Edit tour

Windows Analysis Report
81mieek02V.dll

Overview

General Information

Sample name:	81mieek02V.dll renamed because original name is a hash value
Original sample name:	9f79ed51c51057b765256f856cd3690737c98fce.dll
Analysis ID:	1558404
MD5:	703dd9fac2280e224a1949db0cf545a3
SHA1:	9f79ed51c51057b765256f856cd3690737c98fce
SHA256:	5397c40c0f4bbe1b202069a612b03dac27a0c33eeec7ac97df264b9afbb84da4
Tags:	dlluser-NDA0E
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Creates an autostart registry key pointing to binary in C:\Windows

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for sample

PE file has a writeable .text section

Queries disk data (e.g. SMART data)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to communicate with device drivers

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7516 cmdline: loaddll32.exe "C:\Users\user\Desktop\81mieek02V.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7572 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7604 cmdline: rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7664 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7720 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 7580 cmdline: rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,DoAddToFavDlg MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7848 cmdline: rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,InputFile MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7876 cmdline: rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,PrintFile MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7952 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7876 -s 672 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 8156 cmdline: rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7192 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6032 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 8164 cmdline: rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",InputFile MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8172 cmdline: rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",PrintFile MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 3508 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8172 -s 668 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 6720 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 6464 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2384 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 7692 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7700 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7636 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
81mieek02V.dll	Winnti_NlaifSvc	Winnti sample - file NlaifSvc.dll	Florian Roth	0x3b77e:$x1: cracked by ximo 0x3b838:$x1: cracked by ximo 0x3b8f2:$x1: cracked by ximo 0x3b9ac:$x1: cracked by ximo 0x3ba66:$x1: cracked by ximo 0x3bb20:$x1: cracked by ximo 0x3bbda:$x1: cracked by ximo 0x3bc94:$x1: cracked by ximo 0x402d6:$x1: cracked by ximo 0x43d1b:$x1: cracked by ximo

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.rundll32.exe.10000000.0.unpack	Winnti_NlaifSvc	Winnti sample - file NlaifSvc.dll	Florian Roth	0x3b77e:$x1: cracked by ximo 0x3b838:$x1: cracked by ximo 0x3b8f2:$x1: cracked by ximo 0x3b9ac:$x1: cracked by ximo 0x3ba66:$x1: cracked by ximo 0x3bb20:$x1: cracked by ximo 0x3bbda:$x1: cracked by ximo 0x3bc94:$x1: cracked by ximo 0x402d6:$x1: cracked by ximo 0x43d1b:$x1: cracked by ximo
3.2.rundll32.exe.10000000.0.unpack	Winnti_NlaifSvc	Winnti sample - file NlaifSvc.dll	Florian Roth	0x3b77e:$x1: cracked by ximo 0x3b838:$x1: cracked by ximo 0x3b8f2:$x1: cracked by ximo 0x3b9ac:$x1: cracked by ximo 0x3ba66:$x1: cracked by ximo 0x3bb20:$x1: cracked by ximo 0x3bbda:$x1: cracked by ximo 0x3bc94:$x1: cracked by ximo 0x402d6:$x1: cracked by ximo 0x43d1b:$x1: cracked by ximo
19.2.rundll32.exe.10000000.0.unpack	Winnti_NlaifSvc	Winnti sample - file NlaifSvc.dll	Florian Roth	0x3b77e:$x1: cracked by ximo 0x3b838:$x1: cracked by ximo 0x3b8f2:$x1: cracked by ximo 0x3b9ac:$x1: cracked by ximo 0x3ba66:$x1: cracked by ximo 0x3bb20:$x1: cracked by ximo 0x3bbda:$x1: cracked by ximo 0x3bc94:$x1: cracked by ximo 0x402d6:$x1: cracked by ximo 0x43d1b:$x1: cracked by ximo

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 7580, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dtfd

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 81mieek02V.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: 81mieek02V.dll

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: 81mieek02V.dll

Joe Sandbox ML: detected

Source: 81mieek02V.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source:

Binary string: c:\Documents and Settings\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*.* source: rundll32.exe, 00000003.00000003.1820773335.00000000009EB000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10007F3E FindFirstFileA,FindNextFileA,Sleep,FindClose,

3_2_10007F3E

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.56.110 18530	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.160.131.253 18659	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.160.131.254 23588	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: host123.zz.am

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 107.163.56.110 ports 18530,0,1,3,5,8
Source: global traffic	TCP traffic: 107.160.131.253 ports 1,5,6,8,9,18659

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: global traffic	TCP traffic: 192.168.2.8:49705 -> 107.163.56.110:18530
Source: global traffic	TCP traffic: 192.168.2.8:49706 -> 107.160.131.253:18659
Source: global traffic	TCP traffic: 192.168.2.8:49740 -> 107.160.131.254:23588

Source: Joe Sandbox View	ASN Name: TAKE2US TAKE2US
Source: Joe Sandbox View	ASN Name: AS40676US AS40676US
Source: Joe Sandbox View	ASN Name: AS40676US AS40676US

Source: global traffic

TCP traffic: 192.168.2.8:49766 -> 202.108.0.52:80

Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10003F41 InternetReadFile,

3_2_10003F41

Source: global traffic	DNS traffic detected: DNS query: host123.zz.am
Source: global traffic	DNS traffic detected: DNS query: blog.sina.com.cn

Source: rundll32.exe, rundll32.exe, 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3105438873.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.3424148455.0000000010012000.00000040.00000001.01000000.00000003.sdmp, 81mieek02V.dll	String found in binary or memory: http://107.160.131.253:18659/
Source: rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.253:18659//joy.asp?sid=rungnejcndvgnJLdFe5vteX8v2LUicbtudb8mtiWmtaWnd
Source: rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.253:18659//joy.asp?sid=rungnejcndvgnJLdFe5vteX8v2LUicbtudb8mtiWmtaWndm
Source: rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3105438873.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.3424148455.0000000010012000.00000040.00000001.01000000.00000003.sdmp, 81mieek02V.dll	String found in binary or memory: http://107.160.131.254:23588/article.php
Source: rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.php$
Source: rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.php-
Source: rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.php.
Source: rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.php0
Source: rundll32.exe, 00000003.00000002.3900645695.000000000560D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3900881412.000000000582A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpC:
Source: rundll32.exe, 00000003.00000003.3145080967.000000000099B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpK
Source: rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpP_W
Source: rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpR
Source: rundll32.exe, 00000003.00000003.3145080967.000000000099B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpU
Source: rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpWindows
Source: rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpX
Source: rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpa6
Source: rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3145080967.000000000099B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpd
Source: rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpo
Source: rundll32.exe, 00000003.00000003.2062100348.00000000009FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpop
Source: rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpsi
Source: rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpt
Source: rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpttings
Source: rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpuiL
Source: rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpv
Source: rundll32.exe, 00000003.00000003.3145080967.000000000099B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpx/3.6.15
Source: rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpy
Source: rundll32.exe, 00000003.00000002.3900572308.000000000558D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.160.13I
Source: rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.56.110:18530/u1129.html
Source: rundll32.exe, 00000003.00000002.3898385688.0000000004A8D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.56.110:18530u1129.html
Source: rundll32.exe, 00000003.00000002.3903332167.0000000006993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s
Source: rundll32.exe, 00000003.00000002.3900984971.00000000059FD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093
Source: rundll32.exe, 00000003.00000003.2262195935.00000000009FE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2262409750.00000000009FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093ktop
Source: rundll32.exe, 00000003.00000003.2666331827.00000000009F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093n4
Source: rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3885950674.000000000092A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093z
Source: rundll32.exe, 00000003.00000002.3885950674.000000000092A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093zj
Source: rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093~V
Source: Amcache.hve.14.dr	String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, rundll32.exe, 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3106003483.000000001003D000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.3424235070.000000001003D000.00000040.00000001.01000000.00000003.sdmp, 81mieek02V.dll	String found in binary or memory: http://www.rsac.org/ratingsv01.html

System Summary

Malicious sample detected (through community Yara rule)

Source: 81mieek02V.dll, type: SAMPLE	Matched rule: Winnti sample - file NlaifSvc.dll Author: Florian Roth
Source: 11.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti sample - file NlaifSvc.dll Author: Florian Roth
Source: 3.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti sample - file NlaifSvc.dll Author: Florian Roth
Source: 19.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti sample - file NlaifSvc.dll Author: Florian Roth

PE file has a writeable .text section

Source: 81mieek02V.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10008AAD: DeviceIoControl,

3_2_10008AAD

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10003F63 ExitWindowsEx,

3_2_10003F63

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B224	3_2_1000B224
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B70D	3_2_1000B70D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100121ED	3_2_100121ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000AEC0	3_2_1000AEC0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 10001000 appears 305 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7876 -s 672

Source: 81mieek02V.dll

Binary or memory string: OriginalFilenamejscript.dllL vs 81mieek02V.dll

Source: 81mieek02V.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: 81mieek02V.dll, type: SAMPLE	Matched rule: Winnti_NlaifSvc date = 2017-01-25, hash1 = 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5, author = Florian Roth, description = Winnti sample - file NlaifSvc.dll, reference = https://goo.gl/VbvJtL, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti_NlaifSvc date = 2017-01-25, hash1 = 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5, author = Florian Roth, description = Winnti sample - file NlaifSvc.dll, reference = https://goo.gl/VbvJtL, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti_NlaifSvc date = 2017-01-25, hash1 = 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5, author = Florian Roth, description = Winnti sample - file NlaifSvc.dll, reference = https://goo.gl/VbvJtL, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 19.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti_NlaifSvc date = 2017-01-25, hash1 = 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5, author = Florian Roth, description = Winnti sample - file NlaifSvc.dll, reference = https://goo.gl/VbvJtL, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: 81mieek02V.dll

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winDLL@42/10@49/5

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1000404F AdjustTokenPrivileges,

3_2_1000404F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10003FB7 CreateToolhelp32Snapshot,

3_2_10003FB7

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\Desktop\12010043

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3524:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\host123.zz.am:6658
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1152:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mhost123.zz.am:6658
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\0x5d65r455f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8172
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7876

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\00987261-4711-47d5-a380-5cd68794a3ac

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,DoAddToFavDlg

Source: 81mieek02V.dll

ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\81mieek02V.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,DoAddToFavDlg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,InputFile
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,PrintFile
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7876 -s 672
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",InputFile
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",PrintFile
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8172 -s 668
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,DoAddToFavDlg	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,InputFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,PrintFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",InputFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",PrintFile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:

Binary string: c:\Documents and Settings\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*.* source: rundll32.exe, 00000003.00000003.1820773335.00000000009EB000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1003900A push dword ptr [esp+4Ch]; retn 0050h	3_2_1003901C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10027023 push dword ptr [esp+18h]; retn 001Ch	3_2_1002A254
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F024 push dword ptr [esp+14h]; retn 0018h	3_2_1002F036
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10029029 push dword ptr [esp+38h]; retn 003Ch	3_2_10027C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10029029 pushad ; mov dword ptr [esp], 73E57D1Ah	3_2_10029046
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1003B02D push dword ptr [esp+50h]; retn 0054h	3_2_1003B061
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F039 push esp; mov dword ptr [esp], B1CF2C6Dh	3_2_1002F051
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F039 push dword ptr [esp+50h]; retn 0054h	3_2_1002F068
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10035048 push dword ptr [esp+50h]; retn 0054h	3_2_100351D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10033059 push dword ptr [esp+50h]; retn 0054h	3_2_1003307F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10033064 push dword ptr [esp+50h]; retn 0054h	3_2_1003307F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002D06D push dword ptr [esp+38h]; retn 003Ch	3_2_1002D08D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10031079 push dword ptr [esp+30h]; retn 0034h	3_2_10031095
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10027080 push ebp; mov dword ptr [esp], edx	3_2_1002FD0B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10027080 push dword ptr [esp+04h]; retn 0008h	3_2_1002FD4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10023085 push dword ptr [esp+38h]; retn 003Ch	3_2_10023093
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10023096 push dword ptr [esp+50h]; retn 0054h	3_2_100230B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100330A5 push dword ptr [esp+2Ch]; retn 0030h	3_2_1002B78C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100330A5 push dword ptr [esp+04h]; retn 0008h	3_2_1003B2DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100230B6 push dword ptr [esp+34h]; retn 0038h	3_2_1002F874
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100270BA push dword ptr [esp+34h]; retn 0038h	3_2_1002AD33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100250BC push dword ptr [esp+44h]; retn 0048h	3_2_1003408E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F0D4 push dword ptr [esp+0Ch]; retn 0014h	3_2_1002F0EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100270D4 push dword ptr [esp+0Ch]; retn 0010h	3_2_100282E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100270D4 push dword ptr [esp+0Ch]; retn 0010h	3_2_100338DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100350D9 push dword ptr [esp+50h]; retn 0054h	3_2_10035102
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100250D9 push dword ptr [esp+14h]; retn 0018h	3_2_100250F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002B0E4 push dword ptr [esp+48h]; retn 004Ch	3_2_1002B0FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002D0EF push dword ptr [esp+10h]; retn 0014h	3_2_1002D116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002B0EF push dword ptr [esp+48h]; retn 004Ch	3_2_1002B0FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10039107 push dword ptr [esp+4Ch]; retn 0050h	3_2_10039116

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dtfd

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dtfd			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dtfd			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_3-17259

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1001E1FE rdtsc

3_2_1001E1FE

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 369			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 5413			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7776	Thread sleep count: 369 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7776	Thread sleep time: -664200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3284	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3284	Thread sleep time: -330000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7844	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7584	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3032	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7096	Thread sleep time: -2340000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1280	Thread sleep time: -2400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 4472	Thread sleep time: -2400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7540	Thread sleep time: -2700000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3276	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7776	Thread sleep count: 5413 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7776	Thread sleep time: -9743400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7584	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10007F3E FindFirstFileA,FindNextFileA,Sleep,FindClose,

3_2_10007F3E

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: rundll32.exe, 00000003.00000003.1730291364.0000000000857000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y\Machine\Software\Classes\Applications\\VMwareHostOpen.exes\Applications\\VMwareHostOpen.exeion\\Run\User Shell Foldersockdown_Zones\4
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: rundll32.exe, 00000003.00000002.3884846057.000000000056B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: s\Applications\\VMwareHoP
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ons\\VMwareHostO
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: rundll32.exe, 00000003.00000002.3893503666.000000000463B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Applications\\VMwareHostOpen.exe
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1001E1FE rdtsc

3_2_1001E1FE

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.56.110 18530	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.160.131.253 18659	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.160.131.254 23588	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: host123.zz.am

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Queries disk data (e.g. SMART data)

Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	31 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	111 Process Injection	31 Virtualization/Sandbox Evasion	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Rundll32	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	111 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
81mieek02V.dll	79%	ReversingLabs	Win32.Backdoor.Farfli
81mieek02V.dll	100%	Avira	TR/Crypt.PEPM.Gen
81mieek02V.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://107.160.131.254:23588/article.phpK	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpsi	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpttings	0%	Avira URL Cloud	safe
http://107.160.131.253:18659//joy.asp?sid=rungnejcndvgnJLdFe5vteX8v2LUicbtudb8mtiWmtaWnd	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpC:	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpv	0%	Avira URL Cloud	safe
http://107.163.56.110:18530/u1129.html	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.php	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpx/3.6.15	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpop	0%	Avira URL Cloud	safe
http://107.163.56.110:18530u1129.html	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpP_W	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpuiL	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpt	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.php.	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpa6	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpy	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.php0	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.php-	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpo	0%	Avira URL Cloud	safe
http://www.rsac.org/ratingsv01.html	0%	Avira URL Cloud	safe
http://107.160.13I	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpX	0%	Avira URL Cloud	safe
http://107.160.131.253:18659/	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpd	0%	Avira URL Cloud	safe
http://107.160.131.253:18659//joy.asp?sid=rungnejcndvgnJLdFe5vteX8v2LUicbtudb8mtiWmtaWndm	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.php$	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpWindows	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpR	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpU	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
blogx.sina.com.cn	202.108.0.52	true	false	high
host123.zz.am	unknown	unknown	true	unknown
blog.sina.com.cn	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://107.160.131.254:23588/article.php	rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3105438873.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.3424148455.0000000010012000.00000040.00000001.01000000.00000003.sdmp, 81mieek02V.dll	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpx/3.6.15	rundll32.exe, 00000003.00000003.3145080967.000000000099B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpK	rundll32.exe, 00000003.00000003.3145080967.000000000099B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5762479093~V	rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.131.254:23588/article.phpttings	rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpC:	rundll32.exe, 00000003.00000002.3900645695.000000000560D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3900881412.000000000582A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpsi	rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.56.110:18530/u1129.html	rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.253:18659//joy.asp?sid=rungnejcndvgnJLdFe5vteX8v2LUicbtudb8mtiWmtaWnd	rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.14.dr	false		high
http://107.160.131.254:23588/article.phpop	rundll32.exe, 00000003.00000003.2062100348.00000000009FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%s	rundll32.exe, 00000003.00000002.3903332167.0000000006993000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5762479093	rundll32.exe, 00000003.00000002.3900984971.00000000059FD000.00000004.00000010.00020000.00000000.sdmp	false		high
http://107.160.131.254:23588/article.phpv	rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpy	rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.56.110:18530u1129.html	rundll32.exe, 00000003.00000002.3898385688.0000000004A8D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpuiL	rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpt	rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpa6	rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpo	rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.php.	rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.php0	rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.php-	rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5762479093n4	rundll32.exe, 00000003.00000003.2666331827.00000000009F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.131.254:23588/article.phpP_W	rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.rsac.org/ratingsv01.html	rundll32.exe, rundll32.exe, 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3106003483.000000001003D000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.3424235070.000000001003D000.00000040.00000001.01000000.00000003.sdmp, 81mieek02V.dll	false	Avira URL Cloud: safe	unknown
http://107.160.131.253:18659/	rundll32.exe, rundll32.exe, 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3105438873.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.3424148455.0000000010012000.00000040.00000001.01000000.00000003.sdmp, 81mieek02V.dll	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.php$	rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpd	rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3145080967.000000000099B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5762479093z	rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3885950674.000000000092A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.131.253:18659//joy.asp?sid=rungnejcndvgnJLdFe5vteX8v2LUicbtudb8mtiWmtaWndm	rundll32.exe, 00000003.00000002.3885950674.000000000093E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2348218877.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5762479093ktop	rundll32.exe, 00000003.00000003.2262195935.00000000009FE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2262409750.00000000009FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.13I	rundll32.exe, 00000003.00000002.3900572308.000000000558D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpX	rundll32.exe, 00000003.00000003.2348218877.000000000098E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5762479093zj	rundll32.exe, 00000003.00000002.3885950674.000000000092A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.131.254:23588/article.phpR	rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpU	rundll32.exe, 00000003.00000003.3145080967.000000000099B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1821029258.000000000099C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpWindows	rundll32.exe, 00000003.00000002.3885950674.000000000098E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
202.108.0.52	blogx.sina.com.cn	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
107.163.56.110	unknown	United States	20248	TAKE2US	true
107.160.131.253	unknown	United States	40676	AS40676US	true
107.160.131.254	unknown	United States	40676	AS40676US	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558404
Start date and time:	2024-11-19 13:21:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	81mieek02V.dll renamed because original name is a hash value
Original Sample Name:	9f79ed51c51057b765256f856cd3690737c98fce.dll
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winDLL@42/10@49/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 28 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 20.189.173.20
Excluded domains from analysis (whitelisted): login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, onedsblobprdwus15.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 81mieek02V.dll

Simulations

Behavior and APIs

Time	Type	Description
07:22:57	API Interceptor	1130791x Sleep call for process: rundll32.exe modified
07:23:04	API Interceptor	1x Sleep call for process: loaddll32.exe modified
07:25:43	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
202.108.0.52	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
107.163.56.110	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse
	02hNixBIvP.exe	Get hash	malicious	Unknown	Browse
	abc.dll	Get hash	malicious	Unknown	Browse
107.160.131.253	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse
107.160.131.254	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
blogx.sina.com.cn	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	http://zeuso.cc	Get hash	malicious	Unknown	Browse	202.108.0.52
	02hNixBIvP.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	abc.dll	Get hash	malicious	Unknown	Browse	123.126.45.92

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS40676US	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	107.160.131.254
	Malwarebytes Premium v4.6.8.311.exe	Get hash	malicious	Unknown	Browse	41.216.183.30
	Fdoze89ykv.js	Get hash	malicious	Mint Stealer	Browse	45.61.137.33
	QKS3UTHFX9.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	5z3Wzl6uag.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	e8HOp8k5Kj.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	Fdoze89ykv.js	Get hash	malicious	Mint Stealer	Browse	45.61.137.33
	QKS3UTHFX9.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	5z3Wzl6uag.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	e8HOp8k5Kj.js	Get hash	malicious	Unknown	Browse	45.61.137.33
AS40676US	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	107.160.131.254
	Malwarebytes Premium v4.6.8.311.exe	Get hash	malicious	Unknown	Browse	41.216.183.30
	Fdoze89ykv.js	Get hash	malicious	Mint Stealer	Browse	45.61.137.33
	QKS3UTHFX9.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	5z3Wzl6uag.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	e8HOp8k5Kj.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	Fdoze89ykv.js	Get hash	malicious	Mint Stealer	Browse	45.61.137.33
	QKS3UTHFX9.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	5z3Wzl6uag.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	e8HOp8k5Kj.js	Get hash	malicious	Unknown	Browse	45.61.137.33
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	owari.mips.elf	Get hash	malicious	Unknown	Browse	111.193.177.206
	owari.x86.elf	Get hash	malicious	Unknown	Browse	60.194.199.155
	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	hmips.elf	Get hash	malicious	Mirai	Browse	111.196.123.227
	botx.m68k.elf	Get hash	malicious	Mirai	Browse	123.112.202.42
	botx.ppc.elf	Get hash	malicious	Mirai	Browse	113.45.119.194
	botx.arm.elf	Get hash	malicious	Mirai	Browse	211.145.29.8
	xd.m68k.elf	Get hash	malicious	Mirai	Browse	114.117.36.234
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	219.238.44.6
TAKE2US	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	107.163.43.253
	yakuza.m68k.elf	Get hash	malicious	Unknown	Browse	107.163.215.236
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	107.163.130.253
	wODub61gZe.exe	Get hash	malicious	FormBook	Browse	107.163.130.249
	mips.elf	Get hash	malicious	Mirai	Browse	107.163.25.123
	INVOICES.exe	Get hash	malicious	FormBook	Browse	107.163.130.253
	sh4.elf	Get hash	malicious	Mirai	Browse	23.231.236.168
	armv6l.elf	Get hash	malicious	Unknown	Browse	23.231.236.146
	3qsTcL9MOT.exe	Get hash	malicious	FormBook	Browse	107.163.96.57

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	707
Entropy (8bit):	4.513669632585202
Encrypted:	false
SSDEEP:	6:yFOvHqs+dDnarD3UxX9IRQX30XEQdKfUfUfUfUfUfUfUfUfUfUfUfUfUfUfUfUfB:80GKDExX9sa30UQdo
MD5:	AC5A40EB28714C91BF03D4AE329453E0
SHA1:	7413A451CA9F08853B97B953E922B9D768A5662C
SHA-256:	A6E29175CC5A2CF8E7F3DC1BB99C4EB67B7B6BFB95135E9A9EDDBC3178FF3251
SHA-512:	CFADE49F3F71BF4971049A5641864D201801446A1734D8CD184A58CF1DD6E5263F5A3A02EE58DC95FF9055CA6011C32B58365CB6DD9695F29D4D6F25C33465AF
Malicious:	false
Preview:	..2024-11-21 11:09..iOffset....2024-11-23 02:50..iOffset....2024-11-24 00:18..iOffset....2024-11-25 17:30..iOffset....2024-11-27 13:21..iOffset....2024-11-28 14:40..iOffset....2024-11-29 20:14..iOffset....2024-12-03 02:55..iOffset....2024-12-07 23:49..iOffset....2024-12-11 17:44..iOffset....2024-12-21 17:59..iOffset....2025-06-14 06:22..iOffset....2035-08-05 11:58..iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset..

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_46a5a6ec-a63e-448c-b52e-075047df540a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.950660304130958
Encrypted:	false
SSDEEP:	192:fYi6OCZ30BU/wjeTGW6ZYzuiFdZ24IO8dci:gib0EBU/wjeS7YzuiFdY4IO8dci
MD5:	A9DC248DC7A6385B3B2ED3E7CE6E883F
SHA1:	4A9BE26A60D0BECAFB000C9A7652AAC586D8F25E
SHA-256:	6BDD255A0E561C40A78B099E71BF609ADDA08222B2312093EF51B76813E7297D
SHA-512:	5E162487232592FB549DDB2210FD651A05E08BBAEBF84E5AC4330A1FA89FFA5420D8BF924C0ED246744281577A3C67535AD05609D6461B40B429FB28D67DA87E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.4.9.2.5.8.1.6.7.1.2.3.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.4.9.2.5.8.2.4.5.2.4.9.1.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.9.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.6.a.5.a.6.e.c.-.a.6.3.e.-.4.4.8.c.-.b.5.2.e.-.0.7.5.0.4.7.d.f.5.4.0.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.b.7.9.6.7.4.-.6.6.b.4.-.4.4.2.7.-.9.5.0.f.-.f.4.8.d.a.0.2.2.8.0.4.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.c.4.-.0.0.0.1.-.0.0.1.4.-.2.7.4.3.-.5.f.c.6.7.d.3.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fee72e296cfe876676a0f903eac30ffbede4e6_7522e4b5_e78355c5-05cb-4bce-aa3e-de35fc5094ce\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9505495766227757
Encrypted:	false
SSDEEP:	192:cyLilOuxv0BU/wjeTWWaZYzuiFdZ24IO8dci:zLicuxcBU/wjeibYzuiFdY4IO8dci
MD5:	8426AE0380B32B076C2CD4991CF775E3
SHA1:	571408AE48019AB4A904251BE7ACCDCEE412DAA6
SHA-256:	A217DD176F4C5B7C706A8CD00A4480195673F96B841E77CA1A602BFCCCF30A75
SHA-512:	8F401DFBB4F0C262717E82873B212F0DF6CFFB16BC5AB56BA42BD913741B64B621554F8BCFEF836118C97E492754870530525FDDF2ED1F3AC5BBCF7DBC65A914
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.4.9.2.5.8.4.9.3.2.5.9.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.4.9.2.5.8.5.4.4.8.2.0.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.9.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.8.3.5.5.c.5.-.0.5.c.b.-.4.b.c.e.-.a.a.3.e.-.d.e.3.5.f.c.5.0.9.4.c.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.2.9.8.9.8.9.-.3.f.c.8.-.4.c.7.f.-.8.7.d.3.-.5.f.7.d.2.9.6.4.6.4.1.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.e.c.-.0.0.0.1.-.0.0.1.4.-.b.c.b.3.-.3.1.c.8.7.d.3.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B1D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Nov 19 12:23:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	45552
Entropy (8bit):	2.0176218639730443
Encrypted:	false
SSDEEP:	192:P3qddVZLXpXHNQCXO5H4JHChxs/2REErjG5LO7F6iocFS:/qdjZi5HcHCPs/IEErjG5LO7FfF
MD5:	0842375C2A28781A00F66AB38147E855
SHA1:	DFC791DAA6162F7ED6801656923DBD451084415F
SHA-256:	56E5F34321FD1B64CAAA7205CC1151DB5BB60068EDBAC0E128B3FDC19517D62F
SHA-512:	4D51D0BCEA03DB26F8B408584C09E438FACF78FB801CA288EF5259E6B8DC9D5148C562C8F66C40B08ECFF232DCB8800BBC1329B5FDC07895C2D5B1C38D0590AD
Malicious:	false
Preview:	MDMP..a..... .......%.<g........................................V/..........T.......8...........T...............(...........L...........8...............................................................................eJ..............GenuineIntel............T...........%.<g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C08.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8272
Entropy (8bit):	3.690952184880969
Encrypted:	false
SSDEEP:	192:R6l7wVeJzE6Q6Yfk6IgmfTZopr+89be4sfNqm:R6lXJQ6Q6YM6IgmfTZaerfB
MD5:	DC9EA4B6B4A96CCF61FA32A2B918BA4B
SHA1:	BC47F4CEFA1866244D22AB0D16A5BE527FA9A471
SHA-256:	9E5E9288380A10671B474A80D24D7A5317445F29016C2DC782AA3EDFB5A6ABEE
SHA-512:	C5E6E5AAAB8B9D59FE857DEC02DD78427EC695B2A9013B4C583D14FF4AD80FA9692290F289EFC42CCE156C26272AE0A454D083873259C4BA6737D6C5FCD7447A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D90.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.463863000679733
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9BBtyWpW8VYlYm8M4JCdPSF4+q8/AEbGScSBd:uIjfAI7XBtT7VlJQ+J3Bd
MD5:	66CA9702FDE4BE1BD2C06176C8C17A7C
SHA1:	8BCE4B93F518356D2F2483B59D3DC5D12C4284B1
SHA-256:	75ECBDF101A2CA754CDE197DDDCD975C1D73900954E67044528DF4B30FD24347
SHA-512:	D566E7C0DE0D4806B055438F335983F6601265F2F627AB026643FA4E07A5C1E4AF2909D1A34EB7CF3D7E510DFAAAC0621580BA0452970BCA5E6ECB525629CB9B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="594925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER87FE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Nov 19 12:23:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	44286
Entropy (8bit):	2.024496436739641
Encrypted:	false
SSDEEP:	192:bkpd13ZbvXpXlx0PXO5H4B6atHhforvjpPiR6b7wK:op3Zbp5HE6atHhorv9Pis
MD5:	B123A3CB1FD4493088F27F22F93F95CF
SHA1:	0C693486EDCE62AD4B7E25E3A3F35C382DD61B98
SHA-256:	6B8C8F82D3382F0FA89E1DDA95D51EB8AE1E7AE34C327EA8C2254C3A09CC3AB5
SHA-512:	8802DD883B3F4A02319914B93C970B7262242F676A3F29ECF42CE1D8EFB69FF14ED84D54124A07E6F6286EC7C9511E65A7D208ACDE4E82261665377241CD7F6C
Malicious:	false
Preview:	MDMP..a..... .......).<g........................................V/..........T.......8...........T...............^...........L...........8...............................................................................eJ..............GenuineIntel............T...........(.<g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88AB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8262
Entropy (8bit):	3.691956539802815
Encrypted:	false
SSDEEP:	192:R6l7wVeJJW6M6YHQz6rgmfTxoprZ89bRssfA7m:R6lXJo6M6Ywz6rgmfTxbR/fx
MD5:	361E3075CEEF04F52C0D0E08BBD98107
SHA1:	22A971ED14728B8093F680D802A5B96FFD8FE86D
SHA-256:	828328F6715AFA0B209A3DFC518A52C19FA5CA909F75D8EEEC169CBE5AF3F69F
SHA-512:	348706607C8505F72E45A448F0E13B3383932A34661BAB67287915177BCAE31162B20CD122BA112208C011C19AA81642B5ED78E11BD4128113CFD5BA7ED942C3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.1.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88EA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.465694737100821
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9BBtyWpW8VYVYm8M4JCdPOFqwIm+q8/AvGScShd:uIjfAI7XBtT7VlJO9m3J3hd
MD5:	DC11BF421ED6B4A5F60EE98783141981
SHA1:	4D75496F3E66026F905BCA7824B19A123554BFB6
SHA-256:	630E89F8A5ADFB39566F6661F8BF497139D349E2F04728A3B279654BED08EA2B
SHA-512:	86DD742C60E6AB1100628E6B9B7D5557D08B37B1897DAAA4AB9411CB9C0CDCB4F9132303CBB5A32FA0640BEA884240EC6FBBD994B53CC854D60950E418528026
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="594925" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372873519540036
Encrypted:	false
SSDEEP:	6144:MFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNEiL:8V1QyWWI/glMM6kF7Kq
MD5:	C35CBD2CEF6E068FA36B2D7D07F9AB3D
SHA1:	FD286F14DEF26C4C94EA42371FCB276ED017D83D
SHA-256:	709746474C800127297CA702F04E6421536B137AED4997676049ACA1727354BC
SHA-512:	5AA9D5B5034D647FC9525C0E5CA64E7DDCD4110E3A973E9DD7115CA0A0854A443A7083E408EB87B83AD1D79701EEF5E5D10794B6D548D15A108508F505F04B1C
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.4..}:..............................................................................................................................................................................................................................................................................................................................................1T..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, PECompact2 compressed
Entropy (8bit):	6.39398433928256
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	81mieek02V.dll
File size:	322'777 bytes
MD5:	703dd9fac2280e224a1949db0cf545a3
SHA1:	9f79ed51c51057b765256f856cd3690737c98fce
SHA256:	5397c40c0f4bbe1b202069a612b03dac27a0c33eeec7ac97df264b9afbb84da4
SHA512:	69e3b4cf81bf8c5e2a944f22bf145442415882712957c1a64c051ad3a89b5dd9cd1247f2331fc429295bfda244799263bcebb347bcdc09339f7875c19af493d0
SSDEEP:	6144:YutK09bpsWYrPnP3UKLSr1TS8BbdrFucR+z+qagIK+bcgaI0C:BK0YWYrPP35LSrBS8LQ4+z+qagQYVIv
TLSH:	2C64AE0237B552F9D4F70A3A9F35E72DE33438109CA8DD159B8A18C91CE394AADD538B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... B..N...N...N...B...N.F.....N.......N.......N.......N...@...N.m.D...N...O.^.N.m.E...N.=.H...N.m.J...N.Rich..N................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10042ae6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL
DLL Characteristics:
Time Stamp:	0x565C7C9C [Mon Nov 30 16:43:08 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1e14d607956b4cc2b9b7835c72bf0b77

Entrypoint Preview

Instruction
jmp 00007F6CA44CD65Eh
adc byte ptr [ebp+6E3FA254h], al
or eax, dword ptr [esi]
mov cl, 92h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4fb24	0x68	.rsrc
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d6cc	0x118	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4f000	0xb10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x49000	0x1628	.text
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4e000	0x4ca00	b29859f73b90e7f64037da48fbee12a8	False	0.5888783391109299	data	6.394873960706557	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4f000	0x2000	0x1e00	a03763a40a39da37762a5efcd57a5136	False	0.6859375	data	6.354524003809639	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x51000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x4b000	0x16c	data	English	United States	0.5521978021978022
RT_STRING	0x4b170	0x86	data	English	United States	0.6417910447761194
RT_STRING	0x4b1f8	0x56	data	English	United States	0.6744186046511628
RT_STRING	0x4b250	0x16e	data	English	United States	0.505464480874317
RT_STRING	0x4b3c0	0x128	data	English	United States	0.581081081081081
RT_STRING	0x4b4e8	0xd2	data	English	United States	0.5761904761904761
RT_STRING	0x4b5c0	0x6a	data	English	United States	0.660377358490566
RT_STRING	0x4b630	0xc8	Matlab v4 mat-file (little endian) b, numeric, rows 0, columns 0	English	United States	0.555
RT_STRING	0x4b6f8	0x200	data	English	United States	0.375
RT_STRING	0x4b8f8	0x23e	data	English	United States	0.44773519163763065
RT_STRING	0x4bb38	0x12e	data	English	United States	0.4503311258278146
RT_STRING	0x4bc68	0xca	Matlab v4 mat-file (little endian) O, numeric, rows 0, columns 0	English	United States	0.42574257425742573
RT_STRING	0x4bd38	0x252	data	English	United States	0.39225589225589225
RT_STRING	0x4bf90	0x28e	data	English	United States	0.43730886850152906
RT_STRING	0x4c220	0xce	data	English	United States	0.4563106796116505
RT_STRING	0x4c2f0	0x15c	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	English	United States	0.4166666666666667
RT_STRING	0x4c450	0x398	data	English	United States	0.375
RT_STRING	0x4c7e8	0x2ae	data	English	United States	0.3688046647230321
RT_STRING	0x4ca98	0x42	data	English	United States	0.4696969696969697
RT_STRING	0x4cae0	0x20	data	English	United States	0.34375
RT_STRING	0x4cb00	0x20	data	English	United States	0.34375
RT_STRING	0x4cb20	0x20	data	English	United States	0.34375
RT_STRING	0x4cb40	0x20	data	English	United States	0.34375
RT_STRING	0x4cb60	0x20	data	English	United States	0.34375
RT_STRING	0x4cb80	0x20	data	English	United States	0.34375
RT_STRING	0x4cba0	0x20	data	English	United States	0.34375
RT_STRING	0x4cbc0	0x20	data	English	United States	0.34375
RT_STRING	0x4cbe0	0x7a	data	English	United States	0.6475409836065574
RT_STRING	0x4cc60	0x20	data	English	United States	0.34375
RT_STRING	0x4cc80	0x20	data	English	United States	0.34375
RT_STRING	0x4cca0	0x13a	Matlab v4 mat-file (little endian) ', numeric, rows 0, columns 0	English	United States	0.3821656050955414
RT_STRING	0x4cde0	0x19a	data	English	United States	0.4195121951219512
RT_STRING	0x4cf80	0x9a	data	English	United States	0.512987012987013
RT_STRING	0x4d020	0xa8	data	English	United States	0.5833333333333334
RT_STRING	0x4d0c8	0x20	data	English	United States	0.34375
RT_VERSION	0x4f7f0	0x31c	data	English	United States	0.4296482412060301
RT_HTML	0x4d0e8	0x49	HTML document, ASCII text, with CRLF line terminators	English	United States	0.8493150684931506
RT_HTML	0x4d138	0xd	HTML document, ASCII text, with no line terminators	English	United States	1.3076923076923077
RT_HTML	0x4d148	0x6be	HTML document, ASCII text, with CRLF line terminators	English	United States	0.5179606025492468

Imports

DLL	Import
MFC42.DLL
MSVCRT.dll	_strcmpi
KERNEL32.dll	CreateDirectoryA
USER32.dll	GetDesktopWindow
ADVAPI32.dll	RegDeleteValueA
WS2_32.dll	htons
SHLWAPI.dll	PathIsDirectoryA
ole32.dll	CoUninitialize
OLEAUT32.dll	SafeArrayGetVartype
MSVCP60.dll	?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
NETAPI32.dll	Netbios
KERNEL32.dll	GetModuleFileNameW
KERNEL32.dll	GetModuleHandleA, LoadLibraryA, LocalAlloc, LocalFree, GetModuleFileNameA, ExitProcess

Exports

Name	Ordinal	Address
DoAddToFavDlg	1	0x10008645
InputFile	2	0x1000678b
PrintFile	3	0x1000443d

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 13:22:58.826095104 CET	49705	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 13:22:58.826235056 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 13:22:59.825125933 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 13:22:59.825134993 CET	49705	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 13:23:01.825226068 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 13:23:01.840735912 CET	49705	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 13:23:05.825176001 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 13:23:05.867259026 CET	49705	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 13:23:13.825139046 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 13:23:13.872046947 CET	49705	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 13:23:23.863858938 CET	49740	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:23.863894939 CET	49741	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:24.872055054 CET	49741	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:24.872056961 CET	49740	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:26.872081995 CET	49740	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:26.887685061 CET	49741	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:27.679569960 CET	49766	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:27.860878944 CET	49769	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:27.978847027 CET	49771	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:27.979996920 CET	49772	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:28.872104883 CET	49769	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:28.981473923 CET	49772	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:28.984919071 CET	49771	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:30.872070074 CET	49769	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:30.981509924 CET	49772	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:30.997090101 CET	49771	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:31.872891903 CET	49802	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:31.985925913 CET	49805	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:31.986813068 CET	49806	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:32.887693882 CET	49802	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:32.997035027 CET	49805	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:32.997039080 CET	49806	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:34.903353930 CET	49802	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:34.997112036 CET	49806	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:35.012720108 CET	49805	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:35.893884897 CET	49836	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:36.017410040 CET	49838	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:36.017971992 CET	49839	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:36.903338909 CET	49836	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:37.028350115 CET	49838	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:37.032341003 CET	49839	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:38.903358936 CET	49836	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:39.028404951 CET	49838	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:39.028407097 CET	49839	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:39.888571024 CET	49871	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:40.002470016 CET	49873	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:40.004853964 CET	49874	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:40.903342009 CET	49871	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:40.997082949 CET	49873	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:41.012680054 CET	49874	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:42.903369904 CET	49871	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:43.012717009 CET	49873	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:43.028352976 CET	49874	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:43.904123068 CET	49905	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:44.016477108 CET	49907	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:44.017060041 CET	49908	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:44.903337002 CET	49905	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:45.028424978 CET	49907	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:45.028445005 CET	49908	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:46.903350115 CET	49905	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:47.028373957 CET	49907	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:47.028376102 CET	49908	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:47.904058933 CET	49942	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:48.018913984 CET	49945	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:48.019963980 CET	49946	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:48.919007063 CET	49942	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:49.028373957 CET	49945	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:49.028377056 CET	49946	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:50.934639931 CET	49942	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:51.028371096 CET	49945	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:51.028373957 CET	49946	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:51.920041084 CET	49978	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:52.055198908 CET	49980	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:52.056093931 CET	49981	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:52.934581041 CET	49978	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:53.059623957 CET	49981	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:53.060349941 CET	49980	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:54.938836098 CET	49978	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:55.075259924 CET	49981	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:55.076387882 CET	49980	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:55.935765028 CET	50008	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:56.119232893 CET	50010	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:56.119457960 CET	50011	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:56.934710026 CET	50008	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:57.137856960 CET	50010	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:57.141360044 CET	50011	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:58.950237036 CET	50008	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:59.153343916 CET	50010	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:23:59.153465986 CET	50011	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:23:59.951668978 CET	50045	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:00.068414927 CET	50047	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:00.119818926 CET	50049	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:00.965843916 CET	50045	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:01.075222969 CET	50047	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:01.122186899 CET	50049	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:02.981571913 CET	50045	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:03.090991020 CET	50047	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:03.122145891 CET	50049	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:03.966650009 CET	50084	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:04.078289986 CET	50086	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:04.079510927 CET	50087	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:04.981587887 CET	50084	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:05.090898991 CET	50086	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:05.090900898 CET	50087	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:06.981484890 CET	50084	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:07.090944052 CET	50087	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:07.090950012 CET	50086	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:07.966866016 CET	50127	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:08.081315041 CET	50130	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:08.081518888 CET	50131	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:08.981509924 CET	50127	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:09.075301886 CET	50130	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:09.090940952 CET	50131	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:10.981539011 CET	50127	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:11.075251102 CET	50130	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:11.090884924 CET	50131	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:11.982628107 CET	50171	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:12.099617004 CET	50174	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:12.100188971 CET	50175	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:12.997112989 CET	50171	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:13.106643915 CET	50175	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:13.106648922 CET	50174	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:15.012778997 CET	50171	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:15.122107983 CET	50174	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:15.122111082 CET	50175	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:15.998236895 CET	50227	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:16.110840082 CET	50230	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:16.111682892 CET	50231	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:17.012798071 CET	50227	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:17.122169018 CET	50230	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:17.122284889 CET	50231	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:19.028422117 CET	50227	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:19.137787104 CET	50230	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:19.137998104 CET	50231	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:20.001065969 CET	50292	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:20.151595116 CET	50294	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:20.152370930 CET	50295	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:21.012744904 CET	50292	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:21.153381109 CET	50294	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:21.154479980 CET	50295	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:23.028467894 CET	50292	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:23.153450966 CET	50294	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:23.158400059 CET	50295	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:24.017103910 CET	50368	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:24.130004883 CET	50371	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:24.130564928 CET	50372	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:25.028378010 CET	50368	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:25.137819052 CET	50372	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:25.137970924 CET	50371	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:27.044070959 CET	50368	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:27.153429985 CET	50371	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:27.153440952 CET	50372	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:28.029197931 CET	50446	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:28.144329071 CET	50449	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:28.722937107 CET	50464	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:29.028417110 CET	50446	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:29.153408051 CET	50449	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:29.731553078 CET	50464	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:31.028400898 CET	50446	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:31.153434038 CET	50449	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:31.731538057 CET	50464	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:32.045288086 CET	50559	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:32.157568932 CET	50563	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:32.159368038 CET	50564	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:33.059642076 CET	50559	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:33.153398991 CET	50564	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:33.155076981 CET	50563	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:35.075270891 CET	50559	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:35.153398991 CET	50564	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:35.169023991 CET	50563	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:36.064416885 CET	50654	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:36.195683002 CET	50661	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:36.196578026 CET	50662	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:37.075284004 CET	50654	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:37.200309992 CET	50662	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:37.201380014 CET	50661	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:39.075287104 CET	50654	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:39.200264931 CET	50662	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:39.216447115 CET	50661	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:40.110088110 CET	50849	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:40.222244024 CET	50856	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:40.222548962 CET	50857	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:41.122164965 CET	50849	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:41.231528997 CET	50857	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:41.231599092 CET	50856	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:43.137808084 CET	50849	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:43.232295990 CET	50857	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:43.232414007 CET	50856	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:44.234246016 CET	51073	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:44.234489918 CET	51074	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:44.238073111 CET	51076	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:45.231534958 CET	51076	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:45.247205019 CET	51073	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:45.341187000 CET	51074	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:47.292583942 CET	51076	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:47.292723894 CET	51073	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:47.340982914 CET	51074	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:48.366369963 CET	51314	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:48.367343903 CET	51315	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:48.369877100 CET	51316	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:49.387798071 CET	51315	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:49.544047117 CET	51314	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:49.544477940 CET	51316	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:51.482520103 CET	51315	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:51.544069052 CET	51316	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:51.544090033 CET	51314	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:52.376214981 CET	51547	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:52.495171070 CET	51554	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:52.495820045 CET	51555	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:53.482429981 CET	51547	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:53.591008902 CET	51554	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:53.591051102 CET	51555	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:55.481571913 CET	51547	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:55.590933084 CET	51555	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:55.590943098 CET	51554	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:56.391747952 CET	52852	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:56.505027056 CET	52899	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:56.509674072 CET	52901	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:57.544078112 CET	52901	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:57.544079065 CET	52852	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:57.544919968 CET	52899	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:59.544073105 CET	52852	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:24:59.544074059 CET	52901	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:24:59.544111967 CET	52899	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:00.404603958 CET	54865	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:00.538065910 CET	54866	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:00.541582108 CET	54867	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:01.544475079 CET	54865	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:01.590955019 CET	54866	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:01.590960026 CET	54867	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:03.544075012 CET	54865	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:03.590961933 CET	54866	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:03.590972900 CET	54867	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:04.426111937 CET	57055	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:04.534086943 CET	57093	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:04.536624908 CET	57095	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:05.481602907 CET	57055	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:05.590954065 CET	57093	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:05.590975046 CET	57095	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:07.481638908 CET	57055	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:07.590972900 CET	57095	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:07.591007948 CET	57093	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:08.436225891 CET	59895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:08.551667929 CET	59998	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:08.553374052 CET	59999	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:09.481662035 CET	59895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:09.544070959 CET	59998	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:09.731564045 CET	59999	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:11.544085026 CET	59998	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:11.562984943 CET	59895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:11.731595993 CET	59999	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:12.481771946 CET	62541	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:12.598305941 CET	62583	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:12.600461006 CET	62585	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:13.544087887 CET	62541	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:13.731580019 CET	62583	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:13.794090986 CET	62585	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:15.544087887 CET	62541	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:15.731585979 CET	62583	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:15.794100046 CET	62585	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:16.501617908 CET	49185	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:16.612103939 CET	49260	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:16.616972923 CET	49261	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:17.539838076 CET	49185	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:17.645169973 CET	49260	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:17.645256996 CET	49261	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:19.606189013 CET	49185	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:19.715718031 CET	49261	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:19.715720892 CET	49260	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:20.516279936 CET	51970	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:20.634015083 CET	52029	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:20.635047913 CET	52030	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:21.590976000 CET	51970	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:21.731601954 CET	52030	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:21.789588928 CET	52029	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:23.590990067 CET	51970	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:23.731714010 CET	52030	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:23.794115067 CET	52029	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:24.530093908 CET	54577	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:24.644890070 CET	54681	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:24.645448923 CET	54682	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:25.544115067 CET	54577	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:25.731631994 CET	54682	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:25.786969900 CET	54681	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:27.544281960 CET	54577	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:27.731633902 CET	54682	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:27.794128895 CET	54681	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:28.550240993 CET	57318	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:28.660180092 CET	57351	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:29.127332926 CET	57735	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:29.590998888 CET	57318	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:29.731631994 CET	57351	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:30.231668949 CET	57735	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:31.590991974 CET	57318	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:31.731745005 CET	57351	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:32.231672049 CET	57735	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:32.560954094 CET	60147	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:32.699876070 CET	60257	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:32.701498985 CET	60259	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:33.712810040 CET	60257	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:33.712902069 CET	60259	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:33.731640100 CET	60147	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:35.731626034 CET	60147	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:35.737051964 CET	60257	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:35.737123966 CET	60259	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:36.576656103 CET	62812	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:36.690505028 CET	62951	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:36.692234993 CET	62953	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:37.731626034 CET	62812	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:37.731631041 CET	62951	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:37.794122934 CET	62953	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:39.731642008 CET	62812	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:39.731749058 CET	62951	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:39.870604038 CET	62953	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:40.600379944 CET	65296	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:40.704191923 CET	65297	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:40.723093033 CET	65299	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:41.731844902 CET	65296	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:41.759262085 CET	65297	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:41.759357929 CET	65299	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:43.794151068 CET	65297	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:43.794158936 CET	65299	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:43.841002941 CET	65296	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:44.607685089 CET	50947	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:44.721802950 CET	51083	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:44.721812963 CET	51082	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:45.731643915 CET	50947	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:45.731668949 CET	51082	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:45.731831074 CET	51083	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:47.731654882 CET	50947	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:47.731682062 CET	51082	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:47.731719971 CET	51083	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:48.495071888 CET	52960	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:48.495277882 CET	52961	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:48.496026993 CET	52962	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:49.544173002 CET	52960	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:49.544176102 CET	52962	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:49.593758106 CET	52961	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:51.544156075 CET	52960	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:51.544253111 CET	52962	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:51.591197968 CET	52961	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:52.664539099 CET	54853	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:52.824212074 CET	54886	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:52.824661970 CET	54887	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:53.701781988 CET	54853	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:53.841032982 CET	54886	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:53.841090918 CET	54887	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:55.794167995 CET	54853	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:55.841037989 CET	54886	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:55.842504978 CET	54887	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:56.670073986 CET	57239	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:56.798835039 CET	57366	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:56.801053047 CET	57368	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:57.731661081 CET	57239	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:57.841048956 CET	57366	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:57.887912989 CET	57368	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:25:59.731658936 CET	57239	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:59.841027021 CET	57366	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:25:59.931087017 CET	57368	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:00.694063902 CET	59575	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:00.818317890 CET	59685	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:00.818320036 CET	59684	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:01.718153000 CET	59575	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:01.840754032 CET	59684	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:01.840868950 CET	59685	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:03.769639969 CET	59575	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:03.882530928 CET	59684	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:03.882636070 CET	59685	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:04.701045036 CET	61895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:04.818497896 CET	61986	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:04.824099064 CET	61988	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:05.794249058 CET	61895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:05.981693983 CET	61986	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:05.982527018 CET	61988	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:07.794470072 CET	61895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:07.981710911 CET	61986	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:07.981818914 CET	61988	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:08.858515024 CET	63833	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:08.982724905 CET	63888	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:08.986399889 CET	63890	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:09.981718063 CET	63833	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:10.091068983 CET	63888	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:10.091084003 CET	63890	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:12.091090918 CET	63833	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:12.091105938 CET	63890	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:12.091113091 CET	63888	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:12.989805937 CET	50088	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:12.990694046 CET	50089	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:12.992611885 CET	50091	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:14.044209957 CET	50089	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:14.044245958 CET	50091	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:14.091057062 CET	50088	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:16.044213057 CET	50089	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:16.044449091 CET	50091	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:16.294200897 CET	50088	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:16.998305082 CET	52476	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:17.115685940 CET	52580	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:17.119308949 CET	52582	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:18.091075897 CET	52476	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:18.231754065 CET	52580	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:18.231771946 CET	52582	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:20.091156006 CET	52476	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:20.231795073 CET	52580	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:20.231863976 CET	52582	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:21.004184008 CET	55391	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:21.125011921 CET	55435	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:21.125209093 CET	55434	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:22.091192961 CET	55391	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:22.294370890 CET	55435	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:22.294389963 CET	55434	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:24.091093063 CET	55391	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:24.481739998 CET	55434	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:24.481745005 CET	55435	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:25.028697968 CET	57219	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:25.169265032 CET	57226	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:25.170376062 CET	57227	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:26.089143038 CET	57219	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:26.210571051 CET	57226	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:26.210597992 CET	57227	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:28.184860945 CET	57219	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:28.294229984 CET	57227	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:28.294229031 CET	57226	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:29.029783010 CET	59504	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:29.146573067 CET	59575	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:29.632668972 CET	59877	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:30.044208050 CET	59504	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:30.294215918 CET	59575	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:30.731722116 CET	59877	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:32.044243097 CET	59504	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:32.387993097 CET	59575	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:32.731734991 CET	59877	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:33.069844007 CET	61830	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:33.195310116 CET	61922	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:33.197086096 CET	61923	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:34.231730938 CET	61830	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:34.294248104 CET	61922	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:34.294258118 CET	61923	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:36.231728077 CET	61830	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:36.294246912 CET	61922	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:36.294567108 CET	61923	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:37.097460985 CET	64148	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:37.215465069 CET	64253	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:37.239161015 CET	64255	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:38.185125113 CET	64148	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:38.294276953 CET	64253	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:38.294558048 CET	64255	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:40.240911961 CET	64148	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:40.388060093 CET	64253	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:40.388062954 CET	64255	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:41.108798981 CET	50587	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:41.223166943 CET	50728	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:41.224009037 CET	50729	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:42.231786013 CET	50729	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:42.231832981 CET	50587	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:42.231971025 CET	50728	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:44.231760025 CET	50587	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:44.232616901 CET	50729	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:44.232616901 CET	50728	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:45.123792887 CET	53554	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:45.237930059 CET	53688	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:45.238743067 CET	53689	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:46.231796026 CET	53554	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:46.294291019 CET	53688	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:46.294295073 CET	53689	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:48.231775999 CET	53554	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:48.294291973 CET	53689	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:48.294395924 CET	53688	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:49.139605045 CET	56057	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:49.253603935 CET	56151	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:49.257014990 CET	56153	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:50.184921026 CET	56057	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:50.294476986 CET	56153	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:50.342657089 CET	56151	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:52.294291973 CET	56057	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:52.294780970 CET	56153	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:52.341588974 CET	56151	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:53.155241013 CET	58915	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:53.272355080 CET	59024	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:53.272353888 CET	59025	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:54.231959105 CET	58915	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:54.388044119 CET	59024	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:54.388607025 CET	59025	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:56.231831074 CET	58915	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:56.481785059 CET	59024	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:56.481952906 CET	59025	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:57.170804024 CET	61804	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:57.289189100 CET	61934	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:57.289755106 CET	61935	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:26:58.231765032 CET	61804	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:58.341145039 CET	61934	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:26:58.341891050 CET	61935	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:27:00.232517004 CET	61804	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:00.341162920 CET	61935	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:27:00.341166973 CET	61934	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:01.186471939 CET	62780	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:01.315574884 CET	62851	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:01.320489883 CET	62852	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:27:02.253070116 CET	62780	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:02.341146946 CET	62852	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:27:02.388076067 CET	62851	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:04.263151884 CET	62780	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:04.356774092 CET	62852	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:27:04.388020992 CET	62851	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:08.263020992 CET	62780	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:08.356787920 CET	62852	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:27:08.388029099 CET	62851	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:16.263077021 CET	62780	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 13:27:16.356796980 CET	62852	80	192.168.2.8	202.108.0.52
Nov 19, 2024 13:27:16.388051987 CET	62851	23588	192.168.2.8	107.160.131.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 13:23:20.851130962 CET	63910	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:23:21.403458118 CET	53	63910	1.1.1.1	192.168.2.8
Nov 19, 2024 13:23:25.092622042 CET	56187	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:23:25.619621038 CET	53	56187	1.1.1.1	192.168.2.8
Nov 19, 2024 13:23:27.309988976 CET	53389	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:23:27.677083015 CET	53	53389	1.1.1.1	192.168.2.8
Nov 19, 2024 13:23:30.061816931 CET	62084	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:23:30.564500093 CET	53	62084	1.1.1.1	192.168.2.8
Nov 19, 2024 13:23:35.302881002 CET	64678	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:23:35.310664892 CET	53	64678	1.1.1.1	192.168.2.8
Nov 19, 2024 13:23:40.124362946 CET	61432	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:23:40.673605919 CET	53	61432	1.1.1.1	192.168.2.8
Nov 19, 2024 13:23:45.108654022 CET	59969	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:23:45.115885019 CET	53	59969	1.1.1.1	192.168.2.8
Nov 19, 2024 13:23:50.110486984 CET	62741	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:23:50.118160009 CET	53	62741	1.1.1.1	192.168.2.8
Nov 19, 2024 13:23:55.085882902 CET	58557	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:23:55.618839979 CET	53	58557	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:00.101177931 CET	62934	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:00.110347033 CET	53	62934	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:05.093569994 CET	51460	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:05.347250938 CET	53	51460	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:10.093015909 CET	61124	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:10.630876064 CET	53	61124	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:15.077033043 CET	59419	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:15.084805965 CET	53	59419	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:20.055459023 CET	50331	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:20.063033104 CET	53	50331	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:25.060514927 CET	61247	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:25.596714020 CET	53	61247	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:28.144834995 CET	65069	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:28.693099022 CET	53	65069	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:30.047977924 CET	58223	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:30.055006027 CET	53	58223	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:35.061002970 CET	56560	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:35.604775906 CET	53	56560	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:40.045208931 CET	63468	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:40.052668095 CET	53	63468	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:45.044869900 CET	54930	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:45.052067041 CET	53	54930	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:50.046860933 CET	51949	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:50.054250002 CET	53	51949	1.1.1.1	192.168.2.8
Nov 19, 2024 13:24:55.046518087 CET	58689	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:24:55.541901112 CET	53	58689	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:00.054855108 CET	59369	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:00.542938948 CET	53	59369	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:05.047591925 CET	59534	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:05.055120945 CET	53	59534	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:10.046014071 CET	64084	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:10.053042889 CET	53	64084	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:15.044374943 CET	57631	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:15.051698923 CET	53	57631	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:20.045089006 CET	62564	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:20.052128077 CET	53	62564	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:25.045387030 CET	57733	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:25.584173918 CET	53	57733	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:28.661644936 CET	51681	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:29.125828981 CET	53	51681	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:30.046004057 CET	54980	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:30.053647995 CET	53	54980	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:35.045310020 CET	57982	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:35.053432941 CET	53	57982	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:40.174962044 CET	60382	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:40.718411922 CET	53	60382	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:45.045711994 CET	62428	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:45.053747892 CET	53	62428	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:50.077505112 CET	51601	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:50.086288929 CET	53	51601	1.1.1.1	192.168.2.8
Nov 19, 2024 13:25:55.045299053 CET	52577	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:25:55.053072929 CET	53	52577	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:00.044593096 CET	50049	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:00.565200090 CET	53	50049	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:05.045510054 CET	51693	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:05.055665016 CET	53	51693	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:10.053179026 CET	53586	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:10.064955950 CET	53	53586	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:15.119347095 CET	53204	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:15.126447916 CET	53	53204	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:20.045089960 CET	50088	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:20.052783012 CET	53	50088	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:25.045505047 CET	61391	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:25.598747969 CET	53	61391	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:29.147072077 CET	51420	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:29.629334927 CET	53	51420	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:30.045355082 CET	57560	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:30.534117937 CET	53	57560	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:35.045813084 CET	49300	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:35.564107895 CET	53	49300	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:40.095741034 CET	51956	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:40.102521896 CET	53	51956	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:45.045583010 CET	65271	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:45.052799940 CET	53	65271	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:50.044939995 CET	56617	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:50.052392960 CET	53	56617	1.1.1.1	192.168.2.8
Nov 19, 2024 13:26:55.046739101 CET	56599	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:26:55.054665089 CET	53	56599	1.1.1.1	192.168.2.8
Nov 19, 2024 13:27:00.070651054 CET	54040	53	192.168.2.8	1.1.1.1
Nov 19, 2024 13:27:00.614614964 CET	53	54040	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 13:23:20.851130962 CET	192.168.2.8	1.1.1.1	0x1930	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:25.092622042 CET	192.168.2.8	1.1.1.1	0x4d9d	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:27.309988976 CET	192.168.2.8	1.1.1.1	0xe9c9	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:30.061816931 CET	192.168.2.8	1.1.1.1	0xce77	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:35.302881002 CET	192.168.2.8	1.1.1.1	0x6428	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:40.124362946 CET	192.168.2.8	1.1.1.1	0xbe8d	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:45.108654022 CET	192.168.2.8	1.1.1.1	0xcbc	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:50.110486984 CET	192.168.2.8	1.1.1.1	0x2b7c	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:55.085882902 CET	192.168.2.8	1.1.1.1	0x1e00	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:00.101177931 CET	192.168.2.8	1.1.1.1	0x2ca6	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:05.093569994 CET	192.168.2.8	1.1.1.1	0x3202	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:10.093015909 CET	192.168.2.8	1.1.1.1	0x4a85	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:15.077033043 CET	192.168.2.8	1.1.1.1	0x6814	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:20.055459023 CET	192.168.2.8	1.1.1.1	0x1ebc	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:25.060514927 CET	192.168.2.8	1.1.1.1	0x1de0	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:28.144834995 CET	192.168.2.8	1.1.1.1	0xbab8	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:30.047977924 CET	192.168.2.8	1.1.1.1	0x2151	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:35.061002970 CET	192.168.2.8	1.1.1.1	0x5f3b	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:40.045208931 CET	192.168.2.8	1.1.1.1	0x47d5	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:45.044869900 CET	192.168.2.8	1.1.1.1	0x5acb	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:50.046860933 CET	192.168.2.8	1.1.1.1	0x6401	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:55.046518087 CET	192.168.2.8	1.1.1.1	0xd861	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:00.054855108 CET	192.168.2.8	1.1.1.1	0xffea	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:05.047591925 CET	192.168.2.8	1.1.1.1	0x6b9d	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:10.046014071 CET	192.168.2.8	1.1.1.1	0xb059	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:15.044374943 CET	192.168.2.8	1.1.1.1	0x329a	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:20.045089006 CET	192.168.2.8	1.1.1.1	0x28e2	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:25.045387030 CET	192.168.2.8	1.1.1.1	0xf228	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:28.661644936 CET	192.168.2.8	1.1.1.1	0x3c67	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:30.046004057 CET	192.168.2.8	1.1.1.1	0x58b5	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:35.045310020 CET	192.168.2.8	1.1.1.1	0xc52	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:40.174962044 CET	192.168.2.8	1.1.1.1	0xc473	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:45.045711994 CET	192.168.2.8	1.1.1.1	0x7355	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:50.077505112 CET	192.168.2.8	1.1.1.1	0x1d00	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:55.045299053 CET	192.168.2.8	1.1.1.1	0xb511	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:00.044593096 CET	192.168.2.8	1.1.1.1	0xa903	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:05.045510054 CET	192.168.2.8	1.1.1.1	0xaeda	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:10.053179026 CET	192.168.2.8	1.1.1.1	0x9687	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:15.119347095 CET	192.168.2.8	1.1.1.1	0x5c7d	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:20.045089960 CET	192.168.2.8	1.1.1.1	0xc4be	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:25.045505047 CET	192.168.2.8	1.1.1.1	0x2b63	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:29.147072077 CET	192.168.2.8	1.1.1.1	0x46d2	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:30.045355082 CET	192.168.2.8	1.1.1.1	0x73f9	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:35.045813084 CET	192.168.2.8	1.1.1.1	0x807b	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:40.095741034 CET	192.168.2.8	1.1.1.1	0xe6d8	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:45.045583010 CET	192.168.2.8	1.1.1.1	0x1911	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:50.044939995 CET	192.168.2.8	1.1.1.1	0x8005	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:55.046739101 CET	192.168.2.8	1.1.1.1	0xa08a	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:27:00.070651054 CET	192.168.2.8	1.1.1.1	0xd544	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 13:23:21.403458118 CET	1.1.1.1	192.168.2.8	0x1930	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:25.619621038 CET	1.1.1.1	192.168.2.8	0x4d9d	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:27.677083015 CET	1.1.1.1	192.168.2.8	0xe9c9	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 13:23:27.677083015 CET	1.1.1.1	192.168.2.8	0xe9c9	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:30.564500093 CET	1.1.1.1	192.168.2.8	0xce77	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:35.310664892 CET	1.1.1.1	192.168.2.8	0x6428	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:40.673605919 CET	1.1.1.1	192.168.2.8	0xbe8d	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:45.115885019 CET	1.1.1.1	192.168.2.8	0xcbc	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:50.118160009 CET	1.1.1.1	192.168.2.8	0x2b7c	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:23:55.618839979 CET	1.1.1.1	192.168.2.8	0x1e00	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:00.110347033 CET	1.1.1.1	192.168.2.8	0x2ca6	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:05.347250938 CET	1.1.1.1	192.168.2.8	0x3202	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:10.630876064 CET	1.1.1.1	192.168.2.8	0x4a85	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:15.084805965 CET	1.1.1.1	192.168.2.8	0x6814	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:20.063033104 CET	1.1.1.1	192.168.2.8	0x1ebc	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:25.596714020 CET	1.1.1.1	192.168.2.8	0x1de0	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:28.693099022 CET	1.1.1.1	192.168.2.8	0xbab8	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 13:24:28.693099022 CET	1.1.1.1	192.168.2.8	0xbab8	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:30.055006027 CET	1.1.1.1	192.168.2.8	0x2151	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:35.604775906 CET	1.1.1.1	192.168.2.8	0x5f3b	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:40.052668095 CET	1.1.1.1	192.168.2.8	0x47d5	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:45.052067041 CET	1.1.1.1	192.168.2.8	0x5acb	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:50.054250002 CET	1.1.1.1	192.168.2.8	0x6401	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:24:55.541901112 CET	1.1.1.1	192.168.2.8	0xd861	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:00.542938948 CET	1.1.1.1	192.168.2.8	0xffea	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:05.055120945 CET	1.1.1.1	192.168.2.8	0x6b9d	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:10.053042889 CET	1.1.1.1	192.168.2.8	0xb059	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:15.051698923 CET	1.1.1.1	192.168.2.8	0x329a	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:20.052128077 CET	1.1.1.1	192.168.2.8	0x28e2	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:25.584173918 CET	1.1.1.1	192.168.2.8	0xf228	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:29.125828981 CET	1.1.1.1	192.168.2.8	0x3c67	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 13:25:29.125828981 CET	1.1.1.1	192.168.2.8	0x3c67	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:30.053647995 CET	1.1.1.1	192.168.2.8	0x58b5	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:35.053432941 CET	1.1.1.1	192.168.2.8	0xc52	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:40.718411922 CET	1.1.1.1	192.168.2.8	0xc473	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:45.053747892 CET	1.1.1.1	192.168.2.8	0x7355	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:50.086288929 CET	1.1.1.1	192.168.2.8	0x1d00	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:25:55.053072929 CET	1.1.1.1	192.168.2.8	0xb511	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:00.565200090 CET	1.1.1.1	192.168.2.8	0xa903	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:05.055665016 CET	1.1.1.1	192.168.2.8	0xaeda	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:10.064955950 CET	1.1.1.1	192.168.2.8	0x9687	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:15.126447916 CET	1.1.1.1	192.168.2.8	0x5c7d	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:20.052783012 CET	1.1.1.1	192.168.2.8	0xc4be	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:25.598747969 CET	1.1.1.1	192.168.2.8	0x2b63	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:29.629334927 CET	1.1.1.1	192.168.2.8	0x46d2	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 13:26:29.629334927 CET	1.1.1.1	192.168.2.8	0x46d2	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:30.534117937 CET	1.1.1.1	192.168.2.8	0x73f9	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:35.564107895 CET	1.1.1.1	192.168.2.8	0x807b	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:40.102521896 CET	1.1.1.1	192.168.2.8	0xe6d8	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:45.052799940 CET	1.1.1.1	192.168.2.8	0x1911	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:50.052392960 CET	1.1.1.1	192.168.2.8	0x8005	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:26:55.054665089 CET	1.1.1.1	192.168.2.8	0xa08a	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 13:27:00.614614964 CET	1.1.1.1	192.168.2.8	0xd544	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	07:22:54
Start date:	19/11/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\81mieek02V.dll"
Imagebase:	0xbf0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:22:54
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:22:55
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",#1
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:22:55
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,DoAddToFavDlg
Imagebase:	0xd80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:22:55
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",#1
Imagebase:	0xd80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:22:55
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:22:55
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:22:55
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x290000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:22:58
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,InputFile
Imagebase:	0xd80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:23:01
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\81mieek02V.dll,PrintFile
Imagebase:	0xd80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:23:01
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7876 -s 672
Imagebase:	0x10000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:23:04
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg
Imagebase:	0xd80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:23:04
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",InputFile
Imagebase:	0xd80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:23:04
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\81mieek02V.dll",PrintFile
Imagebase:	0xd80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:23:04
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1152, Parent PID: 7192

General

Target ID:	22
Start time:	07:23:04
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:23:04
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8172 -s 668
Imagebase:	0x10000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:23:04
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x290000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:23:28
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg
Imagebase:	0xd80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:23:28
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0x7ff6ee680000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3524, Parent PID: 6464

General

Target ID:	28
Start time:	07:23:28
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	07:23:28
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x290000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:23:36
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\81mieek02V.dll",DoAddToFavDlg
Imagebase:	0xd80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7700, Parent PID: 7692

General

Target ID:	31
Start time:	07:23:36
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7860, Parent PID: 7700

General

Target ID:	32
Start time:	07:23:36
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:23:36
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x290000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	99.6%
Signature Coverage:	1.2%
Total number of Nodes:	251
Total number of Limit Nodes:	10

Executed Functions

Function 10007F3E Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L2ltYWdlLnBocA==, xrefs: 1000818B
., xrefs: 10007FCF
P, xrefs: 100080F7
NPKI, xrefs: 1000802C
12010043, xrefs: 1000805B
%s\%s, xrefs: 10008067
*.*, xrefs: 10007F8C
107.160.131.254:23588/article.php, xrefs: 10008113

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %s\%s$*.*$.$107.160.131.254:23588/article.php$12010043$L2ltYWdlLnBocA==$NPKI$P
API String ID: 0-3984435826
Opcode ID: 0a215aef5ca7b5c606a273fdfbec72fd9b9d822c18bbfb0613fe871d940a9004
Instruction ID: 154fd83921e69bd95517e48f0429fd4d3315e101fc3602ca34ca7394d0d5f03d
Opcode Fuzzy Hash: 0a215aef5ca7b5c606a273fdfbec72fd9b9d822c18bbfb0613fe871d940a9004
Instruction Fuzzy Hash: C371517690425DBEEB61D7A4DC45FEEB7BCEB48240F1004E6F608E6041DB74AB898F61

Function 10003FB7 Relevance: 1.5, APIs: 1, Instructions: 4processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000000,00000000,10005931,00000002,00000000,00000000,00000000), ref: 10003FBF

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 1e956e5b503a472c93e19a4642fd5130f6607d7bc175f230498bf039bbf47dc4
Instruction ID: ca46abfd3f4ae67059df7024880e3d5c8c44562ed1dec37196b9e10746ab925e
Opcode Fuzzy Hash: 1e956e5b503a472c93e19a4642fd5130f6607d7bc175f230498bf039bbf47dc4
Instruction Fuzzy Hash: D5A00136408212ABDA42AB50CD48D4AFFA2BBA8781F02C819F19980034CB32C5A5EB12

Function 10006EDE Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 174
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(0000EA60), ref: 10006F24
Sleep.KERNEL32 ref: 10007059
wsprintfA.USER32 ref: 1000709D
PrintFile.81MIEEK02V(00000000,?,00000000), ref: 100070D6
PrintFile.81MIEEK02V(00000000,?,00000000,?,00000000), ref: 100070E9

Strings

QVlSVFNydi5heWU=, xrefs: 10006EFA
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 10006F90
QVNEU3ZjLmV4ZQ==, xrefs: 10006EEE
c:\1.txt, xrefs: 10007047
http://107.160.131.254:23588/article.php, xrefs: 10007007
iOffset, xrefs: 10007042
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 10006F79

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FilePrintSleep$wsprintf
String ID: QVNEU3ZjLmV4ZQ==$QVlSVFNydi5heWU=$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$c:\1.txt$http://107.160.131.254:23588/article.php$iOffset
API String ID: 1547040302-3813294871
Opcode ID: 6901e9babde4ee68b3136e4664651ea7350d119c703396e769bb1a0f608c4114
Instruction ID: e128ca64511400ca05deee7795c3814a468ccd3a13c6d035e862ae5cb279fd62
Opcode Fuzzy Hash: 6901e9babde4ee68b3136e4664651ea7350d119c703396e769bb1a0f608c4114
Instruction Fuzzy Hash: AC51D9B6D04359E6FB22D764CC56FCF77ACEB083C1F1045A5F208EA086DA75AB808E55

Function 10006499 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 272
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 100064F7

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 10006546

Part of subcall function 10003F24: InternetOpenUrlA.WININET(80000100,00000000,00000000,00000000,00000000,10006206), ref: 10003F39

Part of subcall function 10003F41: InternetReadFile.WININET(?,?,?,?), ref: 10003F51

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,75570ECC,0007D000,00000000,00000000), ref: 100065C8
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,?,?,?,75570ECC,0007D000,00000000,00000000), ref: 100065E6
wsprintfA.USER32 ref: 100066E9

Strings

title, xrefs: 10006647, 1000664C, 10006655
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 1000651A
aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==, xrefs: 100064DF

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Internet$ByteCharMultiOpenWidewsprintf$FileFormatReadTime___crt
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==$title
API String ID: 4077377486-2496724313
Opcode ID: 75abeeb0c1ce65552ecf3d51c3df04188886b104fd09b7b212ed437500202792
Instruction ID: 9bb45785208bde0406de56643d62444fa716b577ceefe44749a59ab2aa42cbd8
Opcode Fuzzy Hash: 75abeeb0c1ce65552ecf3d51c3df04188886b104fd09b7b212ed437500202792
Instruction Fuzzy Hash: 9C81E5B5C05248BEFB01DBA4DC82EEF7B7EEF09394F244059F504A7186DA356E4187A1

Function 10005DB4 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 116
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtGetTimeFormatEx.LIBCMT ref: 10005E11

Part of subcall function 1000409D: RegQueryValueExA.KERNEL32(00000000,?,000F003F,00000000,?,80000002,?,10005E16,?,ProcessorNameString,00000000,00000004,?,?,80000002,?), ref: 100040B2

Part of subcall function 10004092: RegCloseKey.KERNEL32(?,10006DBE,?), ref: 10004096

Strings

12010043, xrefs: 10005E8F
%u MB, xrefs: 10005E7E
ProcessorNameString, xrefs: 10005E02
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10005DC5
@, xrefs: 10005E57
Find CPU Error, xrefs: 10005E36
http://107.160.131.254:23588/article.php, xrefs: 10005EF8

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseFormatQueryTimeValue___crt
String ID: %u MB$12010043$@$Find CPU Error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$http://107.160.131.254:23588/article.php
API String ID: 271660946-3893357082
Opcode ID: 37022121a03464651817a9c0c5e1d81c5aa94c867a3c5e15367f04ef0a505e5e
Instruction ID: 4f35d1d9e5d3edf0c8f7125bb17b53cb037807f44d0344e2d1e4939474d77481
Opcode Fuzzy Hash: 37022121a03464651817a9c0c5e1d81c5aa94c867a3c5e15367f04ef0a505e5e
Instruction Fuzzy Hash: 6531C0B6804208BAFB10C764DC42FDF77BCEB08351F10406AFA18BA082EB75BA458B55

Function 10006CF7 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 72
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10003FF7: GetShortPathNameA.KERNEL32(?,?,?), ref: 10004003

Part of subcall function 1000406C: RegCreateKeyExA.KERNEL32(?,00000000,000F003F,00000000,?,00000000,00000000,80000001,10006D60,?,10006D60,80000001,00000000,00000000,REG_SZ,00000000), ref: 1000408A

wsprintfA.USER32 ref: 10006D88
___crtGetTimeFormatEx.LIBCMT ref: 10006DAE

Part of subcall function 100040D4: RegSetValueExA.KERNEL32(00000001,?,00000001,00000000,?,?,?,10006DB3,?,dtfd,00000000,00000001,?,00000001,?), ref: 100040E9

Part of subcall function 10004092: RegCloseKey.KERNEL32(?,10006DBE,?), ref: 10004096

Strings

%s "%s",DoAddToFavDlg, xrefs: 10006D82
C:\Windows\SysWOW64\rundll32.exe, xrefs: 10006D77
C:\Users\user\Desktop\81mieek02V.dll, xrefs: 10006D26, 10006D2C, 10006D71
U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 10006D4A
REG_SZ, xrefs: 10006D44
dtfd, xrefs: 10006DA6

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateFormatNamePathShortTimeValue___crtwsprintf
String ID: %s "%s",DoAddToFavDlg$C:\Users\user\Desktop\81mieek02V.dll$C:\Windows\SysWOW64\rundll32.exe$REG_SZ$U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$dtfd
API String ID: 1762869224-426308641
Opcode ID: fe4a6ca71fda934b348afe6d657169d78400bf351d74a23e551a426737a6504a
Instruction ID: 20d4b35ab7fa00c236079ec8a4dd8982143edab80ee48f6a2419757257224b01
Opcode Fuzzy Hash: fe4a6ca71fda934b348afe6d657169d78400bf351d74a23e551a426737a6504a
Instruction Fuzzy Hash: 451160B694415CBEFB11D7A4DC86FEA776CEB14340F1404A1F704FA085DAB16F988AA4

Function 1000826C Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 145
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00080000,00000000,00000000), ref: 10008394
wsprintfA.USER32 ref: 100083E6

Strings

8.8.8.8, xrefs: 100083EF
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 100082DC
127.0.0.1, xrefs: 100083F4
Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=, xrefs: 10008405
http://107.160.131.254:23588/article.php, xrefs: 10008353
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 100082C5

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: 127.0.0.1$8.8.8.8$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=$http://107.160.131.254:23588/article.php
API String ID: 1749205058-626475063
Opcode ID: 54eedc971582e05c3486c3a0f88f100d4df9f5038933db9e4620657874ea0a6d
Instruction ID: 78e0688a60563a7bb1736696f6623559e09cac3deedd02f0104af55f58a5e4a8
Opcode Fuzzy Hash: 54eedc971582e05c3486c3a0f88f100d4df9f5038933db9e4620657874ea0a6d
Instruction Fuzzy Hash: 9E4106B6D04258B6F721D364CC46FCF77ACEB457C0F2400A6F248A9086EAB4AB848E51

Function 10006A6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10003ECE: CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

GetLastError.KERNEL32 ref: 10006AA8

Part of subcall function 10006499: wsprintfA.USER32 ref: 100064F7
Part of subcall function 10006499: ___crtGetTimeFormatEx.LIBCMT ref: 10006546

Sleep.KERNEL32(0002BF20,00000000,00000000,00000000,00000000,000000FF), ref: 10006ADD
CreateThread.KERNEL32(00000000,00000000,1000687E,00000000,00000000,00000000), ref: 10006AF1

Strings

5762479093, xrefs: 10006AC7
0x5d65r455f, xrefs: 10006A97

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Create$ErrorFormatLastMutexSleepThreadTime___crtwsprintf
String ID: 0x5d65r455f$5762479093
API String ID: 3244495550-2446933972
Opcode ID: 3b97f3ef57c6d34437c21e844b3cc3d0ae84d0d31088cb251ee543bf93b7c76e
Instruction ID: bd1adab126fe453b34de0ea9e0b5f284958d10fa0a203dc352c1be2a30225ce5
Opcode Fuzzy Hash: 3b97f3ef57c6d34437c21e844b3cc3d0ae84d0d31088cb251ee543bf93b7c76e
Instruction Fuzzy Hash: 9701F2A4844228BAF211F3704CCADBF395DDB563D4F200528F915A908BDB24EC0145B3

Function 10008567 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 79
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00002710), ref: 1000857E
Sleep.KERNEL32(001B7740,?,00000000,80000002,00000000,00000000,000F003F,?), ref: 100085BF

Strings

D, xrefs: 10008612
wINsTA0\dEFauLT, xrefs: 1000862C
aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=, xrefs: 10008580

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: D$aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=$wINsTA0\dEFauLT
API String ID: 3472027048-3516831565
Opcode ID: 97b5d75c4eae03a1f54d307b40641d8b725bb66f95620e0adc97901586be56a8
Instruction ID: 69b21accf233d090089117fd856bc82e5cd65d02c06b2ff4ec7ccf08b8a7457c
Opcode Fuzzy Hash: 97b5d75c4eae03a1f54d307b40641d8b725bb66f95620e0adc97901586be56a8
Instruction Fuzzy Hash: 6421817680525CBAEB11EBE4CC46EDFBB7CEF08390F1400A9F604BB151DB765A458B91

Function 100044AD Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000,?,00000000,GetExtendedUdpTable,?,iphlpapi.dll), ref: 100044E9
GetExtendedUdpTable.IPHLPAPI(?,?,00000001,00000002,00000001,00000000,?,00000000,GetExtendedUdpTable,?,iphlpapi.dll), ref: 10004513

Strings

GetExtendedUdpTable, xrefs: 100044CA
iphlpapi.dll, xrefs: 100044BC

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExtendedTable
String ID: GetExtendedUdpTable$iphlpapi.dll
API String ID: 2407854163-1809394930
Opcode ID: 8f3a0eb883154a3195ca5da507f2da972492a258440e1d6e2132d319b0eaf8e7
Instruction ID: 6449560a486cb6172ee975f2d37c1f40bf8993c7a1880d61e14318031523e361
Opcode Fuzzy Hash: 8f3a0eb883154a3195ca5da507f2da972492a258440e1d6e2132d319b0eaf8e7
Instruction Fuzzy Hash: D1215CB5500508BFEB20DB69DC46EAF77BCDF813D1F214519F9119A086DE30AE808674

Function 1000841C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,00000800,?,?,?,svchsot.exe,?,?,?,?,00000000,?,?,?), ref: 1000855C

Strings

svchsot.exe, xrefs: 10008524
U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 1000846F

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$svchsot.exe
API String ID: 3472027048-2214221337
Opcode ID: d2131fb9256a9d085b7213a385e4fb7e2e0d0505dace0aeb26e32ec0842a8d4a
Instruction ID: e8defaa02cb337ec462540d7064ad22b690c993f3d196736069eab589a90189d
Opcode Fuzzy Hash: d2131fb9256a9d085b7213a385e4fb7e2e0d0505dace0aeb26e32ec0842a8d4a
Instruction Fuzzy Hash: EE314D7290015DBEEB01DBA4CD81DEFB7FDFB48284F1440A6F644E6105EA30AF858BA1

Function 100087B6 Relevance: 6.0, APIs: 4, Instructions: 27
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00006A6E), ref: 100087D1
Sleep.KERNEL32(00001388,?,?,Function_00006A6E), ref: 100087D8
CreateThread.KERNEL32(?,?,Function_0000841C,?,?,?,?,?,Function_00006A6E), ref: 100087E4
Sleep.KERNEL32(000000FF,?,?,Function_0000841C,?,?,?,?,?,Function_00006A6E), ref: 100087E8

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 7611a2c7549d694aa888d6d647670ac1460baf17db733e16608d155f4bf44ca4
Instruction ID: 2df9746d7e78e8372c6e87ac4aa0691d1060a96339f5c4ce5d4c7b8b7a8da0f8
Opcode Fuzzy Hash: 7611a2c7549d694aa888d6d647670ac1460baf17db733e16608d155f4bf44ca4
Instruction Fuzzy Hash: 46E05EE024435DBDF321B2791CC8DFF1E0DEB812FCB254252F528100CB6A540D048AB2

Function 10006B1F Relevance: 4.6, APIs: 3, Instructions: 122
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10003ECE: CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

GetLastError.KERNEL32 ref: 10006B55
CreateThread.KERNEL32(?,?,1000687E), ref: 10006B6B
Sleep.KERNEL32(00002710,?,00000000,00000000,000000FF,?,?,1000687E), ref: 10006B88

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Create$ErrorLastMutexSleepThread
String ID:
API String ID: 145085098-0
Opcode ID: 9fdb200d5929ef7e8f6a96f443088d0c96ecfb43422a1e838647d38a76ea70c1
Instruction ID: 4f35827bfa7b5ea93410d600da94e256639eda4c8ceaa52b9f8b13dee9a51c26
Opcode Fuzzy Hash: 9fdb200d5929ef7e8f6a96f443088d0c96ecfb43422a1e838647d38a76ea70c1
Instruction Fuzzy Hash: 463182714043905EF716DB284C45EA7BFAEDF5A390B14416AF8A5CB287D620D941C771

Function 10007101 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 95
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 100071AC
wsprintfA.USER32 ref: 100071FE

Strings

http://107.160.131.254:23588/article.php, xrefs: 1000716B

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: http://107.160.131.254:23588/article.php
API String ID: 1749205058-3833642815
Opcode ID: 97092958d065cc5244b5ac70b0ba84f38b29928c2b3a7baf181ba609d4b8ef37
Instruction ID: aabc6cc0ccec88c78b37051fa20fdae4f9ca8aa4d7268392f08ad21868547801
Opcode Fuzzy Hash: 97092958d065cc5244b5ac70b0ba84f38b29928c2b3a7baf181ba609d4b8ef37
Instruction Fuzzy Hash: 462129B6D046557AF724D368CC56FCF37ACEF053D0F2000A6F608A50C6E679AE818A11

Function 100061BD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 10006201

Strings

TW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNi4xOyB6aC1DTjsgcnY6MS45LjIuMTUpIEdlY2tvLzIwMTEwMzAzIEZpcmVmb3gvMy42LjE1, xrefs: 100061D0

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FormatInternetOpenTime___crt
String ID: TW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNi4xOyB6aC1DTjsgcnY6MS45LjIuMTUpIEdlY2tvLzIwMTEwMzAzIEZpcmVmb3gvMy42LjE1
API String ID: 483802873-1756078650
Opcode ID: 82af1a15f59e1fdef4f373340f409e9f860dae93766629ca999b654561017b81
Instruction ID: f0c3526304c825564c5c4eb44b26f53dc373e74deb03e814873fed5b313e77ee
Opcode Fuzzy Hash: 82af1a15f59e1fdef4f373340f409e9f860dae93766629ca999b654561017b81
Instruction Fuzzy Hash: 1C21C575D0014DBAEF21DB55DC45D9F7B7DDB852D0F20807AF608E6045DA319A818660

Function 10006290 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 100062BF

Part of subcall function 10003F24: InternetOpenUrlA.WININET(80000100,00000000,00000000,00000000,00000000,10006206), ref: 10003F39

Strings

TW96aWxsYS80LjAgKGNvbXBhdGlibGUp, xrefs: 10006298

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen$FormatTime___crt
String ID: TW96aWxsYS80LjAgKGNvbXBhdGlibGUp
API String ID: 1165476586-1918919809
Opcode ID: 5c4a45e9f88b1cdcaa63395fc832ffbcbaa15b587116e0ae30a38edddbb0ae5c
Instruction ID: e1df23a7d6fc88136f19512af0817ca3ec1a39d4f872029b50130054e15d899c
Opcode Fuzzy Hash: 5c4a45e9f88b1cdcaa63395fc832ffbcbaa15b587116e0ae30a38edddbb0ae5c
Instruction Fuzzy Hash: 61E0D832D089D238BA33E1671C0ED9F1EBDCBC7AF0B71402DF9489100EE8556485C0B5

Function 100081F7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0036EE80), ref: 10008264

Strings

C:\Program Files, xrefs: 10008200

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: C:\Program Files
API String ID: 3472027048-1387799010
Opcode ID: ef70be951d54eb09da497d03d6b876b815efcf974a7af6f3814c100205ad0eea
Instruction ID: c9703108929f2dc2805788eab40c91aa3f5a92b87bc929f4f41ff718cce9746c
Opcode Fuzzy Hash: ef70be951d54eb09da497d03d6b876b815efcf974a7af6f3814c100205ad0eea
Instruction Fuzzy Hash: 40F0723A905AA1A6F701DFA409C068B776DFF022A0B210026F840BF047C7B18E0243E2

Function 1000406C Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(?,00000000,000F003F,00000000,?,00000000,00000000,80000001,10006D60,?,10006D60,80000001,00000000,00000000,REG_SZ,00000000), ref: 1000408A

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8241c048834319a8777681939fd791c1f2bb79611796acde0cc24ef85fc7be79
Instruction ID: 2e24eff2bcdac0d7bb79d22e3b0edd8e416dbe054c2d5b18b585679418e55d12
Opcode Fuzzy Hash: 8241c048834319a8777681939fd791c1f2bb79611796acde0cc24ef85fc7be79
Instruction Fuzzy Hash: 8DD0AE3200014EFBCF025F81ED05CDA3F6AFB0C2A9B068254FA1825030C777D9B1AB91

Function 100040BA Relevance: 1.5, APIs: 1, Instructions: 10registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,?), ref: 100040CC

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a195baf415497c3f6e756206114371a6254dc762b0ba02df47c96a08b610d07e
Instruction ID: 17287b262fc42a8ef4c3757039caf17c8ec33028492a73a8645d3109de99ba33
Opcode Fuzzy Hash: a195baf415497c3f6e756206114371a6254dc762b0ba02df47c96a08b610d07e
Instruction Fuzzy Hash: 40C0013200420EFBCF025F81EC058DA3F2AFB082A1B008010FE1804030C773D9B1EBA1

Function 10003F0A Relevance: 1.5, APIs: 1, Instructions: 10networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 8fdbf6ddd27a1d6b462f044f687e1b09091a90aa3cf3341bbc8376c5064c6b07
Instruction ID: b95a3e5d4d1581b579a43ffb785aa3053a804adf9b6b5080047aec5b24f95343
Opcode Fuzzy Hash: 8fdbf6ddd27a1d6b462f044f687e1b09091a90aa3cf3341bbc8376c5064c6b07
Instruction Fuzzy Hash: 32C0013200020EFBCF025F81EC058DA7F2AFB092A0B008010FA1804031C733D971AB95

Function 10003ECE Relevance: 1.5, APIs: 1, Instructions: 5synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: f03030767440787e5e8ee563cbeb237b89049fd46284869140ae0419c91515a8
Instruction ID: 0bba5641deb9fc7c6708226b57f3740a3060a6e77b98bc1f4937df3feb83fb0f
Opcode Fuzzy Hash: f03030767440787e5e8ee563cbeb237b89049fd46284869140ae0419c91515a8
Instruction Fuzzy Hash: 51B0093A408220BFDF025F90DD4880ABBA2BB88362F24C958F6A941031C7328420EB02

Function 10003FF7 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32(?,?,?), ref: 10004003

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: b2e0d57d01f7aa481c28775ec103b2c79e6903a2f37fda92ba0980fa6487b9be
Instruction ID: 299f2b121c0b8d63d2f16659a91a8a26a6eb1e7383ee0b7c2fbbf344de06ce20
Opcode Fuzzy Hash: b2e0d57d01f7aa481c28775ec103b2c79e6903a2f37fda92ba0980fa6487b9be
Instruction Fuzzy Hash: BCB0097A509210BFDF025B91DE4880ABBA2AB89321F10C958F2A940031C7328520EB12

Function 10004104 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

Process32First.KERNEL32(00000000,00000000), ref: 1000410C

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 4be810b948c5642b78a3303991c31d5753e2f497cabb41971bfbf009a223d646
Instruction ID: d0469a6573cf8832cc4e791a541241725128130187f64684ac8c75673cb250d8
Opcode Fuzzy Hash: 4be810b948c5642b78a3303991c31d5753e2f497cabb41971bfbf009a223d646
Instruction Fuzzy Hash: B8A00176509612ABDA42AB51CE4884ABEA2FBA8381F01C819F18940434CB3284A5EB12

Function 10004115 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000000), ref: 1000411D

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 96d6b844675e51e99f82aec0d05e68cf0a3385db677bffcb7afb410fd8c547f0
Instruction ID: 2ceb7d0ae5350f2ffb1294a1e21229299d690b4e3dcfc0507f8b466183483048
Opcode Fuzzy Hash: 96d6b844675e51e99f82aec0d05e68cf0a3385db677bffcb7afb410fd8c547f0
Instruction Fuzzy Hash: B1A00136408612ABDA42AB50CD4884ABEA2FBA8381F11C819F18941034CB3684A5EB12

Function 1000400A Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,1000824C,10015940), ref: 1000400E

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 2ee3dedfe077572030ca3591167bf26a544b4eb7bba9e94adf73c1260513ac4d
Instruction ID: e310fc801df329cbdffcf5e880badee8d9e0b58f708c6ac467addbfbb1e58057
Opcode Fuzzy Hash: 2ee3dedfe077572030ca3591167bf26a544b4eb7bba9e94adf73c1260513ac4d
Instruction Fuzzy Hash: 029002305055119BDE015B10CE4940A7E71AB84701B00C4A4E04541130C7328810EE01

Function 10004092 Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,10006DBE,?), ref: 10004096

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 2d988dbd5b15decafcf846d532543195a702f6c68f6a27351b5815321025a744
Instruction ID: c461232d01f39555025ee1551a6f08c036cd225bd5518e59674b318f5e785400
Opcode Fuzzy Hash: 2d988dbd5b15decafcf846d532543195a702f6c68f6a27351b5815321025a744
Instruction Fuzzy Hash: 799002705055119BDE415B11CF494097AA5AB84701B008458E04A41030C7318810EA01

Function 10003EB4 Relevance: 1.5, APIs: 1, Instructions: 3networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(00000000), ref: 10003EB8

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: dcfbcd4351272649fb1253f470343220905ed4c20dbbca1a40d0a1126bf3fd71
Instruction ID: ddc175de635f80408d7ee48a1059bf0ffdd1ba2c9e36570999931cb834b2f0bc
Opcode Fuzzy Hash: dcfbcd4351272649fb1253f470343220905ed4c20dbbca1a40d0a1126bf3fd71
Instruction Fuzzy Hash: F7900270545110ABDE015B21CF4A4097A61AB85B01B048454E14940031C7318810EA12

Function 10003F72 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(00080000,10005C92,?,?,%s\lang.ini,C:\Users\user\Desktop,?,00000000,00080000), ref: 10003F76

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 6dc1e466dda3ac71b59e7395498c1fa1529f77b3beb14a38e7d5df6994b7eb4f
Instruction ID: df56204a28902bd86cd8e7b59e1535f4ff11cbe2af3c274bf077f84441daad3a
Opcode Fuzzy Hash: 6dc1e466dda3ac71b59e7395498c1fa1529f77b3beb14a38e7d5df6994b7eb4f
Instruction Fuzzy Hash: 869002705051109BDF015B11CF494497A65AB84701B00855CF05A41431C7318910EA01

Non-executed Functions

Function 1000B224 Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

K, xrefs: 1000B246

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 2579a251d1a9acc8374f22f67a4bb7b2891299b7fe2be1df8caa295a5f0ee3c9
Instruction ID: 6c5504f13a17a8b4553fb93f6e314e3eb43bbcef24ba1366296fc093faca9512
Opcode Fuzzy Hash: 2579a251d1a9acc8374f22f67a4bb7b2891299b7fe2be1df8caa295a5f0ee3c9
Instruction Fuzzy Hash: 13D1F2311046896EDB21CFAC8C80EFFBBBCAF4AA40F840549FD85CB642D555E92DA771

Function 1000AEC0 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

K, xrefs: 1000AEE2

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 40533ac75a34c0e28785cd811d3dcb55fe45dda3d4d2e35189a70ffc9c8f5c8e
Instruction ID: a9c7f45465d92fcd6248bf8d3b75336943ce7982e690b294f387925eaf45448f
Opcode Fuzzy Hash: 40533ac75a34c0e28785cd811d3dcb55fe45dda3d4d2e35189a70ffc9c8f5c8e
Instruction Fuzzy Hash: 6F9143311046896EDB21CFAD8C80EFFBBBCAF06A40F840549FE85C7642D255E92DA771

Function 10003F41 Relevance: 1.5, APIs: 1, Instructions: 6filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,?,?), ref: 10003F51

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 17794e789735475d89bbd1f9c593eb9d99e0ec2b66a06d8a24d179cffc3f724c
Instruction ID: 66c4406e5843dae4aa23aa47ff20fa86481cf42106c3819bfbf8a2f6b8e79ef1
Opcode Fuzzy Hash: 17794e789735475d89bbd1f9c593eb9d99e0ec2b66a06d8a24d179cffc3f724c
Instruction Fuzzy Hash: 20B00872519392ABDF02DF91CD4482ABAA6BB89301F084C5CF2A540071C7328428EB02

Function 10003F63 Relevance: 1.5, APIs: 1, Instructions: 4shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(000000BC,000000BC), ref: 10003F6B

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExitWindows
String ID:
API String ID: 1089080001-0
Opcode ID: ddd05c4d22fa51185853cbc8baa1bf28f6a18d545d76c7cc1a4f4cf3c1112b8e
Instruction ID: a0a7e03ceb7acd9bb0d3454ea8bb5ca0f40435505fc546ba40186378cb909d0a
Opcode Fuzzy Hash: ddd05c4d22fa51185853cbc8baa1bf28f6a18d545d76c7cc1a4f4cf3c1112b8e
Instruction Fuzzy Hash: 81A00175509222EBDE025B51CE4888ABEA6AB88381F008858F28940031C77284A2EB02

Function 100121ED Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

', xrefs: 100121FC

Memory Dump Source

Source File: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: caccb626b00a962d49a4d86a0300a1125d2220d93bea72919c028e0ffa6b786b
Instruction ID: f389f15fd0a8877f73eb6a91fb6ffbaafb7a2d8a217a3cbe01a0a4cb358a3832
Opcode Fuzzy Hash: caccb626b00a962d49a4d86a0300a1125d2220d93bea72919c028e0ffa6b786b
Instruction Fuzzy Hash: 5581276940E3D19FC7438B785CF91823FA2AE1B24434F09DAC4C09F4B7E1995D49C7A2

Function 1000B70D Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eebda9e14e432eb1eff53421c5c1b8c098bdb1a5ff6e099d7d67764739a7ad5
Instruction ID: 9e0b5d620d62c11970e9cc848d1ca02f4ed839136e4bfa4bb83daef4b24ba54e
Opcode Fuzzy Hash: 5eebda9e14e432eb1eff53421c5c1b8c098bdb1a5ff6e099d7d67764739a7ad5
Instruction Fuzzy Hash: AA313A33E2C6B607E324DF7E4C84025F7D6EB8A06275A8779DE88E7255D128EC518BD0

Function 10008AAD Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e333d78722ad0821d4e98b6652e5a75445b5621be3666c330cc0561f1e3ae06e
Instruction ID: 9deb1ace0ade157a7cf376dc79b16b2541233208deadd1a3cef8bf08dc3f5488
Opcode Fuzzy Hash: e333d78722ad0821d4e98b6652e5a75445b5621be3666c330cc0561f1e3ae06e
Instruction Fuzzy Hash: 43F0682128E3C15DE30186685441BC1FF846B76314F0CC7CDB1D40B283C1954084CBA6

Function 1001E1FE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b9005d6082dbdac1a2845a9fd333a3e7a79171a5b874446ea0314262c5ac30
Instruction ID: f0cb1bca0584f7cb9865d2b0003cd1252f49916ae924d73bcd8c513b2b9b2d6d
Opcode Fuzzy Hash: 12b9005d6082dbdac1a2845a9fd333a3e7a79171a5b874446ea0314262c5ac30
Instruction Fuzzy Hash: 11E0E5A440C38AFEC703AB3488840E93FA6EE91310F04840CF4C403A02E3B589A09332

Function 1000720E Relevance: 28.4, APIs: 6, Strings: 10, Instructions: 366COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000008,00000001,?), ref: 10007338
VariantInit.OLEAUT32(?), ref: 1000734D
SafeArrayCreate.OLEAUT32(00000003,00000001,?), ref: 10007368
VariantInit.OLEAUT32(?), ref: 10007377

Part of subcall function 10007A62: VariantInit.OLEAUT32(?), ref: 10007AA1

SafeArrayCreate.OLEAUT32(00000008,00000001,00000002), ref: 10007505
VariantInit.OLEAUT32(?), ref: 10007513

Strings

GatewayCostMetric, xrefs: 100073BE
IPEnabled=TRUE, xrefs: 10007226
DefaultIPGateway, xrefs: 1000737C
Win32_NetworkAdapterConfiguration.Index=, xrefs: 100072A7
Win32_NetworkAdapterConfiguration, xrefs: 1000722B
SetDNSServerSearchOrder, xrefs: 1000749B, 1000755F
Index, xrefs: 1000725D
DNSServerSearchOrder, xrefs: 10007519
p=5w, xrefs: 1000733A, 10007513
SetGateways, xrefs: 100072F1, 100073F7

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant$ArrayCreateSafe
String ID: DNSServerSearchOrder$DefaultIPGateway$GatewayCostMetric$IPEnabled=TRUE$Index$SetDNSServerSearchOrder$SetGateways$Win32_NetworkAdapterConfiguration$Win32_NetworkAdapterConfiguration.Index=$p=5w
API String ID: 2640012081-3861124693
Opcode ID: 12229ab9ea9be2b5515b3a4e7304c5cbd28c893a32b3e86cd77fead74930fbe5
Instruction ID: ecf29a1c47d91b81846b45f5da98bbb69cd4e5f42de0d6ad34227a81938465a8
Opcode Fuzzy Hash: 12229ab9ea9be2b5515b3a4e7304c5cbd28c893a32b3e86cd77fead74930fbe5
Instruction Fuzzy Hash: DAD17E70D00209EFEB15CFA4C8809EEBBB8FF49780F104419F419AB259DB75AA45CFA1

Function 10005989 Relevance: 25.6, APIs: 4, Strings: 13, Instructions: 81COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100059AE
wsprintfA.USER32 ref: 100059FB
wsprintfA.USER32 ref: 10005A08
wsprintfA.USER32 ref: 10005A19

Strings

M%s, xrefs: 10005A0F
C:\Users\user\Desktop, xrefs: 100059D7, 100059DD, 100059E5, 100059F0, 100059FD
host123.zz.am:6658, xrefs: 10005A0A
C:\Users\user\Desktop\81mieek02V.dll, xrefs: 100059C9, 100059CE, 100059DC
%s\%s, xrefs: 100059F1
C:\Users\user\Desktop\version.txt, xrefs: 10005A03
C:\Users\user\Desktop\12010043, xrefs: 100059F6
12010043, xrefs: 1000599D, 100059A3
%s\version.txt, xrefs: 100059FE
Mhost123.zz.am:6658, xrefs: 10005A14
C:\Windows\SysWOW64\rundll32.exe, xrefs: 100059BF
ECF4BB45F69C, xrefs: 10005A4B
12010043, xrefs: 100059A9

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %s\%s$%s\version.txt$12010043$12010043$C:\Users\user\Desktop$C:\Users\user\Desktop\12010043$C:\Users\user\Desktop\81mieek02V.dll$C:\Users\user\Desktop\version.txt$C:\Windows\SysWOW64\rundll32.exe$ECF4BB45F69C$M%s$Mhost123.zz.am:6658$host123.zz.am:6658
API String ID: 2111968516-2540919926
Opcode ID: 857beac2df9e912fa28a8a8c5910c135d4b4ee4941f056ece51d960c3556155a
Instruction ID: 32e0762688fea209a997a92a9e142d3ada4c65c650573aee4fc5e34dd7d3b294
Opcode Fuzzy Hash: 857beac2df9e912fa28a8a8c5910c135d4b4ee4941f056ece51d960c3556155a
Instruction Fuzzy Hash: 961159356007197BF210E7919C45F5F7E9CDF896A6F01021DFB01AE181DB76F9818A72

Function 10004D36 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 308COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10004EC5
VariantInit.OLEAUT32(?), ref: 10004ECB
VariantInit.OLEAUT32(?), ref: 10004ED1
VariantInit.OLEAUT32(?,?,?,?,?,?,?,?,?,10016AD0,00000000,00080000), ref: 10005009
VariantInit.OLEAUT32(?,?,?,?,?,?,?,?,?,10016AD0,00000000,00080000), ref: 1000500F

Strings

SELECT * FROM , xrefs: 10004DEA
ProcessID, xrefs: 10004F0C
CommandLine, xrefs: 10004EF7
svchost.exe -k NetworkService, xrefs: 10004FE0
svchost.exe, xrefs: 10004F6F
WQL, xrefs: 10004E42
Name, xrefs: 10004EE2
p=5w, xrefs: 10004E9C

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: CommandLine$Name$ProcessID$SELECT * FROM $WQL$p=5w$svchost.exe$svchost.exe -k NetworkService
API String ID: 1927566239-4270180057
Opcode ID: b6f3bf19f9a655f11ce33ea3d1eef9f97ff5ff13253a98ebad0314bfa4936779
Instruction ID: f681daf1cfe066dfb2c65bb1802d225618d831e3fba353d21c944956626e3e16
Opcode Fuzzy Hash: b6f3bf19f9a655f11ce33ea3d1eef9f97ff5ff13253a98ebad0314bfa4936779
Instruction Fuzzy Hash: 23A159B1900209AFEB04DFA4CC81DEEBBBDEF48394F104569F515AB295DB31AE45CB60

Function 1000570F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 102filethreadCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1000574F
wsprintfA.USER32 ref: 100057B1
wsprintfA.USER32 ref: 100057C5
PrintFile.81MIEEK02V(?,?,00000000,?,?,?,?,?,?,?,10016AD0,00000000,00080000,?,1000720C), ref: 100057E8
CreateThread.KERNEL32(00000000,00000000,10005620,00000000,00000000,00000000), ref: 10005835

Strings

c:\windows\system32\drivers\%s, xrefs: 100057AB
Win32_process, xrefs: 100057ED
%s\%s, xrefs: 10005749
ROOT\CIMv2, xrefs: 100057F2
c:\windows\system32\drivers\%s\%s, xrefs: 100057BF

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$CreateFilePrintThread
String ID: %s\%s$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s
API String ID: 1788855648-1421401311
Opcode ID: ae8518da5cd223e832b712c6548c98f9a89997a3f3d4d6029e7fac4c4bf50c1f
Instruction ID: 590dfccee83cd698aee2aff2a0aef7bd89598b4f0e32949fa848c193a7d694e7
Opcode Fuzzy Hash: ae8518da5cd223e832b712c6548c98f9a89997a3f3d4d6029e7fac4c4bf50c1f
Instruction Fuzzy Hash: 0531EA72910238BBEB21D7A4CC45FCF7B6CEB08356F0404A6F708FA051DB75AA858A91

Function 100053B7 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 179sleepfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10005437
wsprintfA.USER32 ref: 1000549E
wsprintfA.USER32 ref: 100054BC
PrintFile.81MIEEK02V(?,?,10016594,?,00000000), ref: 100054DE
wsprintfA.USER32 ref: 10005582
Sleep.KERNEL32(000003E8,00000000,76C08400,?,40000000,00000001,00000000,00000002,00000000,00000000,7541C650,?,?,00000009,00000000,10016594), ref: 100055AE

Strings

Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz, xrefs: 100054A9
c:\windows\system32\drivers\%s, xrefs: 10005498
%s\%s, xrefs: 10005431

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$FilePrintSleep
String ID: %s\%s$Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz$c:\windows\system32\drivers\%s
API String ID: 518940211-4228670124
Opcode ID: c361d524b353549e0f38205e8cfe1225c09218ba4335209976bd8a7148bd2516
Instruction ID: 3567043749f32881e03762bb9a57e308b600a04db8eea4acb5e64ce7ea9520bd
Opcode Fuzzy Hash: c361d524b353549e0f38205e8cfe1225c09218ba4335209976bd8a7148bd2516
Instruction Fuzzy Hash: 9751C272900658BFEB11CB68CC45FEE73ADEB48341F1404A5FA08AB191DBB1FE858B50

Function 10004351 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,cmd.exe), ref: 100043A6
Sleep.KERNEL32(000003E8), ref: 100043E5

Strings

QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LmV4ZQ==, xrefs: 100043A8, 100043AD, 100043CB
self, xrefs: 1000437E
QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LnZpcg==, xrefs: 100043BF
cmd.exe, xrefs: 1000435C, 10004362, 10004370

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LmV4ZQ==$QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LnZpcg==$cmd.exe$self
API String ID: 3472027048-2620343502
Opcode ID: 3f59aa8a2a531e52e96b689b157fed57f8b0b4aca2b36427f54941e0ecbe5060
Instruction ID: 2962837d3e63ffe82077fec71eea4cc39f059f6aab2461bdb2792d37a05628b4
Opcode Fuzzy Hash: 3f59aa8a2a531e52e96b689b157fed57f8b0b4aca2b36427f54941e0ecbe5060
Instruction Fuzzy Hash: 370126BA000394BAFB12BB74EC46F9E3B5CDF452E2F120016F9446D086CEB5AA804565

Function 10005F15 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98timeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000001,SeShutdownPrivilege,00000001,00000000,00000000,?,000000BC,00000000,?,000000BC,00000000,?,00000128,00000000), ref: 10005F21

Part of subcall function 10004126: OpenProcessToken.ADVAPI32(00000028,00000028,00000028,10005F32,00000000,00000028,00000000,00000001,SeShutdownPrivilege,00000001,00000000,00000000,?,000000BC,00000000,?), ref: 10004132

Part of subcall function 100040F1: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,00000000), ref: 100040FD

___crtGetTimeFormatEx.LIBCMT ref: 10005F79

Part of subcall function 1000404F: AdjustTokenPrivileges.ADVAPI32(00000000,00000010,?,00000000,00000000,10005F7E,?,10005F7E,00000000,00000000,?,00000010,00000000,00000000), ref: 10004064

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005FD4

Strings

C:\Users\user\Desktop, xrefs: 10005FA3
%s\lang.ini, xrefs: 10005FAE

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessTimerToken$AdjustConcurrency::details::platform::__CreateCurrentFormatLookupOpenPrivilegePrivilegesQueueTimeValue___crt
String ID: %s\lang.ini$C:\Users\user\Desktop
API String ID: 3793502078-2679580386
Opcode ID: 4c2164c536502c8c7bf62064663df8d628c4358b27154a1aa27f72d12e264788
Instruction ID: ec7a4272703c46c275716bc18e38bfb45c62e376eb564a1a1e1e8047e794edd2
Opcode Fuzzy Hash: 4c2164c536502c8c7bf62064663df8d628c4358b27154a1aa27f72d12e264788
Instruction Fuzzy Hash: FE21BDB6D00119BEEB10DAA4CC02FEF7BBCDF04790F104021FA04E6185EA75AB809AE1

Function 10005CF7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F72: PathFileExistsA.SHLWAPI(00080000,10005C92,?,?,%s\lang.ini,C:\Users\user\Desktop,?,00000000,00080000), ref: 10003F76

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005D61

Strings

C:\Users\user\Desktop, xrefs: 10005D16
http://, xrefs: 10005D87
search, xrefs: 10005D9B
%s\lang.ini, xrefs: 10005D26

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Timer$Concurrency::details::platform::__CreateExistsFilePathQueue
String ID: %s\lang.ini$C:\Users\user\Desktop$http://$search
API String ID: 1721638100-2691734327
Opcode ID: d1da8393b741fbea104cea0a346650b348cc7a6ae7d15635f455682e2727de3c
Instruction ID: d10eea2e68a17fc7dae01a0a692719cf89fcc4e95e635f9962b470bf74251c26
Opcode Fuzzy Hash: d1da8393b741fbea104cea0a346650b348cc7a6ae7d15635f455682e2727de3c
Instruction Fuzzy Hash: D81106769081197FFB61DAA4CC42FDB776CDB143D5F1045B2FB48A9080EA72AFC44A60

Function 10005C4C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F72: PathFileExistsA.SHLWAPI(00080000,10005C92,?,?,%s\lang.ini,C:\Users\user\Desktop,?,00000000,00080000), ref: 10003F76

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005CB6

Strings

C:\Users\user\Desktop, xrefs: 10005C6B
http://, xrefs: 10005CDC
%s\lang.ini, xrefs: 10005C7B

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Timer$Concurrency::details::platform::__CreateExistsFilePathQueue
String ID: %s\lang.ini$C:\Users\user\Desktop$http://
API String ID: 1721638100-4272537799
Opcode ID: 354cb08d00e8bc516f166db664e2c84127a23412515739fcecc10b8ce6ebd26b
Instruction ID: 275623b6bb4d38d455d16e038d1f67d5d5eba5b08857937f3fa6caa2442e2442
Opcode Fuzzy Hash: 354cb08d00e8bc516f166db664e2c84127a23412515739fcecc10b8ce6ebd26b
Instruction Fuzzy Hash: 131104769041197EFB21DAA4CC42FDB776CDB14384F0085B1FA48B6080EA71AF884660

Function 100087F4 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 32sleepCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10008824
Sleep.KERNEL32(000007D0,?,?), ref: 10008845

Strings

C:\Users\user\Desktop, xrefs: 1000880B
Y21kLmV4ZSAvYyBwaW5nIDEyNy4wLjAuMSAtbiAzJnJkIC9zIC9xICIlcyI=, xrefs: 10008810

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: C:\Users\user\Desktop$Y21kLmV4ZSAvYyBwaW5nIDEyNy4wLjAuMSAtbiAzJnJkIC9zIC9xICIlcyI=
API String ID: 1749205058-715194466
Opcode ID: d826f062264427af496b9675ff0d63a37454a8e3147eb2671c5731483726d261
Instruction ID: cb8f3af107b47666e7401f40fe0349a9d09f1feb376e898973d7629cffdb37cc
Opcode Fuzzy Hash: d826f062264427af496b9675ff0d63a37454a8e3147eb2671c5731483726d261
Instruction Fuzzy Hash: 00F0AEF250019DABEB15CBA4CC857EA3768FF04285F040975F705F5051DBB19AC44A55

Function 10007A62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10007AA1

Strings

, xrefs: 10007B0D
p=5w, xrefs: 10007AA1

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: $p=5w
API String ID: 1927566239-2851331367
Opcode ID: d0ca9816adfda9363097ead228823b8de7426d0966cf0e74972078de5e0d5c66
Instruction ID: ef89c2eb01536c9538a48ebd5608185a951f11054c82c4a53c762a0a2007c409
Opcode Fuzzy Hash: d0ca9816adfda9363097ead228823b8de7426d0966cf0e74972078de5e0d5c66
Instruction Fuzzy Hash: AB41A475D002599FEF14DFA4C884AEEB7F8FF05284F10446DE91AA3245DB38AE48CB61

Function 10005F98 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31timeCOMMON

Download Yara Rule

APIs

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005FD4

Part of subcall function 10004015: CreateFileA.KERNEL32(00000080,00000003,00000000,00000000,80000000,?,10005CBB,?,10005CBB,?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 1000402D

Strings

C:\Users\user\Desktop, xrefs: 10005FA3
%s\lang.ini, xrefs: 10005FAE

Memory Dump Source

Source File: 00000003.00000002.3944815124.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3944781524.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944858701.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944900929.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3944947368.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945004798.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3945048555.000000001004F000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateTimer$Concurrency::details::platform::__FileQueue
String ID: %s\lang.ini$C:\Users\user\Desktop
API String ID: 3486561800-2679580386
Opcode ID: b1726d4115c593d66bb357bf89ab1e7ee1f9c93add6e05033f4287082a534528
Instruction ID: 2e9b22e8cb94d114ab57fa925500967999958ebf182bde47e5e7f2d31677baea
Opcode Fuzzy Hash: b1726d4115c593d66bb357bf89ab1e7ee1f9c93add6e05033f4287082a534528
Instruction Fuzzy Hash: 23E0687290112432E670D1669C07FCF3E9CDB857F4F000220B688E60C4DAB4AAC4C6E0

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 81mieek02V.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\1.txt

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_46a5a6ec-a63e-448c-b52e-075047df540a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fee72e296cfe876676a0f903eac30ffbede4e6_7522e4b5_e78355c5-05cb-4bce-aa3e-de35fc5094ce\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B1D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C08.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D90.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER87FE.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88AB.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88EA.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
81mieek02V.dll

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre