Edit tour

Windows Analysis Report
b3sV534MMf.dll

Overview

General Information

Sample name:	b3sV534MMf.dll renamed because original name is a hash value
Original sample name:	4135a80b786a0e4504e17352362e6ecc754b4ce5.dll
Analysis ID:	1558490
MD5:	28de8c856e847f8097131e502fc75d8d
SHA1:	4135a80b786a0e4504e17352362e6ecc754b4ce5
SHA256:	657ffa1f45c97cdda48a5c2ea95eecdfdfeae68d9aac937c120b0ab063ea6e87
Tags:	dlluser-NDA0E
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to infect the boot sector

Creates an autostart registry key pointing to binary in C:\Windows

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for sample

PE file has a writeable .text section

Queries disk data (e.g. SMART data)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality to communicate with device drivers

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 1312 cmdline: loaddll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 3196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5764 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 1308 cmdline: rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 6780 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6724 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 2896 cmdline: rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,GetColor MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7180 cmdline: rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,InputFile MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7204 cmdline: rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,PrintFile MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7280 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 672 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7348 cmdline: rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7400 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7488 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 7356 cmdline: rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",InputFile MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7384 cmdline: rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",PrintFile MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7464 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 668 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7812 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7832 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7884 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 7948 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7976 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 8020 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
b3sV534MMf.dll	Winnti_NlaifSvc	Winnti sample - file NlaifSvc.dll	Florian Roth	0x37ff1:$x1: cracked by ximo 0x380ab:$x1: cracked by ximo 0x38165:$x1: cracked by ximo 0x3821f:$x1: cracked by ximo 0x382d9:$x1: cracked by ximo 0x38393:$x1: cracked by ximo 0x3844d:$x1: cracked by ximo 0x38507:$x1: cracked by ximo 0x3f64f:$x1: cracked by ximo 0x436a2:$x1: cracked by ximo

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.rundll32.exe.10000000.0.unpack	Winnti_NlaifSvc	Winnti sample - file NlaifSvc.dll	Florian Roth	0x37ff1:$x1: cracked by ximo 0x380ab:$x1: cracked by ximo 0x38165:$x1: cracked by ximo 0x3821f:$x1: cracked by ximo 0x382d9:$x1: cracked by ximo 0x38393:$x1: cracked by ximo 0x3844d:$x1: cracked by ximo 0x38507:$x1: cracked by ximo 0x3f64f:$x1: cracked by ximo 0x436a2:$x1: cracked by ximo
15.2.rundll32.exe.10000000.0.unpack	Winnti_NlaifSvc	Winnti sample - file NlaifSvc.dll	Florian Roth	0x37ff1:$x1: cracked by ximo 0x380ab:$x1: cracked by ximo 0x38165:$x1: cracked by ximo 0x3821f:$x1: cracked by ximo 0x382d9:$x1: cracked by ximo 0x38393:$x1: cracked by ximo 0x3844d:$x1: cracked by ximo 0x38507:$x1: cracked by ximo 0x3f64f:$x1: cracked by ximo 0x436a2:$x1: cracked by ximo
3.2.rundll32.exe.10000000.0.unpack	Winnti_NlaifSvc	Winnti sample - file NlaifSvc.dll	Florian Roth	0x37ff1:$x1: cracked by ximo 0x380ab:$x1: cracked by ximo 0x38165:$x1: cracked by ximo 0x3821f:$x1: cracked by ximo 0x382d9:$x1: cracked by ximo 0x38393:$x1: cracked by ximo 0x3844d:$x1: cracked by ximo 0x38507:$x1: cracked by ximo 0x3f64f:$x1: cracked by ximo 0x436a2:$x1: cracked by ximo

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 2896, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gc

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: b3sV534MMf.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: b3sV534MMf.dll

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: b3sV534MMf.dll

Joe Sandbox ML: detected

Source: b3sV534MMf.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10007F3E FindFirstFileA,FindNextFileA,Sleep,

3_2_10007F3E

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.56.110 18530	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 174.139.6.44 803	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 174.139.6.43 805	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 174.139.6.42 3204	Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 107.163.56.110 ports 18530,0,1,3,5,8

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 174.139.6.44:803
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 107.163.56.110:18530
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 174.139.6.42:3204
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 174.139.6.43:805

Source: Joe Sandbox View	IP Address: 202.108.0.52 202.108.0.52
Source: Joe Sandbox View	IP Address: 107.163.56.110 107.163.56.110

Source: Joe Sandbox View	ASN Name: TAKE2US TAKE2US
Source: Joe Sandbox View	ASN Name: VPLSNETUS VPLSNETUS
Source: Joe Sandbox View	ASN Name: VPLSNETUS VPLSNETUS

Source: global traffic

TCP traffic: 192.168.2.4:49746 -> 202.108.0.52:80

Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.44
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.44
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.44
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.44
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.44
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.42
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.42
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.42
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.42
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.42
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.42
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.42
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 174.139.6.42

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10003F41 InternetReadFile,

3_2_10003F41

Source: global traffic

DNS traffic detected: DNS query: blog.sina.com.cn

Source: rundll32.exe, 00000003.00000002.3422401937.0000000004B3D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.56.110:1530/u1129.html
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.56.110:18530/u1129.html
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.56.110:18530/u1129.html&
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C8A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.3427347038.000000000593A000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3421283523.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3092158353.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.4055115191.0000000010012000.00000040.00000001.01000000.00000003.sdmp, b3sV534MMf.dll	String found in binary or memory: http://174.139.6.43:805/index.php
Source: rundll32.exe, 00000003.00000003.3286146158.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.php93
Source: rundll32.exe, 00000003.00000002.3427186245.000000000571D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3427347038.000000000593A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpC:
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpKP
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpMSBuild
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpN
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpStart
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpZ
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpcuments
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpi
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpi/P
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpiD
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpmls
Source: rundll32.exe, 00000003.00000003.3286146158.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3421283523.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpng
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phps
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpvorites
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpw
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.43:805/index.phpwnloads
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.44/
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.44/JtB
Source: rundll32.exe, rundll32.exe, 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000002.3092158353.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.4055115191.0000000010012000.00000040.00000001.01000000.00000003.sdmp, b3sV534MMf.dll	String found in binary or memory: http://174.139.6.44:803/
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.139.6.44:803//joy.asp?sid=rungnejcrueXntG4Fe5vteX8v2LUicbtudb8mtiWmJe2nte
Source: rundll32.exe, 00000003.00000002.3432902402.00000000077EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s
Source: rundll32.exe, 00000003.00000002.3432902402.00000000077EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s&
Source: rundll32.exe, 00000003.00000002.3432902402.00000000077EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s2
Source: rundll32.exe, 00000003.00000002.3432902402.00000000077EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s7
Source: rundll32.exe, 00000003.00000003.3286146158.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3420272005.0000000000A6D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: b3sV534MMf.dll, type: SAMPLE	Matched rule: Winnti sample - file NlaifSvc.dll Author: Florian Roth
Source: 9.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti sample - file NlaifSvc.dll Author: Florian Roth
Source: 15.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti sample - file NlaifSvc.dll Author: Florian Roth
Source: 3.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti sample - file NlaifSvc.dll Author: Florian Roth

PE file has a writeable .text section

Source: b3sV534MMf.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 70450000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 71420000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 723F0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 77040000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73D60000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73630000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 74B50000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 733C0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 746B0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 75450000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 763E0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73830000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73900000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 747B0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 751E0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 75570000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76860000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73540000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73980000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73A90000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 74640000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 75B70000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 764E0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76610000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 74AC0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 734C0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73590000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 738B0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 739D0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73B00000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 74550000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 74830000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 75260000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 755F0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76530000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76660000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 738D0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 73B20000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 74570000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 74690000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 74D50000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 75280000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 75610000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 75BC0000 page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 768E0000 page read and write	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10008AAD: DeviceIoControl,

3_2_10008AAD

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10003F63 ExitWindowsEx,

3_2_10003F63

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B224	3_2_1000B224
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B70D	3_2_1000B70D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100121ED	3_2_100121ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000AEC0	3_2_1000AEC0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 10001000 appears 303 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 672

Source: b3sV534MMf.dll

Binary or memory string: OriginalFilenameSHDOCVW.DLLj% vs b3sV534MMf.dll

Source: b3sV534MMf.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: b3sV534MMf.dll, type: SAMPLE	Matched rule: Winnti_NlaifSvc date = 2017-01-25, hash1 = 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5, author = Florian Roth, description = Winnti sample - file NlaifSvc.dll, reference = https://goo.gl/VbvJtL, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti_NlaifSvc date = 2017-01-25, hash1 = 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5, author = Florian Roth, description = Winnti sample - file NlaifSvc.dll, reference = https://goo.gl/VbvJtL, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti_NlaifSvc date = 2017-01-25, hash1 = 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5, author = Florian Roth, description = Winnti sample - file NlaifSvc.dll, reference = https://goo.gl/VbvJtL, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Winnti_NlaifSvc date = 2017-01-25, hash1 = 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5, author = Florian Roth, description = Winnti sample - file NlaifSvc.dll, reference = https://goo.gl/VbvJtL, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: b3sV534MMf.dll

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winDLL@42/10@3/6

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1000404F AdjustTokenPrivileges,

3_2_1000404F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10003FB7 CreateToolhelp32Snapshot,

3_2_10003FB7

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\Desktop\12021651

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\174.139.6.42:3204
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7384
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\0x5d65r455f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4940:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\M174.139.6.42:3204
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3196:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7204
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\763f537e-c7a1-48da-a969-336a16847db1

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,GetColor

Source: b3sV534MMf.dll

ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,GetColor
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,InputFile
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,PrintFile
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 672
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",InputFile
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",PrintFile
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 668
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,GetColor	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,InputFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,PrintFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",InputFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",PrintFile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002366D pushfd ; mov dword ptr [esp], E450DE37h	3_2_1002ECC8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100283FA pushfd ; mov dword ptr [esp], B391D77Ah	3_2_10028400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100283FA push eax; mov dword ptr [esp], 14991104h	3_2_10028408
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1004701E pushfd ; mov dword ptr [esp], edi	3_2_100475EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10029023 push dword ptr [esp+30h]; retn 0034h	3_2_10034E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021023 push dword ptr [esp+48h]; retn 004Ch	3_2_10032573
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10027024 push dword ptr [esp+3Ch]; retn 0040h	3_2_10027045
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F02D push dword ptr [esp+5Ch]; retn 0060h	3_2_1002F03D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10023037 pushfd ; mov dword ptr [esp], esi	3_2_1002C00B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F040 push dword ptr [esp+44h]; retn 0048h	3_2_1002F074
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002105F push dword ptr [esp+3Ch]; retn 0044h	3_2_10025F46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1003506A push dword ptr [esp+44h]; retn 0048h	3_2_1003507D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002105F push dword ptr [esp+3Ch]; retn 0044h	3_2_10025F46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002105F push dword ptr [esp+3Ch]; retn 0044h	3_2_10025F46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10033C47 push dword ptr [esp+40h]; retn 0048h	3_2_1002A6EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10033C47 push dword ptr [esp+48h]; retn 004Ch	3_2_10033C8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002907B push dword ptr [esp+30h]; retn 0034h	3_2_10031326
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021092 push dword ptr [esp+3Ch]; retn 0044h	3_2_10025F46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021097 push dword ptr [esp+3Ch]; retn 0044h	3_2_10025F46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002309C push esi; mov dword ptr [esp], 1CC44278h	3_2_100230D3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002309C push dword ptr [esp+34h]; retn 0038h	3_2_100279AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100350BD push dword ptr [esp+54h]; retn 0058h	3_2_10037A41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100270BD push dword ptr [esp+50h]; retn 0054h	3_2_100207C2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002B0C7 push dword ptr [esp+5Ch]; retn 0060h	3_2_1002B105
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100230D2 push esi; mov dword ptr [esp], 1CC44278h	3_2_100230D3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100350D7 push dword ptr [esp+3Ch]; retn 0040h	3_2_100350E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001F0D5 push dword ptr [esp+40h]; retn 0044h	3_2_1001F0F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F0D8 push dword ptr [esp+48h]; retn 004Ch	3_2_1002F125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100350EB push dword ptr [esp+30h]; retn 0038h	3_2_10035121
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100250ED push dword ptr [esp+40h]; retn 0044h	3_2_10025103
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001F0F3 push dword ptr [esp+2Ch]; retn 0030h	3_2_1002792A

Source: b3sV534MMf.dll

Static PE information: section name: .rsrc entropy: 6.804416992654808

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: CreateFileA,DeviceIoControl,FormatMessageA, \\.\PHYSICALDRIVE%d

3_2_10008B7A

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: CreateFileA,DeviceIoControl,FormatMessageA, \\.\PHYSICALDRIVE%d

3_2_10008B7A

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gc

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gc			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gc			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_3-18871

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1215			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 6412			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_3-18860

Source: C:\Windows\SysWOW64\rundll32.exe TID: 1868	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5744	Thread sleep count: 1215 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5744	Thread sleep time: -2187000000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5436	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7776	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7796	Thread sleep time: -1260000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7772	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7792	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5436	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7920	Thread sleep count: 106 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7920	Thread sleep time: -31800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7728	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5744	Thread sleep count: 6412 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5744	Thread sleep time: -11541600000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10007F3E FindFirstFileA,FindNextFileA,Sleep,

3_2_10007F3E

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3421283523.0000000002C8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000003.00000002.3420002897.000000000057B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: s\Applications\\VMwareHo8
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: rundll32.exe, 00000003.00000003.2029437842.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y\Machine\Software\Classes\Applications\\VMwareHostOpen.exes\Applications\\VMwareHostOpen.exeion\\Run\User Shell Foldersockdown_Zones\4
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.56.110 18530	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 174.139.6.44 803	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 174.139.6.43 805	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 174.139.6.42 3204	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Queries disk data (e.g. SMART data)

Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Obfuscated Files or Information	LSASS Memory	111 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Bootkit	111 Process Injection	1 Software Packing	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
b3sV534MMf.dll	79%	ReversingLabs	Win32.Backdoor.Zegost
b3sV534MMf.dll	100%	Avira	TR/Farfli.ghwpt
b3sV534MMf.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://174.139.6.43:805/index.phpi/P	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpng	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpMSBuild	0%	Avira URL Cloud	safe
http://174.139.6.44:803//joy.asp?sid=rungnejcrueXntG4Fe5vteX8v2LUicbtudb8mtiWmJe2nte	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpiD	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpZ	0%	Avira URL Cloud	safe
http://107.163.56.110:18530/u1129.html	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.php93	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpi	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpN	0%	Avira URL Cloud	safe
http://174.139.6.44:803/	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpw	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpC:	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpcuments	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpmls	0%	Avira URL Cloud	safe
http://107.163.56.110:1530/u1129.html	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpStart	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phps	0%	Avira URL Cloud	safe
http://107.163.56.110:18530/u1129.html&	0%	Avira URL Cloud	safe
http://174.139.6.44/JtB	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpvorites	0%	Avira URL Cloud	safe
http://174.139.6.44/	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.php	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpKP	0%	Avira URL Cloud	safe
http://174.139.6.43:805/index.phpwnloads	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
blogx.sina.com.cn	202.108.0.52	true	false		high
blog.sina.com.cn	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://blog.sina.com.cn/u/%s7	rundll32.exe, 00000003.00000002.3432902402.00000000077EC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://174.139.6.43:805/index.phpng	rundll32.exe, 00000003.00000003.3286146158.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3421283523.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpiD	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpi	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpi/P	rundll32.exe, 00000003.00000002.3421283523.0000000002C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpMSBuild	rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.56.110:18530/u1129.html	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.12.dr	false		high
http://blog.sina.com.cn/u/%s	rundll32.exe, 00000003.00000002.3432902402.00000000077EC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5762479093	rundll32.exe, 00000003.00000003.3286146158.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3420272005.0000000000A6D000.00000004.00000010.00020000.00000000.sdmp	false		high
http://174.139.6.43:805/index.phpZ	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.php93	rundll32.exe, 00000003.00000003.3286146158.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.44:803//joy.asp?sid=rungnejcrueXntG4Fe5vteX8v2LUicbtudb8mtiWmJe2nte	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpN	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.44:803/	rundll32.exe, rundll32.exe, 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000002.3092158353.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.4055115191.0000000010012000.00000040.00000001.01000000.00000003.sdmp, b3sV534MMf.dll	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpC:	rundll32.exe, 00000003.00000002.3427186245.000000000571D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3427347038.000000000593A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpStart	rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpcuments	rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.56.110:1530/u1129.html	rundll32.exe, 00000003.00000002.3422401937.0000000004B3D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpmls	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%s&	rundll32.exe, 00000003.00000002.3432902402.00000000077EC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://174.139.6.43:805/index.phpw	rundll32.exe, 00000003.00000002.3421283523.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.44/JtB	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.56.110:18530/u1129.html&	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phps	rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.44/	rundll32.exe, 00000003.00000002.3421283523.0000000002C2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpwnloads	rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.php	rundll32.exe, 00000003.00000002.3421283523.0000000002C8A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.3427347038.000000000593A000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3421283523.0000000002CEF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3092158353.0000000010012000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.4055115191.0000000010012000.00000040.00000001.01000000.00000003.sdmp, b3sV534MMf.dll	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpvorites	rundll32.exe, 00000003.00000002.3421283523.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.139.6.43:805/index.phpKP	rundll32.exe, 00000003.00000002.3421283523.0000000002C8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%s2	rundll32.exe, 00000003.00000002.3432902402.00000000077EC000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
202.108.0.52	blogx.sina.com.cn	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
107.163.56.110	unknown	United States	20248	TAKE2US	true
174.139.6.44	unknown	United States	35908	VPLSNETUS	true
174.139.6.43	unknown	United States	35908	VPLSNETUS	true
174.139.6.42	unknown	United States	35908	VPLSNETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558490
Start date and time:	2024-11-19 14:20:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	b3sV534MMf.dll renamed because original name is a hash value
Original Sample Name:	4135a80b786a0e4504e17352362e6ecc754b4ce5.dll
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winDLL@42/10@3/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 35 Number of non-executed functions: 19
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 20.42.73.29, 20.189.173.8
Excluded domains from analysis (whitelisted): self-events-data.trafficmanager.net, onedscolprdwus07.westus.cloudapp.azure.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, self.events.data.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: b3sV534MMf.dll

Simulations

Behavior and APIs

Time	Type	Description
08:21:16	API Interceptor	1461010x Sleep call for process: rundll32.exe modified
08:21:23	API Interceptor	1x Sleep call for process: loaddll32.exe modified
08:23:31	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
202.108.0.52	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
107.163.56.110	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse
	81mieek02V.dll	Get hash	malicious	Unknown	Browse
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse
	02hNixBIvP.exe	Get hash	malicious	Unknown	Browse
	abc.dll	Get hash	malicious	Unknown	Browse
174.139.6.44	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse
174.139.6.43	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse
174.139.6.42	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
blogx.sina.com.cn	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	http://zeuso.cc	Get hash	malicious	Unknown	Browse	202.108.0.52
	02hNixBIvP.exe	Get hash	malicious	Unknown	Browse	202.108.0.52

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	owari.mips.elf	Get hash	malicious	Unknown	Browse	111.193.177.206
	owari.x86.elf	Get hash	malicious	Unknown	Browse	60.194.199.155
	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	hmips.elf	Get hash	malicious	Mirai	Browse	111.196.123.227
VPLSNETUS	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	174.139.6.42
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	98.126.40.18
	FaIJ2e7ZM4.dll	Get hash	malicious	Unknown	Browse	98.126.40.18
	8cv7XxmqSG.dll	Get hash	malicious	Unknown	Browse	98.126.40.18
	32YBHccuG9.dll	Get hash	malicious	Unknown	Browse	98.126.40.18
	xX1k6Ghe8s.elf	Get hash	malicious	Mirai	Browse	98.126.6.62
	i486.elf	Get hash	malicious	Mirai	Browse	174.139.206.64
	NoERE2024000013833.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	bin.sh.elf	Get hash	malicious	Mirai	Browse	174.139.206.51
	arm7.elf	Get hash	malicious	Unknown	Browse	98.126.6.24
VPLSNETUS	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	174.139.6.42
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	98.126.40.18
	FaIJ2e7ZM4.dll	Get hash	malicious	Unknown	Browse	98.126.40.18
	8cv7XxmqSG.dll	Get hash	malicious	Unknown	Browse	98.126.40.18
	32YBHccuG9.dll	Get hash	malicious	Unknown	Browse	98.126.40.18
	xX1k6Ghe8s.elf	Get hash	malicious	Mirai	Browse	98.126.6.62
	i486.elf	Get hash	malicious	Mirai	Browse	174.139.206.64
	NoERE2024000013833.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	bin.sh.elf	Get hash	malicious	Mirai	Browse	174.139.206.51
	arm7.elf	Get hash	malicious	Unknown	Browse	98.126.6.24
TAKE2US	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	107.163.43.161
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	46PhJ3XpBT.dll	Get hash	malicious	Unknown	Browse	107.163.43.236
	01JkTmNJhe.dll	Get hash	malicious	Unknown	Browse	107.163.43.235
	oQy3XhO4cX.dll	Get hash	malicious	Unknown	Browse	107.163.56.251
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	Bcr1Wl2Jn0.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	OL50O9ho5M.dll	Get hash	malicious	Unknown	Browse	107.163.56.251

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	545
Entropy (8bit):	4.294829216447718
Encrypted:	false
SSDEEP:	12:8E2V6mEWfe1Vmb3xyE+QGJ03P2nIupppppppppA:8E2V6mEWm1V83AE+QGJ03P2nIupppppA
MD5:	20D452BA42B131C7715F2B70226BD18F
SHA1:	880D3D514C5B01C14952B5BE7E1204E3AFEFCB0B
SHA-256:	0817036301F37A595D703849942A72F38B1DFDF2AB58C27951D13E90AAB6116B
SHA-512:	68F97AF0DC1846F9C55DC2541E95C04613AF9D118397C8169B10D77FE7C3F8BC726B0852AB6D9C36BE1A76F731F34631C616D292FC1B6355C606761199FA1037
Malicious:	false
Preview:	..2024-11-21 11:24..iOffset....2024-11-22 06:22..iOffset....2024-11-23 02:00..iOffset....2024-11-23 21:38..iOffset....2024-11-24 19:11..iOffset....2024-11-25 17:09..iOffset....2024-11-27 14:20..iOffset....2024-11-28 16:18..iOffset....2024-12-01 08:49..iOffset....2024-12-03 00:52..iOffset....2024-12-05 01:05..iOffset....2024-12-10 08:01..iOffset....2024-12-20 16:52..iOffset....2024-12-26 05:35..iOffset....2034-07-21 19:56..iOffset....iOffset....iOffset....iOffset....iOffset....iOffset....iOffset....iOffset....iOffset....iOffset....iOffset..

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_d72391a1-0057-4f8a-aec9-13bcc5ddd162\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9501327138575276
Encrypted:	false
SSDEEP:	192:qqihipwOg30BU/wjeTlW6ZYzuiFxZ24IO8dci:KhivgEBU/wjex7YzuiFxY4IO8dci
MD5:	270264767AA2E2A110A04B8DB4105F77
SHA1:	A4347646CCC49A3F98B12CC0CEC5E8A4C041A8FA
SHA-256:	7D89EA7B90743162C65B895E245ABBD37C84A944CBF1627991C580FA82BE5ABE
SHA-512:	D7ADC8F077853ECD7810DC93BC0A2A83447693216BAD8194EB7D6161E26D1F2C3C703A30FC5367E6BC294FC4F9517CC52F8135B43F5607C4714A29D64A9CD2EF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.4.9.6.0.8.1.2.8.6.8.7.6.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.4.9.6.0.8.2.9.7.4.3.7.9.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.9.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.7.2.3.9.1.a.1.-.0.0.5.7.-.4.f.8.a.-.a.e.c.9.-.1.3.b.c.c.5.d.d.d.1.6.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.7.9.3.c.e.d.-.3.2.9.d.-.4.d.7.e.-.8.e.5.3.-.6.2.1.0.0.2.4.9.c.0.a.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.2.4.-.0.0.0.1.-.0.0.1.4.-.5.9.7.f.-.4.f.e.c.8.5.3.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_fa7a985e-ae7d-4121-8b55-6115f8b96465\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9500609877784236
Encrypted:	false
SSDEEP:	192:9pi8Or30BU/wjeTlWaZYzuiFWZ24IO8dci:ziNrEBU/wjexbYzuiFWY4IO8dci
MD5:	4C6B04F06633C067D289B35100D8BAAA
SHA1:	5BFFEF7DBF944566970BC9888EC8B87701DF9236
SHA-256:	A004B5E42082476FCA7A3424EC2BCB9B70921FC157C35DCEB79012B2B904DECE
SHA-512:	4760B70054FABDA11384CA3335FBB49C7BF718EA41903E658713A949854676D73F8C82FFEBDD847BF6A1B91A370346CCF4944B4C20FE835A03321700248DBA53
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.4.9.6.0.8.4.9.3.0.4.3.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.4.9.6.0.8.5.3.6.7.9.2.5.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.9.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.7.a.9.8.5.e.-.a.e.7.d.-.4.1.2.1.-.8.b.5.5.-.6.1.1.5.f.8.b.9.6.4.6.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.a.5.e.8.8.4.-.c.f.9.3.-.4.5.d.8.-.8.5.8.c.-.e.9.b.3.3.3.c.e.4.2.d.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.d.8.-.0.0.0.1.-.0.0.1.4.-.0.f.c.8.-.2.f.e.e.8.5.3.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER61B8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Nov 19 13:21:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46060
Entropy (8bit):	1.972564757559395
Encrypted:	false
SSDEEP:	192:RvQFZwnXUXa+CO5H4z1LlRh5/pd7QozDDGEloY06:hSZwjK5Hy1Lld/pd7HDGEO6
MD5:	BAF4466F6321998663186A6524FF760E
SHA1:	5218022972D2E854DAADBF9E050A85784014EF79
SHA-256:	2F8FCDF10020075E8EF5A576CBA87416357C442ECF5DEBE62F5D16487446C72A
SHA-512:	52B11BB92A5E8F0BB56BAF2AE4FA9052385CDFC2EA4F004ADCBC28300495386577E11133A219C8E0C1D88679BEB6F07EF4C27A5F1532EF94D4ABCE731A492B0A
Malicious:	false
Preview:	MDMP..a..... ........<g........................................V/..........T.......8...........T...............$...........L...........8...............................................................................eJ..............GenuineIntel............T.......$....<g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6718.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8274
Entropy (8bit):	3.6942061461833755
Encrypted:	false
SSDEEP:	192:R6l7wVeJnMP6qo6Yr160gmfTZhprQ89bXFsf0j9m:R6lXJE6N6Yp60gmfTZxXefP
MD5:	A51F03B049C5228ED22954FABE755CD6
SHA1:	B651CE1129CE37FFB8916C9BC069C267E225B6B5
SHA-256:	8B4084F30E8FF212B0BC7E54F9B1B90CE9F3AC5BDAF516E7234B1E5D230A34E8
SHA-512:	914B99E53C3C9B0D4630EB8C7151A0D80394F4956FFED291E34BABB378C090A1BCB947743B8774DEDA21A1FBC087C6D8E7116C4A9428E5267672E436E95D308D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6758.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.463009927202668
Encrypted:	false
SSDEEP:	48:cvIwWl8zsHJg77aI9WZWpW8VYWYm8M4JCdPSF++q8/A26A1GScSxd:uIjfpI7Yo7VCJGrA1J3xd
MD5:	7B505C43385EE48EC5109B1B7C19F506
SHA1:	C9CF2FC9CA77A1808619B767C8C70E1056674583
SHA-256:	07FB9834707E47BCA6595CB42E570BE96AFC22DAC71DDD69AD2C3755C1D50284
SHA-512:	FD068BEEC2A2E8648D7FDF16BE4404BDD837808AFA1964E7E6C4D4E5EED4A5BAA3DFAF79852C495DE0923A00F0B66C820382C5AAC4C7262A3D7BDD42FA9E0199
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="594984" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FE1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Nov 19 13:21:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	44538
Entropy (8bit):	2.0069766522026904
Encrypted:	false
SSDEEP:	192:iNAdFZwsMXUXablvO5H4TX9U6Mi/lIPeIY0c7g6hE6bG3:mATZwsKblm5HSX9ZMi/lI23nm
MD5:	28D25DE9B860D1C0B14D7BE24676F397
SHA1:	C3390136674262255AB8675BBD443AF056D1298C
SHA-256:	666A80C3A06C622E44E0865213724341CAAF20E96DFDE2E25490CE8493D688CB
SHA-512:	6F6940BF04974A76F6FDFA15E155FC9BAE003F2ECA23D59410AA4B4FDED0B3CE0FE8D6E3CACB2192AC0A5368E16D1EAD959BE4B5E9F9CFC922FEF94C928C5039
Malicious:	false
Preview:	MDMP..a..... ........<g........................................V/..........T.......8...........T...............Z...........L...........8...............................................................................eJ..............GenuineIntel............T............<g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER708E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8270
Entropy (8bit):	3.6953182307591685
Encrypted:	false
SSDEEP:	192:R6l7wVeJd5666YTQ76j4gmfTZhprG89b4nsf3Im:R6lXJz666YM76j4gmfTZD4sfd
MD5:	E2231A98F039DEF343653301B29AE908
SHA1:	EB41FBCA7920926A1C59585AC23995A48FB11764
SHA-256:	83DB1AF00DBD0A6113C74CF8A56F9C39844D475D8AB7E6CB43ED14D20CD6B2B5
SHA-512:	92CA76D51DBAF91039A659E98D6ECFCB653D925D13CF7D5E0B3747DEC18B9A91F40668DE771EDA25AB4A2927CABDE529B5695E0690AD924068C2C26F3BE1EDDE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70CE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.464471239442059
Encrypted:	false
SSDEEP:	48:cvIwWl8zsHJg77aI9WZWpW8VY6sYm8M4JCdPSFJ+q8/A0hGScS4d:uIjfpI7Yo7VrpJB8hJ34d
MD5:	4C752F3B6A4BBBDC90A4AA237199D9B2
SHA1:	4E9359D43A86AE1E7128532FDA0CC80BE431B96B
SHA-256:	14249EB5D5AE63A8C60287500F3A0B900F81799003DB7FBC696B777A7D86144C
SHA-512:	55C5DA7F9B23FA75D15ADF754B965342686B7C3B1B05CC63D17CE96B972D066F8E0BCEEE5B4266CE67BF5746298C019D2ED1D5C6327E596315F4899A4CC6DA94
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="594984" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4662622230137305
Encrypted:	false
SSDEEP:	6144:3IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNxdwBCswSbG:4XD94+WlLZMM6YFHT+G
MD5:	42761F45B343B66D08FE691F149A7CA3
SHA1:	84D545EDD2106185D343ED31CA85FABAC0AFBAA5
SHA-256:	8B7A626F126DD8293BAF806E2D72F2E900F907931B9C6C5C44D94FD9316E7486
SHA-512:	38194F46F7AAAA689537D04C5A782134163AB9A06EA51BF1C3D0CBC583DFFCB85A05A3926FE9E35CEB84F2D872BD9BDF3B0513E657E819089A634A93E8E55771
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.6..:..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows, PECompact2 compressed
Entropy (8bit):	6.5937427390560135
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	b3sV534MMf.dll
File size:	307'834 bytes
MD5:	28de8c856e847f8097131e502fc75d8d
SHA1:	4135a80b786a0e4504e17352362e6ecc754b4ce5
SHA256:	657ffa1f45c97cdda48a5c2ea95eecdfdfeae68d9aac937c120b0ab063ea6e87
SHA512:	2a3bafdcd8efeb511d4889f943648175513710f495af6408392752623d662ba98052e9b03a5fa70a6d5f36ddc0f4e7bf108721cc31171a722d4b3fa796171044
SSDEEP:	6144:NuezXQ8wsFPhmNsCBk5mizL5rC5rgRMLt6wVVNrBqFdEJRKgY:LzA8wsFPEsC+5dzL5rC5rgRML4wVVN8H
TLSH:	D9649E51337252F5D4DB0A32AE29EB2EE77064109CECDD52DF8315852CE344AFA9938B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... B..N...N...N...B...N.F.....N.......N.......N.......N...@...N.m.D...N...O.^.N.m.E...N.=.H...N.m.J...N.Rich..N................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1003c7e7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL
DLL Characteristics:
Time Stamp:	0x565E7E2A [Wed Dec 2 05:14:18 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e68f6ce4fad6e16f1060136013578ef2

Entrypoint Preview

Instruction
call 00007FE6305481D0h
pushfd
mov byte ptr [edi-01h], 00000000h
lahf
jmp 00007FE63054F146h
lea esp, dword ptr [esp+2Ch]
ja 00007FE63054AA2Ah
clc
push esi
clc
cmc
imul edx, edx, 0000000Ah
bt cx, 0006h
call 00007FE63054EAB9h
scasb
cli
jns 00007FE630549376h
xchg eax, ebp
or al, A3h
outsd
sub eax, 2E68A76Ah
popad
cmp esi, edi
stosb
arpl word ptr [edx+edx], sp
cwde
add byte ptr [ebx], dh
mov ecx, F931ECB0h
fcomp3 st(7)
neg dword ptr [esi]
push esp
dec byte ptr [edi]
outsd
fild qword ptr [edi+7369282Eh]
adc dword ptr [ebx-17h], edx
xor dword ptr [esi], ebx
dec eax
imul dword ptr [edi+09B273BCh]
retf 1D1Bh
dec edi
sbb dword ptr [edx-3751134Ch], esi
mov ebx, 49984820h
in eax, dx
movsd
fdecstp
mov cl, 56h
xlatb
push ss
iretd
or byte ptr [ebx+62h], cl
dec edx
movsd
cmpsd
jbe 00007FE6305493F2h
std
jno 00007FE630549337h
xor eax, 5EF4DB8Ah
les esi, fword ptr [ebp-19CAF247h]
clc
sub ebp, edx
inc ecx
mov ebx, 26422BC8h
push esi
and eax, A755A9C5h
fsubr dword ptr [ebp+47322F99h]
xchg eax, esp
mov dl, 5Dh
enter 4489h, 24h
and al, C6h
inc esp
and al, 08h
inc esp
mov byte ptr [esp], cl
pushfd
push dword ptr [esp]
push dword ptr [esp+2Ch]
retn 0030h
adc dword ptr [ebx+00h], eax

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4b4fc	0x63	.rsrc
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ba60	0x118	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4b000	0x4e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x16a0	.text
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4a000	0x49600	a96619345afc837efb52794823a02534	False	0.624823653109029	data	6.591507115633169	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4b000	0x2000	0x1800	1bf51ba21035870b8724a79f96a556c7	False	0.794921875	data	6.804416992654808	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x4d000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_DIALOG	0x4a000	0xb2	data	English	United States	0.7191011235955056
RT_DIALOG	0x4a0b8	0xb2	data	English	United States	0.7191011235955056
RT_STRING	0x4a170	0x2a2	data	English	United States	0.37388724035608306
RT_VERSION	0x4b118	0x3d0	data	English	United States	0.4764344262295082

Imports

DLL	Import
MFC42.DLL
MSVCRT.dll	memcpy
KERNEL32.dll	SetFilePointer
USER32.dll	wsprintfA
ADVAPI32.dll	AdjustTokenPrivileges
WS2_32.dll	htons
SHLWAPI.dll	StrStrIA
ole32.dll	CoInitializeSecurity
OLEAUT32.dll	SysFreeString
MSVCP60.dll	?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
NETAPI32.dll	Netbios
KERNEL32.dll	GetModuleFileNameW
KERNEL32.dll	GetModuleHandleA, LoadLibraryA, LocalAlloc, LocalFree, GetModuleFileNameA, ExitProcess

Exports

Name	Ordinal	Address
GetColor	1	0x10008645
InputFile	2	0x1000678b
PrintFile	3	0x1000443d

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:21:18.043709993 CET	49738	803	192.168.2.4	174.139.6.44
Nov 19, 2024 14:21:18.109107018 CET	49739	18530	192.168.2.4	107.163.56.110
Nov 19, 2024 14:21:19.047017097 CET	49738	803	192.168.2.4	174.139.6.44
Nov 19, 2024 14:21:19.109510899 CET	49739	18530	192.168.2.4	107.163.56.110
Nov 19, 2024 14:21:21.047030926 CET	49738	803	192.168.2.4	174.139.6.44
Nov 19, 2024 14:21:21.109527111 CET	49739	18530	192.168.2.4	107.163.56.110
Nov 19, 2024 14:21:25.062658072 CET	49738	803	192.168.2.4	174.139.6.44
Nov 19, 2024 14:21:25.132925987 CET	49739	18530	192.168.2.4	107.163.56.110
Nov 19, 2024 14:21:33.062710047 CET	49738	803	192.168.2.4	174.139.6.44
Nov 19, 2024 14:21:33.140842915 CET	49739	18530	192.168.2.4	107.163.56.110
Nov 19, 2024 14:21:40.082081079 CET	49743	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:21:41.078468084 CET	49743	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:21:43.078372955 CET	49743	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:21:43.252254963 CET	49744	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:43.252532005 CET	49745	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:44.265870094 CET	49745	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:44.265872002 CET	49744	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:46.265880108 CET	49745	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:46.265881062 CET	49744	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:46.652245998 CET	49746	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:47.078577995 CET	49743	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:21:47.253612995 CET	49747	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:47.364893913 CET	49748	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:47.365425110 CET	49749	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:48.265891075 CET	49747	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:48.359642029 CET	49749	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:48.375253916 CET	49748	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:50.266021013 CET	49747	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:50.359643936 CET	49749	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:50.390896082 CET	49748	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:51.258402109 CET	49750	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:51.535480022 CET	49751	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:51.536098957 CET	49752	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:52.265901089 CET	49750	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:52.547167063 CET	49751	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:52.547367096 CET	49752	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:54.265938997 CET	49750	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:54.607287884 CET	49751	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:54.607790947 CET	49752	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:55.078434944 CET	49743	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:21:55.267950058 CET	49754	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:55.382906914 CET	49755	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:55.383697033 CET	49756	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:56.312813997 CET	49754	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:56.390953064 CET	49755	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:56.390964031 CET	49756	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:58.406589031 CET	49754	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:58.406588078 CET	49755	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:58.406662941 CET	49756	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:21:59.532591105 CET	49758	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:59.649398088 CET	49759	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:21:59.653146029 CET	49760	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:00.547288895 CET	49758	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:00.656625986 CET	49760	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:00.703474998 CET	49759	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:01.190318108 CET	49761	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:02.203469992 CET	49761	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:02.547250032 CET	49758	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:02.656621933 CET	49760	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:02.703485012 CET	49759	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:03.673880100 CET	49762	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:03.674550056 CET	49763	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:03.676060915 CET	49764	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:04.219088078 CET	49761	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:04.694473982 CET	49762	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:04.812853098 CET	49763	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:04.812983990 CET	49764	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:06.704320908 CET	49762	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:06.812856913 CET	49763	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:06.813098907 CET	49764	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:07.673007965 CET	49765	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:07.787035942 CET	49767	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:07.789345980 CET	49768	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:08.234750986 CET	49761	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:08.672230005 CET	49765	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:08.797277927 CET	49767	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:08.797281981 CET	49768	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:10.687927961 CET	49765	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:10.797385931 CET	49767	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:10.797610044 CET	49768	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:11.691502094 CET	49769	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:11.803848982 CET	49770	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:11.804934025 CET	49771	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:12.687882900 CET	49769	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:12.812922001 CET	49770	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:12.812922001 CET	49771	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:14.687899113 CET	49769	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:14.812908888 CET	49770	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:14.812908888 CET	49771	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:15.689158916 CET	49773	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:15.823456049 CET	49774	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:15.824022055 CET	49775	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:16.234893084 CET	49761	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:16.703532934 CET	49773	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:16.828531981 CET	49774	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:16.828658104 CET	49775	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:18.719187975 CET	49773	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:18.844171047 CET	49774	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:18.844422102 CET	49775	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:19.755863905 CET	49776	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:19.869724035 CET	49777	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:19.869975090 CET	49778	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:20.766108036 CET	49776	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:20.875413895 CET	49778	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:20.875413895 CET	49777	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:22.347388029 CET	49779	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:22.766118050 CET	49776	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:22.891022921 CET	49778	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:22.891022921 CET	49777	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:23.359796047 CET	49779	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:23.788973093 CET	49780	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:23.896883965 CET	49781	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:23.897645950 CET	49782	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:24.781688929 CET	49780	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:24.906667948 CET	49781	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:24.906667948 CET	49782	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:25.375446081 CET	49779	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:26.781694889 CET	49780	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:26.908896923 CET	49781	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:26.922377110 CET	49782	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:27.782551050 CET	49789	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:27.899569035 CET	49790	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:27.901606083 CET	49791	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:28.797382116 CET	49789	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:28.891063929 CET	49790	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:28.891149044 CET	49791	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:29.375475883 CET	49779	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:30.812959909 CET	49789	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:30.906727076 CET	49790	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:30.906770945 CET	49791	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:31.798799038 CET	49793	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:31.933974981 CET	49794	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:31.936225891 CET	49795	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:32.797346115 CET	49793	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:32.937966108 CET	49794	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:32.938004017 CET	49795	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:34.797346115 CET	49793	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:34.937966108 CET	49794	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:34.938014984 CET	49795	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:35.814255953 CET	49796	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:35.933948040 CET	49797	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:35.939815044 CET	49798	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:36.828588009 CET	49796	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:36.922354937 CET	49797	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:36.937979937 CET	49798	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:37.391107082 CET	49779	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:38.828592062 CET	49796	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:38.923222065 CET	49797	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:38.937994003 CET	49798	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:39.830739975 CET	49800	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:39.943835974 CET	49801	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:39.945286989 CET	49802	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:40.844254017 CET	49800	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:40.953623056 CET	49802	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:40.953670025 CET	49801	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:42.859869003 CET	49800	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:42.953681946 CET	49801	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:42.969317913 CET	49802	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:43.518017054 CET	49803	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:43.860842943 CET	49804	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:44.346401930 CET	49805	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:44.348786116 CET	49806	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:44.531785011 CET	49803	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:44.875524044 CET	49804	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:45.359916925 CET	49805	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:45.359961033 CET	49806	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:46.547421932 CET	49803	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:46.875504971 CET	49804	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:47.359935045 CET	49806	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:47.359935045 CET	49805	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:47.861368895 CET	49812	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:47.986105919 CET	49813	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:48.312623978 CET	49814	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:48.875562906 CET	49812	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:49.000534058 CET	49813	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:49.313018084 CET	49814	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:50.563422918 CET	49803	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:50.875546932 CET	49812	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:51.016174078 CET	49813	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:51.313059092 CET	49814	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:51.877054930 CET	49815	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:51.994679928 CET	49816	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:52.012778044 CET	49817	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:52.891268969 CET	49815	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:52.984940052 CET	49816	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:53.016176939 CET	49817	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:54.906857967 CET	49815	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:54.984945059 CET	49816	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:55.031802893 CET	49817	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:55.892921925 CET	49818	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:56.006154060 CET	49819	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:56.007213116 CET	49820	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:56.906794071 CET	49818	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:57.016304016 CET	49819	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:57.016432047 CET	49820	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:58.578743935 CET	49803	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:22:58.906861067 CET	49818	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:59.016277075 CET	49820	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:22:59.016486883 CET	49819	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:22:59.910170078 CET	49823	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:00.020482063 CET	49824	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:00.021430016 CET	49825	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:00.922462940 CET	49823	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:01.031882048 CET	49825	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:01.034564972 CET	49824	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:02.938076973 CET	49823	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:03.047446966 CET	49825	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:03.047549963 CET	49824	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:03.909010887 CET	49828	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:04.055325031 CET	49829	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:04.056952953 CET	49830	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:04.689764023 CET	49831	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:04.922575951 CET	49828	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:05.047468901 CET	49829	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:05.063086987 CET	49830	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:05.813116074 CET	49831	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:06.922611952 CET	49828	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:07.110605001 CET	49830	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:07.235358000 CET	49829	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:07.813091040 CET	49831	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:08.055629969 CET	49832	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:08.056571007 CET	49833	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:08.056895971 CET	49834	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:09.219501019 CET	49834	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:09.219608068 CET	49832	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:09.219669104 CET	49833	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:10.679543972 CET	49835	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:10.679543972 CET	49836	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:10.680649996 CET	49837	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:11.735001087 CET	49835	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:11.735019922 CET	49836	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:11.735019922 CET	49837	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:11.895657063 CET	49831	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:13.734982014 CET	49835	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:13.734997034 CET	49836	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:13.734997988 CET	49837	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:14.811294079 CET	49838	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:14.811691999 CET	49839	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:14.812732935 CET	49840	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:15.828783035 CET	49838	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:15.828778028 CET	49840	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:15.906874895 CET	49839	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:17.909171104 CET	49839	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:17.922538042 CET	49840	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:17.922542095 CET	49838	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:18.879826069 CET	49841	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:19.144808054 CET	49843	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:19.324598074 CET	49844	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:19.906924009 CET	49831	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:20.031896114 CET	49841	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:20.219415903 CET	49843	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:20.406887054 CET	49844	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:22.032097101 CET	49841	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:22.313294888 CET	49843	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:22.516294003 CET	49844	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:22.907874107 CET	49845	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:22.992968082 CET	49846	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:23.024702072 CET	49847	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:24.018640995 CET	49845	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:24.031920910 CET	49846	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:24.031920910 CET	49847	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:26.016294003 CET	49845	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:26.018054962 CET	49848	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:26.031910896 CET	49846	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:26.032002926 CET	49847	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:26.924649000 CET	49849	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:27.048959017 CET	49850	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:27.053303957 CET	49851	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:27.100670099 CET	49848	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:28.031930923 CET	49849	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:28.235040903 CET	49850	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:28.235166073 CET	49851	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:29.219448090 CET	49848	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:30.032660961 CET	49849	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:30.235071898 CET	49850	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:30.235071898 CET	49851	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:30.927350998 CET	49852	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:31.041491985 CET	49853	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:31.043530941 CET	49854	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:32.031994104 CET	49852	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:32.219455004 CET	49853	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:32.219455004 CET	49854	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:33.219695091 CET	49848	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:34.034806013 CET	49852	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:34.219439983 CET	49853	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:34.238692045 CET	49854	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:34.933223009 CET	49857	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:35.061311007 CET	49858	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:35.061567068 CET	49859	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:36.016367912 CET	49857	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:36.235090971 CET	49858	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:36.235090971 CET	49859	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:38.016365051 CET	49857	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:38.328840971 CET	49858	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:38.328970909 CET	49859	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:39.108556986 CET	49860	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:39.111231089 CET	49861	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:39.112771034 CET	49862	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:40.219491959 CET	49860	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:40.219491959 CET	49861	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:40.235111952 CET	49862	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:41.219506979 CET	49848	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:42.219486952 CET	49860	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:42.219486952 CET	49861	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:42.328857899 CET	49862	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:43.133724928 CET	49864	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:43.244712114 CET	49865	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:43.245973110 CET	49866	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:44.219487906 CET	49864	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:44.330220938 CET	49866	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:44.407018900 CET	49865	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:46.219691992 CET	49864	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:46.328850985 CET	49866	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:46.487813950 CET	49865	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:47.142712116 CET	49867	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:47.259228945 CET	49868	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:47.259228945 CET	49869	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:47.340723038 CET	49870	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:48.220505953 CET	49867	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:48.328883886 CET	49870	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:48.354809046 CET	49868	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:48.354866982 CET	49869	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:50.219502926 CET	49867	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:50.329339981 CET	49870	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:50.407031059 CET	49868	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:50.407114983 CET	49869	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:51.160871983 CET	49871	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:51.276133060 CET	49872	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:51.858613968 CET	49873	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:52.205133915 CET	49871	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:52.313324928 CET	49872	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:53.016411066 CET	49873	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:54.219526052 CET	49871	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:54.328885078 CET	49870	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:23:54.370300055 CET	49872	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:55.181091070 CET	49874	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:55.400453091 CET	49875	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:55.402904987 CET	49876	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:56.219517946 CET	49874	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:56.490305901 CET	49875	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:56.490335941 CET	49876	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:58.219543934 CET	49874	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:58.610158920 CET	49875	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:58.610256910 CET	49876	80	192.168.2.4	202.108.0.52
Nov 19, 2024 14:23:59.192003012 CET	49877	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:23:59.310776949 CET	49879	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:00.219593048 CET	49877	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:00.328912973 CET	49879	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:02.219551086 CET	49877	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:02.422688007 CET	49870	3204	192.168.2.4	174.139.6.42
Nov 19, 2024 14:24:02.422699928 CET	49879	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:03.330281973 CET	49881	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:03.332714081 CET	49882	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:04.328973055 CET	49882	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:04.328963041 CET	49881	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:06.328938007 CET	49881	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:06.328944921 CET	49882	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:10.330240011 CET	49881	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:10.330290079 CET	49882	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:18.344631910 CET	49881	805	192.168.2.4	174.139.6.43
Nov 19, 2024 14:24:18.344660997 CET	49882	805	192.168.2.4	174.139.6.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:21:46.303427935 CET	64871	53	192.168.2.4	1.1.1.1
Nov 19, 2024 14:21:46.649912119 CET	53	64871	1.1.1.1	192.168.2.4
Nov 19, 2024 14:22:47.991146088 CET	61214	53	192.168.2.4	1.1.1.1
Nov 19, 2024 14:22:48.311491966 CET	53	61214	1.1.1.1	192.168.2.4
Nov 19, 2024 14:23:51.278502941 CET	64785	53	192.168.2.4	1.1.1.1
Nov 19, 2024 14:23:51.823559046 CET	53	64785	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 14:21:46.303427935 CET	192.168.2.4	1.1.1.1	0x6529	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:22:47.991146088 CET	192.168.2.4	1.1.1.1	0xd317	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:23:51.278502941 CET	192.168.2.4	1.1.1.1	0xe4c7	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 14:21:46.649912119 CET	1.1.1.1	192.168.2.4	0x6529	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:21:46.649912119 CET	1.1.1.1	192.168.2.4	0x6529	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:22:48.311491966 CET	1.1.1.1	192.168.2.4	0xd317	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:22:48.311491966 CET	1.1.1.1	192.168.2.4	0xd317	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:23:51.823559046 CET	1.1.1.1	192.168.2.4	0xe4c7	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:23:51.823559046 CET	1.1.1.1	192.168.2.4	0xe4c7	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	08:21:14
Start date:	19/11/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll"
Imagebase:	0x840000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:21:14
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:21:14
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:21:14
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,GetColor
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:21:14
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",#1
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:21:14
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:21:14
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:21:14
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x670000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:21:17
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,InputFile
Imagebase:	0x800000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:21:20
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\b3sV534MMf.dll,PrintFile
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:21:21
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 672
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:21:23
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:21:23
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",InputFile
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:21:23
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\b3sV534MMf.dll",PrintFile
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:21:24
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7428, Parent PID: 7400

General

Target ID:	18
Start time:	08:21:24
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:21:24
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 668
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:21:24
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x670000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:21:46
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:21:46
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7844, Parent PID: 7832

General

Target ID:	26
Start time:	08:21:47
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:21:47
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x670000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:21:55
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\b3sV534MMf.dll",GetColor
Imagebase:	0xac0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7976, Parent PID: 7948

General

Target ID:	29
Start time:	08:21:55
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7984, Parent PID: 7976

General

Target ID:	30
Start time:	08:21:55
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:21:55
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x670000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.1%
Total number of Nodes:	268
Total number of Limit Nodes:	11

Executed Functions

Function 10007F3E Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*.*, xrefs: 10007F8C
%s\%s, xrefs: 10008067
P, xrefs: 100080F7
12021651, xrefs: 1000805B
., xrefs: 10007FCF
NPKI, xrefs: 1000802C
174.139.6.43:805/index.php, xrefs: 10008113
L2ltYWdlLnBocA==, xrefs: 1000818B

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %s\%s$*.*$.$12021651$174.139.6.43:805/index.php$L2ltYWdlLnBocA==$NPKI$P
API String ID: 0-3152428263
Opcode ID: e83cbb7ce683d5171164fb005deed9e300ede837ebf357770279583dc42bb93f
Instruction ID: afc7814580d48a7676e1bb84efd507c43e14b796dcde495971179b2b3bbe2c4c
Opcode Fuzzy Hash: e83cbb7ce683d5171164fb005deed9e300ede837ebf357770279583dc42bb93f
Instruction Fuzzy Hash: 87718F7690425DBEEB51D7A4DC45FEEB7BCEF48290F1004E6E608E6041EB749B898F21

Function 10008B7A Relevance: 5.1, Strings: 4, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C:\Users\user\Desktop\b3sV534MMf.dll, xrefs: 10008B7A
C:\Users\user\Desktop, xrefs: 10008B85
12021651, xrefs: 10008B83
\\.\PHYSICALDRIVE%d, xrefs: 10008B8E

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 12021651$C:\Users\user\Desktop$C:\Users\user\Desktop\b3sV534MMf.dll$\\.\PHYSICALDRIVE%d
API String ID: 0-1713663353
Opcode ID: e0116ed2b988a9dc7d34c9a1f1eefb8bfd1d5af49d1360a5db21c19b3a86c223
Instruction ID: 0f2a881c0ba3978bc0576c9cf3dbb33b30f55d0b098a5ea06b62feb8b8cf0b11
Opcode Fuzzy Hash: e0116ed2b988a9dc7d34c9a1f1eefb8bfd1d5af49d1360a5db21c19b3a86c223
Instruction Fuzzy Hash: D931D0B65401187EF715D6A0DD82FFF336CEB01294F104265FA54AA0C1EA78AF0A87B5

Function 10003FB7 Relevance: 1.5, APIs: 1, Instructions: 4processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000000,00000000,10005931,00000002,00000000,00000000,00000000), ref: 10003FBF

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 1e956e5b503a472c93e19a4642fd5130f6607d7bc175f230498bf039bbf47dc4
Instruction ID: ca46abfd3f4ae67059df7024880e3d5c8c44562ed1dec37196b9e10746ab925e
Opcode Fuzzy Hash: 1e956e5b503a472c93e19a4642fd5130f6607d7bc175f230498bf039bbf47dc4
Instruction Fuzzy Hash: D5A00136408212ABDA42AB50CD48D4AFFA2BBA8781F02C819F19980034CB32C5A5EB12

Function 10008AAD Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff75e7fe589ecd24971b98b24c5b9315f543cd1c40e81c60cd2a41a51bcc4e6
Instruction ID: 493b1b29979d5d8ed0c3f261c20b4ca22d9c43e3e0870ceab011e7372302cd5e
Opcode Fuzzy Hash: cff75e7fe589ecd24971b98b24c5b9315f543cd1c40e81c60cd2a41a51bcc4e6
Instruction Fuzzy Hash: 2EF0366229E3C26DE31287285841BD6FF956B76314F0CDBCDB1D81B283C1A584D8C7B6

Function 10006EDE Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 174
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(0000EA60), ref: 10006F24
Sleep.KERNEL32 ref: 10007059
wsprintfA.USER32 ref: 1000709D
PrintFile.B3SV534MMF(00000000,?,00000000), ref: 100070D6
PrintFile.B3SV534MMF(00000000,?,00000000,?,00000000), ref: 100070E9

Strings

QVlSVFNydi5heWU=, xrefs: 10006EFA
QVNEU3ZjLmV4ZQ==, xrefs: 10006EEE
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 10006F90
c:\1.txt, xrefs: 10007047
iOffset, xrefs: 10007042
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 10006F79
http://174.139.6.43:805/index.php, xrefs: 10007007

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FilePrintSleep$wsprintf
String ID: QVNEU3ZjLmV4ZQ==$QVlSVFNydi5heWU=$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$c:\1.txt$http://174.139.6.43:805/index.php$iOffset
API String ID: 1547040302-151153007
Opcode ID: 6b3fb956b1b31f50ccfb7c7703921a19242a907f830c663297b5379c06271bd6
Instruction ID: 8dfa040b4042d5a949b98b170938a078f1726f0d921d1e03628392f43cd5410d
Opcode Fuzzy Hash: 6b3fb956b1b31f50ccfb7c7703921a19242a907f830c663297b5379c06271bd6
Instruction Fuzzy Hash: EA51D9B6D04359BAF722D760CC56FCF77ACEB083C1F2045A5F208E6086DA75AB808E55

Function 100064D5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 283
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 100064F7

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 10006546

Part of subcall function 10003F24: InternetOpenUrlA.WININET(80000100,00000000,00000000,00000000,00000000,10006206), ref: 10003F39

Part of subcall function 10003F41: InternetReadFile.WININET(?,?,?,?), ref: 10003F51

MultiByteToWideChar.KERNEL32(0000FDE9,?,?,000000FF,?,?,?,?,?,00000000,10017B8C,00000000), ref: 100065C8
MultiByteToWideChar.KERNEL32(0000FDE9,?,?,000000FF,00000000,?,?,?,000000FF,?,?,?,?,?,00000000,10017B8C), ref: 100065E6
wsprintfA.USER32 ref: 100066E9

Strings

title, xrefs: 10006647, 1000664C, 10006655
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 1000651A
aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==, xrefs: 100064DF

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Internet$ByteCharMultiOpenWidewsprintf$FileFormatReadTime___crt
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==$title
API String ID: 4077377486-2496724313
Opcode ID: 3cf509de175d1bafa7ecc4d4b79c9f88d87fe85883615ef4302368c40025d449
Instruction ID: a3645680fa3df20bd134621aa3cc8f71b16a9f1173e4a3834ed7d3f1afc37bd0
Opcode Fuzzy Hash: 3cf509de175d1bafa7ecc4d4b79c9f88d87fe85883615ef4302368c40025d449
Instruction Fuzzy Hash: 0981E1B6801218BEFB01DBA4DC82EFF7B6DDF05394F244159F904BB186DA356E4187A1

Function 10006CF7 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 72
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10003FF7: GetShortPathNameA.KERNEL32(?,?,?), ref: 10004003

Part of subcall function 1000406C: RegCreateKeyExA.KERNEL32(?,00000000,000F003F,00000000,?,00000000,00000000,80000001,10006D60,?,10006D60,80000001,00000000,00000000,REG_SZ,00000000), ref: 1000408A

wsprintfA.USER32 ref: 10006D88
___crtGetTimeFormatEx.LIBCMT ref: 10006DAE

Part of subcall function 100040D4: RegSetValueExA.KERNEL32(00000001,?,00000001,00000000,10015738,?,?,10006DB3,?,10015738,00000000,00000001,?,00000001,?), ref: 100040E9

Part of subcall function 10004092: RegCloseKey.KERNEL32(?,10006DBE,?), ref: 10004096

Strings

U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 10006D4A
C:\Windows\SysWOW64\rundll32.exe, xrefs: 10006D77
C:\Users\user\Desktop\b3sV534MMf.dll, xrefs: 10006D26, 10006D2C, 10006D71
REG_SZ, xrefs: 10006D44
%s "%s",GetColor, xrefs: 10006D82

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateFormatNamePathShortTimeValue___crtwsprintf
String ID: %s "%s",GetColor$C:\Users\user\Desktop\b3sV534MMf.dll$C:\Windows\SysWOW64\rundll32.exe$REG_SZ$U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==
API String ID: 1762869224-566355842
Opcode ID: c596956d60ca18c86f8c347a2a9999c70d74b52254da84de320ef44d1e342eb9
Instruction ID: fc49ecc0cde6da7ef2fb6a4f98208201b60ef311f6de46faaa851482017432d5
Opcode Fuzzy Hash: c596956d60ca18c86f8c347a2a9999c70d74b52254da84de320ef44d1e342eb9
Instruction Fuzzy Hash: 021182B694421CBEFB11D7A4DC86FEA776CEB14354F1004A1F704B9085DAB16FD88AA4

Function 10006499 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 100064F7

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 10006546

Part of subcall function 10003F24: InternetOpenUrlA.WININET(80000100,00000000,00000000,00000000,00000000,10006206), ref: 10003F39

Part of subcall function 10003F41: InternetReadFile.WININET(?,?,?,?), ref: 10003F51

MultiByteToWideChar.KERNEL32(0000FDE9,?,?,000000FF,?,?,?,?,?,00000000,10017B8C,00000000), ref: 100065C8
MultiByteToWideChar.KERNEL32(0000FDE9,?,?,000000FF,00000000,?,?,?,000000FF,?,?,?,?,?,00000000,10017B8C), ref: 100065E6
wsprintfA.USER32 ref: 100066E9

Strings

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 1000651A
aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==, xrefs: 100064DF

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Internet$ByteCharMultiOpenWidewsprintf$FileFormatReadTime___crt
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==
API String ID: 4077377486-782189213
Opcode ID: 50c8f770b4c5d3b43effb56a947a7a92a223db9dd6af337e75ca1dc64f755a1f
Instruction ID: 9ebbffcf6faf3d5af311395f9aa38a975852c0fd016f763e1c36b953c1b761f9
Opcode Fuzzy Hash: 50c8f770b4c5d3b43effb56a947a7a92a223db9dd6af337e75ca1dc64f755a1f
Instruction Fuzzy Hash: 22414CB6C0021DBEFF01DBA4CC82DFF7A7DEB08394F204165F518A6196DA356E408AA1

Function 10008567 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 83
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00002710), ref: 1000857E
Sleep.KERNEL32(001B7740), ref: 100085BF
wsprintfA.USER32 ref: 100085EC

Strings

aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=, xrefs: 10008580
wINsTA0\dEFauLT, xrefs: 1000862C
c:\%d.log, xrefs: 100085E6
D, xrefs: 10008612

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$wsprintf
String ID: D$aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=$c:\%d.log$wINsTA0\dEFauLT
API String ID: 3195947292-2583752392
Opcode ID: 52d64d1be171e9efc5b51aece66d8205c40ec15e3b0680b0258c64f3a6b005f6
Instruction ID: 50e96591f79335c1e8b45cffc21f133aa4dd079f5b5086e8394058b99137be6a
Opcode Fuzzy Hash: 52d64d1be171e9efc5b51aece66d8205c40ec15e3b0680b0258c64f3a6b005f6
Instruction Fuzzy Hash: 5F219076C0011CBEEB12EBE4CC45EDFBB7CEF48390F140466F604BA141EA756A458BA1

Function 1000838D Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 95
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 10008394
wsprintfA.USER32 ref: 100083E6

Strings

127.0.0.1, xrefs: 100083F4
Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=, xrefs: 10008405
8.8.8.8, xrefs: 100083EF
http://174.139.6.43:805/index.php, xrefs: 10008353

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: 127.0.0.1$8.8.8.8$Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=$http://174.139.6.43:805/index.php
API String ID: 1749205058-3980729192
Opcode ID: 8be8db1dc05f112c527003b6dacf39840429743c9606b8861592cf895ce67054
Instruction ID: e8d6c46d509b70771ad05a902953c63f24a8652204ea5db2457c6af9c5b48fe8
Opcode Fuzzy Hash: 8be8db1dc05f112c527003b6dacf39840429743c9606b8861592cf895ce67054
Instruction Fuzzy Hash: 4021F1B6904255BAF716D360CC96F8F3BACEB456C1F2444A5F244A9087EBB5EB808A11

Function 10005DE7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 52
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtGetTimeFormatEx.LIBCMT ref: 10005E11

Part of subcall function 1000409D: RegQueryValueExA.KERNEL32(?,?,?,?,?,?), ref: 100040B2

Part of subcall function 10004092: RegCloseKey.KERNEL32(?,10006DBE,?), ref: 10004096

Strings

ProcessorNameString, xrefs: 10005E02
@, xrefs: 10005E57
12021651, xrefs: 10005E8F
%u MB, xrefs: 10005E7E

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseFormatQueryTimeValue___crt
String ID: %u MB$12021651$@$ProcessorNameString
API String ID: 271660946-1881400266
Opcode ID: d88d79eaefbc45251d36645f7e55bfef7bd552ee592ace3b6ec4bcdae5631418
Instruction ID: ee32c36273931c3467c2a54d194341e3fec3a2fdf5d0efd58eb21727ef661a29
Opcode Fuzzy Hash: d88d79eaefbc45251d36645f7e55bfef7bd552ee592ace3b6ec4bcdae5631418
Instruction Fuzzy Hash: 5011A0B6800248AAEF11DBA0CC41FDE7B6CEF00204F188499F615A6046EF35B7498B55

Function 100087B7 Relevance: 7.5, APIs: 5, Instructions: 27
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000927C0), ref: 100087C5
CreateThread.KERNEL32(?,?,Function_00006A6E), ref: 100087D1
Sleep.KERNEL32(00001388,?,?,Function_00006A6E), ref: 100087D8
CreateThread.KERNEL32(?,?,1000841C,?,?,?,?,?,Function_00006A6E), ref: 100087E4
Sleep.KERNEL32(000000FF), ref: 100087E8

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$CreateThread
String ID:
API String ID: 3220764680-0
Opcode ID: 9857e69c7aa5c04d87c58b36f69020f73a70e859f82f10bb09c527f9e2964423
Instruction ID: 97d8cae0da7006b7316437b6fdaa94dcad4298e965bed5c2a5e4c1c08e9363ca
Opcode Fuzzy Hash: 9857e69c7aa5c04d87c58b36f69020f73a70e859f82f10bb09c527f9e2964423
Instruction Fuzzy Hash: 6AD0C9E478835D3CB520B2B60CC9CBF0C0DEBD46FC3264651F669600CE9D808E0089B2

Function 100044AD Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000,?,00000000,GetExtendedUdpTable,00000000,iphlpapi.dll), ref: 100044E9
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000,?,?,00000000,GetExtendedUdpTable,00000000,iphlpapi.dll), ref: 10004513

Strings

GetExtendedUdpTable, xrefs: 100044CA
iphlpapi.dll, xrefs: 100044BC

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExtendedTable
String ID: GetExtendedUdpTable$iphlpapi.dll
API String ID: 2407854163-1809394930
Opcode ID: 664a43c313f4c8ab79249adf4d7776a04b759f7de6a74d0a6a2c4c7939920573
Instruction ID: b5b37be831cb72ff93c13f38fb64547689303bea2de322210ff5a5e2846739fc
Opcode Fuzzy Hash: 664a43c313f4c8ab79249adf4d7776a04b759f7de6a74d0a6a2c4c7939920573
Instruction Fuzzy Hash: 3F21F9B5900914BFEB20DBA8CC85DAF77FCEF81395B21055AF551D7086EB30AE818664

Function 10006A6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10003ECE: CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

GetLastError.KERNEL32 ref: 10006AA8

Part of subcall function 10006499: wsprintfA.USER32 ref: 100064F7
Part of subcall function 10006499: ___crtGetTimeFormatEx.LIBCMT ref: 10006546

Sleep.KERNEL32(0002BF20,00000000,00000000,?,00000000,000000FF,?,?,1000687E,00000000), ref: 10006ADD
CreateThread.KERNEL32(?,?,1000687E,00000000), ref: 10006AF1

Strings

5762479093, xrefs: 10006AC7

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Create$ErrorFormatLastMutexSleepThreadTime___crtwsprintf
String ID: 5762479093
API String ID: 3244495550-3483958698
Opcode ID: c292ee69dc6425c3148df60cbde27f5695175c813395b8fde47a3e8ddae9763d
Instruction ID: 422baab63c08c1e54c6da26f7362cfa22c888ea5658382f1eeaf6102145cc144
Opcode Fuzzy Hash: c292ee69dc6425c3148df60cbde27f5695175c813395b8fde47a3e8ddae9763d
Instruction Fuzzy Hash: BB0168B59403187BF220F3708CCACBF3A5DDB963E0F200139F9049A18BDA25EC044272

Function 10008482 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 113
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000493E0,00000000,?,00000000,80000002,00000000,00000000,000F003F,?), ref: 1000855C
Sleep.KERNEL32(001B7740), ref: 100085BF

Strings

svchsot.exe, xrefs: 10008524
U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 1000846F

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$svchsot.exe
API String ID: 3472027048-2214221337
Opcode ID: fd576de4b3fc3feadcb3bb963780c1a9551cd14ce5fde572fcf076f684463ebd
Instruction ID: b7cf586044e2671ffdd42329cb688930c4320023932569c53e4af711d715d841
Opcode Fuzzy Hash: fd576de4b3fc3feadcb3bb963780c1a9551cd14ce5fde572fcf076f684463ebd
Instruction Fuzzy Hash: 0131FBB680425CBEEB12DBA0CD85DEF7BBCFF09285B1400A2F541E6006E671AF449B71

Function 10007101 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 95sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 100071AC
wsprintfA.USER32 ref: 100071FE

Strings

http://174.139.6.43:805/index.php, xrefs: 1000716B

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: http://174.139.6.43:805/index.php
API String ID: 1749205058-3195113140
Opcode ID: 59a894dbdb0a2aae870c8481ffe35e669776b9c8fa737a1a1a936e2fa149482d
Instruction ID: 6e35aeaf06452b137760d0cb28982c4119741183e15c1229ce18836c51c33211
Opcode Fuzzy Hash: 59a894dbdb0a2aae870c8481ffe35e669776b9c8fa737a1a1a936e2fa149482d
Instruction Fuzzy Hash: 132129B6D046557AF724D368CC56FCF3BACEF053D0F2000A6F608A50C6E679AE818A11

Function 100084BB Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000493E0,00000000,?,00000000,80000002,00000000,00000000,000F003F,?), ref: 1000855C
Sleep.KERNEL32(001B7740), ref: 100085BF

Strings

svchsot.exe, xrefs: 10008524
U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 1000846F

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$svchsot.exe
API String ID: 3472027048-2214221337
Opcode ID: 72445ef8a4ded9d5fc185bdf9991e8c0518eef41a36dbfaae2350b6009e1f532
Instruction ID: 49c026a31a7b763a0aa51d95342cc4f24ac29f13658c43b6c248d16b497c3765
Opcode Fuzzy Hash: 72445ef8a4ded9d5fc185bdf9991e8c0518eef41a36dbfaae2350b6009e1f532
Instruction Fuzzy Hash: CC3196B680015DBEEB11DBA0CD85DEFB7BCFB09285F1440A2F645E6005DA35AF849BA1

Function 10006B1F Relevance: 4.5, APIs: 3, Instructions: 47sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 10003ECE: CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

GetLastError.KERNEL32 ref: 10006B55
CreateThread.KERNEL32(?,?,1000687E), ref: 10006B6B
Sleep.KERNEL32(00002710,00000000,00000000,?,00000000,000000FF,?,?,1000687E), ref: 10006B88

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Create$ErrorLastMutexSleepThread
String ID:
API String ID: 145085098-0
Opcode ID: 170fc673015a53e62389e4e05a4f6a211bd5cee69549bab6bee49d7e8617ce6f
Instruction ID: 72cad43286caf886e094a07264cc0548bb137ceabefc554c7101d4208cc1579f
Opcode Fuzzy Hash: 170fc673015a53e62389e4e05a4f6a211bd5cee69549bab6bee49d7e8617ce6f
Instruction Fuzzy Hash: BEF0F6B58052607AF621B3755C8EDAF3E6CDFC67E4F200139F509D60CADA54E94581B2

Function 100069F2 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 10006AA8
Sleep.KERNEL32(0002BF20,00000000,00000000,?,00000000,000000FF,?,?,1000687E,00000000), ref: 10006ADD

Strings

5762479093, xrefs: 10006AC7

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLastSleep
String ID: 5762479093
API String ID: 1458359878-3483958698
Opcode ID: 1df4263f7db79390f94cad6d6f30531637e587d7cd8f8beb535f42523eefeb4a
Instruction ID: b14aca41d51b256f78105d68b34805587476813ad00675fb894e2a90b3c36f4e
Opcode Fuzzy Hash: 1df4263f7db79390f94cad6d6f30531637e587d7cd8f8beb535f42523eefeb4a
Instruction Fuzzy Hash: 7DF0FCA69443507FF301E3708C87DAF379DDF577D0B254068F5009E14BE6109C054672

Function 100061BD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 10006201

Strings

TW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNi4xOyB6aC1DTjsgcnY6MS45LjIuMTUpIEdlY2tvLzIwMTEwMzAzIEZpcmVmb3gvMy42LjE1, xrefs: 100061D0

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FormatInternetOpenTime___crt
String ID: TW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNi4xOyB6aC1DTjsgcnY6MS45LjIuMTUpIEdlY2tvLzIwMTEwMzAzIEZpcmVmb3gvMy42LjE1
API String ID: 483802873-1756078650
Opcode ID: c2cbce892976d4b1007170d2a4a46ac64bb505d69b85d8154e6bdc3861738b06
Instruction ID: f0c3526304c825564c5c4eb44b26f53dc373e74deb03e814873fed5b313e77ee
Opcode Fuzzy Hash: c2cbce892976d4b1007170d2a4a46ac64bb505d69b85d8154e6bdc3861738b06
Instruction Fuzzy Hash: 1C21C575D0014DBAEF21DB55DC45D9F7B7DDB852D0F20807AF608E6045DA319A818660

Function 10006290 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 100062BF

Part of subcall function 10003F24: InternetOpenUrlA.WININET(80000100,00000000,00000000,00000000,00000000,10006206), ref: 10003F39

Strings

TW96aWxsYS80LjAgKGNvbXBhdGlibGUp, xrefs: 10006298

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen$FormatTime___crt
String ID: TW96aWxsYS80LjAgKGNvbXBhdGlibGUp
API String ID: 1165476586-1918919809
Opcode ID: 5c4a45e9f88b1cdcaa63395fc832ffbcbaa15b587116e0ae30a38edddbb0ae5c
Instruction ID: e1df23a7d6fc88136f19512af0817ca3ec1a39d4f872029b50130054e15d899c
Opcode Fuzzy Hash: 5c4a45e9f88b1cdcaa63395fc832ffbcbaa15b587116e0ae30a38edddbb0ae5c
Instruction Fuzzy Hash: 61E0D832D089D238BA33E1671C0ED9F1EBDCBC7AF0B71402DF9489100EE8556485C0B5

Function 100081F7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0036EE80), ref: 10008264

Strings

C:\Program Files, xrefs: 10008200

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: C:\Program Files
API String ID: 3472027048-1387799010
Opcode ID: 9c12519ba8f92ada5ea338270599224c826a3e176a5bdac3043c0311ba39c226
Instruction ID: ff1306f0a4f1ac59270128d03767b5ad6af54f96c84c5a7b76bd668247e82245
Opcode Fuzzy Hash: 9c12519ba8f92ada5ea338270599224c826a3e176a5bdac3043c0311ba39c226
Instruction Fuzzy Hash: 60F02276906AA1E6F701DFA458C068F776DFF122A1B210026F940BF046D7B59A4147E2

Function 10006A58 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0002BF20,00000000,00000000,?,00000000,000000FF,?,?,1000687E,00000000), ref: 10006ADD

Strings

5762479093, xrefs: 10006AC7

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: 5762479093
API String ID: 3472027048-3483958698
Opcode ID: a26036ad016d7c9e7ae796b905a858889943a9e54840ed55f1f4de09bb6151af
Instruction ID: c70fe16bf65d4ebafc1be4ec70161536b021d68c1a422e5c9178506ebaefb377
Opcode Fuzzy Hash: a26036ad016d7c9e7ae796b905a858889943a9e54840ed55f1f4de09bb6151af
Instruction Fuzzy Hash: 5AE026B67847287AF212E2315C4395B3A8ADF223E67148020F501E804BE761E94045F2

Function 1000406C Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(?,00000000,000F003F,00000000,?,00000000,00000000,80000001,10006D60,?,10006D60,80000001,00000000,00000000,REG_SZ,00000000), ref: 1000408A

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8241c048834319a8777681939fd791c1f2bb79611796acde0cc24ef85fc7be79
Instruction ID: 2e24eff2bcdac0d7bb79d22e3b0edd8e416dbe054c2d5b18b585679418e55d12
Opcode Fuzzy Hash: 8241c048834319a8777681939fd791c1f2bb79611796acde0cc24ef85fc7be79
Instruction Fuzzy Hash: 8DD0AE3200014EFBCF025F81ED05CDA3F6AFB0C2A9B068254FA1825030C777D9B1AB91

Function 1003748F Relevance: 1.5, APIs: 1, Instructions: 12threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 10037498

Memory Dump Source

Source File: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: ad270d2bd068476132eed9c0890dd0f41c6575f8d5f58fc5ce26e06ee558db0d
Instruction ID: 71c3a9970c7d6d96de73f33e6f2bdf1ab161db2225937d05d9eb6bc3fd0978d2
Opcode Fuzzy Hash: ad270d2bd068476132eed9c0890dd0f41c6575f8d5f58fc5ce26e06ee558db0d
Instruction Fuzzy Hash: 59C08C7900A600FFA20AD7A7FC434AE6AA1DCC4260FA08548B09827D118E38B9514E52

Function 100040BA Relevance: 1.5, APIs: 1, Instructions: 10registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,?), ref: 100040CC

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a195baf415497c3f6e756206114371a6254dc762b0ba02df47c96a08b610d07e
Instruction ID: 17287b262fc42a8ef4c3757039caf17c8ec33028492a73a8645d3109de99ba33
Opcode Fuzzy Hash: a195baf415497c3f6e756206114371a6254dc762b0ba02df47c96a08b610d07e
Instruction Fuzzy Hash: 40C0013200420EFBCF025F81EC058DA3F2AFB082A1B008010FE1804030C773D9B1EBA1

Function 10003F0A Relevance: 1.5, APIs: 1, Instructions: 10networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 8fdbf6ddd27a1d6b462f044f687e1b09091a90aa3cf3341bbc8376c5064c6b07
Instruction ID: b95a3e5d4d1581b579a43ffb785aa3053a804adf9b6b5080047aec5b24f95343
Opcode Fuzzy Hash: 8fdbf6ddd27a1d6b462f044f687e1b09091a90aa3cf3341bbc8376c5064c6b07
Instruction Fuzzy Hash: 32C0013200020EFBCF025F81EC058DA7F2AFB092A0B008010FA1804031C733D971AB95

Function 10003ECE Relevance: 1.5, APIs: 1, Instructions: 5synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: f03030767440787e5e8ee563cbeb237b89049fd46284869140ae0419c91515a8
Instruction ID: 0bba5641deb9fc7c6708226b57f3740a3060a6e77b98bc1f4937df3feb83fb0f
Opcode Fuzzy Hash: f03030767440787e5e8ee563cbeb237b89049fd46284869140ae0419c91515a8
Instruction Fuzzy Hash: 51B0093A408220BFDF025F90DD4880ABBA2BB88362F24C958F6A941031C7328420EB02

Function 10003FF7 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32(?,?,?), ref: 10004003

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: b2e0d57d01f7aa481c28775ec103b2c79e6903a2f37fda92ba0980fa6487b9be
Instruction ID: 299f2b121c0b8d63d2f16659a91a8a26a6eb1e7383ee0b7c2fbbf344de06ce20
Opcode Fuzzy Hash: b2e0d57d01f7aa481c28775ec103b2c79e6903a2f37fda92ba0980fa6487b9be
Instruction Fuzzy Hash: BCB0097A509210BFDF025B91DE4880ABBA2AB89321F10C958F2A940031C7328520EB12

Function 10004104 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

Process32First.KERNEL32(00000000,00000000), ref: 1000410C

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 4be810b948c5642b78a3303991c31d5753e2f497cabb41971bfbf009a223d646
Instruction ID: d0469a6573cf8832cc4e791a541241725128130187f64684ac8c75673cb250d8
Opcode Fuzzy Hash: 4be810b948c5642b78a3303991c31d5753e2f497cabb41971bfbf009a223d646
Instruction Fuzzy Hash: B8A00176509612ABDA42AB51CE4884ABEA2FBA8381F01C819F18940434CB3284A5EB12

Function 10004115 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(0000005C,0000005C), ref: 1000411D

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 96d6b844675e51e99f82aec0d05e68cf0a3385db677bffcb7afb410fd8c547f0
Instruction ID: 2ceb7d0ae5350f2ffb1294a1e21229299d690b4e3dcfc0507f8b466183483048
Opcode Fuzzy Hash: 96d6b844675e51e99f82aec0d05e68cf0a3385db677bffcb7afb410fd8c547f0
Instruction Fuzzy Hash: B1A00136408612ABDA42AB50CD4884ABEA2FBA8381F11C819F18941034CB3684A5EB12

Function 1000400A Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,1000824C,10015938), ref: 1000400E

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 2ee3dedfe077572030ca3591167bf26a544b4eb7bba9e94adf73c1260513ac4d
Instruction ID: e310fc801df329cbdffcf5e880badee8d9e0b58f708c6ac467addbfbb1e58057
Opcode Fuzzy Hash: 2ee3dedfe077572030ca3591167bf26a544b4eb7bba9e94adf73c1260513ac4d
Instruction Fuzzy Hash: 029002305055119BDE015B10CE4940A7E71AB84701B00C4A4E04541130C7328810EE01

Function 10004092 Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,10006DBE,?), ref: 10004096

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 2d988dbd5b15decafcf846d532543195a702f6c68f6a27351b5815321025a744
Instruction ID: c461232d01f39555025ee1551a6f08c036cd225bd5518e59674b318f5e785400
Opcode Fuzzy Hash: 2d988dbd5b15decafcf846d532543195a702f6c68f6a27351b5815321025a744
Instruction Fuzzy Hash: 799002705055119BDE415B11CF494097AA5AB84701B008458E04A41030C7318810EA01

Function 10003F72 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(00080000,10005C92,?,?,%s\lang.ini,C:\Users\user\Desktop,?,00000000,00080000), ref: 10003F76

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 6dc1e466dda3ac71b59e7395498c1fa1529f77b3beb14a38e7d5df6994b7eb4f
Instruction ID: df56204a28902bd86cd8e7b59e1535f4ff11cbe2af3c274bf077f84441daad3a
Opcode Fuzzy Hash: 6dc1e466dda3ac71b59e7395498c1fa1529f77b3beb14a38e7d5df6994b7eb4f
Instruction Fuzzy Hash: 869002705051109BDF015B11CF494497A65AB84701B00855CF05A41431C7318910EA01

Function 10008417 Relevance: 1.3, APIs: 1, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 10008394
wsprintfA.USER32 ref: 100083E6

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID:
API String ID: 1749205058-0
Opcode ID: 556947e3ce337b3b0b687775f34b152472cb1fc700a18dab62916dd140d410ee
Instruction ID: e0f405a6295bc0021ca29f9cf2c982baf8811236296f7b974faba122b9606113
Opcode Fuzzy Hash: 556947e3ce337b3b0b687775f34b152472cb1fc700a18dab62916dd140d410ee
Instruction Fuzzy Hash: CD01B176C05658BAFB22C760CC11BCB7BACFB08280F1049A1E248A5096DB74AB448F00

Non-executed Functions

Function 1000B224 Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

K, xrefs: 1000B246

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 2579a251d1a9acc8374f22f67a4bb7b2891299b7fe2be1df8caa295a5f0ee3c9
Instruction ID: 6c5504f13a17a8b4553fb93f6e314e3eb43bbcef24ba1366296fc093faca9512
Opcode Fuzzy Hash: 2579a251d1a9acc8374f22f67a4bb7b2891299b7fe2be1df8caa295a5f0ee3c9
Instruction Fuzzy Hash: 13D1F2311046896EDB21CFAC8C80EFFBBBCAF4AA40F840549FD85CB642D555E92DA771

Function 1000AEC0 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

K, xrefs: 1000AEE2

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 40533ac75a34c0e28785cd811d3dcb55fe45dda3d4d2e35189a70ffc9c8f5c8e
Instruction ID: a9c7f45465d92fcd6248bf8d3b75336943ce7982e690b294f387925eaf45448f
Opcode Fuzzy Hash: 40533ac75a34c0e28785cd811d3dcb55fe45dda3d4d2e35189a70ffc9c8f5c8e
Instruction Fuzzy Hash: 6F9143311046896EDB21CFAD8C80EFFBBBCAF06A40F840549FE85C7642D255E92DA771

Function 10003F41 Relevance: 1.5, APIs: 1, Instructions: 6filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,?,?), ref: 10003F51

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 17794e789735475d89bbd1f9c593eb9d99e0ec2b66a06d8a24d179cffc3f724c
Instruction ID: 66c4406e5843dae4aa23aa47ff20fa86481cf42106c3819bfbf8a2f6b8e79ef1
Opcode Fuzzy Hash: 17794e789735475d89bbd1f9c593eb9d99e0ec2b66a06d8a24d179cffc3f724c
Instruction Fuzzy Hash: 20B00872519392ABDF02DF91CD4482ABAA6BB89301F084C5CF2A540071C7328428EB02

Function 10003F63 Relevance: 1.5, APIs: 1, Instructions: 4shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(000000BC,000000BC), ref: 10003F6B

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExitWindows
String ID:
API String ID: 1089080001-0
Opcode ID: ddd05c4d22fa51185853cbc8baa1bf28f6a18d545d76c7cc1a4f4cf3c1112b8e
Instruction ID: a0a7e03ceb7acd9bb0d3454ea8bb5ca0f40435505fc546ba40186378cb909d0a
Opcode Fuzzy Hash: ddd05c4d22fa51185853cbc8baa1bf28f6a18d545d76c7cc1a4f4cf3c1112b8e
Instruction Fuzzy Hash: 81A00175509222EBDE025B51CE4888ABEA6AB88381F008858F28940031C77284A2EB02

Function 100121ED Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

', xrefs: 100121FC

Memory Dump Source

Source File: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: 6f443eddfc8222ff2f5f800cc829f9353839bebc9c3e7457bd0cbed3613cd613
Instruction ID: f389f15fd0a8877f73eb6a91fb6ffbaafb7a2d8a217a3cbe01a0a4cb358a3832
Opcode Fuzzy Hash: 6f443eddfc8222ff2f5f800cc829f9353839bebc9c3e7457bd0cbed3613cd613
Instruction Fuzzy Hash: 5581276940E3D19FC7438B785CF91823FA2AE1B24434F09DAC4C09F4B7E1995D49C7A2

Function 1000B70D Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eebda9e14e432eb1eff53421c5c1b8c098bdb1a5ff6e099d7d67764739a7ad5
Instruction ID: 9e0b5d620d62c11970e9cc848d1ca02f4ed839136e4bfa4bb83daef4b24ba54e
Opcode Fuzzy Hash: 5eebda9e14e432eb1eff53421c5c1b8c098bdb1a5ff6e099d7d67764739a7ad5
Instruction Fuzzy Hash: AA313A33E2C6B607E324DF7E4C84025F7D6EB8A06275A8779DE88E7255D128EC518BD0

Function 1000720E Relevance: 28.4, APIs: 6, Strings: 10, Instructions: 358COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000008,00000001,?), ref: 10007338
VariantInit.OLEAUT32(?), ref: 1000734D
SafeArrayCreate.OLEAUT32(00000003,00000001,?), ref: 10007368
VariantInit.OLEAUT32(?), ref: 10007377

Part of subcall function 10007A62: VariantInit.OLEAUT32(?), ref: 10007AA1

SafeArrayCreate.OLEAUT32(00000008,00000001,00000002), ref: 10007505
VariantInit.OLEAUT32(?), ref: 10007513

Strings

p=<u, xrefs: 1000733A, 10007513
DNSServerSearchOrder, xrefs: 10007519
DefaultIPGateway, xrefs: 1000737C
SetDNSServerSearchOrder, xrefs: 1000749B, 1000755F
Win32_NetworkAdapterConfiguration, xrefs: 1000722B
IPEnabled=TRUE, xrefs: 10007226
GatewayCostMetric, xrefs: 100073BE
SetGateways, xrefs: 100072F1, 100073F7
Win32_NetworkAdapterConfiguration.Index=, xrefs: 100072A7
Index, xrefs: 1000725D

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant$ArrayCreateSafe
String ID: DNSServerSearchOrder$DefaultIPGateway$GatewayCostMetric$IPEnabled=TRUE$Index$SetDNSServerSearchOrder$SetGateways$Win32_NetworkAdapterConfiguration$Win32_NetworkAdapterConfiguration.Index=$p=<u
API String ID: 2640012081-3655912496
Opcode ID: 166749451ec1508bf59700e092c3af7201e4401a2a9ec7d4452531bb1519d429
Instruction ID: 9d002e7adf09fdf71323f72db342d1bc3075542c080a75d13bd0d318768fde2d
Opcode Fuzzy Hash: 166749451ec1508bf59700e092c3af7201e4401a2a9ec7d4452531bb1519d429
Instruction Fuzzy Hash: 2ED17F74D00219EFEB15CFA4C8809EEBBB8FF49781F104019F419AB259DB75AA45CFA1

Function 100053B7 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 226sleepfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10005437
wsprintfA.USER32 ref: 1000549E
wsprintfA.USER32 ref: 100054BC
PrintFile.B3SV534MMF(?,?,?,?,00000000), ref: 100054DE
rand.MSVCRT ref: 10005538
rand.MSVCRT ref: 10005543
rand.MSVCRT ref: 1000554E
rand.MSVCRT ref: 10005559
rand.MSVCRT ref: 10005564
wsprintfA.USER32 ref: 10005582
Sleep.KERNEL32(000003E8,00000000,00000000,00000061,?,40000000,00000001,00000000,00000002,00000000,00000000,?,?,?,00000009,00000000), ref: 100055AE

Strings

%s\%s, xrefs: 10005431
Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz, xrefs: 100054A9
Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXGV0Y1wlYyVjJWMuJWMlYyVj, xrefs: 1000556F
c:\windows\system32\drivers\%s, xrefs: 10005498

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: rand$wsprintf$FilePrintSleep
String ID: %s\%s$Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz$Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXGV0Y1wlYyVjJWMuJWMlYyVj$c:\windows\system32\drivers\%s
API String ID: 2577056782-455112146
Opcode ID: 8d814943ede8a0ded33f20e92e1f5805c3cf556b27fcf436b6769411b698c126
Instruction ID: 82889d552a462bf185d714c7d3d8cd771ce47005269810554c025dd8bf44c487
Opcode Fuzzy Hash: 8d814943ede8a0ded33f20e92e1f5805c3cf556b27fcf436b6769411b698c126
Instruction Fuzzy Hash: E7613973940258BFEB10DB64CC46FEE776EEB84351F184466F608AB181CAB1EA858B50

Function 10005989 Relevance: 25.6, APIs: 4, Strings: 13, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100059AE
wsprintfA.USER32 ref: 100059FB
wsprintfA.USER32 ref: 10005A08
wsprintfA.USER32 ref: 10005A19

Strings

C:\Users\user\Desktop\12021651, xrefs: 100059F6
C:\Users\user\Desktop\version.txt, xrefs: 10005A03
C:\Windows\SysWOW64\rundll32.exe, xrefs: 100059BF
%s\%s, xrefs: 100059F1
C:\Users\user\Desktop\b3sV534MMf.dll, xrefs: 100059C9, 100059CE, 100059DC
12021651, xrefs: 1000599D, 100059A3, 100059EF
%s\version.txt, xrefs: 100059FE
174.139.6.42:3204, xrefs: 10005A0A
C:\Users\user\Desktop, xrefs: 100059D7, 100059DD, 100059E5, 100059F0, 100059FD
12021651, xrefs: 100059A9
ECF4BBEA1588, xrefs: 10005A4B
M174.139.6.42:3204, xrefs: 10005A14
M%s, xrefs: 10005A0F

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %s\%s$%s\version.txt$12021651$12021651$174.139.6.42:3204$C:\Users\user\Desktop$C:\Users\user\Desktop\12021651$C:\Users\user\Desktop\b3sV534MMf.dll$C:\Users\user\Desktop\version.txt$C:\Windows\SysWOW64\rundll32.exe$ECF4BBEA1588$M%s$M174.139.6.42:3204
API String ID: 2111968516-1065473168
Opcode ID: b670a70032b59a39dd4e75addf7983aeef193788df8b5767d71336893f906c59
Instruction ID: 2622bda390c1fc69688ed133630b74a7e87bc192078dfd3625eba7e1b50de2c8
Opcode Fuzzy Hash: b670a70032b59a39dd4e75addf7983aeef193788df8b5767d71336893f906c59
Instruction Fuzzy Hash: 79214876600319BBF210E7959C41F9F3B9CCF852E6F01412AFB04AE185DB72E9858A72

Function 10004DE1 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 230COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10004EC5
VariantInit.OLEAUT32(?), ref: 10004ECB
VariantInit.OLEAUT32(?), ref: 10004ED1
VariantInit.OLEAUT32(?,?,?,WQL,?,?), ref: 10005009
VariantInit.OLEAUT32(?,?,?,WQL,?,?), ref: 1000500F

Strings

p=<u, xrefs: 10004E9C
svchost.exe, xrefs: 10004F6F
SELECT * FROM , xrefs: 10004DEA
ProcessID, xrefs: 10004F0C
WQL, xrefs: 10004E42
CommandLine, xrefs: 10004EF7
svchost.exe -k NetworkService, xrefs: 10004FE0
Name, xrefs: 10004EE2

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: CommandLine$Name$ProcessID$SELECT * FROM $WQL$p=<u$svchost.exe$svchost.exe -k NetworkService
API String ID: 1927566239-3501905436
Opcode ID: 0da7957a48b5a39ea88ddb39b7bee5f93250a08a3b71e554fd3c967710fc5538
Instruction ID: f90636b10a7337c2a5a872a63f2ead223ed2d5a9c72937338c4d651b313ba435
Opcode Fuzzy Hash: 0da7957a48b5a39ea88ddb39b7bee5f93250a08a3b71e554fd3c967710fc5538
Instruction Fuzzy Hash: 2F8129B2900249AFEF04CFE4C8849EEBBB9FF49350F114569F516AB294DB31AE45CB50

Function 1000570F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 103filethreadCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1000574F
wsprintfA.USER32 ref: 100057B1
wsprintfA.USER32 ref: 100057C5
PrintFile.B3SV534MMF(?,?,?,?,00000000,?,?,?,?,?,?,?,10016AD0,00000000,00080000), ref: 100057E8
CreateThread.KERNEL32(00000000,00000000,10005620,00000000,00000000), ref: 10005835

Strings

%s\%s, xrefs: 10005749
c:\windows\system32\drivers\%s\%s, xrefs: 100057BF
Win32_process, xrefs: 100057ED
ROOT\CIMv2, xrefs: 100057F2
c:\windows\system32\drivers\%s, xrefs: 100057AB

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$CreateFilePrintThread
String ID: %s\%s$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s
API String ID: 1788855648-1421401311
Opcode ID: a213fb8c8922784ab3c06b997f3ea2f857694b863c8a4d83c7139e0280cac0f2
Instruction ID: 28a3424c43d880dab5bccd7007b6d6d5217b25d19112805f30e3ba200c1ee7d2
Opcode Fuzzy Hash: a213fb8c8922784ab3c06b997f3ea2f857694b863c8a4d83c7139e0280cac0f2
Instruction Fuzzy Hash: 9D31BB72910238BBEB21D7A4CC45FCF7B6CEB08356F0404A6F708FA051DB75AAC58A91

Function 10004351 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 78COMMON

Download Yara Rule

Strings

QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LmV4ZQ==, xrefs: 100043CB
cmd.exe, xrefs: 1000435C, 10004362, 10004370
%s.%d, xrefs: 1000441B
QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LnZpcg==, xrefs: 100043BF
self, xrefs: 1000437E

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %s.%d$QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LmV4ZQ==$QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LnZpcg==$cmd.exe$self
API String ID: 0-3916765701
Opcode ID: a4d6dded159f046c25e693c99690a910910f1a199705c8da070720c34925021f
Instruction ID: fe88ff4f4a2ba1e8cf0b189abc1debd098fa27393324e90b19e2d405f5e50096
Opcode Fuzzy Hash: a4d6dded159f046c25e693c99690a910910f1a199705c8da070720c34925021f
Instruction Fuzzy Hash: DE11E2BA0002187AFB21EB74AC46FDF3A5CDF507A1F210161FA4468086CEB6EAC04568

Function 10004391 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 61sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 100043A6
Sleep.KERNEL32(000003E8), ref: 100043E5
wsprintfA.USER32 ref: 10004421

Strings

QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LmV4ZQ==, xrefs: 100043A8, 100043AD, 100043CB
%s.%d, xrefs: 1000441B
QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LnZpcg==, xrefs: 100043BF

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$wsprintf
String ID: %s.%d$QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LmV4ZQ==$QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LnZpcg==
API String ID: 3195947292-2191795975
Opcode ID: 6e03216eeb2a8fb36a3462989fe8955f81af108459bf6b6e60ff2a3b6874ac74
Instruction ID: a8aa3844fab9e21a99a7d3e1679ae8e0c29cd9a59e52682f97805e2f5805e0d3
Opcode Fuzzy Hash: 6e03216eeb2a8fb36a3462989fe8955f81af108459bf6b6e60ff2a3b6874ac74
Instruction Fuzzy Hash: 9001C4B65002587BEF12AB70DC86FDE3B5DEF44394F104451F644A9092CEB5EDC04A64

Function 10005C4C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F72: PathFileExistsA.SHLWAPI(00080000,10005C92,?,?,%s\lang.ini,C:\Users\user\Desktop,?,00000000,00080000), ref: 10003F76

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005CB6

Strings

http://, xrefs: 10005CDC
C:\Users\user\Desktop, xrefs: 10005C6B
%s\lang.ini, xrefs: 10005C7B

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Timer$Concurrency::details::platform::__CreateExistsFilePathQueue
String ID: %s\lang.ini$C:\Users\user\Desktop$http://
API String ID: 1721638100-2510504628
Opcode ID: 628b499e9a68a97e2ed47c29d2a86c48c529a9e8e13b1be541f5ff1dba026eb1
Instruction ID: 275623b6bb4d38d455d16e038d1f67d5d5eba5b08857937f3fa6caa2442e2442
Opcode Fuzzy Hash: 628b499e9a68a97e2ed47c29d2a86c48c529a9e8e13b1be541f5ff1dba026eb1
Instruction Fuzzy Hash: 131104769041197EFB21DAA4CC42FDB776CDB14384F0085B1FA48B6080EA71AF884660

Function 10004630 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100046C3

Strings

\*.*, xrefs: 10004668
%s\%s, xrefs: 100046BD
., xrefs: 100046E4

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %s\%s$.$\*.*
API String ID: 2111968516-2210278135
Opcode ID: b25ff04f038f720622f88d5534156cbd27d2e1f8617f74dc2531a989b65ec00c
Instruction ID: 683538f7eec48923da7b8d13486b14582c2964fd5ec070a7e611c26c670eb571
Opcode Fuzzy Hash: b25ff04f038f720622f88d5534156cbd27d2e1f8617f74dc2531a989b65ec00c
Instruction Fuzzy Hash: 655191B680425CBBEF11DFA4CC46EDE7B7DEF05380F0144A5FA08A6055DB70AB849B65

Function 100087F4 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 32sleepCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10008824
Sleep.KERNEL32(000007D0,?,?), ref: 10008845

Strings

C:\Users\user\Desktop, xrefs: 1000880B
Y21kLmV4ZSAvYyBwaW5nIDEyNy4wLjAuMSAtbiAzJnJkIC9zIC9xICIlcyI=, xrefs: 10008810

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: C:\Users\user\Desktop$Y21kLmV4ZSAvYyBwaW5nIDEyNy4wLjAuMSAtbiAzJnJkIC9zIC9xICIlcyI=
API String ID: 1749205058-3359968284
Opcode ID: 66a9ce85892f9329b91f459de07680a1dd55e73f2aaeff98105d7350e625594f
Instruction ID: 965344b6c88be0343068e8971810c2bf4f2ae0e85ab05c2aaa4b824111ab2e12
Opcode Fuzzy Hash: 66a9ce85892f9329b91f459de07680a1dd55e73f2aaeff98105d7350e625594f
Instruction Fuzzy Hash: 4BF0AEB2500199ABEB11CB64DC85BEB376CFF08284F040875F715F5051DBB09EC48A55

Function 10007A62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10007AA1

Strings

p=<u, xrefs: 10007AA1
, xrefs: 10007B0D

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: $p=<u
API String ID: 1927566239-2520713026
Opcode ID: 390db24222ace8c8f4c7a0dd0452aa1db35f677c827bbe28e411cf0bddaf2bf3
Instruction ID: 0318de303bb8448969fbaf99b11e2c77d0245d43348cbae189f38b54ec35a164
Opcode Fuzzy Hash: 390db24222ace8c8f4c7a0dd0452aa1db35f677c827bbe28e411cf0bddaf2bf3
Instruction Fuzzy Hash: 19419375D002599FEF04DFA4C985AEEB7F8FF09284F10446DE91AA3245DB38AE04CB61

Function 10005D43 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005D61

Part of subcall function 10004015: CreateFileA.KERNEL32(00000080,00000003,00000000,00000000,80000000,?,10005CBB,?,10005CBB,?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 1000402D

Part of subcall function 10004035: ReadFile.KERNEL32(?,?,?,00000000,10005CD6,?,10005CD6,00000000,?,?,?,00000000), ref: 10004047

Part of subcall function 10003F92: CloseHandle.KERNEL32(?,1000597F,75BF8400,75BF8400,00000000,C:\Users\user\Desktop,0000005C,C:\Users\user\Desktop,C:\Users\user\Desktop\b3sV534MMf.dll), ref: 10003F96

Part of subcall function 10003F7D: StrStrIA.SHLWAPI(?,?,10005CE9,?,http://,00000000,00000000,?,?,?,00000000), ref: 10003F85

Strings

http://, xrefs: 10005D87
search, xrefs: 10005D9B

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateFileTimer$CloseConcurrency::details::platform::__HandleQueueRead
String ID: http://$search
API String ID: 2951256540-4044578368
Opcode ID: 9e6e4ca6741ed5e007112af3b910463a043c3e26c2793888b7e088ada7bab67f
Instruction ID: 9f63b41622fab1ff82f924877dfa164aae2497f5c9a9996aa7f2a54ef5475ee4
Opcode Fuzzy Hash: 9e6e4ca6741ed5e007112af3b910463a043c3e26c2793888b7e088ada7bab67f
Instruction Fuzzy Hash: 75F0C276904019BAFB21DAA4CC41FEF376CDB002D5F108162FA18A90D5EA329E9146A0

Function 10005F98 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005FD4

Part of subcall function 10004015: CreateFileA.KERNEL32(00000080,00000003,00000000,00000000,80000000,?,10005CBB,?,10005CBB,?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 1000402D

Strings

C:\Users\user\Desktop, xrefs: 10005FA3
%s\lang.ini, xrefs: 10005FAE

Memory Dump Source

Source File: 00000003.00000002.3485228797.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3485198869.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485265903.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485302140.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485346150.000000001001B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485394896.000000001003A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3485433446.000000001004B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateTimer$Concurrency::details::platform::__FileQueue
String ID: %s\lang.ini$C:\Users\user\Desktop
API String ID: 3486561800-1738621931
Opcode ID: 91917efd60eee5a4c7f72a7cce19e0cd623d68f546c36473dca52c4ca7f31dab
Instruction ID: dfcc7b63688ca43a2c74d680eb54bb4daf041f1c606f04c7c9245eb5a67af0f6
Opcode Fuzzy Hash: 91917efd60eee5a4c7f72a7cce19e0cd623d68f546c36473dca52c4ca7f31dab
Instruction Fuzzy Hash: A3F046768001187AF620D665CC07FEF3E6CDB857E0F104121FA08E90C4EB75AAC196E0

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report b3sV534MMf.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\1.txt

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_d72391a1-0057-4f8a-aec9-13bcc5ddd162\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_fa7a985e-ae7d-4121-8b55-6115f8b96465\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER61B8.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6718.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6758.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FE1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER708E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70CE.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
b3sV534MMf.dll

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre