86fff2e600dd81668c850555c3f2a32c942d35467b2a0a9b4de5975f
Opcode Fuzzy Hash: baec97785920ce0e83f699ee0cab5ecddd222c302950ac1f3686fb92f114ece4
Instruction Fuzzy Hash: 8581F2769002049FC71BDF69FD92AA677BDFB96300F14815AE5058B2B4EB718901CF91

Function 0037C520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,N9,?,00390A4E,00000000), ref: 0037C549
RtlFreeHeap.NTDLL(00000000,?,00390A4E,00000000), ref: 0037C550

Strings

N9, xrefs: 0037C543, 0037C546

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: N9
API String ID: 3859560861-548346202
Opcode ID: 0bdcfda5a92a96577431a022c01f6eb69b1da55988a4468abf92151e38319334
Instruction ID: cec4e0bea898af2b315ec70cc75e55148258bf87f0de7ca8f33e84cfedb97e8a
Opcode Fuzzy Hash: 0bdcfda5a92a96577431a022c01f6eb69b1da55988a4468abf92151e38319334
Instruction Fuzzy Hash: 05F065719182049FD7169F59EC9A66637FCEB06714F00440EE509C7620D779E880CB55

Function 00383060 Relevance: 4.8, APIs: 3, Instructions: 287
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0038327A
WriteFile.KERNELBASE(?,?,00005000,00005000,00000000), ref: 0038344B
CloseHandle.KERNELBASE(?), ref: 003834DA

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: cf33735b4229e4e164d585e2988553bbe8485de1f7114ca94d95a3c1a983b44c
Instruction ID: 576067a3a8c262d9f1ccc4aeb2019d4ad050c2c442995ae95b4f237092430ec1
Opcode Fuzzy Hash: cf33735b4229e4e164d585e2988553bbe8485de1f7114ca94d95a3c1a983b44c
Instruction Fuzzy Hash: A8C1CE76A206108BC307EF68FC9166A73EDF796721F14811BE806CB375E7759941CB84

Function 0038C640 Relevance: 4.6, APIs: 3, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00372591,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00372591), ref: 0038C701
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 0038C737
FreeSid.ADVAPI32(?), ref: 0038C798

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 4b58aaceb8e03f3d2f98019dc76eecfa42c6ebfa2ed02e40377a19fcfb7e53d4
Instruction ID: ac1d306f297dd869521ab9a6c95bf97b3ef3db3496423eed4a112cf275bc02c8
Opcode Fuzzy Hash: 4b58aaceb8e03f3d2f98019dc76eecfa42c6ebfa2ed02e40377a19fcfb7e53d4
Instruction Fuzzy Hash: 3941BC3AA14244DFD70ADF68FD96A6A7BBDFB59300F14819BE502C7261E732A940CF11

Function 0037B744 Relevance: .2, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822355a58be36f77c90a0eb18d5124c0b3500a77cea8537c00434e0f990d4af1
Instruction ID: fd0ec06597504b0807be3774043ebd9ba7871810ad5c702e50b0c769bd39ba20
Opcode Fuzzy Hash: 822355a58be36f77c90a0eb18d5124c0b3500a77cea8537c00434e0f990d4af1
Instruction Fuzzy Hash: 16C176366252418BC34BCF29FE9252577FDFB9A721B10912FE402CB2B0E77A9941CB45

Function 0038A760 Relevance: 10.8, APIs: 7, Instructions: 266
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,000000FF), ref: 0038A7F1
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,?,?,000000FF), ref: 0038A849
CloseHandle.KERNELBASE(00000000,?,?,000000FF), ref: 0038A885
GetTickCount.KERNEL32 ref: 0038A8B8
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0038AA75
WriteFile.KERNELBASE(00000000,000000FF,?,?,00000000), ref: 0038AAC8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0038AAE2

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID:
API String ID: 3478262135-0
Opcode ID: a126c1cfb3382584c7562ff15d8cd0833ff61f576336617639d72772b1b5210e
Instruction ID: c3a28f945f0f045c22cc0edb6effa13e29d485c3f8910ee19860d61e12869ff9
Opcode Fuzzy Hash: a126c1cfb3382584c7562ff15d8cd0833ff61f576336617639d72772b1b5210e
Instruction Fuzzy Hash: 95A101756016109FE307DF28ED82B7A33BDEB8A711F04401BE805CB3A4E7799981CB96

Function 003838B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000008,00000000,00000000,?,00000000,?,?,?,?,?,00000000), ref: 00383A0F
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00383A3E
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00383A52

Strings

D, xrefs: 003839D3

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 66f64cd663b83afa75fe3f315b5e5c5e09b05c334676a32ebf24166ecb77916e
Instruction ID: a3182b0cf54eca5a13f6e2ca99565c2eb7c437920d79da6eaec689cfd63e4102
Opcode Fuzzy Hash: 66f64cd663b83afa75fe3f315b5e5c5e09b05c334676a32ebf24166ecb77916e
Instruction Fuzzy Hash: E141E1719013149FDB0ADF58ED92B6937BDFB59B01F00801FE506DB2A4D3B6A944CB85

Function 00376F00 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00379195,021A1850,?,?,?,?,?,00386DD6), ref: 00376F59
RtlAllocateHeap.NTDLL(00000000,?,00379195,021A1850,?,?,?,?,?,00386DD6), ref: 00376F60

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: a3f67ff6c9ba618495027bf11a9b310bb39f3dbce8b018d93a3d5a4617d230e1
Instruction ID: 984033b22d3fa75d6408c598e52d9a64186a6ec008696087837e5e0ded43c613
Opcode Fuzzy Hash: a3f67ff6c9ba618495027bf11a9b310bb39f3dbce8b018d93a3d5a4617d230e1
Instruction Fuzzy Hash: 2DF0EC31514B008BCB0ADB69FD9AB2637EDFB56741F044015F506CB670E6B69400C7D8

Function 00372290 Relevance: 3.0, APIs: 2, Instructions: 21
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 003722A2
CharLowerBuffA.USER32(?,00000000), ref: 003722BE

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 72335287d71dc4b9f457fb1932e0392ce546bd5dab9398197f9ed4473836fa89
Instruction ID: 9bc8f926e9f098101d90408f4e2da28535239c93ca17f14634aef0d21751a3e6
Opcode Fuzzy Hash: 72335287d71dc4b9f457fb1932e0392ce546bd5dab9398197f9ed4473836fa89
Instruction Fuzzy Hash: E5E0DF721105209B83029F98FC4D0F533ECFB06B02F080056E54AC21B0EB2C18418390

Function 00386D32 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003620E0: GetStdHandle.KERNEL32(000000F6,?,?,00386D5F), ref: 00362113
Part of subcall function 003620E0: GetStdHandle.KERNEL32(000000F5,?,?,00386D5F), ref: 00362145
Part of subcall function 003620E0: GetStdHandle.KERNEL32(000000F4,?,?,00386D5F), ref: 00362198

ExitProcess.KERNEL32 ref: 00386E44

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Handle$ExitProcess
String ID:
API String ID: 256993070-0
Opcode ID: acedba22cae698224e0f9b84c58c5268157da7399c4f7653fd47b1ace864aa93
Instruction ID: c8c68a07d78819d8b7c6daeed8cc2d4b719a71ca051854389a7fea115844cd14
Opcode Fuzzy Hash: acedba22cae698224e0f9b84c58c5268157da7399c4f7653fd47b1ace864aa93
Instruction Fuzzy Hash: D721BE26611A108BC707EF74FC9357933AEE756361B048516E811CFB69FB798541C741

Function 00382780 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 003827B0

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a855f3585cb902cf3fa6c7182a11f158660323ae65d372147c7390203fc4dd75
Instruction ID: 9acade4d406d9b2ae7818c1de21a9fb09ea4cb3eec77fa2e150504761f9e15cc
Opcode Fuzzy Hash: a855f3585cb902cf3fa6c7182a11f158660323ae65d372147c7390203fc4dd75
Instruction Fuzzy Hash: 05D052704203088AC702BF20FE86A22B7ACFB42700F00581AE8008F224F378E6828BD1

Non-executed Functions

Function 0038EEB0 Relevance: 33.7, APIs: 15, Strings: 4, Instructions: 444pipeprocessfileCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000,?,00000000,00000001), ref: 0038F00B
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0038F086
CreatePipe.KERNEL32(?,00000000,0000000C,00000000), ref: 0038F0A6
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0038F147
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 0038F2C2
CloseHandle.KERNEL32(00000000), ref: 0038F353
CloseHandle.KERNEL32(?), ref: 0038F367
CloseHandle.KERNEL32(00000000), ref: 0038F37B
CloseHandle.KERNEL32(00000000), ref: 0038F3A9
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0038F446
CloseHandle.KERNEL32(00000000), ref: 0038F4D4
CloseHandle.KERNEL32(00000000), ref: 0038F4E8
WaitForSingleObject.KERNEL32(?,00002710), ref: 0038F56B
CloseHandle.KERNEL32(?), ref: 0038F586
CloseHandle.KERNEL32(?), ref: 0038F5A7

Strings

<,]8, xrefs: 0038F2D1
D, xrefs: 0038F1D6
;8\w, xrefs: 0038F4FA
^K6, xrefs: 0038F522, 0038F5F1, 0038F541

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: ;8\w$<,]8$D$^K6
API String ID: 1130065513-1325849568
Opcode ID: 3453e0f68c4d3d56c2f701d455321675f3ba02e17525027e43db7ee7219a29a4
Instruction ID: 1e924aaece7910ed5dc888e9d78ecb444807a08767221dbd7e5eede86a2dafd6
Opcode Fuzzy Hash: 3453e0f68c4d3d56c2f701d455321675f3ba02e17525027e43db7ee7219a29a4
Instruction Fuzzy Hash: 5E12EF75A10205DFC70ADF68ED86AAA77BDFB9A310F14812BE802D76B4E7359940CB50

Function 003801B0 Relevance: 29.0, APIs: 10, Strings: 6, Instructions: 1003COMMON

Download Yara Rule

Strings

!|/0, xrefs: 00380AE8
@(l$, xrefs: 00380A8B, 00380A91
/, xrefs: 003803F1
SbJ, xrefs: 00380E0D
*c, xrefs: 00380F6B
'~(-, xrefs: 00380449

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Time$FileSystem__aulldivlstrlen
String ID: !|/0$'~(-$/$@(l$$SbJ$*c
API String ID: 3360920532-3188750162
Opcode ID: 50832009c85d1ec1e552eaf9e05e0f57de81bb2760414b8b160bd8f38ca84b5d
Instruction ID: 79bfa7d4a154a39276bd0e058f0f9c322c3eb9fb3c0c76fc8f9824beceb7cf7d
Opcode Fuzzy Hash: 50832009c85d1ec1e552eaf9e05e0f57de81bb2760414b8b160bd8f38ca84b5d
Instruction Fuzzy Hash: AA920571A103008FC70BEF28EC9267A77BDFB96310F10856BE406DB2A1EB759945CB91

Function 0038DB50 Relevance: 17.2, APIs: 11, Instructions: 662memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,00000000,00000001), ref: 0038DD1A
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000001), ref: 0038DDBB
GetProcAddress.KERNEL32(00000000,00000000), ref: 0038DE59
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0038DEBE
HeapAlloc.KERNEL32(0038D075,00000000,00000288,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0038DF03
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0038DF39
HeapFree.KERNEL32(0038D075,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0038DFDD
HeapAlloc.KERNEL32(0038D075,00000000,00000288,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0038E00E
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0038E035

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: FreeHeapLibrary$Alloc$AddressLoadProcProcess
String ID:
API String ID: 1582890587-0
Opcode ID: 6ef5fa86701c46b33f077c143db81111d2cdd81f0358836897eec378e8bbe09d
Instruction ID: c03af649f467a6fc02429444a9bf1c14668fb7bcf82c3f3387ae10dca91daed1
Opcode Fuzzy Hash: 6ef5fa86701c46b33f077c143db81111d2cdd81f0358836897eec378e8bbe09d
Instruction Fuzzy Hash: CB52EF76A103008FD30ADF29EC926AA77FCF75A321F10812BE806CB6B0E7759941CB51

Function 0038B7F0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 387processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 0038B8EC
Process32First.KERNEL32(00000000,00000128), ref: 0038BA96

Strings

9y8, xrefs: 0038BC13

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: 9y8
API String ID: 2353314856-3592070472
Opcode ID: 14b3eb4494bc944d8275f12f587aa1a5339f6a021b65d7fc7d51c39f3af81015
Instruction ID: d334749830518940b48d55a26da2a3246e5dcd93f127d5e2204554e92488833d
Opcode Fuzzy Hash: 14b3eb4494bc944d8275f12f587aa1a5339f6a021b65d7fc7d51c39f3af81015
Instruction Fuzzy Hash: 10F12172A102018BC71BDF29ED92A7A77FDFB96710F00815BE406CB2B4E7799981CB50

Function 00378200 Relevance: 13.7, APIs: 9, Instructions: 167serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 0037826F
CreateServiceA.ADVAPI32(00000000,00CA05B8,00CA05B8,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 003782CA
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00378301
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00378323
CloseServiceHandle.ADVAPI32(00000000), ref: 0037833A
OpenServiceA.ADVAPI32(00000000,00CA05B8,00000010), ref: 0037838B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 003783C2
CloseServiceHandle.ADVAPI32(00000000), ref: 00378408
CloseServiceHandle.ADVAPI32(00000000), ref: 00378481

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: e4d75b547a08841dd70ff02c5dacb064607dc2050fe1e04184243f38402a47dc
Instruction ID: 5de3b27aa9c380063431ca28f46b0d9d2fe4cc9a4c8ca30209f9e2c84d49e6cf
Opcode Fuzzy Hash: e4d75b547a08841dd70ff02c5dacb064607dc2050fe1e04184243f38402a47dc
Instruction Fuzzy Hash: F861CD716546119BD31BCB68FC8AB3637FCF746701F04911BE805C66B0EBB69881CB51

Function 0037D2C0 Relevance: 12.6, Strings: 8, Instructions: 2557COMMON

Download Yara Rule

Strings

l, xrefs: 0037F076
)0.N, xrefs: 0037FEEC
l, xrefs: 0037E35B
0, xrefs: 0037F5B1
.6<, xrefs: 0037D725
@~|Z, xrefs: 0037F1B6
l, xrefs: 0037F080
%, xrefs: 0037EF61

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: %$)0.N$.6<$0$@~|Z$l$l$l
API String ID: 0-3339051608
Opcode ID: fff5a9ed584ad8513e5d3631e67dce374d3af39581bec75c4d7ff3c1e1038dfa
Instruction ID: 48693ac155101630c6ba2c045778655b8e50499a81b55d39edbff8fa45ca6420
Opcode Fuzzy Hash: fff5a9ed584ad8513e5d3631e67dce374d3af39581bec75c4d7ff3c1e1038dfa
Instruction Fuzzy Hash: 9E43BA76A14201CFC72BCF28ED9266A77F9FB5A310F14812BD40ADB6B4E7399841CB45

Function 0038A050 Relevance: 7.8, APIs: 5, Instructions: 288serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,?,00000000,00000001), ref: 0038A124
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,0000000A,?,00000000,?,00000000,00000001), ref: 0038A164
GetLastError.KERNEL32(?,00000000,00000001), ref: 0038A176
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,-0000001A,0000000A,?,00000000,00000001), ref: 0038A24F

Part of subcall function 0036BBA0: wvsprintfA.USER32(00000000,?,003809D1), ref: 0036BBEB

CloseServiceHandle.ADVAPI32(00000000,00000001), ref: 0038A44C

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenServicewvsprintf
String ID:
API String ID: 475583450-0
Opcode ID: 127448c40db118124771fb1cb41b5c072340bbd44bec4bc04e3f8d8f7ae0a0c4
Instruction ID: 1ec75864f74c7df5578c78b7193522bcc19aadf5585857a80182f95572ea4df2
Opcode Fuzzy Hash: 127448c40db118124771fb1cb41b5c072340bbd44bec4bc04e3f8d8f7ae0a0c4
Instruction Fuzzy Hash: EBC1EF76A103009BD716DF69ED81A6AB7FDFBAA300F00812BE505DB2B0E7759941CB52

Function 003803B9 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

!|/0, xrefs: 00380AE8
/, xrefs: 003803F1
@(l$, xrefs: 00380A8B, 00380A91

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: !|/0$/$@(l$
API String ID: 0-3106747989
Opcode ID: 53cd9d213653e20acb6c64234554dd01c727141c7deb96893502311c6a3fe091
Instruction ID: 2ac8ed0ec6674f4857fdd51af72833bce6dc10a8396577a7c2c382da5e03e8d6
Opcode Fuzzy Hash: 53cd9d213653e20acb6c64234554dd01c727141c7deb96893502311c6a3fe091
Instruction Fuzzy Hash: 81022571A103008BD71BEF64EC92ABE77BDFB55310F10816BE4069B2A1EB759A45CF90

Function 0037C250 Relevance: 6.1, APIs: 4, Instructions: 148processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0037C312
Process32First.KERNEL32(00000000,?), ref: 0037C35A
Process32Next.KERNEL32(00000000,00000128), ref: 0037C478

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: d87760c14378a72e65a7b8630a33cc34d2ce4ff370c51ee4373ebe7f2b96a8e0
Instruction ID: bc0f4ceab7f327d6fd177a983a226057cf077fd80a728b6616e0d1386958b7b8
Opcode Fuzzy Hash: d87760c14378a72e65a7b8630a33cc34d2ce4ff370c51ee4373ebe7f2b96a8e0
Instruction Fuzzy Hash: 6C513375910211CFD727CF24FD95AA937BDFB86301F00841BE8469A6B4EB798940CF91

Function 00387BD0 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 591COMMON

Download Yara Rule

Strings

:rgN, xrefs: 00387D61

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: :rgN
API String ID: 0-1384114704
Opcode ID: 4d89211d69dd612edb2b703286179347e695e4870a78258eafc4557475a93a01
Instruction ID: b9e2a455162aad0ea9d74ac57eb66472aa67274fea0aa807252037505c38814f
Opcode Fuzzy Hash: 4d89211d69dd612edb2b703286179347e695e4870a78258eafc4557475a93a01
Instruction Fuzzy Hash: 1532F375A10301DBC717EF28EC8267A73BEFB96310F54845BE802DB6A5EB359941CB90

Function 003899B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00389A16
GetTickCount.KERNEL32 ref: 00389B6B

Strings

@(l$, xrefs: 00389ABD

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CountSystemTickTime
String ID: @(l$
API String ID: 2164215191-2034585603
Opcode ID: 192d925970fa7f581815a71388b8a1d6012e559e400083091f9484cb296ba5c3
Instruction ID: aa739564ff1c4dfc9feb4411c7af4387aaaebd4dcda2fec28a26ab9c69afc080
Opcode Fuzzy Hash: 192d925970fa7f581815a71388b8a1d6012e559e400083091f9484cb296ba5c3
Instruction Fuzzy Hash: 76418C729112108FD34BDF28FCC257677ADF7A6721F08412BD846CA671E77A9940CBA0

Function 00385950 Relevance: 5.3, Strings: 4, Instructions: 342COMMON

Download Yara Rule

Strings

7dsX, xrefs: 00385A94
,L, xrefs: 00385DF7
W, xrefs: 00385DE4, 00385DEA
Pl6, xrefs: 00385CCA

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: ,L$7dsX$Pl6$W
API String ID: 0-545268470
Opcode ID: d1db13f5929bf6d0cbac14ddb70c35451e9c2d38b86b2df7960bc189db62baaf
Instruction ID: e2affd6bd25911ccb93f0ca58bfa5ec67ee437511972dec510815b206645a870
Opcode Fuzzy Hash: d1db13f5929bf6d0cbac14ddb70c35451e9c2d38b86b2df7960bc189db62baaf
Instruction Fuzzy Hash: 8FE10276A107108BC70ACF29ECD156A77FAFB9A321F15822FD8069B374D7395841CB94

Function 00382950 Relevance: 4.8, APIs: 3, Instructions: 309sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00382CB0
Sleep.KERNEL32(00015F90), ref: 00382E36
DeleteFileA.KERNEL32(?), ref: 00382E4D

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: File$DeleteModuleNameSleep
String ID:
API String ID: 2157229623-0
Opcode ID: 6f933d090b50acc2b4fc3a7473d251cbc5a36cd0082737ed461ba1874a612395
Instruction ID: 39f30c3440ca5b4ad22e091d98da8051dba472ca10fb2443275d415175902f4f
Opcode Fuzzy Hash: 6f933d090b50acc2b4fc3a7473d251cbc5a36cd0082737ed461ba1874a612395
Instruction Fuzzy Hash: 1FD134769103049BC30BEF68FC92AB637FDFB96700F04855AE4068B2B1EB759981CB51

Function 00375F50 Relevance: 4.7, Strings: 3, Instructions: 927COMMON

Download Yara Rule

Strings

t#A9, xrefs: 003765B7
[m#X, xrefs: 003762F7
V#7, xrefs: 00375FE2, 00376D8D, 00376124, 003761FE, 00376387, 00376398, 00376430, 00376A29, 00376B2D, 003763DA, 003763FC, 003762BA, 00375FE5, 00376128, 00376201, 003762BE, 0037638B, 0037639B, 003763E2, 003763FF, 00376440, 00376A2C, 00376B30, 00376D90

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: V#7$[m#X$t#A9
API String ID: 0-2000824755
Opcode ID: 4302e559374c672d8a53e74062007efc41fc7c13474faf45cda57ebdf4e240dd
Instruction ID: 4d2d34fa6f9c5cd107262286cd8530265cd6dadcbb022939f5c27f1813ec3a00
Opcode Fuzzy Hash: 4302e559374c672d8a53e74062007efc41fc7c13474faf45cda57ebdf4e240dd
Instruction Fuzzy Hash: F4823776A106058FCB2BCF68ED925AE77FDFB99310F14811AD806DB364E7399841CB90

Function 003619C0 Relevance: 4.1, Strings: 3, Instructions: 356COMMON

Download Yara Rule

Strings

C:\Users\user, xrefs: 00361B2A
=], xrefs: 00361C71
p`^p, xrefs: 00361EEB

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: C:\Users\user$p`^p$=]
API String ID: 0-4116397439
Opcode ID: 199db9c21ed8b85964a7ad0055604fc71bfeceb885246e32a5d08b5e766fda00
Instruction ID: 96d2ee9398cab647dee8909cb0305fdbbbd7b9384a8a7b8c4f1295015a750839
Opcode Fuzzy Hash: 199db9c21ed8b85964a7ad0055604fc71bfeceb885246e32a5d08b5e766fda00
Instruction Fuzzy Hash: 39E1F572A103009FC74BEF68FC82AAA77BDFB55310F14851AE406DB2B5EB759940CB51

Function 003644A0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 453fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0038EEB0: CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000,?,00000000,00000001), ref: 0038F00B

DeleteFileA.KERNEL32(?), ref: 00364B8D

Strings

, xrefs: 00364839

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CreateDeleteFilePipe
String ID:
API String ID: 4227001771-3916222277
Opcode ID: 8f51eb0c42a4cc6100dd48e5591268f27acf67c58672561a52feb8d618290a5e
Instruction ID: 192947e5efdb9f1ad2983dce8d6916ab6c4104746b867a39bcdb793d32556a7b
Opcode Fuzzy Hash: 8f51eb0c42a4cc6100dd48e5591268f27acf67c58672561a52feb8d618290a5e
Instruction Fuzzy Hash: 47023575A102148BC707EF68FC8267A77FDFB96711F10812BE405CB2A5E77A8A41CB91

Function 00385B98 Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

,L, xrefs: 00385DF7
W, xrefs: 00385DE4, 00385DEA
Pl6, xrefs: 00385CCA

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: ,L$Pl6$W
API String ID: 0-3761019080
Opcode ID: 742ca90650ea34e766410303c7b6d7494e6adf17422faae0c19f96d59bd6bd61
Instruction ID: 81478035b7d514fef7d42c4bfb1e70aa7be07cb3f590cf81410ee9e529f585f5
Opcode Fuzzy Hash: 742ca90650ea34e766410303c7b6d7494e6adf17422faae0c19f96d59bd6bd61
Instruction Fuzzy Hash: 9C81E476A117208FC71ACF29ED951AA73BAFBC9321F1A821FD8066B364D7355C41CB84

Function 00385B96 Relevance: 4.0, Strings: 3, Instructions: 202COMMON

Download Yara Rule

Strings

,L, xrefs: 00385DF7
W, xrefs: 00385DE4, 00385DEA
Pl6, xrefs: 00385CCA

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: ,L$Pl6$W
API String ID: 0-3761019080
Opcode ID: 9587a9fc019996eb2f0aa2c4dda495efc553f60b8891b1f9b6a67b1e76e9de25
Instruction ID: 73b75bc1d319b4ce95cc312f3d9df889f66e9186bd6e1483f00b9a306743d2bd
Opcode Fuzzy Hash: 9587a9fc019996eb2f0aa2c4dda495efc553f60b8891b1f9b6a67b1e76e9de25
Instruction Fuzzy Hash: 5481E476A117208FC70ACF29ED951AA73BAFBC9321F1A821FD8066B364D7355C41CB84

Function 0038FE10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 573COMMON

Download Yara Rule

Strings

1BJ, xrefs: 00390617

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CountSystemTickTime
String ID: 1BJ
API String ID: 2164215191-3696045056
Opcode ID: 2ac37c0c76c85dd08c233558fe7a5eefa606b996b0eac355ec4b81fc502bd64b
Instruction ID: 6a785c51a1d2f8e195e0135ea6c2994634261695fd490ca8a54e5acd96fe7065
Opcode Fuzzy Hash: 2ac37c0c76c85dd08c233558fe7a5eefa606b996b0eac355ec4b81fc502bd64b
Instruction Fuzzy Hash: 0F421475A10200CFC70BDF68ED92AAA77BDFB96310F04812AE406DB275E7759984CF91

Function 0037C640 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

j7, xrefs: 0037C76B
j7, xrefs: 0037C683

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: j7$j7
API String ID: 0-2901554399
Opcode ID: 98d3dd30ca24fd9d5f6d43dade773360313f4590c2139ffd9b9939625573f8d9
Instruction ID: 88b68a8c718b7514c091739f02628d0925fcfd95af0300231f3682760195a4c1
Opcode Fuzzy Hash: 98d3dd30ca24fd9d5f6d43dade773360313f4590c2139ffd9b9939625573f8d9
Instruction Fuzzy Hash: 00A12336520611CFC71BCF29EC8256633FAFB9A711F15D21BD85A8B678E7399841CB80

Function 0038CBE0 Relevance: 2.1, APIs: 1, Instructions: 633COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 0038CD44

Part of subcall function 003640B0: lstrlen.KERNEL32(?,?,00361038,?), ref: 003640DD

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: ComputerNamelstrlen
String ID:
API String ID: 4141851928-0
Opcode ID: f15947bd615fb64772aed17123373a1e67c582ebb6af11ba3e76769ca4c4e09d
Instruction ID: d1dd58af8213f1f9a2e77aa9679e768a25d63aebd3536fd8a7884e7d007b9c0b
Opcode Fuzzy Hash: f15947bd615fb64772aed17123373a1e67c582ebb6af11ba3e76769ca4c4e09d
Instruction Fuzzy Hash: 2F52F671910205CFC70BEF64EC92ABA73BDFB56301F50816BE4069B2B1EB71A944CB65

Function 00388BA0 Relevance: 1.9, Strings: 1, Instructions: 668COMMON

Download Yara Rule

Strings

@H , xrefs: 003894F3

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: @H
API String ID: 0-679593823
Opcode ID: 535b2811f244efb9163138251bedd5570d4928705fb28ba2f5a3e3eb9f222fc0
Instruction ID: 481700b03ff782ae1c4a4f8cbb0e3d372af7a2adced98740c45dbc6d9b583150
Opcode Fuzzy Hash: 535b2811f244efb9163138251bedd5570d4928705fb28ba2f5a3e3eb9f222fc0
Instruction Fuzzy Hash: A8522F71A142018FC70BEF29ED9267A77BDFBA2310F18816BE406CB6B1E7758941CB45

Function 00388DD6 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

@H , xrefs: 003894F3

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: @H
API String ID: 0-679593823
Opcode ID: 13c8c3790dbc5f1f6e1f0b2c63319667bb964da2d9396fe8c05b01912503690b
Instruction ID: fa37e7ed6b27734bb8ed4595e1caa7a6ee0655968b4a24b81be669f0b3c0af3e
Opcode Fuzzy Hash: 13c8c3790dbc5f1f6e1f0b2c63319667bb964da2d9396fe8c05b01912503690b
Instruction Fuzzy Hash: 0D120F729142418FCB07DF69EC9227A77BDFBA2310F18816BD446CB6B1E3798941CB41

Function 00375520 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

zwfC, xrefs: 00375AC0

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: zwfC
API String ID: 0-2819243322
Opcode ID: 92041e3872c8d87075f42b990deedc04dbdb46ee2c17f01ba5f5825666af8c8f
Instruction ID: 03cefe9998cc99e58286fbc7b7217450de4f03e60c89c9b08be2d0761c6fa869
Opcode Fuzzy Hash: 92041e3872c8d87075f42b990deedc04dbdb46ee2c17f01ba5f5825666af8c8f
Instruction Fuzzy Hash: 19E1F575A006049FC70BEF68ED9296A77AEFB96310F14852FE806CB371E7759801CB91

Function 00365730 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

+EM, xrefs: 00365AD0

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: +EM
API String ID: 0-2077864378
Opcode ID: 00710b5c2b9aa678e262be97ef38c814cda3b49d53300df901944535ec3c59bd
Instruction ID: 6c19b6576c413d507de765e642b01d0328b65ff35f5666608261810c1a2b9f1a
Opcode Fuzzy Hash: 00710b5c2b9aa678e262be97ef38c814cda3b49d53300df901944535ec3c59bd
Instruction Fuzzy Hash: 40D10F7AA04611CBC70BCF28FDD156677ADF79A311F10C62BD8468B679E7369801CB41

Function 00385010 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0038503B

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: e16abdfecd3f59b2640092fc8532ef930db4d401a15effdc18dd091aa55fe6a7
Instruction ID: 1176e120d3295647b95372728aafb3485ed6173c4def6c6be2e7945841715642
Opcode Fuzzy Hash: e16abdfecd3f59b2640092fc8532ef930db4d401a15effdc18dd091aa55fe6a7
Instruction Fuzzy Hash: 92F01271D142088FC706CFA8E8414AABBF8FB16315F004969E805C3324F7359A10CB81

Function 003885E0 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

!B%I, xrefs: 00388813

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: !B%I
API String ID: 0-2905040698
Opcode ID: a08fb361fc45dea30778dfcfe6506a164ea6de9f87d83ddcb9a3a4432774a147
Instruction ID: d18b483b50031c0cdd6839b9a5cf7671b134fa1132d5ace87a33cb4c1a606bc9
Opcode Fuzzy Hash: a08fb361fc45dea30778dfcfe6506a164ea6de9f87d83ddcb9a3a4432774a147
Instruction Fuzzy Hash: 8AB10036A142408FC30ACF29EC8152A7BFEFBA6311F14C16BD845DB6B5E7398942CB51

Function 003777A1 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

eH(, xrefs: 003779F9

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: eH(
API String ID: 0-1750492490
Opcode ID: 25e0e5d406727248134ac58d761c1aa99119f7b7c7d5fe1af6eee0c677544de6
Instruction ID: 73015b158044932bd44e07a7e4bd63bc4bb416d96b3a145e5447c8ea8f5d7066
Opcode Fuzzy Hash: 25e0e5d406727248134ac58d761c1aa99119f7b7c7d5fe1af6eee0c677544de6
Instruction Fuzzy Hash: E391ED765042218BC35ACF69EC9263677FDFB96321F01812FE816CB6B1E7398801CB91

Function 003777F0 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

eH(, xrefs: 003779F9

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: eH(
API String ID: 0-1750492490
Opcode ID: 0db767afd1d25bb5aa3e80ee846462849abe3d2918e7f16532763d6f42826515
Instruction ID: 7594a8eca76eb97acedea89893fbdde465231b6d3e6382be18c94f4e1cb8a63b
Opcode Fuzzy Hash: 0db767afd1d25bb5aa3e80ee846462849abe3d2918e7f16532763d6f42826515
Instruction Fuzzy Hash: F291EE76514221CBC31ACF69EC9263677FDFB96321F01812EE816CB6B0E7798801CB91

Function 00365894 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

+EM, xrefs: 00365AD0

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID: +EM
API String ID: 0-2077864378
Opcode ID: 195f716bcf63305863608ab7023ffbe1e9af5fcdf8433dd7317b46b76cd7cb6d
Instruction ID: 99cea096e0b5f46f844087796e792a45bb30106ace850c3a77801f351b60d755
Opcode Fuzzy Hash: 195f716bcf63305863608ab7023ffbe1e9af5fcdf8433dd7317b46b76cd7cb6d
Instruction Fuzzy Hash: DC710D7A904641CFC70BCF28EDC01657BEDF79A311F25C62BD8868B269E7369846CB41

Function 00374420 Relevance: 1.0, Instructions: 983COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd233ce641302441a250c8194a1a82cf77f85dbfdcc532f0754eca46148dd89
Instruction ID: 9b71f3556c48f5378c801ea7a6e94f5ed4d388a7eff8c62ab121bc93340b1ef6
Opcode Fuzzy Hash: dcd233ce641302441a250c8194a1a82cf77f85dbfdcc532f0754eca46148dd89
Instruction Fuzzy Hash: 36920675900205DFCB1BDF68ED919BA77BDFB99310F00811BE80ADB260E7799941CB91

Function 00383AF0 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb623972f05c22cf6924f7b90f74e98d3e29672e804eafc8d55a77365ffad41
Instruction ID: f5e3eacbcf7e6492c65ec41ba767232dab3403e99650b7a15500e7051e1cb2a0
Opcode Fuzzy Hash: 3fb623972f05c22cf6924f7b90f74e98d3e29672e804eafc8d55a77365ffad41
Instruction Fuzzy Hash: EE02FD76A142018BCB0AEF28EC9227A77FDFB5A711F14811BD816DBB70E7758981CB44

Function 0038ABB0 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5e8dcf7aecd96af655f5efca0ef670058ca5e9f559805f89600e8a515c1aca
Instruction ID: f640984aa1ab0515cd26f56e9a018961938cba23cf437df00ea85081819d7da6
Opcode Fuzzy Hash: 9e5e8dcf7aecd96af655f5efca0ef670058ca5e9f559805f89600e8a515c1aca
Instruction Fuzzy Hash: DBE1FE72A14610CBC30BCF29EC81526B7FEFB9A311F50811BD406CB678EB3A9941CB51

Function 00362F90 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5361a8273c192098b73b433ed6fa303c6cec43aa0242f560816ce3b4c65b55
Instruction ID: 1300d904d596d9bb63c00b322726674807b87b5e6710459ab04c9a7b7f5b372f
Opcode Fuzzy Hash: 8f5361a8273c192098b73b433ed6fa303c6cec43aa0242f560816ce3b4c65b55
Instruction Fuzzy Hash: FDC126356102058FDB27DF28FC8167577A8FB56311F11822BE806CB7A5E7769A81CB81

Function 00374A29 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc84900c585cfc957e9113970e6536603b41916496c53a4b86ac02747a4dd5d3
Instruction ID: 0c4a4515c4461eb23801436c346608ad1a13fb0888e32595b8da91366890036c
Opcode Fuzzy Hash: cc84900c585cfc957e9113970e6536603b41916496c53a4b86ac02747a4dd5d3
Instruction Fuzzy Hash: EAB19F75A10606CBC72BDF28EC9157A77BDFB9A310F11811BE806DB660E739E840CB91

Function 003845A0 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b28b81d1cb008f48afa84a4c194ce41a756c82b78a4149b7f784f2da35ac3927
Instruction ID: 7e639efb4a9d6ffba3a0c11ec016c4bd6efb5ca4f82c110dec0ad0df057301f0
Opcode Fuzzy Hash: b28b81d1cb008f48afa84a4c194ce41a756c82b78a4149b7f784f2da35ac3927
Instruction Fuzzy Hash: 14B1B876A11210CFC30ACF29ED9216577FAFB9A321F15812FD8468B674E77A9841CF84

Function 00390850 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: f69ad95ddf69e131b5e05ca033b35074d0fef201758359d45644339968433533
Instruction ID: 308d643bbd80f8e3a43f3a2e36910f13cda6e68d9ca0720bd720037f4ee64645
Opcode Fuzzy Hash: f69ad95ddf69e131b5e05ca033b35074d0fef201758359d45644339968433533
Instruction Fuzzy Hash: 6B81E1756142018FCB1BDF28EC92A3A33FDFB96310F00851AE406CB365EB399841CB94

Function 0036B150 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0036B1D7
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0036B256
CloseHandle.KERNEL32(00000000), ref: 0036B26B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0036B2E7
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 0036B31A
CloseHandle.KERNEL32(00000000), ref: 0036B334

Strings

td9k, xrefs: 0036B23D

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: td9k
API String ID: 3236713533-1579400769
Opcode ID: ee0d90fe71905b512fb5d1eb12935853ec7a7e7419fdd351c98fcd7c9a55ced4
Instruction ID: 334993840a765135ad76ee7833557e9684b5b6668dbf6e88046e78e81605de79
Opcode Fuzzy Hash: ee0d90fe71905b512fb5d1eb12935853ec7a7e7419fdd351c98fcd7c9a55ced4
Instruction Fuzzy Hash: 0151C176A152059FD306CF69FC81A6AB7BCFB86314F10821BE805CB2B4E7359941CF85

Function 0036B531 Relevance: 12.2, APIs: 8, Instructions: 188registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00CA05B8,Function_00014290,?,?,00000072), ref: 0036B669
SetServiceStatus.ADVAPI32(00000000,003A67EC,?,?,00000072), ref: 0036B70D
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000072), ref: 0036B721
SetServiceStatus.ADVAPI32(00000000,003A67EC,?,?,00000072), ref: 0036B771
WaitForSingleObject.KERNEL32(00000000,00001388,?,?,00000072), ref: 0036B7D0
SetServiceStatus.ADVAPI32(00000000,003A67EC,00000072), ref: 0036B82A
CloseHandle.KERNEL32(00000000), ref: 0036B841
SetServiceStatus.ADVAPI32(00000000,003A67EC), ref: 0036B8AA

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 70c4bf7fc0df9cc5f44fb3a69d08201a012c51f6eb74e9ad3a2b1f0f4fdd6998
Instruction ID: 4a385601f969cd73a76a29ba668a1a34c03335094c2f687acde7fd7bf6605ece
Opcode Fuzzy Hash: 70c4bf7fc0df9cc5f44fb3a69d08201a012c51f6eb74e9ad3a2b1f0f4fdd6998
Instruction Fuzzy Hash: 3981BC7A525211CFC30BCF29FD969267BBDF79A705F04851AE412CA2B4E77A9841CF40

Function 00381E90 Relevance: 10.7, APIs: 7, Instructions: 238processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00381F5E
Process32First.KERNEL32(00000000,00000128), ref: 00381FDC
OpenProcess.KERNEL32(00000001,00000000,?), ref: 003820A2

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: 3866a8e978d27a0dc01954a157ac42822a8cbbcf5241537bcf099266b9187c94
Instruction ID: 4aa70dfb92b69498dd3f10ffd31c8088c6b2628552cebc7a8a1cca392124f9cc
Opcode Fuzzy Hash: 3866a8e978d27a0dc01954a157ac42822a8cbbcf5241537bcf099266b9187c94
Instruction Fuzzy Hash: E4A1BCB5901310CFC71BEF28ED96AAA77BDFB66311F10415BD806CA2B4E7369A40CB40

Function 0038BADC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182processCOMMON

Download Yara Rule

APIs

Part of subcall function 003640B0: lstrlen.KERNEL32(?,?,00361038,?), ref: 003640DD

CreateToolhelp32Snapshot.KERNEL32(00000008,?,00000000), ref: 0038BC6C
Module32First.KERNEL32(00000000,00000224), ref: 0038BCE6
CloseHandle.KERNEL32(00000000,0000000A,?,00000000), ref: 0038BE0E
Process32Next.KERNEL32(?,00000128), ref: 0038BE48
CloseHandle.KERNEL32(00000000,?,00000000), ref: 0038BE96

Strings

9y8, xrefs: 0038BC13

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CloseHandle$CreateFirstModule32NextProcess32SnapshotToolhelp32lstrlen
String ID: 9y8
API String ID: 2493088380-3592070472
Opcode ID: 2c3acb3a8a4f704de426084008572a5e4b0aaeabed1b6dcd0da67dd72b6590a3
Instruction ID: 50f3c41e66b1d27cd491c50f964fb30acb535dde2a4e997fb5e9bc190f91ce3a
Opcode Fuzzy Hash: 2c3acb3a8a4f704de426084008572a5e4b0aaeabed1b6dcd0da67dd72b6590a3
Instruction Fuzzy Hash: 7B71E171A102028FDB1BDF29ED92A7A77BDFB9A310F00815FE406CB2A0E7759941CB51

Function 00381FF6 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 00372290: lstrlen.KERNEL32(?), ref: 003722A2
Part of subcall function 00372290: CharLowerBuffA.USER32(?,00000000), ref: 003722BE

OpenProcess.KERNEL32(00000001,00000000,?), ref: 003820A2
TerminateProcess.KERNEL32(00000000), ref: 00382132
CloseHandle.KERNEL32(00000000), ref: 0038217B
Process32Next.KERNEL32(00000000,00000128), ref: 00382228
CloseHandle.KERNEL32(00000000), ref: 0038227B

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CloseHandleProcess$BuffCharLowerNextOpenProcess32Terminatelstrlen
String ID:
API String ID: 3465298759-0
Opcode ID: 71950190e3e0ba69b0209d6d6e4ca02d2a2439209e17a0087b4d235fcdcd99c9
Instruction ID: 082f2964b9097dafb5e54d136e39c425a1c471fa435571e3f7f7ddfbb8b58fda
Opcode Fuzzy Hash: 71950190e3e0ba69b0209d6d6e4ca02d2a2439209e17a0087b4d235fcdcd99c9
Instruction Fuzzy Hash: 8C61CB75A01304CBC71BEF28ED96AAA73BDFB66310F10415BE8068A275D7369A41CF85

Function 00381950 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,00388262,Function_00001300,00000001,?), ref: 0038199B
CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 003819C2
CloseHandle.KERNEL32(00000000,?,00388262,Function_00001300,00000001,?), ref: 003819DD
WaitForSingleObject.KERNEL32(?,000000FF,?,00388262,Function_00001300,00000001,?), ref: 003819F2
CloseHandle.KERNEL32(?,?,000000FF,?,00388262,Function_00001300,00000001,?), ref: 00381A19

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: fa1321d9748c59a06534cc7d200f981d54998af8dd73cf6f91ed1d76c93ff30d
Instruction ID: 5d5b3c18d4de80a2f2fc05c4a12c1b56ec370a4819f8c04c4ac5feb3549e00a9
Opcode Fuzzy Hash: fa1321d9748c59a06534cc7d200f981d54998af8dd73cf6f91ed1d76c93ff30d
Instruction Fuzzy Hash: C221E1352103049FD316DF64EC96B267BACFB49710F14821AF9468B6F4D7B69840CB95

Function 00377110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,00000000,?), ref: 00377221
RegSetValueExA.ADVAPI32(?,00CA0830,00000000,00000001,?,00000000), ref: 003772E0
RegCloseKey.ADVAPI32(?), ref: 00377300

Strings

IR, xrefs: 00377313

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: CloseOpenValue
String ID: IR
API String ID: 779948276-3379982419
Opcode ID: 3df954b23d7d0c6d721624bfd9b7b25450cf4c6f77e9922da9cff6e17ad2cd22
Instruction ID: 050c010acc94bfad02791bd7cc82c16fd11dfb0064fb09a62f3e5fbbe1c65d27
Opcode Fuzzy Hash: 3df954b23d7d0c6d721624bfd9b7b25450cf4c6f77e9922da9cff6e17ad2cd22
Instruction Fuzzy Hash: 4A41113A6102109BD716DF28EC86A7737FDE79A321F14812BE806CB771E7798841CB95

Function 0038E880 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 0038E966
ReadFile.KERNEL32(00000000,?,00005000,00000000,00000000), ref: 0038E9D7
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 0038EADD

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: fe157df490abedda0b3cac3088219a6cebbac84c57eb601e23e7b6dd780db25e
Instruction ID: 68f3fbc900c4c7178cd5d4b5ecbcc9cfc41c8e6f34bdd860a4742dc6e6d70103
Opcode Fuzzy Hash: fe157df490abedda0b3cac3088219a6cebbac84c57eb601e23e7b6dd780db25e
Instruction Fuzzy Hash: 0B81EE766103049FD307EF68EC92A6A33BDF786700F00555BE806CB2A5EB76A841CF95

Function 0038FAD0 Relevance: 6.0, APIs: 4, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,00390A87,00000000,?,?,?,?,?,00000001), ref: 0038FAF7
RtlReAllocateHeap.NTDLL(00000000,?,00390A87,00000000), ref: 0038FAFE
GetProcessHeap.KERNEL32(00000000,?,?,00390A87,00000000,?,?,?,?,?,00000001), ref: 0038FB19
HeapAlloc.KERNEL32(00000000,?,00390A87,00000000,?,?,?,?,?,00000001), ref: 0038FB20

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: b556ee720742ed5bbe3bd2e1d40d7ca57fdbdcb68224a7a54e57ba40f68316e0
Instruction ID: 954df124c09e067597bc0ea98c8e190779c446ace3f34150ed86f01c93590e15
Opcode Fuzzy Hash: b556ee720742ed5bbe3bd2e1d40d7ca57fdbdcb68224a7a54e57ba40f68316e0
Instruction Fuzzy Hash: 9DF03971210304FFDB06AFB0EC0AAAA3B6CFF89711F148005F919C76A0EB329940CB61

Function 00363DC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001,00000001,00000000,00000001,00000000), ref: 00363E43
__aulldiv.LIBCMT ref: 00363E74

Strings

L9<8, xrefs: 00363F4F

Memory Dump Source

Source File: 00000000.00000002.2191845263.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.2191828599.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191874510.0000000000392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191889567.0000000000393000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.0000000000396000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191914098.00000000003AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191991153.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_66HKNPT1fl.jbxd

Similarity

API ID: Time$FileSystem__aulldiv
String ID: L9<8
API String ID: 2838486344-2160928743
Opcode ID: 1bef48dcad9d6c06f14500c381fbe152a21fd1086796940131f93ec7d53743b4
Instruction ID: 46f6e9303afac90e3af0b53c9af5b62d7a873ae50e77653053da3ec75b288ce9
Opcode Fuzzy Hash: 1bef48dcad9d6c06f14500c381fbe152a21fd1086796940131f93ec7d53743b4
Instruction Fuzzy Hash: CD41E0B6A142108FC70BCF18EDA156977BEFB9A714F21811FE4038BA74D3769941CB91

Analysis Process: ew4bjmdlid9hjn8.exePID: 3960, Parent PID: 4784COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	1946
Total number of Limit Nodes:	24

Executed Functions

Function 000600C8 Relevance: 61.4, APIs: 29, Strings: 5, Instructions: 1861sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 000603F9
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00060427
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0006046A
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00060496
GetTickCount.KERNEL32 ref: 00060587
GetCommandLineA.KERNEL32 ref: 0006063E
Sleep.KERNEL32(000003E8), ref: 00060CDF

Part of subcall function 0005B150: CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0005B1D7

Sleep.KERNEL32(00000D05), ref: 00060BD2

Part of subcall function 0005B150: GetFileTime.KERNEL32(00000000,?,?,?), ref: 0005B256
Part of subcall function 0005B150: CloseHandle.KERNEL32(00000000), ref: 0005B26B

Sleep.KERNEL32(000007D0), ref: 00060DD1
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00060EA8
SetFileAttributesA.KERNEL32(?,00000080), ref: 00060ECC
CopyFileA.KERNEL32(?,?,00000000), ref: 00060EFE
SetFileAttributesA.KERNEL32(?,00000002), ref: 000610B9
SetFileAttributesA.KERNEL32(?,00000080), ref: 000610E7
GetCommandLineA.KERNEL32(00000000), ref: 0006120E
GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 0006132B

Part of subcall function 00062290: lstrlen.KERNEL32(?), ref: 000622A2
Part of subcall function 00062290: CharLowerBuffA.USER32(?,00000000), ref: 000622BE

MessageBoxA.USER32(00000000,00000004,00000005,00000000), ref: 00061663

Part of subcall function 000572E0: CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00057452

CloseHandle.KERNEL32(00000130), ref: 00061AC5
SetFileAttributesA.KERNELBASE(?,00000080), ref: 00061AE1
CopyFileA.KERNEL32(?,?,00000000), ref: 00061B07
SetFileAttributesA.KERNELBASE(?,00000002), ref: 00061B43
Sleep.KERNELBASE(000003E8), ref: 00061CAC
WSAStartup.WS2_32(00000202,?), ref: 00061947

Part of subcall function 00072780: ExitProcess.KERNEL32 ref: 000727B0

Sleep.KERNEL32(000007D0), ref: 00061DFC
SetFileAttributesA.KERNEL32(C:\daxjjwrfm\tkjnbticppc.exe,00000080), ref: 00061E27
CopyFileA.KERNEL32(?,C:\daxjjwrfm\tkjnbticppc.exe,00000000), ref: 00061E45
SetFileAttributesA.KERNEL32(C:\daxjjwrfm\tkjnbticppc.exe,00000002), ref: 00061E7B

Part of subcall function 0007C080: Sleep.KERNEL32(000003E8), ref: 0007C1C3

Part of subcall function 0005BBA0: wvsprintfA.USER32(00000000,?,000709D1), ref: 0005BBEB

CreateThread.KERNEL32(00000000,00000000,Function_0002FE10,00000000,00000000,00000000), ref: 00062194
Sleep.KERNEL32(0000C350), ref: 00062210

Strings

C:\Users\user, xrefs: 000603F3
x7;C, xrefs: 00060C47
Xzc, xrefs: 000618C8, 000618D6
C:\daxjjwrfm\tkjnbticppc.exe, xrefs: 00061892, 00061905, 00061E22, 00061E39, 00061E76, 00062099
\t3, xrefs: 00061A90

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: File$AttributesSleep$Create$CopyMutex$CloseCommandHandleLineModuleName$BuffCharCountEnvironmentExitLowerMessageProcessStartupThreadTickTimeVariablelstrlenwvsprintf
String ID: C:\Users\user$C:\daxjjwrfm\tkjnbticppc.exe$Xzc$\t3$x7;C
API String ID: 1500488346-251304320
Opcode ID: c9c3b4c8bbb59aaca7b4bfae332ca51f7bd57e67629d0a85633d1a299dce583c
Instruction ID: 8e6c9c0b55d084f31554815b7bdf14b70baf7e421b34199c8fbbafbe7134d654
Opcode Fuzzy Hash: c9c3b4c8bbb59aaca7b4bfae332ca51f7bd57e67629d0a85633d1a299dce583c
Instruction Fuzzy Hash: 6803FE71A00201DBF758DF64ED92AAA37F6FB94311B14812BE446CB2B2EB7C9941CF51

Function 00062490 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 918
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(0009EAC8), ref: 00062572
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 000626EF
DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00062843
RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 0006289F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0006293F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000629E1
CreateDirectoryA.KERNEL32(?,00000000), ref: 00062CAC
CreateDirectoryA.KERNEL32(?,00000000), ref: 00062D6E
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00062EB0
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0006307B
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 000631FA
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 0006344D

Strings

C:\Users\user, xrefs: 00062B0A, 00062BCC
C:\daxjjwrfm\, xrefs: 00062960, 00062CC9, 00063032, 0006321C
\, xrefs: 00062F41
Wq0O, xrefs: 00062FE3

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\daxjjwrfm\$Wq0O$\
API String ID: 1691758827-149769076
Opcode ID: c3129c2607c681c9c429aa1e65eab04391481cc20a7570861ae575e73da5cd03
Instruction ID: 6a6d5ec8a1039e7c0e0de4d7dac3499c66d0ca0fb20506840169432a459764aa
Opcode Fuzzy Hash: c3129c2607c681c9c429aa1e65eab04391481cc20a7570861ae575e73da5cd03
Instruction Fuzzy Hash: AA8225B1A00205CBF718DF68EC92ABA37F5F754311B00812BE945C72B6EB7C9A45CB95

Function 0007DB50 Relevance: 25.2, APIs: 13, Strings: 1, Instructions: 662
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,?,?,00000000,00000001), ref: 0007DD1A
LoadLibraryA.KERNELBASE(00000000,?,?,?,?,?,?,00000000,00000001), ref: 0007DDBB
GetProcAddress.KERNEL32(00000000,00000000), ref: 0007DE59
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0007DEBE
HeapAlloc.KERNEL32(0007D075,00000000,00000288,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0007DF03
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0007DF39
GetAdaptersInfo.IPHLPAPI(00000000,00000288,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0007DF73
HeapFree.KERNEL32(0007D075,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0007DFDD
HeapAlloc.KERNEL32(0007D075,00000000,00000288,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0007E00E
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 0007E035

Strings

J)6v, xrefs: 0007DC3A

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: FreeHeapLibrary$Alloc$AdaptersAddressInfoLoadProcProcess
String ID: J)6v
API String ID: 994048614-3523960662
Opcode ID: 54cadc5a24616ce63726f79c77feca6455d004d9f213715d488e42991060a342
Instruction ID: 8615420d5a7f2e235e826ff2b59819db161525b4ec0e2cf5e3c77340f2245026
Opcode Fuzzy Hash: 54cadc5a24616ce63726f79c77feca6455d004d9f213715d488e42991060a342
Instruction Fuzzy Hash: A252DF72A11701DFF318DF28EC92AAA37F1F759321B10812BE889C7661E77C9941CB55

Function 00068200 Relevance: 13.7, APIs: 9, Instructions: 167
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST(00000000,00000000,00000002), ref: 0006826F
CreateServiceA.ADVAPI32(00000000,01100860,01100860,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 000682CA
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00068301
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00068323
CloseServiceHandle.SECHOST(00000000), ref: 0006833A
OpenServiceA.ADVAPI32(00000000,01100860,00000010), ref: 0006838B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 000683C2
CloseServiceHandle.ADVAPI32(00000000), ref: 00068408
CloseServiceHandle.ADVAPI32(00000000), ref: 00068481

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: b10f191167a0523ad1674fc876adbbfd4a696f5b6ce5bf022b54bc4581886b42
Instruction ID: 010c8cea4c1605aa1c17e5e144340648725bf59c56f9fbb84c4a881b5713c722
Opcode Fuzzy Hash: b10f191167a0523ad1674fc876adbbfd4a696f5b6ce5bf022b54bc4581886b42
Instruction Fuzzy Hash: 5661B9B1A056529BF304CB68FC86B3A37F5FB44702F14811BE985CA2B4EB7C9881CB41

Function 00073060 Relevance: 4.8, APIs: 3, Instructions: 287
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0007327A
WriteFile.KERNELBASE(?,?,00005000,00005000,00000000), ref: 0007344B
CloseHandle.KERNELBASE(?), ref: 000734DA

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 15571a9d054dbaed1acf2e61bd7c9e2ffe413d543ddb3fc1b8eec53c5e163bf5
Instruction ID: 7d75d083ca7adcb64d2b2666c32f045e780f3b7c73729b6f8677b52ff53adf52
Opcode Fuzzy Hash: 15571a9d054dbaed1acf2e61bd7c9e2ffe413d543ddb3fc1b8eec53c5e163bf5
Instruction Fuzzy Hash: E7C11376A10610DBF704DF68FC91AAA73F5F754321B10812BE849CB2B5E77C9981CB85

Function 00077040 Relevance: 4.8, APIs: 3, Instructions: 256
libraryloaderencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75B30000,00000000), ref: 00077229
GetProcAddress.KERNEL32(75B30000,00000000), ref: 00077275
CryptGenRandom.ADVAPI32(00000000,00000004,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000773AD

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: AddressProc$CryptRandom
String ID:
API String ID: 646182245-0
Opcode ID: 75addd10083dcffcf620dea16cb2476ec312e03cbb94318ca269cc2192f17b10
Instruction ID: adbfc2e6dc80a2d935b499ed44f57e0e77123a530b0c1efd0a96dbbbce4250b8
Opcode Fuzzy Hash: 75addd10083dcffcf620dea16cb2476ec312e03cbb94318ca269cc2192f17b10
Instruction Fuzzy Hash: B8B11F71A14242CFF718DF28ED92A6637F0F754361B10812BE98ACB6B1E73D9841CB45

Function 0007CBE0 Relevance: 2.1, APIs: 1, Instructions: 633
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 0007CD44

Part of subcall function 000540B0: lstrlen.KERNEL32(?,?,00051038,?), ref: 000540DD

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: ComputerNamelstrlen
String ID:
API String ID: 4141851928-0
Opcode ID: c9cbe8a50c98fecd29ffba9c47b01699922842d8f4a21e17e6edf23f24e7272b
Instruction ID: a426cfda82ac7e7e6876ea35c2c00b391c0945e6a46424e78539e82a8d0df344
Opcode Fuzzy Hash: c9cbe8a50c98fecd29ffba9c47b01699922842d8f4a21e17e6edf23f24e7272b
Instruction Fuzzy Hash: 2D52D171910205CBF758DF24EC92AFA73B5FB54301F50812BE44A972B2EB7CAA44CB59

Function 000738B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000008,00000000,00000000,?,00000000,?,?,?,?,?,00000000), ref: 00073A0F
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00073A3E
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00073A52

Strings

D, xrefs: 000739D3

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: ec5526b817d22c11b428f01062622e05b3e54cb4a222db77ba6fd875d5a445f1
Instruction ID: 49fe2cb8b8573fc366e4022dc48cf651a1c6a24d4e477737e6c6e19a16d3c0c9
Opcode Fuzzy Hash: ec5526b817d22c11b428f01062622e05b3e54cb4a222db77ba6fd875d5a445f1
Instruction Fuzzy Hash: 9041E271A012059BFB08CF58ED92BA937F5FB54711F00801BE54ADB2B4D7BD9944CB89

Function 0007E880 Relevance: 6.2, APIs: 4, Instructions: 206
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 0007E966
ReadFile.KERNEL32(00000000,?,00005000,00000000,00000000), ref: 0007E9D7
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 0007EADD

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: d022674827a7dc407aa4bbdc1eb7b7b9a9fc1733cb9bb7dd01d27c8f7f71cbb5
Instruction ID: 61567195bc79249e79e9a429c14a33729cca9a493501ba3b0c3e939fbc643ef4
Opcode Fuzzy Hash: d022674827a7dc407aa4bbdc1eb7b7b9a9fc1733cb9bb7dd01d27c8f7f71cbb5
Instruction Fuzzy Hash: C681DF75A10204DBF744DF68FC91AAA33B5F798301F10855BE989872A1EB3CA941CF95

Function 0007C640 Relevance: 4.6, APIs: 3, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00062591,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00062591), ref: 0007C701
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 0007C737
FreeSid.ADVAPI32(?), ref: 0007C798

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: b729f540ee965d9a88bc7a912381c732dbbc25315f77053afcc8b8c57b227edd
Instruction ID: f78b861ce450773965a4fb0957ad58b5f527f9ec4267d8d5d3aab9f08b916e92
Opcode Fuzzy Hash: b729f540ee965d9a88bc7a912381c732dbbc25315f77053afcc8b8c57b227edd
Instruction Fuzzy Hash: 4041BB39A04244DFF708DB68ED95A6A3BF4FB58300B54815EE586C7261EB3CA941CF05

Function 00066F00 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00069195,021A1850,?,?,?,?,?,00076DD6), ref: 00066F59
RtlAllocateHeap.NTDLL(00000000,?,00069195,021A1850,?,?,?,?,?,00076DD6), ref: 00066F60

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5f18f60b81565bea67338aad2ada4728da2d1c014c878603f6ce615f1e46693d
Instruction ID: 6350b1875706232b56cf39a66698cee4883391396c99091d43bbcb959d31c276
Opcode Fuzzy Hash: 5f18f60b81565bea67338aad2ada4728da2d1c014c878603f6ce615f1e46693d
Instruction Fuzzy Hash: 13F020315007008BEB08DB64FC89B2537EAFB00701B04401AF106C7272EEBE9800CBD8

Function 0006C520 Relevance: 3.0, APIs: 2, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00080A4E,?,00080A4E,00000000), ref: 0006C549
RtlFreeHeap.NTDLL(00000000,?,00080A4E,00000000), ref: 0006C550

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 3a0760c9d5094202db3b0f0ccdb25f906f1e977c04f121bfcb4af72fcc8f29c7
Instruction ID: ea609cd0484bd88515f20e5943d80197443c26e711f8538784a6ded49a5e98ab
Opcode Fuzzy Hash: 3a0760c9d5094202db3b0f0ccdb25f906f1e977c04f121bfcb4af72fcc8f29c7
Instruction Fuzzy Hash: 1FF030719186049FF7049F58EC9697537E5BB04704B04440AE99AC7621D778A880CB65

Function 00062290 Relevance: 3.0, APIs: 2, Instructions: 21
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 000622A2
CharLowerBuffA.USER32(?,00000000), ref: 000622BE

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: f8688b3cd131e25061c3f2d9c352abbbebcf47a767c05761e86265e2fb63edca
Instruction ID: e771282ab910dda538b99a1ddef555359f946b4ea4990048dfffdb04c1c45494
Opcode Fuzzy Hash: f8688b3cd131e25061c3f2d9c352abbbebcf47a767c05761e86265e2fb63edca
Instruction Fuzzy Hash: F4E04F721149249BA3019F98FC494F637FCFB157023084067E6C9C2674EB7C6941C7B5

Function 000572E0 Relevance: 1.7, APIs: 1, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00057452

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 901ce219fb3e8d85a871b84f40dccbcf2164a0901e792efa3cc81a020de96963
Instruction ID: c40783729c3e6fcf82a2ccd00c21fe56a7653e86d42464f51fcefe0b0a7c06b1
Opcode Fuzzy Hash: 901ce219fb3e8d85a871b84f40dccbcf2164a0901e792efa3cc81a020de96963
Instruction Fuzzy Hash: D9510E72A016148FF358DB28FC92ABA33B5F798711F10812BE945C76B1E77C9881CB45

Function 00076D32 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000520E0: GetStdHandle.KERNEL32(000000F6,?,?,00076D5F), ref: 00052113
Part of subcall function 000520E0: GetStdHandle.KERNEL32(000000F5,?,?,00076D5F), ref: 00052145
Part of subcall function 000520E0: GetStdHandle.KERNEL32(000000F4,?,?,00076D5F), ref: 00052198

ExitProcess.KERNEL32 ref: 00076E44

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Handle$ExitProcess
String ID:
API String ID: 256993070-0
Opcode ID: a44edc432c8029536e3c1362b14e9eafea0f71a77add6e388e5b16b9b915a030
Instruction ID: 972e00c6a0e549c8411101e95cc94d4e8889fa318ba359aa321a3df51b742bea
Opcode Fuzzy Hash: a44edc432c8029536e3c1362b14e9eafea0f71a77add6e388e5b16b9b915a030
Instruction Fuzzy Hash: E021F636A115118BF708EF34EC925B533A2F764762300C517E8028B7AAFB7D8941C745

Function 00072780 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 000727B0

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 97d2471b80e8b25b93c4ac7f1d7be9445a89ca8740b0455a170bdf8c53d910b1
Instruction ID: 543bc50f3fccad2f8f7759aed348aa41553e851b486b63bc9218a31115fc8c13
Opcode Fuzzy Hash: 97d2471b80e8b25b93c4ac7f1d7be9445a89ca8740b0455a170bdf8c53d910b1
Instruction Fuzzy Hash: 84D05E701207048A9B00EF64FC8562237ACFB407017401426E8018F261E37CEA8187D1

Non-executed Functions

Function 0007EEB0 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 444pipeprocessfileCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000,?,00000000,00000001), ref: 0007F00B
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0007F086
CreatePipe.KERNEL32(?,00000000,0000000C,00000000), ref: 0007F0A6
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0007F147
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 0007F2C2
CloseHandle.KERNEL32(00000000), ref: 0007F353
CloseHandle.KERNEL32(?), ref: 0007F367
CloseHandle.KERNEL32(00000000), ref: 0007F37B
CloseHandle.KERNEL32(00000000), ref: 0007F3A9
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0007F446
CloseHandle.KERNEL32(00000000), ref: 0007F4D4
CloseHandle.KERNEL32(00000000), ref: 0007F4E8
WaitForSingleObject.KERNEL32(?,00002710), ref: 0007F56B
CloseHandle.KERNEL32(?), ref: 0007F586
CloseHandle.KERNEL32(?), ref: 0007F5A7

Strings

D, xrefs: 0007F1D6
<,]8, xrefs: 0007F2D1
;8\w, xrefs: 0007F4FA

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: ;8\w$<,]8$D
API String ID: 1130065513-4129721015
Opcode ID: 507fde8e75ee3019c718721e96341979aa525d602102c710b1ed370383263c85
Instruction ID: 89cd3618976d5e33e2d0b59835af78700fcee30d04033482d4208bdda53e7711
Opcode Fuzzy Hash: 507fde8e75ee3019c718721e96341979aa525d602102c710b1ed370383263c85
Instruction Fuzzy Hash: F512CC71A04206DFF708CF68ED95ABA37B5FB98311B10812BE84AD76B4E73C9941CB54

Function 0007B7F0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 387processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 0007B8EC
Process32First.KERNEL32(00000000,00000128), ref: 0007BA96

Strings

9y8, xrefs: 0007BC13

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: 9y8
API String ID: 2353314856-3592070472
Opcode ID: 2a5191a33c10599133b9fda0c99a57b2f3cc7cf8b70a235e52ada2709a99472c
Instruction ID: bfaf22da486e82c5f8bbebb1b8fbdb18c94eb88892b04ffb048b4155507302d1
Opcode Fuzzy Hash: 2a5191a33c10599133b9fda0c99a57b2f3cc7cf8b70a235e52ada2709a99472c
Instruction Fuzzy Hash: 96F1E271A00211CBF718DF29ED92A7A37F1FB94311B14812BE48AC72B5EB7C9941CB56

Function 000560A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 000540B0: lstrlen.KERNEL32(?,?,00051038,?), ref: 000540DD

Sleep.KERNEL32(000003E8), ref: 00056189
FindFirstFileA.KERNEL32(?,?), ref: 00056274
DeleteFileA.KERNEL32(?), ref: 0005632E
FindNextFileA.KERNEL32(?,?), ref: 00056384
FindClose.KERNEL32(?), ref: 000563AA

Strings

ysh, xrefs: 00056159, 00056169

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleeplstrlen
String ID: ysh
API String ID: 3282225923-1904326249
Opcode ID: 73b57dabfaec1a82a3827e887fd0b674cfa8598f7c23469169558de3c60424e5
Instruction ID: 26e44312713812497a2d8a3a9a2bb57762b48412d8fd32ade9cc178b520f7de9
Opcode Fuzzy Hash: 73b57dabfaec1a82a3827e887fd0b674cfa8598f7c23469169558de3c60424e5
Instruction Fuzzy Hash: 64812272A002149FF718DF64FD92AAA77B5FB94311F44816BE945872B0EB7C8A04CF91

Function 0007A050 Relevance: 7.8, APIs: 5, Instructions: 288serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,?,00000000,00000001), ref: 0007A124
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,0000000A,?,00000000,?,00000000,00000001), ref: 0007A164
GetLastError.KERNEL32(?,00000000,00000001), ref: 0007A176
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,-0000001A,0000000A,?,00000000,00000001), ref: 0007A24F

Part of subcall function 0005BBA0: wvsprintfA.USER32(00000000,?,000709D1), ref: 0005BBEB

CloseServiceHandle.ADVAPI32(00000000,00000001), ref: 0007A44C

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenServicewvsprintf
String ID:
API String ID: 475583450-0
Opcode ID: 6f5c91c89b50387597b86163f08012980f938e1efe6785c34f5c682db143bde0
Instruction ID: 51bed620f331432abf8170693f66721b686902c90553d71e6975de0dea641fc3
Opcode Fuzzy Hash: 6f5c91c89b50387597b86163f08012980f938e1efe6785c34f5c682db143bde0
Instruction Fuzzy Hash: 2DC1FF72A00200DBF754CF68ED81AAA77F5FB99300F00812BE549DB2B1E77C9941CB56

Function 000703B9 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

/, xrefs: 000703F1
@(l$, xrefs: 00070A8B, 00070A91
!|/0, xrefs: 00070AE8

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID:
String ID: !|/0$/$@(l$
API String ID: 0-3106747989
Opcode ID: aed0149a626078f6e2923335ac0f38006c2bae0a9ed71926d40c6b5dd668848e
Instruction ID: 78a6868d612596ec6f406c0d55f6c58bf61edb70f1fe9e6ec1eb48aba6877fcc
Opcode Fuzzy Hash: aed0149a626078f6e2923335ac0f38006c2bae0a9ed71926d40c6b5dd668848e
Instruction Fuzzy Hash: 7D020171E10200CBF714EB24EC92AFA77B5FB54311F10C12AE44A9B2A2EB7C5A45CF95

Function 0005B150 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0005B1D7
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0005B256
CloseHandle.KERNEL32(00000000), ref: 0005B26B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0005B2E7
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 0005B31A
CloseHandle.KERNEL32(00000000), ref: 0005B334

Strings

td9k, xrefs: 0005B23D

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: td9k
API String ID: 3236713533-1579400769
Opcode ID: a19766808ccf964d59109a9dbe5962ea3aa38fb50451983e69ed78b7f274289b
Instruction ID: 30ee8943805e5269473fdd05a678ab1b83efab3adc3af53327bd3cdd25403a74
Opcode Fuzzy Hash: a19766808ccf964d59109a9dbe5962ea3aa38fb50451983e69ed78b7f274289b
Instruction Fuzzy Hash: 1451E375A15201AFF304CF69FC80A6AB7B5FB84314F10826BE949CB2B4E7389940CF85

Function 0005B531 Relevance: 12.2, APIs: 8, Instructions: 188registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(01100860,Function_00014290,?,?,00000072), ref: 0005B669
SetServiceStatus.ADVAPI32(00000000,000967EC,?,?,00000072), ref: 0005B70D
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000072), ref: 0005B721
SetServiceStatus.ADVAPI32(00000000,000967EC,?,?,00000072), ref: 0005B771
WaitForSingleObject.KERNEL32(00000000,00001388,?,?,00000072), ref: 0005B7D0
SetServiceStatus.ADVAPI32(00000000,000967EC,00000072), ref: 0005B82A
CloseHandle.KERNEL32(00000000), ref: 0005B841
SetServiceStatus.ADVAPI32(00000000,000967EC), ref: 0005B8AA

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: ca93018dcf52355744792a8297361c8eb8495fa93fe696026cf175a35abfc90e
Instruction ID: ced5e25d6f851f3cd4a088e200d5a9e00d89076984f2db79c8ec305695a7b8be
Opcode Fuzzy Hash: ca93018dcf52355744792a8297361c8eb8495fa93fe696026cf175a35abfc90e
Instruction Fuzzy Hash: 1881B876609611CFF308CF29FD999267BA1F798706700852BE596CB3B4EB7E9805CB40

Function 0007A760 Relevance: 10.8, APIs: 7, Instructions: 266fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,000000FF), ref: 0007A7F1
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,000000FF), ref: 0007A849
CloseHandle.KERNEL32(00000000,?,?,000000FF), ref: 0007A885
GetTickCount.KERNEL32 ref: 0007A8B8
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0007AA75
WriteFile.KERNEL32(00000000,000000FF,?,?,00000000), ref: 0007AAC8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0007AAE2

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID:
API String ID: 3478262135-0
Opcode ID: 915f5e7c45533c50140b478472fb2c1229127cc485d140acab8af7d7de84c563
Instruction ID: dc8925697518442e8a0ea5dfc78437efd52fb06b0d0bb5d75e556a9e293ba9cd
Opcode Fuzzy Hash: 915f5e7c45533c50140b478472fb2c1229127cc485d140acab8af7d7de84c563
Instruction Fuzzy Hash: 13A1DF71A01210DBF304DF68ED92BBA33B5FB89711F14801BE949C72A5EB7C9941CB96

Function 00071E90 Relevance: 10.7, APIs: 7, Instructions: 238processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00071F5E
Process32First.KERNEL32(00000000,00000128), ref: 00071FDC
OpenProcess.KERNEL32(00000001,00000000,?), ref: 000720A2

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: 4c3fde97c4c9ed122a4e83857107ab2b08816492ab4f885bad05c1f53c5203ab
Instruction ID: f1942cdc0f76e45cb6d4baf3caa40e03b69e29e93ae3071a6204b88700f10513
Opcode Fuzzy Hash: 4c3fde97c4c9ed122a4e83857107ab2b08816492ab4f885bad05c1f53c5203ab
Instruction Fuzzy Hash: ABA1EF75A01211DFF718DF28ED916B977B5FB64311B10812BE889CA2B5E73C9A40CF49

Function 0007BADC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182processCOMMON

Download Yara Rule

APIs

Part of subcall function 000540B0: lstrlen.KERNEL32(?,?,00051038,?), ref: 000540DD

CreateToolhelp32Snapshot.KERNEL32(00000008,?,00000000), ref: 0007BC6C
Module32First.KERNEL32(00000000,00000224), ref: 0007BCE6
CloseHandle.KERNEL32(00000000,0000000A,?,00000000), ref: 0007BE0E
Process32Next.KERNEL32(?,00000128), ref: 0007BE48
CloseHandle.KERNEL32(00000000,?,00000000), ref: 0007BE96

Strings

9y8, xrefs: 0007BC13

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: CloseHandle$CreateFirstModule32NextProcess32SnapshotToolhelp32lstrlen
String ID: 9y8
API String ID: 2493088380-3592070472
Opcode ID: fcc21446699343bf62402a2bba8ced011b7196b49835dee8cb3dc26aab320d12
Instruction ID: 2124f4dd0f99410443b9a19df6f40212ef5aa639504bcb0d0354c27b31fb28cb
Opcode Fuzzy Hash: fcc21446699343bf62402a2bba8ced011b7196b49835dee8cb3dc26aab320d12
Instruction Fuzzy Hash: E671C071A04201CBFB18DF29ED92ABA37F5FB94314B10812BE84AC7271EB7C9941CB55

Function 00071FF6 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 00062290: lstrlen.KERNEL32(?), ref: 000622A2
Part of subcall function 00062290: CharLowerBuffA.USER32(?,00000000), ref: 000622BE

OpenProcess.KERNEL32(00000001,00000000,?), ref: 000720A2
TerminateProcess.KERNEL32(00000000), ref: 00072132
CloseHandle.KERNEL32(00000000), ref: 0007217B
Process32Next.KERNEL32(00000000,00000128), ref: 00072228
CloseHandle.KERNEL32(00000000), ref: 0007227B

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: CloseHandleProcess$BuffCharLowerNextOpenProcess32Terminatelstrlen
String ID:
API String ID: 3465298759-0
Opcode ID: 2416aacd55c852dd72ba38d047499369f85f8a87b7306f9b9b0ecc3675970b96
Instruction ID: d5bfd336181a9463758450dfbf387e3eb844d47be26868b557901da99c178bbc
Opcode Fuzzy Hash: 2416aacd55c852dd72ba38d047499369f85f8a87b7306f9b9b0ecc3675970b96
Instruction Fuzzy Hash: E661F175A01201DFF718DF24ED91AA973B5FB64310B10815BE88ACB275E73C9A41CF59

Function 00071950 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,00078262,Function_00001300,00000001,?), ref: 0007199B
CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 000719C2
CloseHandle.KERNEL32(00000000,?,00078262,Function_00001300,00000001,?), ref: 000719DD
WaitForSingleObject.KERNEL32(?,000000FF,?,00078262,Function_00001300,00000001,?), ref: 000719F2
CloseHandle.KERNEL32(?,?,000000FF,?,00078262,Function_00001300,00000001,?), ref: 00071A19

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 2c0259a0a54647c4608ac0c868ebf78956eeca948aeac16c60db3922871a439c
Instruction ID: d6e425b2cd487c6fbad7f34ee8dd633f960c436898acc4f26e3757f6f23f5408
Opcode Fuzzy Hash: 2c0259a0a54647c4608ac0c868ebf78956eeca948aeac16c60db3922871a439c
Instruction Fuzzy Hash: 8921E131205300AFF314DF60ED95B627BB4FB48710F20851AF59A8B6B4D7BD98408B55

Function 00067110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,00000000,?), ref: 00067221
RegSetValueExA.ADVAPI32(?,010FFCE8,00000000,00000001,?,00000000), ref: 000672E0
RegCloseKey.ADVAPI32(?), ref: 00067300

Strings

IR, xrefs: 00067313

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: CloseOpenValue
String ID: IR
API String ID: 779948276-3379982419
Opcode ID: 5bc48b421dbdf3167519335f048b1941badc1f08df25eec24c139aa0fe9d6020
Instruction ID: 851f8621eb28616b227a410c7184772aef9a975bb5d06cf34d980cf57b7f0af3
Opcode Fuzzy Hash: 5bc48b421dbdf3167519335f048b1941badc1f08df25eec24c139aa0fe9d6020
Instruction Fuzzy Hash: BD4154762112119BF704DF28EC96ABA33F5F784326B14801BE889C7730E77C8841CB56

Function 0006C250 Relevance: 6.1, APIs: 4, Instructions: 148processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0006C312
Process32First.KERNEL32(00000000,?), ref: 0006C35A
Process32Next.KERNEL32(00000000,00000128), ref: 0006C478

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: 4d48f6047f787f21ec90dbe13cd0693ab78c6c32a68f9dcb4a8f051431c78f69
Instruction ID: 9788425b909f6347abdddcd0e2a11a64dc598116b662e524cfaf9b36adb4a953
Opcode Fuzzy Hash: 4d48f6047f787f21ec90dbe13cd0693ab78c6c32a68f9dcb4a8f051431c78f69
Instruction Fuzzy Hash: A751E075905211CBF724CF64FD55AB937B6FB84311F00801BE9869A7B4EB7C8A40CB95

Function 0007FAD0 Relevance: 6.0, APIs: 4, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,00080A87,00000000,?,?,?,?,?,00000001), ref: 0007FAF7
RtlReAllocateHeap.NTDLL(00000000,?,00080A87,00000000), ref: 0007FAFE
GetProcessHeap.KERNEL32(00000000,?,?,00080A87,00000000,?,?,?,?,?,00000001), ref: 0007FB19
HeapAlloc.KERNEL32(00000000,?,00080A87,00000000,?,?,?,?,?,00000001), ref: 0007FB20

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 9a0dc9cd1b337e482f5330e195816ee87749ff818d21ab5331b349c296d5477e
Instruction ID: 66272b393f5d11db24c2eadd7348068a504f117dce75e1910f66eb56233be84a
Opcode Fuzzy Hash: 9a0dc9cd1b337e482f5330e195816ee87749ff818d21ab5331b349c296d5477e
Instruction Fuzzy Hash: 43F03070601205EFFB049FB0EC09A6A3B68FF88751F108105F949C66A0DB399940CB61

Function 00053DC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001,00000001,00000000,00000001,00000000), ref: 00053E43
__aulldiv.LIBCMT ref: 00053E74

Strings

L9<8, xrefs: 00053F4F

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: Time$FileSystem__aulldiv
String ID: L9<8
API String ID: 2838486344-2160928743
Opcode ID: 5ae24007fa2b1124e319c8f041414714f8168f4dd47142eb3efd058e30f90bc1
Instruction ID: 3e86e127fe24b14e98322d221ee4a9b08a694b00f40b084c0f93a3627d0f388c
Opcode Fuzzy Hash: 5ae24007fa2b1124e319c8f041414714f8168f4dd47142eb3efd058e30f90bc1
Instruction Fuzzy Hash: D4412176A10200DBF318CF58ECA257A77B2FB95756320812BE8878B6A1D33C9945CF80

Function 000799B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00079A16
GetTickCount.KERNEL32 ref: 00079B6B

Strings

@(l$, xrefs: 00079ABD

Memory Dump Source

Source File: 00000002.00000002.2169343766.0000000000051000.00000020.00000001.01000000.00000004.sdmp, Offset: 00050000, based on PE: true

Associated: 00000002.00000002.2169329567.0000000000050000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169366749.0000000000082000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169380862.0000000000083000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169394709.0000000000086000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2169416150.000000000009F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50000_ew4bjmdlid9hjn8.jbxd

Similarity

API ID: CountSystemTickTime
String ID: @(l$
API String ID: 2164215191-2034585603
Opcode ID: 76bde2d2eee4a34de0b9eaf0f31e29f8cc5206c873579798bcdb12c6da841c41
Instruction ID: 3608b0c714c54879ebc8c5516e766075f87e924b78d11ccdef4df0acd8d5956b
Opcode Fuzzy Hash: 76bde2d2eee4a34de0b9eaf0f31e29f8cc5206c873579798bcdb12c6da841c41
Instruction Fuzzy Hash: 5D417C72A01211CFF348DF28FCC29AA37B1FB94765315812BD88AC6675EB7D9940CB91

Analysis Process: qbpabupgx.exePID: 6216, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	17.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1947
Total number of Limit Nodes:	32

Executed Functions

Function 00C300C1 Relevance: 63.1, APIs: 29, Strings: 6, Instructions: 1866sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 00C303F9
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00C30427
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00C3046A
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00C30496
GetTickCount.KERNEL32 ref: 00C30587
GetCommandLineA.KERNEL32 ref: 00C3063E
Sleep.KERNEL32(000003E8), ref: 00C30CDF

Part of subcall function 00C2B150: CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00C2B1D7

Sleep.KERNEL32(00000D05), ref: 00C30BD2

Part of subcall function 00C2B150: GetFileTime.KERNEL32(00000000,?,?,?), ref: 00C2B256
Part of subcall function 00C2B150: CloseHandle.KERNEL32(00000000), ref: 00C2B26B

Sleep.KERNEL32(000007D0), ref: 00C30DD1
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00C30EA8
SetFileAttributesA.KERNEL32(?,00000080), ref: 00C30ECC
CopyFileA.KERNEL32(?,?,00000000), ref: 00C30EFE
SetFileAttributesA.KERNEL32(?,00000002), ref: 00C310B9
SetFileAttributesA.KERNEL32(?,00000080), ref: 00C310E7
GetCommandLineA.KERNEL32(00000000), ref: 00C3120E
GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 00C3132B

Part of subcall function 00C32290: lstrlen.KERNEL32(00C3C420,00000000,?,00C3C420,?), ref: 00C322A2
Part of subcall function 00C32290: CharLowerBuffA.USER32(00C3C420,00000000,?,00C3C420,?), ref: 00C322BE

MessageBoxA.USER32(00000000,00000004,00000005,00000000), ref: 00C31663

Part of subcall function 00C272E0: CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00C27452

CloseHandle.KERNEL32(00000130), ref: 00C31AC5
SetFileAttributesA.KERNEL32(?,00000080), ref: 00C31AE1
CopyFileA.KERNEL32(?,?,00000000), ref: 00C31B07
SetFileAttributesA.KERNEL32(?,00000002), ref: 00C31B43
Sleep.KERNEL32(000003E8), ref: 00C31CAC
WSAStartup.WS2_32(00000202,?), ref: 00C31947

Part of subcall function 00C42780: ExitProcess.KERNEL32 ref: 00C427B0

Sleep.KERNEL32(000007D0), ref: 00C31DFC
SetFileAttributesA.KERNELBASE(C:\daxjjwrfm\tkjnbticppc.exe,00000080), ref: 00C31E27
CopyFileA.KERNEL32(?,C:\daxjjwrfm\tkjnbticppc.exe,00000000), ref: 00C31E45
SetFileAttributesA.KERNELBASE(C:\daxjjwrfm\tkjnbticppc.exe,00000002), ref: 00C31E7B

Part of subcall function 00C4C080: Sleep.KERNELBASE(000003E8,00000000,?,00C5007D,?,00000708,00000000), ref: 00C4C1C3

Part of subcall function 00C2BBA0: wvsprintfA.USER32(00000000,?,00C409D1), ref: 00C2BBEB

CreateThread.KERNELBASE(00000000,00000000,Function_0002FE10,00000000,00000000,00000000), ref: 00C32194
Sleep.KERNEL32(0000C350), ref: 00C32210

Strings

mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe", xrefs: 00C31FE0, 00C3208D
C:\daxjjwrfm\tkjnbticppc.exe, xrefs: 00C31892, 00C31905, 00C31E22, 00C31E39, 00C31E76, 00C32099
C:\Windows\system32\config\systemprofile, xrefs: 00C303F3
Xzc, xrefs: 00C318C8, 00C318D6
\t3, xrefs: 00C31A90
x7;C, xrefs: 00C30C47

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$AttributesSleep$Create$CopyMutex$CloseCommandHandleLineModuleName$BuffCharCountEnvironmentExitLowerMessageProcessStartupThreadTickTimeVariablelstrlenwvsprintf
String ID: C:\Windows\system32\config\systemprofile$C:\daxjjwrfm\tkjnbticppc.exe$Xzc$\t3$mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe"$x7;C
API String ID: 1500488346-931268914
Opcode ID: bfa1866decec43ed1839ecc4d26e4dfb72930590f78d31762b6c203c5e691129
Instruction ID: 077a0fb35463b659fe0fb9efd544b7dc238cb0e9adabdb7f67757dfceb2c390e
Opcode Fuzzy Hash: bfa1866decec43ed1839ecc4d26e4dfb72930590f78d31762b6c203c5e691129
Instruction Fuzzy Hash: CC03D279A103009FD728DF66ED92B6E37F5F754302F14812AE802E72B1EBB49981DB51

Function 00C32490 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 918
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00C6EAC8), ref: 00C32572
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00C326EF
DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00C32843
RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00C3289F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00C3293F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C329E1
CreateDirectoryA.KERNEL32(?,00000000), ref: 00C32CAC
CreateDirectoryA.KERNEL32(?,00000000), ref: 00C32D6E
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00C32EB0
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00C3307B
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00C331FA
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 00C3344D

Strings

Wq0O, xrefs: 00C32FE3
C:\daxjjwrfm\, xrefs: 00C32960, 00C32CC9, 00C33032, 00C3321C
\, xrefs: 00C32F41
C:\Windows\system32\config\systemprofile, xrefs: 00C32B0A, 00C32BCC

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\daxjjwrfm\$Wq0O$\
API String ID: 1691758827-4043548932
Opcode ID: 423a2ad53e62a85eed542210bdffa514d8648a1bcc1b12f29134d5b2202ea202
Instruction ID: 317744578c7124649babfebf0156ee9f210039166b148b18708adbd75975f653
Opcode Fuzzy Hash: 423a2ad53e62a85eed542210bdffa514d8648a1bcc1b12f29134d5b2202ea202
Instruction Fuzzy Hash: 91820579910305CBC728DF66EC927BE37B5FB54312F00812AE502E72B1EBB49A85DB51

Function 00C401B0 Relevance: 27.3, APIs: 10, Strings: 5, Instructions: 1003
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 00C403F1
'~(-, xrefs: 00C40449
!|/0, xrefs: 00C40AE8
SbJ, xrefs: 00C40E0D
*c, xrefs: 00C40F6B

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Time$FileSystem__aulldivlstrlen
String ID: !|/0$'~(-$/$SbJ$*c
API String ID: 3360920532-2717626210
Opcode ID: 332f87a046acaefafea2d889fca75a49c4a7e0fdcc786d6ed59b5de9483456b4
Instruction ID: dfa10ebe3438498c19c92959dc8a19895aaf9ca40f3c90d4e8906108ca772e63
Opcode Fuzzy Hash: 332f87a046acaefafea2d889fca75a49c4a7e0fdcc786d6ed59b5de9483456b4
Instruction Fuzzy Hash: BB9235799103008BC728DF66FC9277E77B5FB94312F14812AE806E72A1EBB05985DF91

Function 00C4DB50 Relevance: 25.2, APIs: 13, Strings: 1, Instructions: 662
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,?,?,00000000,00000001), ref: 00C4DD1A
LoadLibraryA.KERNELBASE(00000000,?,?,?,?,?,?,00000000,00000001), ref: 00C4DDBB
GetProcAddress.KERNEL32(00000000,00000000), ref: 00C4DE59
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00C4DEBE
HeapAlloc.KERNEL32(00C4D075,00000000,00000288,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C4DF03
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00C4DF39
GetAdaptersInfo.IPHLPAPI(00000000,00000288,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00C4DF73
HeapFree.KERNEL32(00C4D075,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C4DFDD
HeapAlloc.KERNEL32(00C4D075,00000000,00000288,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C4E00E
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00C4E035

Strings

J)6v, xrefs: 00C4DC3A

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: FreeHeapLibrary$Alloc$AdaptersAddressInfoLoadProcProcess
String ID: J)6v
API String ID: 994048614-3523960662
Opcode ID: 01665d16fe3bacc3c398f9d1e18b6b68a546cf0f3d92764385b4fac2fc2d0130
Instruction ID: e948f89dc613950046296855054a1077f596e18076b9adae9f56958223aeecb8
Opcode Fuzzy Hash: 01665d16fe3bacc3c398f9d1e18b6b68a546cf0f3d92764385b4fac2fc2d0130
Instruction Fuzzy Hash: BC52C179A107018FD328DF6AEC9277E77F5F758312B14422AE806E72B0E7B49981CB51

Function 00C260A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C240B0: lstrlen.KERNEL32(?,?,00C26175,?,00000104,?,00000001), ref: 00C240DD

Sleep.KERNELBASE(000003E8,00000001), ref: 00C26189
FindFirstFileA.KERNELBASE(?,?), ref: 00C26274
DeleteFileA.KERNELBASE(?), ref: 00C2632E
FindNextFileA.KERNELBASE(?,?), ref: 00C26384
FindClose.KERNEL32(?), ref: 00C263AA

Strings

xsh, xrefs: 00C26159, 00C26169

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleeplstrlen
String ID: xsh
API String ID: 3282225923-3135071692
Opcode ID: 1de1caba434abc4a2d694002ad040cc33c3f308d8e67ce99063921ff02beb893
Instruction ID: 278b63c5cd9da670589dcce28745b520fb6a0bd96edcd45e1e38d129e6a88377
Opcode Fuzzy Hash: 1de1caba434abc4a2d694002ad040cc33c3f308d8e67ce99063921ff02beb893
Instruction Fuzzy Hash: 4E81D0799003149FC738CF66FD82BAE77B5FB94311F14815AE506A72B0EBB09A81CB51

Function 00C4FE10 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 573
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe", xrefs: 00C507EA
C:\daxjjwrfm\tkjnbticppc.exe, xrefs: 00C507EF
1BJ, xrefs: 00C50617

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CountSystemTickTime
String ID: 1BJ$C:\daxjjwrfm\tkjnbticppc.exe$mdziuzwugsse "c:\daxjjwrfm\qbpabupgx.exe"
API String ID: 2164215191-4072432483
Opcode ID: d7f176e43f62f33eaff8720c1da9f683f8072a78fd3040f58e684628b31bee44
Instruction ID: 3327bf09f8e074901b3137805bc160355f68a3070a00c1ab61fb8d1cc3f9e0d8
Opcode Fuzzy Hash: d7f176e43f62f33eaff8720c1da9f683f8072a78fd3040f58e684628b31bee44
Instruction Fuzzy Hash: DE42E279910300CBC728CF66EC92BAE37B1FB54312F14412AE806E72B1EBB49985DF55

Function 00C403B9 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 00C403F1
!|/0, xrefs: 00C40AE8

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID:
String ID: !|/0$/
API String ID: 0-3339975929
Opcode ID: 209cbbc81b236738233f946c0316a92cdc280870560d7d159244ad41577566fa
Instruction ID: f9f0bbc937961a0a6efce8afaa14585f164f02b57a0e9e8c9731bd67e3228c2c
Opcode Fuzzy Hash: 209cbbc81b236738233f946c0316a92cdc280870560d7d159244ad41577566fa
Instruction Fuzzy Hash: A50237799103108BC728DF65FC92BBE77B5FB50302F14812AE506A72E2EBB05A85DF51

Function 00C43060 Relevance: 4.8, APIs: 3, Instructions: 287
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?), ref: 00C4327A
WriteFile.KERNELBASE(?,?,00005000,00005000,00000000), ref: 00C4344B
CloseHandle.KERNELBASE(?), ref: 00C434DA

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 085a44ffb076184de5b005fb834d64481f60989b7a7834a563c7ee1b8d9cce52
Instruction ID: ded5e631bd5c2a1e5aa089fb3dc7cb30ecacb789a2c95bf1a3c18118f074a48d
Opcode Fuzzy Hash: 085a44ffb076184de5b005fb834d64481f60989b7a7834a563c7ee1b8d9cce52
Instruction Fuzzy Hash: E6C1D079A10750DBC724CF6AFC9176E33F5F794326B10811AE802DB2B5E7B49A82DB40

Function 00C47040 Relevance: 4.8, APIs: 3, Instructions: 256
libraryloaderencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75B30000,00000000), ref: 00C47229
GetProcAddress.KERNEL32(75B30000,00000000), ref: 00C47275
CryptGenRandom.ADVAPI32(00000000,00000004,00000000,00000000), ref: 00C473AD

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: AddressProc$CryptRandom
String ID:
API String ID: 646182245-0
Opcode ID: fb2fd2b4387557f972c45cae2adae5369798f5cd3c6e0d3b08f0521f08eda4e6
Instruction ID: 11b6f318b96e7d4ea2f7d50da576ccf7a8b9223669576600805f128da2e0b8d3
Opcode Fuzzy Hash: fb2fd2b4387557f972c45cae2adae5369798f5cd3c6e0d3b08f0521f08eda4e6
Instruction Fuzzy Hash: 9FB1EF79A14301CFDB28CF66FD9276E37B4F754312B10422AE902EB6B0E7B49981DB45

Function 00C4CBE0 Relevance: 2.1, APIs: 1, Instructions: 633COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000010), ref: 00C4CD44

Part of subcall function 00C240B0: lstrlen.KERNEL32(?,?,00C26175,?,00000104,?,00000001), ref: 00C240DD

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: ComputerNamelstrlen
String ID:
API String ID: 4141851928-0
Opcode ID: b888bbdd4a66559bc8100da321cf8c7fe95dfd22355603ed26d1f80c9209b7a9
Instruction ID: 48587ec9f71e1f2f15e6b9d5fbfcfeabcc5a62c33c2c2ebb3c97066b749a8c3e
Opcode Fuzzy Hash: b888bbdd4a66559bc8100da321cf8c7fe95dfd22355603ed26d1f80c9209b7a9
Instruction Fuzzy Hash: 3952E275910214CBC728DF66FC92BBE73B5FB54301F50812AE406A72B1EBB0AE84DB55

Function 00C45010 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00C4503B

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 660a246fb99b392578c5ff52bc281b36a4f3bbea229ffe86debfec820afa6a85
Instruction ID: 1e1d85db7a7a150e82ce13949132d92f1aa153f90563c93a39902f00cbb1df2e
Opcode Fuzzy Hash: 660a246fb99b392578c5ff52bc281b36a4f3bbea229ffe86debfec820afa6a85
Instruction Fuzzy Hash: D0F034B1D142098BCB14DF6AEC407AE7BB8FB14315B0049AAE809E3325F7B59600CF81

Function 00C2B531 Relevance: 12.2, APIs: 8, Instructions: 188
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(0138E380,Function_00014290,E4E0A1C8,?,00000072), ref: 00C2B669
SetServiceStatus.SECHOST(01399E70,00C667EC,?,00000072), ref: 00C2B70D
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000072), ref: 00C2B721
SetServiceStatus.ADVAPI32(01399E70,00C667EC,?,00000072), ref: 00C2B771
WaitForSingleObject.KERNEL32(00000228,00001388,?,00000072), ref: 00C2B7D0
SetServiceStatus.ADVAPI32(01399E70,00C667EC,00000072), ref: 00C2B82A
CloseHandle.KERNEL32(00000228), ref: 00C2B841
SetServiceStatus.ADVAPI32(01399E70,00C667EC), ref: 00C2B8AA

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 47b708a90b18336683586aa5225080a29007cc1f06000f25ce098f9fecc4b0e2
Instruction ID: 39497ead33e6e4802ce9c20eaccc27a0af33e47a3622822900902169b136cbb2
Opcode Fuzzy Hash: 47b708a90b18336683586aa5225080a29007cc1f06000f25ce098f9fecc4b0e2
Instruction Fuzzy Hash: E981AB795113118FC328CF27FD95B2E3BA5F798706B00852AE452DB6B4EBF49885CB40

Function 00C3C250 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?), ref: 00C3C312
Process32First.KERNEL32(00000000,?), ref: 00C3C35A
Process32Next.KERNEL32(00000000,00000128), ref: 00C3C478

Strings

7<.s, xrefs: 00C3C2AC, 00C3C2B8

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID: 7<.s
API String ID: 1238713047-2747411034
Opcode ID: 3da0f80bc4fb5c16b44cef3e8104415cb39337c8694f1a792a6ec139368b19d9
Instruction ID: 58d835429f4d65483950b2ba509ebf8f5a9f623c4108c45134b984bd6b832ff1
Opcode Fuzzy Hash: 3da0f80bc4fb5c16b44cef3e8104415cb39337c8694f1a792a6ec139368b19d9
Instruction Fuzzy Hash: 04510579510311CBD724CF22FD957BD37B5FB44305F10811AE946AA6B4EBB48980CF91

Function 00C438B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00C507F9,00000000,00000000,00000000,00000008,00000000,00000000,?,?,?,?,?,?,?,00000001), ref: 00C43A0F
CloseHandle.KERNEL32(00C507F9,?,?,?,?,00000001), ref: 00C43A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000001), ref: 00C43A52

Strings

D, xrefs: 00C439D3

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 52bda8bfd04f5d61deb6ccad09312c75790ffd7867c6425c7350b1143a0ecdf3
Instruction ID: e740a4b00dc3a4562ba6c729d6c39bb989ccd98d4d4b6cb8efe2c1346cc09aa2
Opcode Fuzzy Hash: 52bda8bfd04f5d61deb6ccad09312c75790ffd7867c6425c7350b1143a0ecdf3
Instruction Fuzzy Hash: 3D4113759003049FD728DF5AEC91B6D37B5FB98712F10401AE506EB2B4E7F0A985CB85

Function 00C4C640 Relevance: 4.6, APIs: 3, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00C32591,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00C32591), ref: 00C4C701
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00C4C737
FreeSid.ADVAPI32(?), ref: 00C4C798

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 181c7dbd49076b4492166b90e72d74321cb8e9fa808bf23bbce3ca0e1c99850c
Instruction ID: 98a5a68fe2e052a049d4e952aee6325c16b6f27a1d05ba9b1e95cf12741299ef
Opcode Fuzzy Hash: 181c7dbd49076b4492166b90e72d74321cb8e9fa808bf23bbce3ca0e1c99850c
Instruction Fuzzy Hash: 3F41BE39A05344DFC718CB69EDD6BAE7BB4FB58302B50815AE502E7271E770AA84CF05

Function 00C3C389 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Process32Next.KERNEL32(00000000,00000128), ref: 00C3C478
CloseHandle.KERNELBASE(00000000), ref: 00C3C4D5

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseHandleNextProcess32
String ID:
API String ID: 4007157957-0
Opcode ID: d08fdae7a5bb610bbc429520bcfb5d6879abda07f1140661213fa8f5260f9bd6
Instruction ID: 395894d4e41fffdbb436252c512befbe393b4c2a00fb38a596bd333cb948b1bf
Opcode Fuzzy Hash: d08fdae7a5bb610bbc429520bcfb5d6879abda07f1140661213fa8f5260f9bd6
Instruction Fuzzy Hash: 9A31F275910310CFD738DF22ED95BEE33B5FB84305F10855AE945AA260E7B49A84CFA0

Function 00C36F00 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00C39195,021A1850,?,?,?,?,?,00C46DD6), ref: 00C36F59
RtlAllocateHeap.NTDLL(00000000,?,00C39195,021A1850,?,?,?,?,?,00C46DD6), ref: 00C36F60

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 0deafb8502617fd8449614fa0650b960843ed2cb6a43d4df8ecc67a4914d79a6
Instruction ID: 5d23b4825fab11647d4e0c6cdd883ebf9c8c616eca6d6fc4ac8832c69a38b1f2
Opcode Fuzzy Hash: 0deafb8502617fd8449614fa0650b960843ed2cb6a43d4df8ecc67a4914d79a6
Instruction Fuzzy Hash: BBF08235515B018BCB18DB65FD99B3937E9EB49642B044014F106975A0EAF5958087D8

Function 00C3C520 Relevance: 3.0, APIs: 2, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000002,?,00C4387D,00003C1C,00003C1C,00000000,-00000002,00000000,?,00C2622A,00000002,00000000,?,00000000,00003C1C), ref: 00C3C549
RtlFreeHeap.NTDLL(00000000,?,00C4387D,00003C1C,00003C1C,00000000,-00000002,00000000,?,00C2622A,00000002,00000000,?,00000000,00003C1C,00000002), ref: 00C3C550

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 27951d0f6cf1741b5b201ccc392c817166c7cf3041cbea264b5803a264028383
Instruction ID: 168ec6773f563c978b70c78886940b25d7bc8ec178bb0fc3507444b0140daa40
Opcode Fuzzy Hash: 27951d0f6cf1741b5b201ccc392c817166c7cf3041cbea264b5803a264028383
Instruction Fuzzy Hash: BEF0E5758083048FDA24DF59EC9577D37F4EB04305F00040AE906E7260E7B4F880DB59

Function 00C32290 Relevance: 3.0, APIs: 2, Instructions: 21stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00C3C420,00000000,?,00C3C420,?), ref: 00C322A2
CharLowerBuffA.USER32(00C3C420,00000000,?,00C3C420,?), ref: 00C322BE

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 27d89a4eb37636c7007056e70656f6b72f6b92f636a8ae555f8aa19a005c3723
Instruction ID: 46e50e327289ac05d94bb40e86e8be2799c2658f43b559add032de1ec0e0bf6f
Opcode Fuzzy Hash: 27d89a4eb37636c7007056e70656f6b72f6b92f636a8ae555f8aa19a005c3723
Instruction Fuzzy Hash: EDE0DF761146209BC3209F9AFC493FD37ECFA083063040256F549D31B0EBE458818390

Function 00C272E0 Relevance: 1.7, APIs: 1, Instructions: 162fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00C27452

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eea857ff1e495d68cbfccee7c1fb5ab4ceca79b3d0a661d23408fd94f136b3f0
Instruction ID: 2469d65554ec55503c909d2f1715713bbe2cd3706913c335fc3fa83d53030910
Opcode Fuzzy Hash: eea857ff1e495d68cbfccee7c1fb5ab4ceca79b3d0a661d23408fd94f136b3f0
Instruction Fuzzy Hash: B751E47AA043108FD328DF2AFC9276D37B5F784712F14812AE502E76B1E7B49981CB55

Function 00C435C0 Relevance: 1.7, APIs: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000708,80000000,00000000,00000000,00000003,00000000,00000000,?,?,00000708,00000000), ref: 00C43753

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0e5ef310c89e2ae24d9506f43ffe3ee35cfb8cb9b3301129f89b9abc9a6d1f07
Instruction ID: b857225ad9a889c750e219a6af87e07fceb97adb9347b199e0e662f3784999bd
Opcode Fuzzy Hash: 0e5ef310c89e2ae24d9506f43ffe3ee35cfb8cb9b3301129f89b9abc9a6d1f07
Instruction Fuzzy Hash: 965104B6A003109BD724CF66FC92B2D37E5FB54716F14422AE946DB3B0E7B49981CB90

Function 00C46D32 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00C220E0: GetStdHandle.KERNEL32(000000F6,?,?,00C46D5F), ref: 00C22113
Part of subcall function 00C220E0: GetStdHandle.KERNEL32(000000F5,?,?,00C46D5F), ref: 00C22145
Part of subcall function 00C220E0: GetStdHandle.KERNEL32(000000F4,?,?,00C46D5F), ref: 00C22198

ExitProcess.KERNEL32 ref: 00C46E44

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Handle$ExitProcess
String ID:
API String ID: 256993070-0
Opcode ID: 12962d104f23e1470c23c905f82df49c1f7e053d2a1ef9cea772e9cf7e4a913f
Instruction ID: 026dffe97dfa0d94c362bca78d592a41f6cc1e8fc17d6393dd601a70a9827d72
Opcode Fuzzy Hash: 12962d104f23e1470c23c905f82df49c1f7e053d2a1ef9cea772e9cf7e4a913f
Instruction Fuzzy Hash: D721DB3AA1161087C728DF75FC9237D37A2E7547223048526EC0187B79FBB58985D742

Function 00C4C080 Relevance: 1.4, APIs: 1, Instructions: 153sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8,00000000,?,00C5007D,?,00000708,00000000), ref: 00C4C1C3

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0134f85939a54ce6b64de188d5af9143f9193aa6c021d70e025f8ff1af669f3b
Instruction ID: 720861b5f9bb03d176f1e158e2a261ba644c73331d842ce0d63a636675c52084
Opcode Fuzzy Hash: 0134f85939a54ce6b64de188d5af9143f9193aa6c021d70e025f8ff1af669f3b
Instruction Fuzzy Hash: AD5114359013109BD378DB26EC8273E37F4FB94721B10452AE842EB6B1E7F88981DB91

Non-executed Functions

Function 00C4EEB0 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 444pipeprocessfileCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000,?,00000000,00000001), ref: 00C4F00B
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00C4F086
CreatePipe.KERNEL32(?,00000000,0000000C,00000000), ref: 00C4F0A6
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00C4F147
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00C4F2C2
CloseHandle.KERNEL32(00000000), ref: 00C4F353
CloseHandle.KERNEL32(?), ref: 00C4F367
CloseHandle.KERNEL32(00000000), ref: 00C4F37B
CloseHandle.KERNEL32(00000000), ref: 00C4F3A9
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00C4F446
CloseHandle.KERNEL32(00000000), ref: 00C4F4D4
CloseHandle.KERNEL32(00000000), ref: 00C4F4E8
WaitForSingleObject.KERNEL32(?,00002710), ref: 00C4F56B
CloseHandle.KERNEL32(?), ref: 00C4F586
CloseHandle.KERNEL32(?), ref: 00C4F5A7

Strings

;8\w, xrefs: 00C4F4FA
<,]8, xrefs: 00C4F2D1
D, xrefs: 00C4F1D6

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: ;8\w$<,]8$D
API String ID: 1130065513-4129721015
Opcode ID: b4a01b9094b357c70b3e22e30c83272c8e211c53b8f5738fc36d28c5223fb3a9
Instruction ID: 01ef8e09c7d39b3fcec481019ec6bbc3597065f85c91c44083ee7afdf543c2eb
Opcode Fuzzy Hash: b4a01b9094b357c70b3e22e30c83272c8e211c53b8f5738fc36d28c5223fb3a9
Instruction Fuzzy Hash: 7012B179A10305DFC728CF66ED91BAE37B5FB54712B10812EE802E7674E7B49981CB50

Function 00C4B7F0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 387processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00C4B8EC
Process32First.KERNEL32(00000000,00000128), ref: 00C4BA96

Strings

9y8, xrefs: 00C4BC13

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: 9y8
API String ID: 2353314856-3592070472
Opcode ID: a509cd831d2957a1e58132455f4f391174a3567127747acfbb2749b8138aa9fb
Instruction ID: 5a981726b936463b42c025025e10217c102ddf8a4acd4d7fc7767faa8541fd5f
Opcode Fuzzy Hash: a509cd831d2957a1e58132455f4f391174a3567127747acfbb2749b8138aa9fb
Instruction Fuzzy Hash: FBF1F279A103118BC728CF2AED9277E37F5FB94312B14821AE406E72B4E7B49981DB51

Function 00C38200 Relevance: 13.7, APIs: 9, Instructions: 167serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00C3826F
CreateServiceA.ADVAPI32(00000000,0138E380,0138E380,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00C382CA
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00C38301
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00C38323
CloseServiceHandle.ADVAPI32(00000000), ref: 00C3833A
OpenServiceA.ADVAPI32(00000000,0138E380,00000010), ref: 00C3838B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00C383C2
CloseServiceHandle.ADVAPI32(00000000), ref: 00C38408
CloseServiceHandle.ADVAPI32(00000000), ref: 00C38481

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: 0e838e06b8785c7908354440433ad9990493afbb4a7799af6d4550d034746d48
Instruction ID: afe736519a34db089f2a2e520e674b434682a6b41ddf92132de2ee14333fd2b7
Opcode Fuzzy Hash: 0e838e06b8785c7908354440433ad9990493afbb4a7799af6d4550d034746d48
Instruction Fuzzy Hash: FF61BB79A147019BD324CB2AFC96B3E37F4F794B02F14411AE802E66B0EBB499C5CB41

Function 00C4A050 Relevance: 7.8, APIs: 5, Instructions: 288serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,?,00000000,00000001), ref: 00C4A124
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,0000000A,?,00000000,?,00000000,00000001), ref: 00C4A164
GetLastError.KERNEL32(?,00000000,00000001), ref: 00C4A176
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,-0000001A,0000000A,?,00000000,00000001), ref: 00C4A24F

Part of subcall function 00C2BBA0: wvsprintfA.USER32(00000000,?,00C409D1), ref: 00C2BBEB

CloseServiceHandle.ADVAPI32(00000000,00000001), ref: 00C4A44C

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenServicewvsprintf
String ID:
API String ID: 475583450-0
Opcode ID: 102110815f849b1461dbf1e4ac89a65ce9a9b66e907b3155c7cf7a52ce65d8bf
Instruction ID: 25a56536193cc54c083ddf711098abe94a30b895370eb34e9a6e02d142cfda68
Opcode Fuzzy Hash: 102110815f849b1461dbf1e4ac89a65ce9a9b66e907b3155c7cf7a52ce65d8bf
Instruction Fuzzy Hash: A6C1C275A10300DBD728CF66FD81B6E77F5FB98301F00812AE506EB2A0E7B09981CB52

Function 00C2B150 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00C2B1D7
GetFileTime.KERNEL32(00000000,?,?,?), ref: 00C2B256
CloseHandle.KERNEL32(00000000), ref: 00C2B26B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C2B2E7
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00C2B31A
CloseHandle.KERNEL32(00000000), ref: 00C2B334

Strings

td9k, xrefs: 00C2B23D

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: td9k
API String ID: 3236713533-1579400769
Opcode ID: a2f9ad8818275fe3093486bd5c2f28add0982fa80407cfbd3cead665d4809743
Instruction ID: 59c71cd85bb24754a791db859f5a2488f2ac14479dcc173ae46c4993fbed2ef9
Opcode Fuzzy Hash: a2f9ad8818275fe3093486bd5c2f28add0982fa80407cfbd3cead665d4809743
Instruction Fuzzy Hash: 6151BE79A113059BC324CF6AFC81B6E77B4FB84315F14825AE805EB6A0E7B09D81CF85

Function 00C4A760 Relevance: 10.8, APIs: 7, Instructions: 266fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,000000FF), ref: 00C4A7F1
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,000000FF), ref: 00C4A849
CloseHandle.KERNEL32(00000000,?,?,000000FF), ref: 00C4A885
GetTickCount.KERNEL32 ref: 00C4A8B8
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00C4AA75
WriteFile.KERNEL32(00000000,000000FF,?,?,00000000), ref: 00C4AAC8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C4AAE2

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID:
API String ID: 3478262135-0
Opcode ID: c6734794152b148b414685db143f2f1313d9aef52f2cc9dbf49147f19715509a
Instruction ID: 399071e6b7019a3282550c9bab9fc3b6edde57d4257d3cc74b23c537e1f46ef2
Opcode Fuzzy Hash: c6734794152b148b414685db143f2f1313d9aef52f2cc9dbf49147f19715509a
Instruction Fuzzy Hash: 48A111796003109FD324DF26EC82B7E33B5FB88712F14411AF805E72A4E7B49881DB96

Function 00C41E90 Relevance: 10.7, APIs: 7, Instructions: 238processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000), ref: 00C41F5E
Process32First.KERNEL32(00000000,00000128), ref: 00C41FDC
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C420A2

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: eb599a0a2ad7b78b273dff56c19b3c5a6ba9b65304ed4835e29ff3d80e12c26a
Instruction ID: 0c22815f6a45fc00360ef1625713fd14410cbca0d40cf4e9a3030f933a9ddd72
Opcode Fuzzy Hash: eb599a0a2ad7b78b273dff56c19b3c5a6ba9b65304ed4835e29ff3d80e12c26a
Instruction Fuzzy Hash: B3A1ACB9A01310CBD728DF26ED927AD77B5FB54312B10421AE806EA274E7B49A85CF50

Function 00C4BADC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182processCOMMON

Download Yara Rule

APIs

Part of subcall function 00C240B0: lstrlen.KERNEL32(?,?,00C26175,?,00000104,?,00000001), ref: 00C240DD

CreateToolhelp32Snapshot.KERNEL32(00000008,?,00000000), ref: 00C4BC6C
Module32First.KERNEL32(00000000,00000224), ref: 00C4BCE6
CloseHandle.KERNEL32(00000000,0000000A,?,00000000), ref: 00C4BE0E
Process32Next.KERNEL32(?,00000128), ref: 00C4BE48
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00C4BE96

Strings

9y8, xrefs: 00C4BC13

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseHandle$CreateFirstModule32NextProcess32SnapshotToolhelp32lstrlen
String ID: 9y8
API String ID: 2493088380-3592070472
Opcode ID: 957f447c795746c93170f6e6cf1f0fb11a0dd294f36b967b142c2fd504e415f0
Instruction ID: 87e42218570d7874c499c591672e39235957a8199cdc65450910efda2d370e89
Opcode Fuzzy Hash: 957f447c795746c93170f6e6cf1f0fb11a0dd294f36b967b142c2fd504e415f0
Instruction Fuzzy Hash: 4B71D275A00301CBDB28DF2AED92B7E37F5FB94311B10825AE806D7264EBB49D81CB51

Function 00C41FF6 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 00C32290: lstrlen.KERNEL32(00C3C420,00000000,?,00C3C420,?), ref: 00C322A2
Part of subcall function 00C32290: CharLowerBuffA.USER32(00C3C420,00000000,?,00C3C420,?), ref: 00C322BE

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C420A2
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C42132
CloseHandle.KERNEL32(00000000), ref: 00C4217B
Process32Next.KERNEL32(00000000,00000128), ref: 00C42228
CloseHandle.KERNEL32(00000000), ref: 00C4227B

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseHandleProcess$BuffCharLowerNextOpenProcess32Terminatelstrlen
String ID:
API String ID: 3465298759-0
Opcode ID: b42abe835ba7bbacc4d246e5f45870d34447cd8f04f4c36439c3ce38e9c37d42
Instruction ID: 95345730cbf33f9fc6f287cf766c15185f8e17b7cc0699fdfad0047a7ca68599
Opcode Fuzzy Hash: b42abe835ba7bbacc4d246e5f45870d34447cd8f04f4c36439c3ce38e9c37d42
Instruction Fuzzy Hash: D661EF79A01300CBC728DF16ED92BAD77B5FB54316B10421AE902EB274E7B4AE81CF54

Function 00C41950 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,00C48262,00C21300,00000001,?), ref: 00C4199B
CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 00C419C2
CloseHandle.KERNEL32(00000000,?,00C48262,00C21300,00000001,?), ref: 00C419DD
WaitForSingleObject.KERNEL32(?,000000FF,?,00C48262,00C21300,00000001,?), ref: 00C419F2
CloseHandle.KERNEL32(?,?,000000FF,?,00C48262,00C21300,00000001,?), ref: 00C41A19

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 1d673c09347c5b778a0d9f49783e3cd5ffb13ad175b7031af4138df21d9ddba4
Instruction ID: 60b3a6737ce8111001ba2042f8d83a399b39eac78a1103c10109da9b3f091cd3
Opcode Fuzzy Hash: 1d673c09347c5b778a0d9f49783e3cd5ffb13ad175b7031af4138df21d9ddba4
Instruction Fuzzy Hash: E021B47A2003009FD324DF61ED96B1A3BA4FB48711F10861AF556EB6B4D7F0D880CB55

Function 00C37110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,00000000,?), ref: 00C37221
RegSetValueExA.ADVAPI32(?,0138E5F8,00000000,00000001,?,00000000), ref: 00C372E0
RegCloseKey.ADVAPI32(?), ref: 00C37300

Strings

IR, xrefs: 00C37313

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseOpenValue
String ID: IR
API String ID: 779948276-3379982419
Opcode ID: a13e67a17cd77830a4613271af499fc5a9d89a009339c6d632268fc77772059d
Instruction ID: 4354206dd284ed0ebcce9cd3b6dc899cb20abeda9d527e6a538c0b336282b113
Opcode Fuzzy Hash: a13e67a17cd77830a4613271af499fc5a9d89a009339c6d632268fc77772059d
Instruction Fuzzy Hash: 1041357A6202109BD724DF26EC81B7E37B5F798722B14421AE806D7770E7F88881DB55

Function 00C4E880 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00C4E966
ReadFile.KERNEL32(00000000,?,00005000,00000000,00000000), ref: 00C4E9D7
CloseHandle.KERNEL32(00000000,?,?), ref: 00C4EADD

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: ccb1e1f293daae491e90f1481e0d2194ac6bc47cbf07ea799c7437f8046d4688
Instruction ID: b830d925e9e655bda780b2e2dd6e70e686c9a3d470e33ace28bdd9ca2414c7c6
Opcode Fuzzy Hash: ccb1e1f293daae491e90f1481e0d2194ac6bc47cbf07ea799c7437f8046d4688
Instruction Fuzzy Hash: A281AC796003049FD328DF6AFC92B6E37B5F794312F104519E906A72E1DBB0A981CB95

Function 00C4FAD0 Relevance: 6.0, APIs: 4, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,00C50A87,00000000,?), ref: 00C4FAF7
RtlReAllocateHeap.NTDLL(00000000,?,00C50A87,00000000), ref: 00C4FAFE
GetProcessHeap.KERNEL32(00000000,?,?,00C50A87,00000000,?), ref: 00C4FB19
HeapAlloc.KERNEL32(00000000,?,00C50A87,00000000,?), ref: 00C4FB20

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 6a9b307513d07751938ce3d6bfdcf9cb6a5d614583be97fec7e5e32c2671081f
Instruction ID: 5be6cd3ae5cf836648234f24263f2f80258bc19e9797f044cc22d0c713257890
Opcode Fuzzy Hash: 6a9b307513d07751938ce3d6bfdcf9cb6a5d614583be97fec7e5e32c2671081f
Instruction Fuzzy Hash: 7FF01C75111304EFDB149FB1EC09B6E3BA8FB88612F108108F919A75A0DB719981CB61

Function 00C23DC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000001,?,?,00C4FF15), ref: 00C23E43
__aulldiv.LIBCMT ref: 00C23E74

Strings

L9<8, xrefs: 00C23F4F

Memory Dump Source

Source File: 00000003.00000002.2929597877.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000003.00000002.2929572607.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929628969.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929646445.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929663103.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2929687520.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Time$FileSystem__aulldiv
String ID: L9<8
API String ID: 2838486344-2160928743
Opcode ID: 5e4bdf103d32c12a6550758f118c10bdab541659b43494e8eb48d7298e38a550
Instruction ID: 9239562ddc877d5857c0f034668051a1bfe336b3bfbb5b067fded4b9c01aa179
Opcode Fuzzy Hash: 5e4bdf103d32c12a6550758f118c10bdab541659b43494e8eb48d7298e38a550
Instruction Fuzzy Hash: E8413779A103608BC728CF46FD9173D37B2FB98716710415ED403ABAB0D7B89981CB80

Analysis Process: tkjnbticppc.exePID: 7120, Parent PID: 6216COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1386
Total number of Limit Nodes:	14

Executed Functions

Function 000B2490 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 918
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(000EEAC8), ref: 000B2572
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 000B26EF
DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 000B2843
RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 000B289F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 000B293F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000B29E1
CreateDirectoryA.KERNEL32(?,00000000), ref: 000B2CAC
CreateDirectoryA.KERNEL32(?,00000000), ref: 000B2D6E
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 000B2EB0
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 000B307B
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 000B31FA
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 000B344D

Strings

C:\Windows\system32\config\systemprofile, xrefs: 000B2B0A, 000B2BCC
C:\daxjjwrfm\, xrefs: 000B2960, 000B2CC9, 000B3032, 000B321C
\, xrefs: 000B2F41
Wq0O, xrefs: 000B2FE3

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\daxjjwrfm\$Wq0O$\
API String ID: 1691758827-4043548932
Opcode ID: 569bb66026727e547d58760e87819f5d021c40407d1d6f1dcef6d4506782d12c
Instruction ID: 87acc9f2b3ec79cb01eec3e7816153f2a02152d6a6a55fc29006e7c254a3a964
Opcode Fuzzy Hash: 569bb66026727e547d58760e87819f5d021c40407d1d6f1dcef6d4506782d12c
Instruction Fuzzy Hash: 248226B1A01285CBF704DF64ECD2ABA37B5F754B11B10812BE905EF2A1EB7C9941CB61

Function 000C3060 Relevance: 4.8, APIs: 3, Instructions: 287
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 000C327A
WriteFile.KERNELBASE(?,?,00005000,00005000,00000000), ref: 000C344B
CloseHandle.KERNELBASE(?), ref: 000C34DA

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 82d4771bf7b06b16cfe93b9f0bd549e7e101a43c2f756ccd9485ab7163d5591b
Instruction ID: b6088611a9a0b0f8dc8aaa7d29f0d22596e0228b93b1763a8c67b26edb68e424
Opcode Fuzzy Hash: 82d4771bf7b06b16cfe93b9f0bd549e7e101a43c2f756ccd9485ab7163d5591b
Instruction Fuzzy Hash: 3BC1D076A21690CBF304CF68FCC1AAA33E5F754B25B14811BE805EF265E77C9981CB50

Function 000AB150 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 000AB1D7
GetFileTime.KERNEL32(00000000,?,?,?), ref: 000AB256
CloseHandle.KERNEL32(00000000), ref: 000AB26B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000AB2E7
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 000AB31A
CloseHandle.KERNEL32(00000000), ref: 000AB334

Strings

td9k, xrefs: 000AB23D

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: td9k
API String ID: 3236713533-1579400769
Opcode ID: 7dddfd65d1c49bbaa2c22b67d08ce43b1585ad0f40d9dca6f6c253134a4bf1ed
Instruction ID: 8d0b353ce76084141e7f749db556df9526b489f627e07b909f2013d3bfb2ebae
Opcode Fuzzy Hash: 7dddfd65d1c49bbaa2c22b67d08ce43b1585ad0f40d9dca6f6c253134a4bf1ed
Instruction Fuzzy Hash: C351E7756062859BF304DF68FCC0A6A77B5FB84B14F10826BE809DF260E7789940CF95

Function 000C1E90 Relevance: 10.7, APIs: 7, Instructions: 238
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000C1F5E
Process32First.KERNEL32(00000000,00000128), ref: 000C1FDC
OpenProcess.KERNEL32(00000001,00000000,?), ref: 000C20A2

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: fc70e331f7b647f43a1a27ed46146782552da5ed04df3dd1c3ae3295990c6140
Instruction ID: d5cee05cb7bdced5bae0e381ce9eae32c2056194a753fe72356db3494ebd3cc2
Opcode Fuzzy Hash: fc70e331f7b647f43a1a27ed46146782552da5ed04df3dd1c3ae3295990c6140
Instruction Fuzzy Hash: 38A1EE75602281DBF318DF14EDD1AA973A6FB64B10B00812FDC06EA675E73C9A40CF60

Function 000C38B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000008,00000000,00000000,?,00000000,?,?,?,?,?,00000000), ref: 000C3A0F
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 000C3A3E
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 000C3A52

Strings

D, xrefs: 000C39D3

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 95b76cd297ae5959acae51075e0d95adb8037e8e6ab16ebd8304d4af74fb2f90
Instruction ID: a114bc0bf912e2b097e42fd1cae6afa3279883183edb239ee636c80fa57b3672
Opcode Fuzzy Hash: 95b76cd297ae5959acae51075e0d95adb8037e8e6ab16ebd8304d4af74fb2f90
Instruction Fuzzy Hash: 2041FE71A122459BFB08CF58EDD1BA937B5FB58B05F00801FE906EB2A4D7B8A940CB55

Function 000BC250 Relevance: 6.1, APIs: 4, Instructions: 148
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000BC312
Process32First.KERNEL32(00000000,?), ref: 000BC35A
Process32Next.KERNEL32(00000000,00000128), ref: 000BC478

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: d451c2dc6d1c55748c647ed23daca88357854d7b14c251cd3411ae63b65b6ac4
Instruction ID: 00a2f028587fd54fade82d7947a2e4923c7edf9b7b60ba7e1a8a525384a49474
Opcode Fuzzy Hash: d451c2dc6d1c55748c647ed23daca88357854d7b14c251cd3411ae63b65b6ac4
Instruction Fuzzy Hash: 0B513675602291CBF714CF20FDD5AA937B5FB54B01F00801BE806AE2A4EB7C8A40CF61

Function 000BC520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,N,?,000D0A4E,00000000), ref: 000BC549
RtlFreeHeap.NTDLL(00000000,?,000D0A4E,00000000), ref: 000BC550

Strings

N, xrefs: 000BC543, 000BC546

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: N
API String ID: 3859560861-18607599
Opcode ID: 9e101f185f34021851a3675117394c76c604df97e54c4992b51f43b095c0f3ac
Instruction ID: 96d1656f41cba590a8d2b88007f497611a084d3e782e542557ae284057a672a0
Opcode Fuzzy Hash: 9e101f185f34021851a3675117394c76c604df97e54c4992b51f43b095c0f3ac
Instruction Fuzzy Hash: 57F0A0718092449FF608CF58ECD5A6537E4AB04B00B40440AE90ADB621D778A8C0CB7A

Function 000CC640 Relevance: 4.6, APIs: 3, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(000B2591,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,000B2591), ref: 000CC701
CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 000CC737
FreeSid.ADVAPI32(?), ref: 000CC798

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: be5c8f219b0b0cb30173dc01fa766fe8d83b99f143371ee27319aecfeceddc30
Instruction ID: 9386aeb9ac1b8e8d39882933a41d93eea373d87f842fe2fbfa5d438bed89c33e
Opcode Fuzzy Hash: be5c8f219b0b0cb30173dc01fa766fe8d83b99f143371ee27319aecfeceddc30
Instruction Fuzzy Hash: DA41D039606284DFF708CB68EDD5A6A77F5FB58700B50815FE906DB261E738A940CF21

Function 000B6F00 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,000B9195,021A1850,?,?,?,?,?,000C6DD6), ref: 000B6F59
RtlAllocateHeap.NTDLL(00000000,?,000B9195,021A1850,?,?,?,?,?,000C6DD6), ref: 000B6F60

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 3dbf250bd28e64f9c8eeefbda6d71a19d9ac7dafda9cdc6ee6c9ce8293c3d0da
Instruction ID: 24c0f4efd4e4520b2f24a9b1494bbe69ef390deab9de35dc3a146c06708b3dff
Opcode Fuzzy Hash: 3dbf250bd28e64f9c8eeefbda6d71a19d9ac7dafda9cdc6ee6c9ce8293c3d0da
Instruction Fuzzy Hash: FCF020B15017448BEB0CDB64FDC9B213BE9FB10B01704401AF906DB6B0EEBE9440CBA8

Function 000B2290 Relevance: 3.0, APIs: 2, Instructions: 21
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 000B22A2
CharLowerBuffA.USER32(?,00000000), ref: 000B22BE

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: d9ad0804795f67f49ba85aea370ccb1b7b49090ffc1101a37d601f7f71ee423c
Instruction ID: 0d218284b92bedf7b12c9eefb6a931d9eb40d581929eac19c5b2253588fa3203
Opcode Fuzzy Hash: d9ad0804795f67f49ba85aea370ccb1b7b49090ffc1101a37d601f7f71ee423c
Instruction Fuzzy Hash: C1E0DF321015A49BA3009F98FE884F5B3E8FB14B063085066E98DEA170EB2C6841C3A2

Function 000C2780 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 000C27B0

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3c85f98d95fbfbf7bca59f14bbac07f7413dce407331c5968decc49d84bc3334
Instruction ID: 7f8c7ea22c85c7a6a4e49f91cbbaa0862bafb6985123e7c9b219c5cf4f6c1daf
Opcode Fuzzy Hash: 3c85f98d95fbfbf7bca59f14bbac07f7413dce407331c5968decc49d84bc3334
Instruction Fuzzy Hash: 83D05E70120788CA9700AFA4FCC562137ACFB40B407401429A8058F264E37CE681C7E1

Non-executed Functions

Function 000CEEB0 Relevance: 33.7, APIs: 15, Strings: 4, Instructions: 444
pipeprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000,?,00000000,00000001), ref: 000CF00B
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 000CF086
CreatePipe.KERNEL32(?,00000000,0000000C,00000000), ref: 000CF0A6
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 000CF147
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 000CF2C2
CloseHandle.KERNEL32(00000000), ref: 000CF353
CloseHandle.KERNEL32(?), ref: 000CF367
CloseHandle.KERNEL32(00000000), ref: 000CF37B
CloseHandle.KERNEL32(00000000), ref: 000CF3A9
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 000CF446
CloseHandle.KERNEL32(00000000), ref: 000CF4D4
CloseHandle.KERNEL32(00000000), ref: 000CF4E8
WaitForSingleObject.KERNEL32(?,00002710), ref: 000CF56B
CloseHandle.KERNEL32(?), ref: 000CF586
CloseHandle.KERNEL32(?), ref: 000CF5A7

Strings

^K, xrefs: 000CF522, 000CF5F1, 000CF541
<,]8, xrefs: 000CF2D1
;8\w, xrefs: 000CF4FA
D, xrefs: 000CF1D6

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: ;8\w$<,]8$D$^K
API String ID: 1130065513-1617536871
Opcode ID: ee45c13b49e87ec7ea71eb26e74546c1264afe6f4abc59d920e59ca332bb51ac
Instruction ID: bdf609da975a03ef5f8c689c7a397c6318e273cdb473524950e6922ff74f08da
Opcode Fuzzy Hash: ee45c13b49e87ec7ea71eb26e74546c1264afe6f4abc59d920e59ca332bb51ac
Instruction Fuzzy Hash: 5312CF71605285DFE708CF68EDC5ABA37B6F758B11B14812FE806EB264E73C9940CB61

Function 000CB7F0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 387processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 000CB8EC
Process32First.KERNEL32(00000000,00000128), ref: 000CBA96

Strings

9y8, xrefs: 000CBC13

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: 9y8
API String ID: 2353314856-3592070472
Opcode ID: 960480ddf9eb9e801264665fd3dde503b44a210da654aac56187c0776708e153
Instruction ID: cd6243f3c696d8043c8ec6bfadd5babe3da1aa5662e00e58c34278c7eff8600d
Opcode Fuzzy Hash: 960480ddf9eb9e801264665fd3dde503b44a210da654aac56187c0776708e153
Instruction Fuzzy Hash: 07F1D2716112918BF718CF28EDD2A6937F5F794B10B04811FE806EB275EB7C9981CB61

Function 000B8200 Relevance: 13.7, APIs: 9, Instructions: 167serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 000B826F
CreateServiceA.ADVAPI32(00000000,00BAE1F8,00BAE1F8,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 000B82CA
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 000B8301
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 000B8323
CloseServiceHandle.ADVAPI32(00000000), ref: 000B833A
OpenServiceA.ADVAPI32(00000000,00BAE1F8,00000010), ref: 000B838B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 000B83C2
CloseServiceHandle.ADVAPI32(00000000), ref: 000B8408
CloseServiceHandle.ADVAPI32(00000000), ref: 000B8481

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: 8b78010f6ee0415ba996eefe6edd81904228cb4dc04e46ec24b050cf2f31c721
Instruction ID: ca62f801433cf3697ca7039dd43a8fb32e375ddab9a5694806f4dd21e956a47b
Opcode Fuzzy Hash: 8b78010f6ee0415ba996eefe6edd81904228cb4dc04e46ec24b050cf2f31c721
Instruction Fuzzy Hash: C6619A716066819BF3148B28FDC6B7537F8F754B01F14811BE945EA2B0EB7C9981CB61

Function 000A60A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 000A40B0: lstrlen.KERNEL32(?,?,000A1038,?), ref: 000A40DD

Sleep.KERNEL32(000003E8), ref: 000A6189
FindFirstFileA.KERNEL32(?,?), ref: 000A6274
DeleteFileA.KERNEL32(?), ref: 000A632E
FindNextFileA.KERNEL32(?,?), ref: 000A6384
FindClose.KERNEL32(?), ref: 000A63AA

Strings

ysh, xrefs: 000A6159, 000A6169

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleeplstrlen
String ID: ysh
API String ID: 3282225923-1904326249
Opcode ID: f343d1a4f289493efc99600daafcf6f1d3200c24c3ad6737e76550ca8702e10a
Instruction ID: 358c0b43d6d05277b84b8f9a1137cf467f31ac321ba00d36399da1dd50e0f76d
Opcode Fuzzy Hash: f343d1a4f289493efc99600daafcf6f1d3200c24c3ad6737e76550ca8702e10a
Instruction Fuzzy Hash: 9D811771901284DFF718DF64FDC2AA577B5FBA4B00F14815AE905AB2B0EB7C8941CB61

Function 000CA050 Relevance: 7.8, APIs: 5, Instructions: 288serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,?,00000000,00000001), ref: 000CA124
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,0000000A,?,00000000,?,00000000,00000001), ref: 000CA164
GetLastError.KERNEL32(?,00000000,00000001), ref: 000CA176
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,-0000001A,0000000A,?,00000000,00000001), ref: 000CA24F

Part of subcall function 000ABBA0: wvsprintfA.USER32(00000000,?,000C09D1), ref: 000ABBEB

CloseServiceHandle.ADVAPI32(00000000,00000001), ref: 000CA44C

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenServicewvsprintf
String ID:
API String ID: 475583450-0
Opcode ID: 06c334d233f486617f58fa397c6815d04ef5cc43faae2974ef71ef4bd5e8b4ed
Instruction ID: 31ed7980d7692bea477db2e0686332e9f803fd1a297f5dafb171965a3b12df83
Opcode Fuzzy Hash: 06c334d233f486617f58fa397c6815d04ef5cc43faae2974ef71ef4bd5e8b4ed
Instruction Fuzzy Hash: 5CC1C471A01284DBF354CF64FDC1AAA77F5FB95B14B00812BE905EF2A0E7789941CB62

Function 000AB531 Relevance: 12.2, APIs: 8, Instructions: 192registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00BAE1F8,Function_00014290,E4E0A1C8,?,?,00000072), ref: 000AB669
SetServiceStatus.ADVAPI32(00000000,000E67EC,?,?,00000072), ref: 000AB70D
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000072), ref: 000AB721
SetServiceStatus.ADVAPI32(00000000,000E67EC,?,?,00000072), ref: 000AB771
WaitForSingleObject.KERNEL32(00000000,00001388,?,?,00000072), ref: 000AB7D0
SetServiceStatus.ADVAPI32(00000000,000E67EC,00000072), ref: 000AB82A
CloseHandle.KERNEL32(00000000), ref: 000AB841
SetServiceStatus.ADVAPI32(00000000,000E67EC), ref: 000AB8AA

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: cfcf041b511d8cdc9cc110ff536ff3e3750b93f34bd4dfac37c00a2ae6b1722e
Instruction ID: 0b822858af5c3f7c2b494eae099b9377cc7b0dc935ac4e2e4819c88f45614c64
Opcode Fuzzy Hash: cfcf041b511d8cdc9cc110ff536ff3e3750b93f34bd4dfac37c00a2ae6b1722e
Instruction Fuzzy Hash: CB81CB7660A2D1CFF308CF29FDD58263BA1F768B05700851BE946AE2B5EB7D9441CB60

Function 000CA760 Relevance: 10.8, APIs: 7, Instructions: 266fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,000000FF), ref: 000CA7F1
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,000000FF), ref: 000CA849
CloseHandle.KERNEL32(00000000,?,?,000000FF), ref: 000CA885
GetTickCount.KERNEL32 ref: 000CA8B8
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 000CAA75
WriteFile.KERNEL32(00000000,000000FF,?,?,00000000), ref: 000CAAC8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000CAAE2

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID:
API String ID: 3478262135-0
Opcode ID: a8256ef979cb28c6de68f11587de6bddcba8d0039231a74a4474fe62ed44506d
Instruction ID: 100c90032a1079f8af353fcdc2bcf456ef7f6457af7c37bb1d32f681ed9bccc3
Opcode Fuzzy Hash: a8256ef979cb28c6de68f11587de6bddcba8d0039231a74a4474fe62ed44506d
Instruction Fuzzy Hash: 71A1F6756012809BF304DF64ECC2BBA33B5EB89B15F14401AF905EF2A5E77C9841CB66

Function 000C1950 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,000C8262,Function_00001300,00000001,?), ref: 000C199B
CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 000C19C2
CloseHandle.KERNEL32(00000000,?,000C8262,Function_00001300,00000001,?), ref: 000C19DD
WaitForSingleObject.KERNEL32(?,000000FF,?,000C8262,Function_00001300,00000001,?), ref: 000C19F2
CloseHandle.KERNEL32(?,?,000000FF,?,000C8262,Function_00001300,00000001,?), ref: 000C1A19

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 803f0749ba3a8f2dd57d6c2074fbb681d41df5ecf8a60f0b780a7b02301c2406
Instruction ID: 81035d989fc105b3c614516128b42ec99dc3f98429f77c053065c32441e03ef7
Opcode Fuzzy Hash: 803f0749ba3a8f2dd57d6c2074fbb681d41df5ecf8a60f0b780a7b02301c2406
Instruction Fuzzy Hash: BF21C0352063009FE314DF60ECD5B663BA4FB58B10F10811AF946AE6B4D7B9A840CF65

Function 000B7110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,00000000,?), ref: 000B7221
RegSetValueExA.ADVAPI32(?,00BB1C70,00000000,00000001,?,00000000), ref: 000B72E0
RegCloseKey.ADVAPI32(?), ref: 000B7300

Strings

IR, xrefs: 000B7313

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: CloseOpenValue
String ID: IR
API String ID: 779948276-3379982419
Opcode ID: 06db3419d1fcc4a4f6518152c0960569fe952cd0916fafe4ed6071d947008f29
Instruction ID: 4f53a1cb707dfa39a267da0ad6bc158ab62fde3a75e78a8f831bfb194b38257c
Opcode Fuzzy Hash: 06db3419d1fcc4a4f6518152c0960569fe952cd0916fafe4ed6071d947008f29
Instruction Fuzzy Hash: 2F4134752162909BF704DB28FCC5ABA37F5E794B11B14802BEC0AEB271E7BC8441DB65

Function 000CE880 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 000CE966
ReadFile.KERNEL32(00000000,?,00005000,00000000,00000000), ref: 000CE9D7
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 000CEADD

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: 80b51a5e929794dca0ea4d759970d35f65b4c30a3be018b8ed65c2c674e879e5
Instruction ID: 7ba4785a0715d5806e8f96347ab443403e12cbdc72a82210202d703fb39d79a5
Opcode Fuzzy Hash: 80b51a5e929794dca0ea4d759970d35f65b4c30a3be018b8ed65c2c674e879e5
Instruction Fuzzy Hash: 0181DF75602244DBF704DF68FC91BAA33F5F794B10F00855BE9059B2A1EB38A841CF65

Function 000CFAD0 Relevance: 6.0, APIs: 4, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,000D0A87,00000000,?,?,?,?,?,00000001), ref: 000CFAF7
RtlReAllocateHeap.NTDLL(00000000,?,000D0A87,00000000), ref: 000CFAFE
GetProcessHeap.KERNEL32(00000000,?,?,000D0A87,00000000,?,?,?,?,?,00000001), ref: 000CFB19
HeapAlloc.KERNEL32(00000000,?,000D0A87,00000000,?,?,?,?,?,00000001), ref: 000CFB20

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 7988c93b1ab2bb2dc5b3356d117fa3e952b4dc5f0df4fdc175c35b57ecdc651a
Instruction ID: 3ec43dcd4ee55399c9b11a6019a5c48c806c1f3ac2dcc724eff7dc0f094b9bb3
Opcode Fuzzy Hash: 7988c93b1ab2bb2dc5b3356d117fa3e952b4dc5f0df4fdc175c35b57ecdc651a
Instruction Fuzzy Hash: 11F03071112245EFFB049FB0FC49A6A3B69FF88B51F108045FD09DA6A0EB399940CB71

Function 000A3DC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001,00000001,00000000,00000001,00000000), ref: 000A3E43
__aulldiv.LIBCMT ref: 000A3E74

Strings

L9<8, xrefs: 000A3F4F

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: Time$FileSystem__aulldiv
String ID: L9<8
API String ID: 2838486344-2160928743
Opcode ID: 315d4ecf004d470ed980e853942af3af9063cc04f2a0eb5677ba56ee3d7126e2
Instruction ID: ed40cc72fa3a9a678b226b3707d7243b628796064e921938c65896fb154ca9d3
Opcode Fuzzy Hash: 315d4ecf004d470ed980e853942af3af9063cc04f2a0eb5677ba56ee3d7126e2
Instruction Fuzzy Hash: 07412376A122908FE758CF84FCD156977B6FB96B14310812FE807AF6A1D33C9941CBA1

Function 000C99B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 000C9A16
GetTickCount.KERNEL32 ref: 000C9B6B

Strings

@(l$, xrefs: 000C9ABD

Memory Dump Source

Source File: 00000004.00000002.2941536142.00000000000A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000004.00000002.2941519142.00000000000A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941564264.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941579088.00000000000D3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000D6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2941945731.00000000000EE000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2942023000.00000000000EF000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a0000_tkjnbticppc.jbxd

Similarity

API ID: CountSystemTickTime
String ID: @(l$
API String ID: 2164215191-2034585603
Opcode ID: e022d6b9a1c6bdc6d47de9775193bb2670a637d0d46394bc461f7d51aefaf872
Instruction ID: 48d9ced1e25090c14d5db78e4f46f596db0fa94807db9272d088186aaeb29f2c
Opcode Fuzzy Hash: e022d6b9a1c6bdc6d47de9775193bb2670a637d0d46394bc461f7d51aefaf872
Instruction Fuzzy Hash: E041A072902290CBF344DF28ECC296A37A1FB94B15314812BD846EE671EB7D9941CB61

Analysis Process: qbpabupgx.exePID: 7084, Parent PID: 3960COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1927
Total number of Limit Nodes:	19

Executed Functions

Function 00C300C1 Relevance: 56.1, APIs: 29, Strings: 2, Instructions: 1866sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 00C303F9
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00C30427
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00C3046A
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00C30496
GetTickCount.KERNEL32 ref: 00C30587
GetCommandLineA.KERNEL32 ref: 00C3063E
Sleep.KERNEL32(000003E8), ref: 00C30CDF

Part of subcall function 00C2B150: CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00C2B1D7

Sleep.KERNEL32(00000D05), ref: 00C30BD2

Part of subcall function 00C2B150: GetFileTime.KERNEL32(00000000,?,?,?), ref: 00C2B256
Part of subcall function 00C2B150: CloseHandle.KERNEL32(00000000), ref: 00C2B26B

Sleep.KERNEL32(000007D0), ref: 00C30DD1
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00C30EA8
SetFileAttributesA.KERNEL32(?,00000080), ref: 00C30ECC
CopyFileA.KERNEL32(?,?,00000000), ref: 00C30EFE
SetFileAttributesA.KERNEL32(?,00000002), ref: 00C310B9
SetFileAttributesA.KERNEL32(?,00000080), ref: 00C310E7
GetCommandLineA.KERNEL32(00000000), ref: 00C3120E
GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 00C3132B

Part of subcall function 00C32290: lstrlen.KERNEL32(?), ref: 00C322A2
Part of subcall function 00C32290: CharLowerBuffA.USER32(?,00000000), ref: 00C322BE

MessageBoxA.USER32(00000000,00000004,00000005,00000000), ref: 00C31663

Part of subcall function 00C272E0: CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00C27452

CloseHandle.KERNEL32(FFFFFFFF), ref: 00C31AC5
SetFileAttributesA.KERNEL32(?,00000080), ref: 00C31AE1
CopyFileA.KERNEL32(?,?,00000000), ref: 00C31B07
SetFileAttributesA.KERNEL32(?,00000002), ref: 00C31B43
Sleep.KERNEL32(000003E8), ref: 00C31CAC
WSAStartup.WS2_32(00000202,?), ref: 00C31947

Part of subcall function 00C42780: ExitProcess.KERNEL32 ref: 00C427B0

Sleep.KERNEL32(000007D0), ref: 00C31DFC
SetFileAttributesA.KERNEL32(00C66680,00000080), ref: 00C31E27
CopyFileA.KERNEL32(?,00C66680,00000000), ref: 00C31E45
SetFileAttributesA.KERNEL32(00C66680,00000002), ref: 00C31E7B

Part of subcall function 00C4C080: Sleep.KERNEL32(000003E8), ref: 00C4C1C3

Part of subcall function 00C2BBA0: wvsprintfA.USER32(00000000,?,00C409D1), ref: 00C2BBEB

CreateThread.KERNEL32(00000000,00000000,Function_0002FE10,00000000,00000000,00000000), ref: 00C32194
Sleep.KERNEL32(0000C350), ref: 00C32210

Strings

C:\Users\user, xrefs: 00C303F3
x7;C, xrefs: 00C30C47

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$AttributesSleep$Create$CopyMutex$CloseCommandHandleLineModuleName$BuffCharCountEnvironmentExitLowerMessageProcessStartupThreadTickTimeVariablelstrlenwvsprintf
String ID: C:\Users\user$x7;C
API String ID: 1500488346-3147083300
Opcode ID: c9dd9cd269a22500438e56c139347f0ef2bdb2caa18119d7809544cfade5fea9
Instruction ID: 077a0fb35463b659fe0fb9efd544b7dc238cb0e9adabdb7f67757dfceb2c390e
Opcode Fuzzy Hash: c9dd9cd269a22500438e56c139347f0ef2bdb2caa18119d7809544cfade5fea9
Instruction Fuzzy Hash: CC03D279A103009FD728DF66ED92B6E37F5F754302F14812AE802E72B1EBB49981DB51

Function 00C32490 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 918
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00C6EAC8), ref: 00C32572
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00C326EF
DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00C32843
RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00C3289F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00C3293F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C329E1
CreateDirectoryA.KERNEL32(?,00000000), ref: 00C32CAC
CreateDirectoryA.KERNEL32(?,00000000), ref: 00C32D6E
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00C32EB0
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00C3307B
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00C331FA
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 00C3344D

Strings

C:\daxjjwrfm\, xrefs: 00C32960, 00C32CC9, 00C33032, 00C3321C
C:\Users\user, xrefs: 00C32B0A, 00C32BCC
\, xrefs: 00C32F41
Wq0O, xrefs: 00C32FE3

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Users\user$C:\daxjjwrfm\$Wq0O$\
API String ID: 1691758827-149769076
Opcode ID: 2d8f9dbe48c0a40ad6fc861f317515e55154273908a4fecd6897857f21812fe1
Instruction ID: 317744578c7124649babfebf0156ee9f210039166b148b18708adbd75975f653
Opcode Fuzzy Hash: 2d8f9dbe48c0a40ad6fc861f317515e55154273908a4fecd6897857f21812fe1
Instruction Fuzzy Hash: 91820579910305CBC728DF66EC927BE37B5FB54312F00812AE502E72B1EBB49A85DB51

Function 00C43060 Relevance: 4.8, APIs: 3, Instructions: 287
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00C4327A
WriteFile.KERNELBASE(?,?,00005000,00005000,00000000), ref: 00C4344B
CloseHandle.KERNELBASE(?), ref: 00C434DA

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 4fe8bcb534688b22f888f01159fbfc3967ed2a6549b050bdc728cc6452d8afc3
Instruction ID: ded5e631bd5c2a1e5aa089fb3dc7cb30ecacb789a2c95bf1a3c18118f074a48d
Opcode Fuzzy Hash: 4fe8bcb534688b22f888f01159fbfc3967ed2a6549b050bdc728cc6452d8afc3
Instruction Fuzzy Hash: E6C1D079A10750DBC724CF6AFC9176E33F5F794326B10811AE802DB2B5E7B49A82DB40

Function 00C4C640 Relevance: 4.6, APIs: 3, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00C32591,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00C32591), ref: 00C4C701
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00C4C737
FreeSid.ADVAPI32(?), ref: 00C4C798

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 181c7dbd49076b4492166b90e72d74321cb8e9fa808bf23bbce3ca0e1c99850c
Instruction ID: 98a5a68fe2e052a049d4e952aee6325c16b6f27a1d05ba9b1e95cf12741299ef
Opcode Fuzzy Hash: 181c7dbd49076b4492166b90e72d74321cb8e9fa808bf23bbce3ca0e1c99850c
Instruction Fuzzy Hash: 3F41BE39A05344DFC718CB69EDD6BAE7BB4FB58302B50815AE502E7271E770AA84CF05

Function 00C36F00 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00C39195,021A1850,?,?,?,?,?,00C46DD6), ref: 00C36F59
RtlAllocateHeap.NTDLL(00000000,?,00C39195,021A1850,?,?,?,?,?,00C46DD6), ref: 00C36F60

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 0deafb8502617fd8449614fa0650b960843ed2cb6a43d4df8ecc67a4914d79a6
Instruction ID: 5d23b4825fab11647d4e0c6cdd883ebf9c8c616eca6d6fc4ac8832c69a38b1f2
Opcode Fuzzy Hash: 0deafb8502617fd8449614fa0650b960843ed2cb6a43d4df8ecc67a4914d79a6
Instruction Fuzzy Hash: BBF08235515B018BCB18DB65FD99B3937E9EB49642B044014F106975A0EAF5958087D8

Function 00C3C520 Relevance: 3.0, APIs: 2, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00C50A4E,?,00C50A4E,00000000), ref: 00C3C549
RtlFreeHeap.NTDLL(00000000,?,00C50A4E,00000000), ref: 00C3C550

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 27951d0f6cf1741b5b201ccc392c817166c7cf3041cbea264b5803a264028383
Instruction ID: 168ec6773f563c978b70c78886940b25d7bc8ec178bb0fc3507444b0140daa40
Opcode Fuzzy Hash: 27951d0f6cf1741b5b201ccc392c817166c7cf3041cbea264b5803a264028383
Instruction Fuzzy Hash: BEF0E5758083048FDA24DF59EC9577D37F4EB04305F00040AE906E7260E7B4F880DB59

Function 00C32290 Relevance: 3.0, APIs: 2, Instructions: 21
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 00C322A2
CharLowerBuffA.USER32(?,00000000), ref: 00C322BE

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: BuffCharLowerlstrlen
String ID:
API String ID: 794975171-0
Opcode ID: 27d89a4eb37636c7007056e70656f6b72f6b92f636a8ae555f8aa19a005c3723
Instruction ID: 46e50e327289ac05d94bb40e86e8be2799c2658f43b559add032de1ec0e0bf6f
Opcode Fuzzy Hash: 27d89a4eb37636c7007056e70656f6b72f6b92f636a8ae555f8aa19a005c3723
Instruction Fuzzy Hash: EDE0DF761146209BC3209F9AFC493FD37ECFA083063040256F549D31B0EBE458818390

Function 00C272E0 Relevance: 1.7, APIs: 1, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00C27452

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ff9a6ce975d65d88b60ea674c874f2e84d0342880bcf0e7723c7f2ef4577adad
Instruction ID: 2469d65554ec55503c909d2f1715713bbe2cd3706913c335fc3fa83d53030910
Opcode Fuzzy Hash: ff9a6ce975d65d88b60ea674c874f2e84d0342880bcf0e7723c7f2ef4577adad
Instruction Fuzzy Hash: B751E47AA043108FD328DF2AFC9276D37B5F784712F14812AE502E76B1E7B49981CB55

Function 00C46D32 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C220E0: GetStdHandle.KERNEL32(000000F6,?,?,00C46D5F), ref: 00C22113
Part of subcall function 00C220E0: GetStdHandle.KERNEL32(000000F5,?,?,00C46D5F), ref: 00C22145
Part of subcall function 00C220E0: GetStdHandle.KERNEL32(000000F4,?,?,00C46D5F), ref: 00C22198

ExitProcess.KERNEL32 ref: 00C46E44

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Handle$ExitProcess
String ID:
API String ID: 256993070-0
Opcode ID: 12962d104f23e1470c23c905f82df49c1f7e053d2a1ef9cea772e9cf7e4a913f
Instruction ID: 026dffe97dfa0d94c362bca78d592a41f6cc1e8fc17d6393dd601a70a9827d72
Opcode Fuzzy Hash: 12962d104f23e1470c23c905f82df49c1f7e053d2a1ef9cea772e9cf7e4a913f
Instruction Fuzzy Hash: D721DB3AA1161087C728DF75FC9237D37A2E7547223048526EC0187B79FBB58985D742

Function 00C42780 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00C427B0

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 48b76c3e454a27478c75f43981c4ea385e2e3bb583a35ec5af57f202f6d06b30
Instruction ID: a54b1770b196b70304880f9f6c5da608009657fd9c0749f22eadca36b5ee3b73
Opcode Fuzzy Hash: 48b76c3e454a27478c75f43981c4ea385e2e3bb583a35ec5af57f202f6d06b30
Instruction Fuzzy Hash: E1D05E784203148B8724AF25FC957293BADFB407017801416E4058B630F3B4EA8287D1

Non-executed Functions

Function 00C4EEB0 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 444
pipeprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000,?,00000000,00000001), ref: 00C4F00B
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00C4F086
CreatePipe.KERNEL32(?,00000000,0000000C,00000000), ref: 00C4F0A6
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00C4F147
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00C4F2C2
CloseHandle.KERNEL32(00000000), ref: 00C4F353
CloseHandle.KERNEL32(?), ref: 00C4F367
CloseHandle.KERNEL32(00000000), ref: 00C4F37B
CloseHandle.KERNEL32(00000000), ref: 00C4F3A9
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00C4F446
CloseHandle.KERNEL32(00000000), ref: 00C4F4D4
CloseHandle.KERNEL32(00000000), ref: 00C4F4E8
WaitForSingleObject.KERNEL32(?,00002710), ref: 00C4F56B
CloseHandle.KERNEL32(?), ref: 00C4F586
CloseHandle.KERNEL32(?), ref: 00C4F5A7

Strings

D, xrefs: 00C4F1D6
;8\w, xrefs: 00C4F4FA
<,]8, xrefs: 00C4F2D1

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
String ID: ;8\w$<,]8$D
API String ID: 1130065513-4129721015
Opcode ID: b4a01b9094b357c70b3e22e30c83272c8e211c53b8f5738fc36d28c5223fb3a9
Instruction ID: 01ef8e09c7d39b3fcec481019ec6bbc3597065f85c91c44083ee7afdf543c2eb
Opcode Fuzzy Hash: b4a01b9094b357c70b3e22e30c83272c8e211c53b8f5738fc36d28c5223fb3a9
Instruction Fuzzy Hash: 7012B179A10305DFC728CF66ED91BAE37B5FB54712B10812EE802E7674E7B49981CB50

Function 00C4B7F0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 387
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00C4B8EC
Process32First.KERNEL32(00000000,00000128), ref: 00C4BA96

Strings

9y8, xrefs: 00C4BC13

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: 9y8
API String ID: 2353314856-3592070472
Opcode ID: 30fcde7de3886b4f75e5fc831f327378148b6d3deed390a88901523668ce0f57
Instruction ID: 5a981726b936463b42c025025e10217c102ddf8a4acd4d7fc7767faa8541fd5f
Opcode Fuzzy Hash: 30fcde7de3886b4f75e5fc831f327378148b6d3deed390a88901523668ce0f57
Instruction Fuzzy Hash: FBF1F279A103118BC728CF2AED9277E37F5FB94312B14821AE406E72B4E7B49981DB51

Function 00C38200 Relevance: 13.7, APIs: 9, Instructions: 167serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00C3826F
CreateServiceA.ADVAPI32(00000000,00F63FE8,00F63FE8,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00C382CA
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00C38301
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00C38323
CloseServiceHandle.ADVAPI32(00000000), ref: 00C3833A
OpenServiceA.ADVAPI32(00000000,00F63FE8,00000010), ref: 00C3838B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00C383C2
CloseServiceHandle.ADVAPI32(00000000), ref: 00C38408
CloseServiceHandle.ADVAPI32(00000000), ref: 00C38481

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
String ID:
API String ID: 3525021261-0
Opcode ID: 0e838e06b8785c7908354440433ad9990493afbb4a7799af6d4550d034746d48
Instruction ID: afe736519a34db089f2a2e520e674b434682a6b41ddf92132de2ee14333fd2b7
Opcode Fuzzy Hash: 0e838e06b8785c7908354440433ad9990493afbb4a7799af6d4550d034746d48
Instruction Fuzzy Hash: FF61BB79A147019BD324CB2AFC96B3E37F4F794B02F14411AE802E66B0EBB499C5CB41

Function 00C260A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00C240B0: lstrlen.KERNEL32(?,?,00C21038,?), ref: 00C240DD

Sleep.KERNEL32(000003E8), ref: 00C26189
FindFirstFileA.KERNEL32(?,?), ref: 00C26274
DeleteFileA.KERNEL32(?), ref: 00C2632E
FindNextFileA.KERNEL32(?,?), ref: 00C26384
FindClose.KERNEL32(?), ref: 00C263AA

Strings

ysh, xrefs: 00C26159, 00C26169

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextSleeplstrlen
String ID: ysh
API String ID: 3282225923-1904326249
Opcode ID: 7d76687d16e112ba32ec1badb49ea906a557971391a35faac4b3352bfdb74667
Instruction ID: 278b63c5cd9da670589dcce28745b520fb6a0bd96edcd45e1e38d129e6a88377
Opcode Fuzzy Hash: 7d76687d16e112ba32ec1badb49ea906a557971391a35faac4b3352bfdb74667
Instruction Fuzzy Hash: 4E81D0799003149FC738CF66FD82BAE77B5FB94311F14815AE506A72B0EBB09A81CB51

Function 00C4A050 Relevance: 7.8, APIs: 5, Instructions: 288serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,?,00000000,00000001), ref: 00C4A124
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,0000000A,?,00000000,?,00000000,00000001), ref: 00C4A164
GetLastError.KERNEL32(?,00000000,00000001), ref: 00C4A176
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,-0000001A,0000000A,?,00000000,00000001), ref: 00C4A24F

Part of subcall function 00C2BBA0: wvsprintfA.USER32(00000000,?,00C409D1), ref: 00C2BBEB

CloseServiceHandle.ADVAPI32(00000000,00000001), ref: 00C4A44C

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenServicewvsprintf
String ID:
API String ID: 475583450-0
Opcode ID: 594178828c7b078a2a6e08487dc62ac7a682f7a6166af5657b0c5c1379b2a2ce
Instruction ID: 25a56536193cc54c083ddf711098abe94a30b895370eb34e9a6e02d142cfda68
Opcode Fuzzy Hash: 594178828c7b078a2a6e08487dc62ac7a682f7a6166af5657b0c5c1379b2a2ce
Instruction Fuzzy Hash: A6C1C275A10300DBD728CF66FD81B6E77F5FB98301F00812AE506EB2A0E7B09981CB52

Function 00C403B9 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 420COMMON

Download Yara Rule

Strings

!|/0, xrefs: 00C40AE8
/, xrefs: 00C403F1
@(l$, xrefs: 00C40A8B, 00C40A91

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID:
String ID: !|/0$/$@(l$
API String ID: 0-3106747989
Opcode ID: 62a27755e7b2cd2d9bc1a2d61d89aa1b7a1525f3ac2cbfba381bf8b96f30cf1d
Instruction ID: f9f0bbc937961a0a6efce8afaa14585f164f02b57a0e9e8c9731bd67e3228c2c
Opcode Fuzzy Hash: 62a27755e7b2cd2d9bc1a2d61d89aa1b7a1525f3ac2cbfba381bf8b96f30cf1d
Instruction Fuzzy Hash: A50237799103108BC728DF65FC92BBE77B5FB50302F14812AE506A72E2EBB05A85DF51

Function 00C2B150 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00C2B1D7
GetFileTime.KERNEL32(00000000,?,?,?), ref: 00C2B256
CloseHandle.KERNEL32(00000000), ref: 00C2B26B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C2B2E7
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 00C2B31A
CloseHandle.KERNEL32(00000000), ref: 00C2B334

Strings

td9k, xrefs: 00C2B23D

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: td9k
API String ID: 3236713533-1579400769
Opcode ID: a2f9ad8818275fe3093486bd5c2f28add0982fa80407cfbd3cead665d4809743
Instruction ID: 59c71cd85bb24754a791db859f5a2488f2ac14479dcc173ae46c4993fbed2ef9
Opcode Fuzzy Hash: a2f9ad8818275fe3093486bd5c2f28add0982fa80407cfbd3cead665d4809743
Instruction Fuzzy Hash: 6151BE79A113059BC324CF6AFC81B6E77B4FB84315F14825AE805EB6A0E7B09D81CF85

Function 00C2B531 Relevance: 12.2, APIs: 8, Instructions: 188registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(00F63FE8,Function_00014290,E4E0A1C8,?,00000072), ref: 00C2B669
SetServiceStatus.ADVAPI32(00000000,00C667EC,?,00000072), ref: 00C2B70D
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000072), ref: 00C2B721
SetServiceStatus.ADVAPI32(00000000,00C667EC,?,00000072), ref: 00C2B771
WaitForSingleObject.KERNEL32(00000000,00001388,?,00000072), ref: 00C2B7D0
SetServiceStatus.ADVAPI32(00000000,00C667EC,00000072), ref: 00C2B82A
CloseHandle.KERNEL32(00000000), ref: 00C2B841
SetServiceStatus.ADVAPI32(00000000,00C667EC), ref: 00C2B8AA

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
String ID:
API String ID: 3399922960-0
Opcode ID: 47b708a90b18336683586aa5225080a29007cc1f06000f25ce098f9fecc4b0e2
Instruction ID: 39497ead33e6e4802ce9c20eaccc27a0af33e47a3622822900902169b136cbb2
Opcode Fuzzy Hash: 47b708a90b18336683586aa5225080a29007cc1f06000f25ce098f9fecc4b0e2
Instruction Fuzzy Hash: E981AB795113118FC328CF27FD95B2E3BA5F798706B00852AE452DB6B4EBF49885CB40

Function 00C4A760 Relevance: 10.8, APIs: 7, Instructions: 266fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,000000FF), ref: 00C4A7F1
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,000000FF), ref: 00C4A849
CloseHandle.KERNEL32(00000000,?,?,000000FF), ref: 00C4A885
GetTickCount.KERNEL32 ref: 00C4A8B8
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00C4AA75
WriteFile.KERNEL32(00000000,000000FF,?,?,00000000), ref: 00C4AAC8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C4AAE2

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$CloseCreateHandle$CountReadTickWrite
String ID:
API String ID: 3478262135-0
Opcode ID: 6bcea7c1e658168f33fb9aedfc2950abf94c4de7c062fc996d4ab7eab259bc74
Instruction ID: 399071e6b7019a3282550c9bab9fc3b6edde57d4257d3cc74b23c537e1f46ef2
Opcode Fuzzy Hash: 6bcea7c1e658168f33fb9aedfc2950abf94c4de7c062fc996d4ab7eab259bc74
Instruction Fuzzy Hash: 48A111796003109FD324DF26EC82B7E33B5FB88712F14411AF805E72A4E7B49881DB96

Function 00C41E90 Relevance: 10.7, APIs: 7, Instructions: 238processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C41F5E
Process32First.KERNEL32(00000000,00000128), ref: 00C41FDC
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C420A2

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
String ID:
API String ID: 3397401024-0
Opcode ID: 196b2614437a218df9c31e85585ddcaceb1f69257e7860745ee1d0f77e839c51
Instruction ID: 0c22815f6a45fc00360ef1625713fd14410cbca0d40cf4e9a3030f933a9ddd72
Opcode Fuzzy Hash: 196b2614437a218df9c31e85585ddcaceb1f69257e7860745ee1d0f77e839c51
Instruction Fuzzy Hash: B3A1ACB9A01310CBD728DF26ED927AD77B5FB54312B10421AE806EA274E7B49A85CF50

Function 00C4BADC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182processCOMMON

Download Yara Rule

APIs

Part of subcall function 00C240B0: lstrlen.KERNEL32(?,?,00C21038,?), ref: 00C240DD

CreateToolhelp32Snapshot.KERNEL32(00000008,?,00000000), ref: 00C4BC6C
Module32First.KERNEL32(00000000,00000224), ref: 00C4BCE6
CloseHandle.KERNEL32(00000000,0000000A,?,00000000), ref: 00C4BE0E
Process32Next.KERNEL32(?,00000128), ref: 00C4BE48
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00C4BE96

Strings

9y8, xrefs: 00C4BC13

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseHandle$CreateFirstModule32NextProcess32SnapshotToolhelp32lstrlen
String ID: 9y8
API String ID: 2493088380-3592070472
Opcode ID: bc2a9a8c608fd580a8be1590da89b2f7afc097c82f6181f4b0a8448afbcfbf4b
Instruction ID: 87e42218570d7874c499c591672e39235957a8199cdc65450910efda2d370e89
Opcode Fuzzy Hash: bc2a9a8c608fd580a8be1590da89b2f7afc097c82f6181f4b0a8448afbcfbf4b
Instruction Fuzzy Hash: 4B71D275A00301CBDB28DF2AED92B7E37F5FB94311B10825AE806D7264EBB49D81CB51

Function 00C41FF6 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 00C32290: lstrlen.KERNEL32(?), ref: 00C322A2
Part of subcall function 00C32290: CharLowerBuffA.USER32(?,00000000), ref: 00C322BE

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C420A2
TerminateProcess.KERNEL32(00000000), ref: 00C42132
CloseHandle.KERNEL32(00000000), ref: 00C4217B
Process32Next.KERNEL32(00000000,00000128), ref: 00C42228
CloseHandle.KERNEL32(00000000), ref: 00C4227B

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseHandleProcess$BuffCharLowerNextOpenProcess32Terminatelstrlen
String ID:
API String ID: 3465298759-0
Opcode ID: d415e5d1d141a166dd80f2df999c3f095c7d1480ece47de94d0e6585d9ff1028
Instruction ID: 95345730cbf33f9fc6f287cf766c15185f8e17b7cc0699fdfad0047a7ca68599
Opcode Fuzzy Hash: d415e5d1d141a166dd80f2df999c3f095c7d1480ece47de94d0e6585d9ff1028
Instruction Fuzzy Hash: D661EF79A01300CBC728DF16ED92BAD77B5FB54316B10421AE902EB274E7B4AE81CF54

Function 00C41950 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,00C48262,Function_00001300,00000001,?), ref: 00C4199B
CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 00C419C2
CloseHandle.KERNEL32(00000000,?,00C48262,Function_00001300,00000001,?), ref: 00C419DD
WaitForSingleObject.KERNEL32(?,000000FF,?,00C48262,Function_00001300,00000001,?), ref: 00C419F2
CloseHandle.KERNEL32(?,?,000000FF,?,00C48262,Function_00001300,00000001,?), ref: 00C41A19

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseCreateHandle$EventObjectSingleThreadWait
String ID:
API String ID: 1404307249-0
Opcode ID: 1d673c09347c5b778a0d9f49783e3cd5ffb13ad175b7031af4138df21d9ddba4
Instruction ID: 60b3a6737ce8111001ba2042f8d83a399b39eac78a1103c10109da9b3f091cd3
Opcode Fuzzy Hash: 1d673c09347c5b778a0d9f49783e3cd5ffb13ad175b7031af4138df21d9ddba4
Instruction Fuzzy Hash: E021B47A2003009FD324DF61ED96B1A3BA4FB48711F10861AF556EB6B4D7F0D880CB55

Function 00C37110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,00000000,?), ref: 00C37221
RegSetValueExA.ADVAPI32(?,00F64A38,00000000,00000001,?,00000000), ref: 00C372E0
RegCloseKey.ADVAPI32(?), ref: 00C37300

Strings

IR, xrefs: 00C37313

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseOpenValue
String ID: IR
API String ID: 779948276-3379982419
Opcode ID: 529507cd00321d5269b605191b6524bfb3f76dc89c403a6ac5eab91421aee697
Instruction ID: 4354206dd284ed0ebcce9cd3b6dc899cb20abeda9d527e6a538c0b336282b113
Opcode Fuzzy Hash: 529507cd00321d5269b605191b6524bfb3f76dc89c403a6ac5eab91421aee697
Instruction Fuzzy Hash: 1041357A6202109BD724DF26EC81B7E37B5F798722B14421AE806D7770E7F88881DB55

Function 00C438B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000008,00000000,00000000,?,00000000,?,?,?,?,?,00000000), ref: 00C43A0F
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00C43A3E
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00C43A52

Strings

D, xrefs: 00C439D3

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 52bda8bfd04f5d61deb6ccad09312c75790ffd7867c6425c7350b1143a0ecdf3
Instruction ID: e740a4b00dc3a4562ba6c729d6c39bb989ccd98d4d4b6cb8efe2c1346cc09aa2
Opcode Fuzzy Hash: 52bda8bfd04f5d61deb6ccad09312c75790ffd7867c6425c7350b1143a0ecdf3
Instruction Fuzzy Hash: 3D4113759003049FD728DF5AEC91B6D37B5FB98712F10401AE506EB2B4E7F0A985CB85

Function 00C4E880 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00C4E966
ReadFile.KERNEL32(00000000,?,00005000,00000000,00000000), ref: 00C4E9D7
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00C4EADD

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: e14053cf4295a43ae8c6d91044ca84d44e21ee1916df757bade71461a46187fc
Instruction ID: b830d925e9e655bda780b2e2dd6e70e686c9a3d470e33ace28bdd9ca2414c7c6
Opcode Fuzzy Hash: e14053cf4295a43ae8c6d91044ca84d44e21ee1916df757bade71461a46187fc
Instruction Fuzzy Hash: A281AC796003049FD328DF6AFC92B6E37B5F794312F104519E906A72E1DBB0A981CB95

Function 00C3C250 Relevance: 6.1, APIs: 4, Instructions: 148processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C3C312
Process32First.KERNEL32(00000000,?), ref: 00C3C35A
Process32Next.KERNEL32(00000000,00000128), ref: 00C3C478

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: e95dd7a08abb2b9165c934ef63315e95f72ef5e48f8c60781c84c3b750a17a7a
Instruction ID: 58d835429f4d65483950b2ba509ebf8f5a9f623c4108c45134b984bd6b832ff1
Opcode Fuzzy Hash: e95dd7a08abb2b9165c934ef63315e95f72ef5e48f8c60781c84c3b750a17a7a
Instruction Fuzzy Hash: 04510579510311CBD724CF22FD957BD37B5FB44305F10811AE946AA6B4EBB48980CF91

Function 00C4FAD0 Relevance: 6.0, APIs: 4, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,00C50A87,00000000,?,?,?,?,?,00000001), ref: 00C4FAF7
RtlReAllocateHeap.NTDLL(00000000,?,00C50A87,00000000), ref: 00C4FAFE
GetProcessHeap.KERNEL32(00000000,?,?,00C50A87,00000000,?,?,?,?,?,00000001), ref: 00C4FB19
HeapAlloc.KERNEL32(00000000,?,00C50A87,00000000,?,?,?,?,?,00000001), ref: 00C4FB20

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Heap$Process$AllocAllocate
String ID:
API String ID: 1154092256-0
Opcode ID: 6a9b307513d07751938ce3d6bfdcf9cb6a5d614583be97fec7e5e32c2671081f
Instruction ID: 5be6cd3ae5cf836648234f24263f2f80258bc19e9797f044cc22d0c713257890
Opcode Fuzzy Hash: 6a9b307513d07751938ce3d6bfdcf9cb6a5d614583be97fec7e5e32c2671081f
Instruction Fuzzy Hash: 7FF01C75111304EFDB149FB1EC09B6E3BA8FB88612F108108F919A75A0DB719981CB61

Function 00C23DC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001,00000001,00000000,00000001,00000000), ref: 00C23E43
__aulldiv.LIBCMT ref: 00C23E74

Strings

L9<8, xrefs: 00C23F4F

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: Time$FileSystem__aulldiv
String ID: L9<8
API String ID: 2838486344-2160928743
Opcode ID: 5e4bdf103d32c12a6550758f118c10bdab541659b43494e8eb48d7298e38a550
Instruction ID: 9239562ddc877d5857c0f034668051a1bfe336b3bfbb5b067fded4b9c01aa179
Opcode Fuzzy Hash: 5e4bdf103d32c12a6550758f118c10bdab541659b43494e8eb48d7298e38a550
Instruction Fuzzy Hash: E8413779A103608BC728CF46FD9173D37B2FB98716710415ED403ABAB0D7B89981CB80

Function 00C499B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00C49A16
GetTickCount.KERNEL32 ref: 00C49B6B

Strings

@(l$, xrefs: 00C49ABD

Memory Dump Source

Source File: 00000005.00000002.2171915684.0000000000C21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000005.00000002.2171895436.0000000000C20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171945906.0000000000C52000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171960198.0000000000C53000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C56000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2171975609.0000000000C6E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.2172027878.0000000000C6F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_qbpabupgx.jbxd

Similarity

API ID: CountSystemTickTime
String ID: @(l$
API String ID: 2164215191-2034585603
Opcode ID: 5d0946abebe117be274e0f7781dda57462e58ecd51f681c3de96a397c4971dfe
Instruction ID: 9550a4657eff1512485e41336893dfbaf89ff2b382da7831bce0c929ceae53a7
Opcode Fuzzy Hash: 5d0946abebe117be274e0f7781dda57462e58ecd51f681c3de96a397c4971dfe
Instruction Fuzzy Hash: 2341907A9003108FC364CF2AFCC277E77B1FB94316314412AD846E6671EBB5A981EB51

Analysis Process: tkjnbticppc.exePID: 1540, Parent PID: 3708COMMON

Executed Functions

Function 001100C8 Relevance: 56.1, APIs: 29, Strings: 2, Instructions: 1861sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 001103F9
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00110427
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0011046A
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00110496
GetTickCount.KERNEL32 ref: 00110587
GetCommandLineA.KERNEL32 ref: 0011063E
Sleep.KERNELBASE(000003E8), ref: 00110CDF

Part of subcall function 0010B150: CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0010B1D7

Sleep.KERNEL32(00000D05), ref: 00110BD2

Part of subcall function 0010B150: GetFileTime.KERNEL32(00000000,?,?,?), ref: 0010B256
Part of subcall function 0010B150: CloseHandle.KERNEL32(00000000), ref: 0010B26B

Sleep.KERNEL32(000007D0), ref: 00110DD1
GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00110EA8
SetFileAttributesA.KERNEL32(?,00000080), ref: 00110ECC
CopyFileA.KERNEL32(?,?,00000000), ref: 00110EFE
SetFileAttributesA.KERNEL32(?,00000002), ref: 001110B9
SetFileAttributesA.KERNEL32(?,00000080), ref: 001110E7
GetCommandLineA.KERNEL32(00000000), ref: 0011120E
GetModuleFileNameA.KERNEL32(00000000,00000000,00000200), ref: 0011132B

Part of subcall function 00112290: lstrlen.KERNEL32(?), ref: 001122A2
Part of subcall function 00112290: CharLowerBuffA.USER32(?,00000000), ref: 001122BE

MessageBoxA.USER32(00000000,00000004,00000005,00000000), ref: 00111663

Part of subcall function 001072E0: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00107452

CloseHandle.KERNEL32(00000000), ref: 00111AC5
SetFileAttributesA.KERNEL32(?,00000080), ref: 00111AE1
CopyFileA.KERNEL32(?,?,00000000), ref: 00111B07
SetFileAttributesA.KERNEL32(?,00000002), ref: 00111B43
Sleep.KERNEL32(000003E8), ref: 00111CAC
WSAStartup.WS2_32(00000202,?), ref: 00111947

Part of subcall function 00122780: ExitProcess.KERNEL32 ref: 001227B0

Sleep.KERNEL32(000007D0), ref: 00111DFC
SetFileAttributesA.KERNEL32(00146680,00000080), ref: 00111E27
CopyFileA.KERNEL32(?,00146680,00000000), ref: 00111E45
SetFileAttributesA.KERNEL32(00146680,00000002), ref: 00111E7B

Part of subcall function 0012C080: Sleep.KERNEL32(000003E8), ref: 0012C1C3

Part of subcall function 0010BBA0: wvsprintfA.USER32(00000000,?,001209D1), ref: 0010BBEB

CreateThread.KERNEL32(00000000,00000000,Function_0002FE10,00000000,00000000,00000000), ref: 00112194
Sleep.KERNEL32(0000C350), ref: 00112210

Strings

C:\Windows\system32\config\systemprofile, xrefs: 001103F3
x7;C, xrefs: 00110C47

Memory Dump Source

Source File: 00000009.00000002.3398045051.0000000000101000.00000020.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000009.00000002.3398012120.0000000000100000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398086795.0000000000132000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398107567.0000000000133000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.0000000000136000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398187425.000000000014F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_100000_tkjnbticppc.jbxd

Similarity

API ID: File$AttributesSleep$Create$CopyMutex$CloseCommandHandleLineModuleName$BuffCharCountEnvironmentExitLowerMessageProcessStartupThreadTickTimeVariablelstrlenwvsprintf
String ID: C:\Windows\system32\config\systemprofile$x7;C
API String ID: 1500488346-1470472774
Opcode ID: ffffa3bf1f409cff062c8de5be5a2168513a0d4dd6cc6139a0c438b6f61909df
Instruction ID: a339e5f0b98a187b6ff5cecc69202004ea9c0cc61d18c20e1bacc4d9eca313ea
Opcode Fuzzy Hash: ffffa3bf1f409cff062c8de5be5a2168513a0d4dd6cc6139a0c438b6f61909df
Instruction Fuzzy Hash: E503E179A00200DBD718DF64FC92AAA77F6FB66314B40812AE501CBEB5E7B499C1CF51

Function 00112490 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 918
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(0014EAC8), ref: 00112572
CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 001126EF
DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00112843
RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 0011289F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0011293F
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001129E1
CreateDirectoryA.KERNEL32(?,00000000), ref: 00112CAC
CreateDirectoryA.KERNEL32(?,00000000), ref: 00112D6E
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00112EB0
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0011307B
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 001131FA
SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 0011344D

Strings

\, xrefs: 00112F41
C:\Windows\system32\config\systemprofile, xrefs: 00112B0A, 00112BCC
Wq0O, xrefs: 00112FE3
C:\daxjjwrfm\, xrefs: 00112960, 00112CC9, 00113032, 0011321C

Memory Dump Source

Source File: 00000009.00000002.3398045051.0000000000101000.00000020.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000009.00000002.3398012120.0000000000100000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398086795.0000000000132000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398107567.0000000000133000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.0000000000136000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398187425.000000000014F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_100000_tkjnbticppc.jbxd

Similarity

API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersion
String ID: C:\Windows\system32\config\systemprofile$C:\daxjjwrfm\$Wq0O$\
API String ID: 1691758827-4043548932
Opcode ID: 8b7ce0d9a7a983f99c6529910d33350f70eaef474a15cbe50f89d3fc34916966
Instruction ID: b5f09ebe7e1b409dc3169d9df88d4ea5a70127dbe5c23682e8ac1ab0e605fd7a
Opcode Fuzzy Hash: 8b7ce0d9a7a983f99c6529910d33350f70eaef474a15cbe50f89d3fc34916966
Instruction Fuzzy Hash: 5E8222B9A00211CBD718DF24FC92AAA37F5FB65310B40813AE901DBEB5E77499C1CB55

Function 00123060 Relevance: 4.8, APIs: 3, Instructions: 287
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0012327A
WriteFile.KERNELBASE(?,?,00005000,00005000,00000000), ref: 0012344B
CloseHandle.KERNELBASE(?), ref: 001234DA

Memory Dump Source

Source File: 00000009.00000002.3398045051.0000000000101000.00000020.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000009.00000002.3398012120.0000000000100000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398086795.0000000000132000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398107567.0000000000133000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.0000000000136000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398187425.000000000014F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_100000_tkjnbticppc.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 448f31a9aa7611a3bef47a201bd30ad5b9a01ac47414079fabc2cbe273007960
Instruction ID: 036af81348c3e2a2d06b69c4046d7fad184db21a7692efe9e69129e7014e05b5
Opcode Fuzzy Hash: 448f31a9aa7611a3bef47a201bd30ad5b9a01ac47414079fabc2cbe273007960
Instruction Fuzzy Hash: 67C103B9A10610CBC304DF68FCC166A73F5F766725B10812AE806CBEB4E77899D1CB81

Function 0010B150 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0010B1D7
GetFileTime.KERNEL32(00000000,?,?,?), ref: 0010B256
CloseHandle.KERNEL32(00000000), ref: 0010B26B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0010B2E7
GetFileSize.KERNEL32(00000000,00000000,2AC18000,FE624E21,00989680,00000000), ref: 0010B31A
CloseHandle.KERNEL32(00000000), ref: 0010B334

Strings

td9k, xrefs: 0010B23D

Memory Dump Source

Source File: 00000009.00000002.3398045051.0000000000101000.00000020.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000009.00000002.3398012120.0000000000100000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398086795.0000000000132000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398107567.0000000000133000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.0000000000136000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398187425.000000000014F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_100000_tkjnbticppc.jbxd

Similarity

API ID: File$CloseHandle$CreateSizeTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: td9k
API String ID: 3236713533-1579400769
Opcode ID: c1d81fb912955a8a9d090f627865ee9d6df08b6bcdcae11b9d877f58dec2e1a8
Instruction ID: 8a527b6be2df563995667f8f6f4249aff792102c238269aa9f784e11913a3fbc
Opcode Fuzzy Hash: c1d81fb912955a8a9d090f627865ee9d6df08b6bcdcae11b9d877f58dec2e1a8
Instruction Fuzzy Hash: 3451D179A15201ABC314DF69FC81A6A77F5FB85324F10825AE809CBAB4E77099C1CF85

Function 0011C250 Relevance: 6.1, APIs: 4, Instructions: 148
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0011C312
Process32First.KERNEL32(00000000,?), ref: 0011C35A
Process32Next.KERNEL32(00000000,00000128), ref: 0011C478

Memory Dump Source

Source File: 00000009.00000002.3398045051.0000000000101000.00000020.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000009.00000002.3398012120.0000000000100000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398086795.0000000000132000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398107567.0000000000133000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.0000000000136000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398187425.000000000014F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_100000_tkjnbticppc.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: 3b907b906c220b0de74af9c886fb23e7ba295b8dbfb13eea3c1a0f7ce3346c50
Instruction ID: b517087b3fd7be90fa9984c621cf8294527c08affdb274a7d5e119cd2dc8b6c4
Opcode Fuzzy Hash: 3b907b906c220b0de74af9c886fb23e7ba295b8dbfb13eea3c1a0f7ce3346c50
Instruction Fuzzy Hash: 025133B9905211CFD718CF20FDA56A937B6FB56315F00802AE9469BEB4EB7489C0CF91

Function 0011C520 Relevance: 3.0, APIs: 2, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00130A4E,?,00130A4E,00000000), ref: 0011C549
RtlFreeHeap.NTDLL(00000000,?,00130A4E,00000000), ref: 0011C550

Memory Dump Source

Source File: 00000009.00000002.3398045051.0000000000101000.00000020.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000009.00000002.3398012120.0000000000100000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398086795.0000000000132000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398107567.0000000000133000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.0000000000136000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398187425.000000000014F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_100000_tkjnbticppc.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: fb2a2ab47133d8a839671f88502295e646f430773d5a670bd9a613e8240344bf
Instruction ID: 824675c196719a431b1611a2662b200d8602cbefda666e0aa685d18b7e116eb1
Opcode Fuzzy Hash: fb2a2ab47133d8a839671f88502295e646f430773d5a670bd9a613e8240344bf
Instruction Fuzzy Hash: FCF0ED79A082049FDA089F18EC9AA6437F5EB05704B000409E906CBE70E770F8C0CBA9

Function 00126D32 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001020E0: GetStdHandle.KERNEL32(000000F6,?,?,00126D5F), ref: 00102113
Part of subcall function 001020E0: GetStdHandle.KERNEL32(000000F5,?,?,00126D5F), ref: 00102145
Part of subcall function 001020E0: GetStdHandle.KERNEL32(000000F4,?,?,00126D5F), ref: 00102198

ExitProcess.KERNEL32 ref: 00126E44

Memory Dump Source

Source File: 00000009.00000002.3398045051.0000000000101000.00000020.00000001.01000000.00000007.sdmp, Offset: 00100000, based on PE: true

Associated: 00000009.00000002.3398012120.0000000000100000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398086795.0000000000132000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398107567.0000000000133000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.0000000000136000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398123158.000000000014E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.3398187425.000000000014F000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_100000_tkjnbticppc.jbxd

Similarity

API ID: Handle$ExitProcess
String ID:
API String ID: 256993070-0
Opcode ID: 512f9925ecdcd82cab13ded7a6cd19d53aaa454670480ca725bd627ffaf8c942
Instruction ID: c4cc4dc90143c31db55d8cdd9f6394097923e184f4adf9c96540535991cd5f4a
Opcode Fuzzy Hash: 512f9925ecdcd82cab13ded7a6cd19d53aaa454670480ca725bd627ffaf8c942
Instruction Fuzzy Hash: 6921B73EA116208BC748EF74FC9257533A3EB663213048515E8418BFB9FBB889C2C741

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 66HKNPT1fl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\daxjjwrfm\nozyy3rc2p

C:\daxjjwrfm\ew4bjmdlid9hjn8.exe

C:\daxjjwrfm\nozyy3rc2p

C:\daxjjwrfm\qbpabupgx.exe

C:\daxjjwrfm\tkjnbticppc.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
66HKNPT1fl.exe

Function 00372490 Relevance: 28.9, APIs: 12, Strings: 4, Instructions: 918
fileCOMMON

Function 003660A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186
filesleepCOMMON

Function 0037C520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
memoryCOMMON

Function 00383060 Relevance: 4.8, APIs: 3, Instructions: 287
fileCOMMON

Function 0038C640 Relevance: 4.6, APIs: 3, Instructions: 120
memoryCOMMON

Function 0037B744 Relevance: .2, Instructions: 249
COMMON

Function 0038A760 Relevance: 10.8, APIs: 7, Instructions: 266
fileCOMMON

Function 003838B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
processCOMMON

Function 00376F00 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Function 00372290 Relevance: 3.0, APIs: 2, Instructions: 21
stringCOMMON

Function 00386D32 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00382780 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre