Edit tour

Windows Analysis Report
08e2VwqyI0.dll

Overview

General Information

Sample name:	08e2VwqyI0.dll renamed because original name is a hash value
Original sample name:	dba9c2268b1ee590b4b3b456642c6c7aa6993b9d.dll
Analysis ID:	1558497
MD5:	129a4a5be1e9cff7a54ebf6b80793986
SHA1:	dba9c2268b1ee590b4b3b456642c6c7aa6993b9d
SHA256:	a80d66f921a6f59756560ae3c3afd26fdd43e26f30ecabdd729c80301a8d08ce
Tags:	dlluser-NDA0E
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Creates an autostart registry key pointing to binary in C:\Windows

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for sample

PE file has a writeable .text section

Queries disk data (e.g. SMART data)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 1996 cmdline: loaddll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5540 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 3580 cmdline: rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1160 cmdline: rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,DoAddToFavDlg MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 6720 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 344 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 1308 cmdline: rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,InputFile MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1976 cmdline: rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,PrintFile MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 5784 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 672 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 5280 cmdline: rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 2100 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4648 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 3404 cmdline: rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",InputFile MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4032 cmdline: rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",PrintFile MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6676 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 668 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 3396 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 5736 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4580 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 2300 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 1160 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2848 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 3580, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dtfd

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 08e2VwqyI0.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: 08e2VwqyI0.dll

ReversingLabs: Detection: 97%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: 08e2VwqyI0.dll

Joe Sandbox ML: detected

Source: 08e2VwqyI0.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source:	Binary string: \??\c:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.^nq source: rundll32.exe, 00000004.00000003.2009300275.000000000348A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2011769719.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.M source: rundll32.exe, 00000004.00000003.3728220117.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3727847838.0000000003471000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10007F3E FindFirstFileA,FindNextFileA,Sleep,FindClose,

4_2_10007F3E

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.56.110 18530	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.160.131.253 18659	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.160.131.254 23588	Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 107.163.56.110 ports 18530,0,1,3,5,8
Source: global traffic	TCP traffic: 107.160.131.253 ports 1,5,6,8,9,18659

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: global traffic	TCP traffic: 192.168.2.8:49707 -> 107.163.56.110:18530
Source: global traffic	TCP traffic: 192.168.2.8:49706 -> 107.160.131.253:18659
Source: global traffic	TCP traffic: 192.168.2.8:49740 -> 107.160.131.254:23588

Source: Joe Sandbox View	IP Address: 202.108.0.52 202.108.0.52
Source: Joe Sandbox View	IP Address: 107.163.56.110 107.163.56.110

Source: Joe Sandbox View	ASN Name: TAKE2US TAKE2US
Source: Joe Sandbox View	ASN Name: AS40676US AS40676US
Source: Joe Sandbox View	ASN Name: AS40676US AS40676US

Source: global traffic

TCP traffic: 192.168.2.8:49772 -> 202.108.0.52:80

Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.253
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.56.110
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254
Source: unknown	TCP traffic detected without corresponding DNS query: 107.160.131.254

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10003F41 InternetReadFile,

4_2_10003F41

Source: global traffic	DNS traffic detected: DNS query: host123.zz.am
Source: global traffic	DNS traffic detected: DNS query: blog.sina.com.cn

Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.253/
Source: rundll32.exe, rundll32.exe, 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://107.160.131.253:18659/
Source: rundll32.exe, 00000004.00000002.3874761658.0000000003418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.253:18659//joy.asp?sid=rungnejcndvgnJLdFe5vteX8v2LUicbtudb8mtiWmtaWndm
Source: rundll32.exe, rundll32.exe, 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.php
Source: rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3874761658.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.php$
Source: rundll32.exe, 00000004.00000002.3874761658.0000000003471000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.php(s
Source: rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3874761658.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.php-
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.php.
Source: rundll32.exe, 00000004.00000003.3728220117.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3727847838.0000000003471000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpA
Source: rundll32.exe, 00000004.00000002.3891213656.000000000618A000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3891092502.0000000005F6D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpC:
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpI
Source: rundll32.exe, 00000004.00000003.1930719433.000000000348A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpNetHood
Source: rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3874761658.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3728220117.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3727847838.0000000003471000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpV
Source: rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpn
Source: rundll32.exe, 00000004.00000002.3874761658.0000000003418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpnv
Source: rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpplication
Source: rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phptings
Source: rundll32.exe, 00000004.00000002.3874761658.000000000341D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.160.131.254:23588/article.phpttings
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.56.110:18530/u1129.html
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.56.110:18530/u1129.htmlP
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.56.110:18530/u1129.htmlS
Source: rundll32.exe, 00000004.00000002.3879276594.0000000004E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s
Source: rundll32.exe, 00000004.00000002.3879276594.0000000004E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s1
Source: rundll32.exe, 00000004.00000002.3879276594.0000000004E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s6
Source: rundll32.exe, 00000004.00000002.3879276594.0000000004E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%sc
Source: rundll32.exe, 00000004.00000002.3891297476.00000000063AD000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2883816734.000000000348A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093/w
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093M
Source: rundll32.exe, 00000004.00000003.2883816734.000000000348A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093ktop
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093z
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093z.
Source: rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5762479093~
Source: Amcache.hve.14.dr	String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, rundll32.exe, 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.rsac.org/ratingsv01.html

System Summary

PE file has a writeable .text section

Source: 08e2VwqyI0.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10008AAD: DeviceIoControl,

4_2_10008AAD

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10003F63 ExitWindowsEx,	4_2_10003F63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10003F63 ExitWindowsEx,	11_2_10003F63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_10003F63 ExitWindowsEx,	19_2_10003F63

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_024500CD	0_2_024500CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_026B00CD	3_2_026B00CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000B224	4_2_1000B224
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000B70D	4_2_1000B70D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100121ED	4_2_100121ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000AEC0	4_2_1000AEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_033900CD	4_2_033900CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_047100CD	10_2_047100CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000B224	11_2_1000B224
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000B70D	11_2_1000B70D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100121ED	11_2_100121ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000AEC0	11_2_1000AEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_030600CD	17_2_030600CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 18_2_049C00CD	18_2_049C00CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_1000B224	19_2_1000B224
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_1000B70D	19_2_1000B70D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_100121ED	19_2_100121ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_1000AEC0	19_2_1000AEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_049400CD	19_2_049400CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 26_2_02D900CD	26_2_02D900CD

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10001000 appears 909 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10009125 appears 39 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1000CD90 appears 48 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 672

Source: 08e2VwqyI0.dll

Binary or memory string: OriginalFilenamejscript.dllL vs 08e2VwqyI0.dll

Source: 08e2VwqyI0.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: 08e2VwqyI0.dll

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: 08e2VwqyI0.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winDLL@42/10@58/5

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000404F AdjustTokenPrivileges,	4_2_1000404F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000404F AdjustTokenPrivileges,	11_2_1000404F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_1000404F AdjustTokenPrivileges,	19_2_1000404F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10003FB7 CreateToolhelp32Snapshot,

4_2_10003FB7

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\Desktop\12010043

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\host123.zz.am:6658
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4032
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mhost123.zz.am:6658
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\0x5d65r455f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:740:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1976
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1992:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\46dfa831-5c81-415f-9cd2-319463f8abbb

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,DoAddToFavDlg

Source: 08e2VwqyI0.dll

ReversingLabs: Detection: 97%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,DoAddToFavDlg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,InputFile
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,PrintFile
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 672
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",InputFile
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",PrintFile
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 668
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,DoAddToFavDlg	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,InputFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,PrintFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",InputFile	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",PrintFile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: \??\c:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.^nq source: rundll32.exe, 00000004.00000003.2009300275.000000000348A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2011769719.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.M source: rundll32.exe, 00000004.00000003.3728220117.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3727847838.0000000003471000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_02450E9F LoadLibraryA,GetProcAddress,

0_2_02450E9F

Source: initial sample

Static PE information: section where entry point is pointing to: .rsrc

Source: 08e2VwqyI0.dll

Static PE information: real checksum: 0x31f33 should be: 0x2ef6e

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1003900A push dword ptr [esp+4Ch]; retn 0050h	4_2_1003901C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10027023 push dword ptr [esp+18h]; retn 001Ch	4_2_1002A254
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002F024 push dword ptr [esp+14h]; retn 0018h	4_2_1002F036
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10029029 push dword ptr [esp+38h]; retn 003Ch	4_2_10027C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10029029 pushad ; mov dword ptr [esp], 73E57D1Ah	4_2_10029046
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1003B02D push dword ptr [esp+50h]; retn 0054h	4_2_1003B061
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002F039 push esp; mov dword ptr [esp], B1CF2C6Dh	4_2_1002F051
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002F039 push dword ptr [esp+50h]; retn 0054h	4_2_1002F068
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10035048 push dword ptr [esp+50h]; retn 0054h	4_2_100351D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10033059 push dword ptr [esp+50h]; retn 0054h	4_2_1003307F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10033064 push dword ptr [esp+50h]; retn 0054h	4_2_1003307F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002D06D push dword ptr [esp+38h]; retn 003Ch	4_2_1002D08D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10031079 push dword ptr [esp+30h]; retn 0034h	4_2_10031095
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10027080 push ebp; mov dword ptr [esp], edx	4_2_1002FD0B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10027080 push dword ptr [esp+04h]; retn 0008h	4_2_1002FD4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10023085 push dword ptr [esp+38h]; retn 003Ch	4_2_10023093
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10023096 push dword ptr [esp+50h]; retn 0054h	4_2_100230B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100330A5 push dword ptr [esp+2Ch]; retn 0030h	4_2_1002B78C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100330A5 push dword ptr [esp+04h]; retn 0008h	4_2_1003B2DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100230B6 push dword ptr [esp+34h]; retn 0038h	4_2_1002F874
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100270BA push dword ptr [esp+34h]; retn 0038h	4_2_1002AD33
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100250BC push dword ptr [esp+44h]; retn 0048h	4_2_1003408E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002F0D4 push dword ptr [esp+0Ch]; retn 0014h	4_2_1002F0EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100270D4 push dword ptr [esp+0Ch]; retn 0010h	4_2_100282E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100270D4 push dword ptr [esp+0Ch]; retn 0010h	4_2_100338DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100350D9 push dword ptr [esp+50h]; retn 0054h	4_2_10035102
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100250D9 push dword ptr [esp+14h]; retn 0018h	4_2_100250F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002B0E4 push dword ptr [esp+48h]; retn 004Ch	4_2_1002B0FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002D0EF push dword ptr [esp+10h]; retn 0014h	4_2_1002D116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002B0EF push dword ptr [esp+48h]; retn 004Ch	4_2_1002B0FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10039107 push dword ptr [esp+4Ch]; retn 0050h	4_2_10039116

Source: 08e2VwqyI0.dll

Static PE information: section name: .text entropy: 7.997797944306588

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dtfd

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dtfd			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dtfd			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_4-17729

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1001E1FE rdtsc

4_2_1001E1FE

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 5278

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 5.6 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 1612	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1036	Thread sleep count: 277 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1036	Thread sleep time: -498600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3532	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3532	Thread sleep time: -560000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3508	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 4424	Thread sleep time: -1620000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3344	Thread sleep time: -4200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3832	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3360	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5668	Thread sleep time: -2100000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6840	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1036	Thread sleep count: 5278 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1036	Thread sleep time: -9500400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3508	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10007F3E FindFirstFileA,FindNextFileA,Sleep,FindClose,

4_2_10007F3E

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: rundll32.exe, 00000004.00000002.3874395414.0000000002ECB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: s\Applications\\VMwareHo
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: rundll32.exe, 00000004.00000002.3874761658.000000000341D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: rundll32.exe, 00000004.00000003.1714557553.0000000002F47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y\Machine\Software\Classes\Applications\\VMwareHostOpen.exes\Applications\\VMwareHostOpen.exeion\\Run\User Shell Foldersockdown_Zones\4
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: rundll32.exe, 00000004.00000002.3879276594.0000000004E67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Applications\\VMwareHostOpen.exe
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\loaddll32.exe	API call chain: ExitProcess graph end node	graph_0-384
Source: C:\Windows\System32\loaddll32.exe	API call chain: ExitProcess graph end node	graph_0-395
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-404
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-393
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_4-17642
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_4-17631
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_10-395
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_10-384
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_17-401
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_17-390
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_18-392
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_18-381
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_19-17332
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_19-17321
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_26-392
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_26-381

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1001E1FE rdtsc

4_2_1001E1FE

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 11_2_1000CCF2 LdrInitializeThunk,

11_2_1000CCF2

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_02450E9F LoadLibraryA,GetProcAddress,

0_2_02450E9F

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.56.110 18530	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.160.131.253 18659	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.160.131.254 23588	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Queries disk data (e.g. SMART data)

Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Obfuscated Files or Information	LSASS Memory	111 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	111 Process Injection	2 Software Packing	Security Account Manager	31 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
08e2VwqyI0.dll	97%	ReversingLabs	Win32.Backdoor.Zegost
08e2VwqyI0.dll	100%	Avira	TR/ATRAPS.Gen
08e2VwqyI0.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://107.160.131.254:23588/article.php	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpttings	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phptings	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpplication	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpI	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpn	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.php.	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpC:	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpA	0%	Avira URL Cloud	safe
http://107.163.56.110:18530/u1129.html	0%	Avira URL Cloud	safe
http://107.163.56.110:18530/u1129.htmlS	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.php-	0%	Avira URL Cloud	safe
http://107.163.56.110:18530/u1129.htmlP	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpNetHood	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.php$	0%	Avira URL Cloud	safe
http://www.rsac.org/ratingsv01.html	0%	Avira URL Cloud	safe
http://107.160.131.253/	0%	Avira URL Cloud	safe
http://107.160.131.253:18659/	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpV	0%	Avira URL Cloud	safe
http://107.160.131.253:18659//joy.asp?sid=rungnejcndvgnJLdFe5vteX8v2LUicbtudb8mtiWmtaWndm	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.php(s	0%	Avira URL Cloud	safe
http://107.160.131.254:23588/article.phpnv	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
blogx.sina.com.cn	202.108.0.52	true	false	high
host123.zz.am	unknown	unknown	false	high
blog.sina.com.cn	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://107.160.131.254:23588/article.php	rundll32.exe, rundll32.exe, 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%s6	rundll32.exe, 00000004.00000002.3879276594.0000000004E67000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.131.254:23588/article.phpI	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpttings	rundll32.exe, 00000004.00000002.3874761658.000000000341D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpplication	rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpC:	rundll32.exe, 00000004.00000002.3891213656.000000000618A000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3891092502.0000000005F6D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phptings	rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.56.110:18530/u1129.html	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpA	rundll32.exe, 00000004.00000003.3728220117.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3727847838.0000000003471000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.14.dr	false		high
http://blog.sina.com.cn/u/%s	rundll32.exe, 00000004.00000002.3879276594.0000000004E67000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5762479093	rundll32.exe, 00000004.00000002.3891297476.00000000063AD000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2883816734.000000000348A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.131.254:23588/article.php.	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpn	rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.56.110:18530/u1129.htmlP	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.56.110:18530/u1129.htmlS	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5762479093M	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.131.254:23588/article.php-	rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3874761658.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpNetHood	rundll32.exe, 00000004.00000003.1930719433.000000000348A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%sc	rundll32.exe, 00000004.00000002.3879276594.0000000004E67000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.rsac.org/ratingsv01.html	rundll32.exe, rundll32.exe, 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.253:18659/	rundll32.exe, rundll32.exe, 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.php$	rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3874761658.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5762479093~	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5762479093/w	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5762479093z	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.131.253:18659//joy.asp?sid=rungnejcndvgnJLdFe5vteX8v2LUicbtudb8mtiWmtaWndm	rundll32.exe, 00000004.00000002.3874761658.0000000003418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5762479093ktop	rundll32.exe, 00000004.00000003.2883816734.000000000348A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5762479093z.	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.160.131.254:23588/article.phpV	rundll32.exe, 00000004.00000003.1930955275.0000000003479000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3874761658.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3728220117.0000000003471000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2884108357.0000000003478000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3727847838.0000000003471000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.253/	rundll32.exe, 00000004.00000002.3874761658.00000000033AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.php(s	rundll32.exe, 00000004.00000002.3874761658.0000000003471000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.160.131.254:23588/article.phpnv	rundll32.exe, 00000004.00000002.3874761658.0000000003418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%s1	rundll32.exe, 00000004.00000002.3879276594.0000000004E67000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
202.108.0.52	blogx.sina.com.cn	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
107.163.56.110	unknown	United States	20248	TAKE2US	true
107.160.131.253	unknown	United States	40676	AS40676US	true
107.160.131.254	unknown	United States	40676	AS40676US	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558497
Start date and time:	2024-11-19 14:23:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	08e2VwqyI0.dll renamed because original name is a hash value
Original Sample Name:	dba9c2268b1ee590b4b3b456642c6c7aa6993b9d.dll
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winDLL@42/10@58/5
EGA Information:	Successful, ratio: 88.9%
HCA Information:	Successful, ratio: 95% Number of executed functions: 77 Number of non-executed functions: 56
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.172, 20.42.73.29
Excluded domains from analysis (whitelisted): onedsblobprdeus07.eastus.cloudapp.azure.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 1976 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 08e2VwqyI0.dll

Simulations

Behavior and APIs

Time	Type	Description
08:24:38	API Interceptor	1004897x Sleep call for process: rundll32.exe modified
08:24:45	API Interceptor	1x Sleep call for process: loaddll32.exe modified
08:27:24	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
202.108.0.52	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
107.163.56.110	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse
	81mieek02V.dll	Get hash	malicious	Unknown	Browse
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse
	02hNixBIvP.exe	Get hash	malicious	Unknown	Browse
	abc.dll	Get hash	malicious	Unknown	Browse
107.160.131.253	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse
	81mieek02V.dll	Get hash	malicious	Unknown	Browse
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse
107.160.131.254	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse
	81mieek02V.dll	Get hash	malicious	Unknown	Browse
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
blogx.sina.com.cn	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	202.108.0.52

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS40676US	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	107.160.131.252
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	107.160.131.254
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	107.160.131.254
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	107.160.131.254
	Malwarebytes Premium v4.6.8.311.exe	Get hash	malicious	Unknown	Browse	41.216.183.30
	Fdoze89ykv.js	Get hash	malicious	Mint Stealer	Browse	45.61.137.33
	QKS3UTHFX9.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	5z3Wzl6uag.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	e8HOp8k5Kj.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	Fdoze89ykv.js	Get hash	malicious	Mint Stealer	Browse	45.61.137.33
AS40676US	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	107.160.131.252
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	107.160.131.254
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	107.160.131.254
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	107.160.131.254
	Malwarebytes Premium v4.6.8.311.exe	Get hash	malicious	Unknown	Browse	41.216.183.30
	Fdoze89ykv.js	Get hash	malicious	Mint Stealer	Browse	45.61.137.33
	QKS3UTHFX9.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	5z3Wzl6uag.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	e8HOp8k5Kj.js	Get hash	malicious	Unknown	Browse	45.61.137.33
	Fdoze89ykv.js	Get hash	malicious	Mint Stealer	Browse	45.61.137.33
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
TAKE2US	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	107.163.43.161
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	46PhJ3XpBT.dll	Get hash	malicious	Unknown	Browse	107.163.43.236
	01JkTmNJhe.dll	Get hash	malicious	Unknown	Browse	107.163.43.235

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	721
Entropy (8bit):	4.519220738257457
Encrypted:	false
SSDEEP:	12:8GGdzrn7oce9UcdY7xjIaGwwwwwwwwwwwwwwwwwwwwP:8G4n7o39U0YVje
MD5:	1A2142B706CA0E422BE413C718EF7308
SHA1:	655BF7399BB4BD75695AC5D5BEAB6963DC6ECAF3
SHA-256:	A7A39269A451A173BA8509B63AAFF9D2419FDDB7DF981FAB27DA0F2855CEAC84
SHA-512:	C895FA7C8857079EDD5A75CC8810DF08DBB091408E48E96AAFC48E84CD955F71401B9F54B3D2FAF29C862DA3E82F07E450DECF42A19E379D8CAA23C0631EA16A
Malicious:	false
Preview:	..2024-11-21 13:12..iOffset....2024-11-23 04:03..iOffset....2024-11-24 21:14..iOffset....2024-11-26 15:36..iOffset....2024-11-27 13:24..iOffset....2024-11-28 15:53..iOffset....2024-12-01 06:33..iOffset....2024-12-04 22:39..iOffset....2024-12-07 10:34..iOffset....2024-12-14 07:26..iOffset....2024-12-18 15:24..iOffset....2024-12-23 15:15..iOffset....2029-07-11 02:48..iOffset....2036-11-26 10:30..iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset........iOffset..

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_43694ddf-2812-4925-b8af-347e7aeab431\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.950696993679653
Encrypted:	false
SSDEEP:	192:yQJijOE30BU/wjeT7WaZYzuiFUZ24IO8dci:TJiqEEBU/wjevbYzuiFUY4IO8dci
MD5:	26E7BC64706BE716A2352C1183C34F48
SHA1:	BF2D620B1F7A9314E30A51E2A31BE65EB00A9B0D
SHA-256:	D6774B23692B023AB2F404283C8DDBED6322484A9C3B9836EFB2891CDD4EA4E2
SHA-512:	468A4EA4796C06D6E6DA750E683D6D49520929DCCC06D181780414F1BE1D29DF921A88005F86EBE2BFFDA01AEF0603A983A9719DC289052D7364B8194FCCA867
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.4.9.6.2.8.6.0.8.6.1.5.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.4.9.6.2.8.6.8.5.1.7.7.6.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.9.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.3.6.9.4.d.d.f.-.2.8.1.2.-.4.9.2.5.-.b.8.a.f.-.3.4.7.e.7.a.e.a.b.4.3.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.8.7.f.a.f.3.a.-.8.c.0.7.-.4.7.1.a.-.b.7.1.7.-.a.9.c.e.5.5.d.c.1.a.a.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.c.0.-.0.0.0.1.-.0.0.1.4.-.b.7.e.3.-.6.3.6.6.8.6.3.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_a5abc924-2452-4abb-81bb-5fc932c8c5b9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.95056249331519
Encrypted:	false
SSDEEP:	192:KHA3iZOB30BU/wjeTbWaZYzuiFUZ24IO8dci:CA3iwBEBU/wjePbYzuiFUY4IO8dci
MD5:	A10B880963DCCE0D113EE9CF80E61AAD
SHA1:	9864B6C9C4F9292F397CD34F1D96B5F0E093689F
SHA-256:	E7D150DEA7847B95978F5597CEBAEC5543847F0D9D67B8E165CD3431D913A49E
SHA-512:	5ABFA95DB8D874D178A4E9A58DFFFB0C06E43A08B332832A6233B815F8A13AD2D11A96A65FD1464E4F83F4019710EDA73F6E351FBFFAB691173F3C0E15EBE444
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.4.9.6.2.8.3.0.0.9.3.8.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.4.9.6.2.8.3.9.1.5.6.3.9.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.9.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.5.a.b.c.9.2.4.-.2.4.5.2.-.4.a.b.b.-.8.1.b.b.-.5.f.c.9.3.2.c.8.c.5.b.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.3.1.e.a.e.f.3.-.2.7.5.f.-.4.e.c.8.-.8.f.d.7.-.7.9.9.8.d.e.6.b.6.2.8.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.b.8.-.0.0.0.1.-.0.0.1.4.-.d.f.d.d.-.8.d.6.4.8.6.3.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA782.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Nov 19 13:24:43 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	45268
Entropy (8bit):	2.02092739146417
Encrypted:	false
SSDEEP:	192:DW/EkZHVXpXvUO5H4ysmv1qd/Ar/4+BTdh1Ky:i/bZHf5HTs4cd/Az4+Bo
MD5:	424149B97758D42A94955AD99241655B
SHA1:	CAD007CA26DCB111296BFDAA7351297C1A0C8C8E
SHA-256:	16D4F48C5A0F75C90D3921FD6B3724C6601FFE4C81633EF2B69847439C300F97
SHA-512:	55725C8B040781F45A368DB5F2CEE916A1B03F347924CCA940E95C0F4FBB19303DBF6F64C9D45E3F2B591433AD33716A3B3212C43ACD1BD92DFF28941CD38CAF
Malicious:	false
Preview:	MDMP..a..... .........<g........................................V/..........T.......8...........T...........................L...........8...............................................................................eJ..............GenuineIntel............T.............<g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA85E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8272
Entropy (8bit):	3.6952229836293027
Encrypted:	false
SSDEEP:	192:R6l7wVeJcC626YdE6RgmfTZaYprw89btnsf0GPm:R6lXJB626YO6RgmfTZaQtsfC
MD5:	879A11CAF691ECDDB382FE396C073BF7
SHA1:	1541960D059A3A92F99858715F56015346649080
SHA-256:	BE18C4E2335D1E5932298AD2E132965AB7F581C97EC0FD0D8055DC83358533C0
SHA-512:	87C5E0901CA84F11F9C40CE1E6780C765DA7DC2979F21E25FB5EB822509EB10A488B48133AAC8BDB0BA122C13EC65AA715EDB7C7B81CB9D358F423FD39798044
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.9.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA88E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.461892195265477
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9QzWpW8VYoFoYm8M4JCdPSFW+q8/AxGScSpd:uIjfAI76C7VhFFJupJ3pd
MD5:	308064529445FB5EBE61928086FE9A07
SHA1:	0AFF5318E6D0934F184B81272C653814EB450A32
SHA-256:	22A2AE01AAA0DE08893C3AA84CEF06351CDA97A89C5A28E280C1C4AE31DFAC39
SHA-512:	D8494E209F011E9384B1578A18E843F82236B120795C398C9E43C6C5FA04420BCCC1834D2A50E2B5884C339E6E298B830D19EBFFD21FEF5FEA11209FC65EBC71
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="594987" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB389.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Nov 19 13:24:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	45966
Entropy (8bit):	1.9951415072130652
Encrypted:	false
SSDEEP:	192:WYLWZHVXpX1cO5H4iheT/YI5a9O/3mihgYZYE:XqZH15HDheT/YDZiT
MD5:	CA3FEAEDFD8EF261BC1D2BEC7A3F9476
SHA1:	962088D07A9513B038E500888F7E54BC5C28A5EA
SHA-256:	5EB74BEDB95BAA11A7A1AD48C65F4A1889C150B4B072541EE0902711A974C53F
SHA-512:	67670C28AF5FC898C7B061FC8B942A3ADB75ED79A23E54B345284F5CD215F1CC1FC2F4574DF11925720015BB62BB754A0CD585AC53299452F4AB9033DC6EBCF6
Malicious:	false
Preview:	MDMP..a..... .........<g........................................V/..........T.......8...........T..........................L...........8...............................................................................eJ..............GenuineIntel............T.............<g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB55E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8270
Entropy (8bit):	3.6906602209919854
Encrypted:	false
SSDEEP:	192:R6l7wVeJYjR6r76YVQV6SgmfTZaYprO89bAJsfCRAm:R6lXJSR6r76YWV6SgmfTZaaAifCD
MD5:	BEF443A886833269E99CE65CC29364E7
SHA1:	A9E7C89485E18782FC937EAEC858553E39EB22EB
SHA-256:	173FEF31ED2AFBEDB79F1CE2BEADB1732000F4EDFFFC63A22F0064C42D8D2154
SHA-512:	EA2A68CBD84D1F62040A3D7135400CC1C4D24B0514EA4BA86CDAC3A7FE29D4296EEACF54B3D374FF3F657B6059D75711058E1C62BC6349F3498E2BAF7CA2AA06
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB58E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.459899340293469
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9QzWpW8VYbYm8M4JCdPSFWI+q8/ARnGScSxd:uIjfAI76C7V7JeIZnJ3xd
MD5:	A193261BAA3A3DB7A69582B510883A45
SHA1:	EE5095ECB5AF904AB215277C1A45536899159DF1
SHA-256:	8AD42BD44F393249AAC6E7B8CC71A0C688AB251FC4C0C1A9C0104D8E1ED27A9C
SHA-512:	E844381F719155373A8A0DE24E356B740D4AD56627764F04DD3E29FBC56FC6A39355BEE681ED853944708058C7C7A26882218D2B5A348D073E6EBA127743D6ED
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="594987" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.37287043948001
Encrypted:	false
SSDEEP:	6144:OFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNEiL:eV1QyWWI/glMM6kF7Kq
MD5:	D1B051EC99383A0FFE404B622C2A78EF
SHA1:	909FA24353C4C9E66F6EAE63EDFF9625B33F37DB
SHA-256:	864B62E91ABE3D173BDCDE74F889C67D1527158F8EB6443A575FF626BE410A19
SHA-512:	E9A2EB95378586915BCD4D830D1DA3C541332F403CB74B0EC220ED65587876D860982BC0E014115E28914E1393D108F03CBDEE85F947A59DFEAEE08893A3F96D
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...d.:...............................................................................................................................................................................................................................................................................................................................................w.P........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Entropy (8bit):	7.960894639958724
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 90.54% Win32 EXE PECompact compressed (v2.x) (59071/9) 5.34% Win32 EXE PECompact compressed (generic) (41571/9) 3.76% Generic Win/DOS Executable (2004/3) 0.18% DOS Executable Generic (2002/1) 0.18%
File name:	08e2VwqyI0.dll
File size:	175'321 bytes
MD5:	129a4a5be1e9cff7a54ebf6b80793986
SHA1:	dba9c2268b1ee590b4b3b456642c6c7aa6993b9d
SHA256:	a80d66f921a6f59756560ae3c3afd26fdd43e26f30ecabdd729c80301a8d08ce
SHA512:	2d71d88ff8c8854bacbd6689abd54e739c482b5605295bd9ffea1b06078b4e9f1f6f1072bb03b9cf255cd50a8f28da9bd762c3c3ca950d7165932e89940611fd
SSDEEP:	3072:R2Iz9CI8mUOtDDPwLkBLXLDFkKmvzXBpLHYmmO1QezRd7UcPa1xMjM7A:Rjz9X8mXGUXVPmr9mOzRd7UcPKoMk
TLSH:	100412B0F3F98B59F0A716770831597CC97638816329277FC2889A6EAC5442FF18D764
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... B..N...N...N...B...N.F.....N.......N.......N.......N...@...N.m.D...N...O.^.N.m.E...N.=.H...N.m.J...N.Rich..N................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1004fe9b
Entrypoint Section:	.rsrc
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x565C7C9C [Mon Nov 30 16:43:08 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	bb6e4ad1ce3cf53a77a13b1c6fafb901

Entrypoint Preview

Instruction
mov eax, 10050CB4h
push eax
push dword ptr fs:[00000000h]
mov dword ptr fs:[00000000h], esp
xor eax, eax
mov dword ptr [eax], ecx
push eax
inc ebp
inc ebx
outsd
insd
jo 00007F7A3CF38A23h
arpl word ptr [edx+esi+00h], si
add byte ptr [eax], al
or byte ptr [eax+eax], cl
dec eax
loope 00007F7A3CF389C3h
push esi
push edi
push ebx
push ebp
mov ebx, dword ptr [esp+1Ch]
test ebx, ebx
je 00007F79FADBAB71h
push cs
out 60h, al
or eax, 72656B0Bh
outsb
insb
xor esi, dword ptr [edx]
adc al, 44h
push es
mov eax, C08513FFh
cmp byte ptr [edi+0CE8F08Bh], cl
xor eax, dword ptr [esi+6900ECE3h]
jc 00007F7A3CF38A36h
jne 00007F7A3CF38A23h
insb
inc esi
sbb bh, bh
push ebx
add al, 3Eh
mov dword ptr [8BFFC4D0h], eax
call 00007F79E034A537h
xor eax, dword ptr [edi+636F6E15h]
sbb al, 58h
mov esp, dword ptr [esp+edx]
jl 00007F7A3CF38951h
sar ecx, FFFFFFA1h
sbb byte ptr [edx+68h], ch
adc byte ptr [eax-01h], cl
pushad
clc
cmp dword ptr [ecx], 3F33D008h
mov ebx, eax
push eax
push esp
jbe 00007F7A3CF389C6h
push edi
or byte ptr [eax], cl
lea eax, dword ptr [esi+0Fh]
inc edx
aad C9h
stc
mov dh, 0Ch
add eax, FF0C300Dh
adc dword ptr [esi], ecx
push eax
push ebx
call 00007F7A017732E8h
sub byte ptr [edx+58h], bl
je 00007F7A3CF389C5h
int3
adc dword ptr [edx], esi
jne 00007F7A3CF389F5h
dec eax
push eax
add byte ptr [eax+53h], FFFFFFD5h
pop eax
push eax
add byte ptr [edx], cl
push eax

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4fb24	0x68	.rsrc
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4fc14	0x2eb	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4f000	0xb10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x51000	0x18	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4e000	0x28800	616e4770cbaa1701277e430d81cefbf7	False	0.9978238329475309	data	7.997797944306588	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4f000	0x2000	0x1e00	4178e173c28267cb5211773428c4940e	False	0.6875	data	6.368056297656816	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x51000	0x1000	0x200	aa11e7584102ed6962d8c933636a8bad	False	0.0625	data	0.2162069074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x4b000	0x16c	empty	English	United States	0
RT_STRING	0x4b170	0x86	empty	English	United States	0
RT_STRING	0x4b1f8	0x56	empty	English	United States	0
RT_STRING	0x4b250	0x16e	empty	English	United States	0
RT_STRING	0x4b3c0	0x128	empty	English	United States	0
RT_STRING	0x4b4e8	0xd2	empty	English	United States	0
RT_STRING	0x4b5c0	0x6a	empty	English	United States	0
RT_STRING	0x4b630	0xc8	empty	English	United States	0
RT_STRING	0x4b6f8	0x200	empty	English	United States	0
RT_STRING	0x4b8f8	0x23e	empty	English	United States	0
RT_STRING	0x4bb38	0x12e	empty	English	United States	0
RT_STRING	0x4bc68	0xca	empty	English	United States	0
RT_STRING	0x4bd38	0x252	empty	English	United States	0
RT_STRING	0x4bf90	0x28e	empty	English	United States	0
RT_STRING	0x4c220	0xce	empty	English	United States	0
RT_STRING	0x4c2f0	0x15c	empty	English	United States	0
RT_STRING	0x4c450	0x398	empty	English	United States	0
RT_STRING	0x4c7e8	0x2ae	empty	English	United States	0
RT_STRING	0x4ca98	0x42	empty	English	United States	0
RT_STRING	0x4cae0	0x20	empty	English	United States	0
RT_STRING	0x4cb00	0x20	empty	English	United States	0
RT_STRING	0x4cb20	0x20	empty	English	United States	0
RT_STRING	0x4cb40	0x20	empty	English	United States	0
RT_STRING	0x4cb60	0x20	empty	English	United States	0
RT_STRING	0x4cb80	0x20	empty	English	United States	0
RT_STRING	0x4cba0	0x20	empty	English	United States	0
RT_STRING	0x4cbc0	0x20	empty	English	United States	0
RT_STRING	0x4cbe0	0x7a	empty	English	United States	0
RT_STRING	0x4cc60	0x20	empty	English	United States	0
RT_STRING	0x4cc80	0x20	empty	English	United States	0
RT_STRING	0x4cca0	0x13a	empty	English	United States	0
RT_STRING	0x4cde0	0x19a	empty	English	United States	0
RT_STRING	0x4cf80	0x9a	empty	English	United States	0
RT_STRING	0x4d020	0xa8	empty	English	United States	0
RT_STRING	0x4d0c8	0x20	empty	English	United States	0
RT_VERSION	0x4f7f0	0x31c	data	English	United States	0.4296482412060301
RT_HTML	0x4d0e8	0x49	empty	English	United States	0
RT_HTML	0x4d138	0xd	empty	English	United States	0
RT_HTML	0x4d148	0x6be	empty	English	United States	0

Imports

DLL	Import
kernel32.dll	LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree
MFC42.DLL
MSVCRT.dll	_strcmpi
USER32.dll	GetDesktopWindow
ADVAPI32.dll	RegDeleteValueA
WS2_32.dll	htons
SHLWAPI.dll	PathIsDirectoryA
ole32.dll	CoUninitialize
OLEAUT32.dll	SafeArrayGetVartype
MSVCP60.dll	?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
NETAPI32.dll	Netbios

Exports

Name	Ordinal	Address
DoAddToFavDlg	1	0x10008645
InputFile	2	0x1000678b
PrintFile	3	0x1000443d

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:24:40.615721941 CET	49707	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 14:24:40.615811110 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 14:24:41.625773907 CET	49707	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 14:24:41.625785112 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 14:24:43.641510963 CET	49707	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 14:24:43.641535044 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 14:24:47.641448975 CET	49707	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 14:24:47.641721010 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 14:24:55.657119989 CET	49706	18659	192.168.2.8	107.160.131.253
Nov 19, 2024 14:24:55.657161951 CET	49707	18530	192.168.2.8	107.163.56.110
Nov 19, 2024 14:25:05.726532936 CET	49740	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:05.726566076 CET	49741	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:06.735306978 CET	49740	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:06.735321999 CET	49741	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:08.735232115 CET	49741	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:08.735275030 CET	49740	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:08.853775024 CET	49772	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:09.743359089 CET	49781	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:09.848402977 CET	49783	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:09.848583937 CET	49784	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:10.750876904 CET	49781	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:10.860253096 CET	49784	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:10.860351086 CET	49783	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:12.750935078 CET	49781	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:12.860301018 CET	49783	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:12.860312939 CET	49784	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:13.790194035 CET	49813	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:13.897733927 CET	49814	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:13.898276091 CET	49815	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:14.797770023 CET	49813	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:14.907170057 CET	49814	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:14.909013033 CET	49815	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:16.798535109 CET	49813	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:16.907171965 CET	49814	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:16.909497976 CET	49815	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:17.800687075 CET	49850	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:17.913883924 CET	49852	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:17.914828062 CET	49853	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:18.813447952 CET	49850	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:18.925156116 CET	49853	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:18.925334930 CET	49852	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:20.813430071 CET	49850	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:20.938417912 CET	49853	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:20.939026117 CET	49852	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:21.814012051 CET	49882	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:21.928117037 CET	49884	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:21.928790092 CET	49885	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:22.829083920 CET	49882	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:22.922780037 CET	49884	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:22.922832012 CET	49885	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:24.891526937 CET	49882	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:24.938426018 CET	49885	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:24.938426018 CET	49884	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:25.830224037 CET	49917	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:25.943288088 CET	49919	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:25.943824053 CET	49920	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:26.844660044 CET	49917	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:26.954107046 CET	49920	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:26.985322952 CET	49919	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:28.860316038 CET	49917	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:28.955022097 CET	49920	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:29.094696045 CET	49919	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:29.872823000 CET	49953	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:29.998346090 CET	49955	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:30.377155066 CET	49959	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:30.891599894 CET	49953	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:31.000979900 CET	49955	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:31.391597986 CET	49959	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:32.985482931 CET	49953	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:33.001010895 CET	49955	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:33.391635895 CET	49959	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:33.861284971 CET	49990	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:33.975883007 CET	49992	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:33.977057934 CET	49993	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:34.876353979 CET	49990	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:34.985382080 CET	49992	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:34.985404015 CET	49993	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:36.875955105 CET	49990	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:36.985368013 CET	49992	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:36.985446930 CET	49993	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:37.876288891 CET	50021	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:38.455117941 CET	50023	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:38.456125021 CET	50024	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:38.891649961 CET	50021	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:39.469863892 CET	50023	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:39.469891071 CET	50024	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:40.891657114 CET	50021	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:41.485347986 CET	50024	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:41.485465050 CET	50023	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:41.892653942 CET	50056	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:42.007720947 CET	50058	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:42.008347988 CET	50059	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:42.891611099 CET	50056	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:43.016781092 CET	50058	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:43.016849995 CET	50059	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:44.907248974 CET	50056	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:45.032244921 CET	50058	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:45.035104990 CET	50059	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:45.907807112 CET	50098	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:46.019923925 CET	50100	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:46.020697117 CET	50101	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:46.922863007 CET	50098	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:47.032294035 CET	50100	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:47.035080910 CET	50101	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:48.938508987 CET	50098	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:49.032263041 CET	50100	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:49.035095930 CET	50101	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:49.925606012 CET	50144	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:50.035718918 CET	50146	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:50.036628008 CET	50147	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:50.938514948 CET	50144	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:51.047877073 CET	50146	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:51.049134970 CET	50147	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:52.954145908 CET	50144	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:53.047916889 CET	50146	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:53.048105001 CET	50147	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:53.939373016 CET	50192	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:54.053328037 CET	50194	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:54.054531097 CET	50195	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:54.938524961 CET	50192	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:55.047931910 CET	50194	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:55.051212072 CET	50195	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:56.938529015 CET	50192	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:57.047936916 CET	50194	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:57.051140070 CET	50195	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:57.970362902 CET	50251	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:58.084568977 CET	50253	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:58.085148096 CET	50254	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:25:58.985445023 CET	50251	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:59.094801903 CET	50253	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:25:59.094911098 CET	50254	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:00.985413074 CET	50251	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:01.094901085 CET	50253	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:01.110502005 CET	50254	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:01.970464945 CET	50316	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:02.122955084 CET	50320	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:02.123651981 CET	50321	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:02.985455036 CET	50316	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:03.110642910 CET	50320	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:03.110646009 CET	50321	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:04.985410929 CET	50316	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:05.126163960 CET	50320	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:05.129594088 CET	50321	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:05.987163067 CET	50393	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:06.099972963 CET	50396	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:06.100513935 CET	50397	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:07.001123905 CET	50393	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:07.110411882 CET	50396	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:07.110421896 CET	50397	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:09.001092911 CET	50393	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:09.110553026 CET	50396	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:09.110641956 CET	50397	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:10.002002001 CET	50452	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:10.117201090 CET	50456	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:10.117883921 CET	50457	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:11.016805887 CET	50452	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:11.110445023 CET	50456	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:11.110455036 CET	50457	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:13.016756058 CET	50452	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:13.110630035 CET	50456	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:13.110630989 CET	50457	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:14.002032042 CET	50555	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:14.116729975 CET	50559	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:14.117393970 CET	50560	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:15.016726017 CET	50555	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:15.126080036 CET	50559	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:15.126080036 CET	50560	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:17.016719103 CET	50555	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:17.126133919 CET	50560	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:17.126200914 CET	50559	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:18.022039890 CET	50650	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:18.134448051 CET	50654	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:18.134533882 CET	50655	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:19.032381058 CET	50650	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:19.141714096 CET	50655	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:19.141721964 CET	50654	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:21.032349110 CET	50650	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:21.157393932 CET	50655	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:21.159169912 CET	50654	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:22.034920931 CET	50820	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:22.153125048 CET	50828	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:22.153687000 CET	50829	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:23.032393932 CET	50820	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:23.188607931 CET	50829	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:23.189886093 CET	50828	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:25.032401085 CET	50820	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:25.188607931 CET	50829	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:25.188616037 CET	50828	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:26.051171064 CET	51035	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:26.237404108 CET	51043	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:26.239666939 CET	51044	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:27.079231977 CET	51035	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:27.251101971 CET	51043	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:27.391735077 CET	51044	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:29.079251051 CET	51035	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:29.266752005 CET	51043	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:29.399588108 CET	51044	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:30.168665886 CET	51267	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:30.169061899 CET	51268	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:30.647553921 CET	51298	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:31.282362938 CET	51267	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:31.282757998 CET	51268	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:31.782365084 CET	51298	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:33.289228916 CET	51448	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:33.305258036 CET	51450	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:33.309498072 CET	51451	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:34.342844009 CET	51448	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:34.391746998 CET	51451	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:34.391820908 CET	51450	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:36.391760111 CET	51451	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:36.391772985 CET	51450	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:36.487304926 CET	51448	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:37.331753969 CET	52264	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:37.458865881 CET	52353	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:37.459856033 CET	52354	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:38.376151085 CET	52264	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:38.485522985 CET	52353	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:38.579678059 CET	52354	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:40.485533953 CET	52264	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:40.485573053 CET	52353	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:40.579309940 CET	52354	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:41.354407072 CET	54475	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:41.479357004 CET	54525	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:41.481875896 CET	54526	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:42.376142979 CET	54475	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:42.486022949 CET	54526	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:42.579286098 CET	54525	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:44.376147985 CET	54475	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:44.487242937 CET	54526	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:44.579406023 CET	54525	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:45.480082989 CET	57083	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:45.481848955 CET	57085	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:45.482141972 CET	57086	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:46.485570908 CET	57086	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:46.579299927 CET	57083	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:46.579668999 CET	57085	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:48.490139961 CET	57086	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:48.579298973 CET	57083	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:48.579298973 CET	57085	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:49.487488985 CET	59733	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:49.606384993 CET	59827	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:49.609586954 CET	59828	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:50.594918966 CET	59733	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:50.594973087 CET	59828	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:50.688668013 CET	59827	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:52.688692093 CET	59733	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:52.688698053 CET	59828	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:52.688775063 CET	59827	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:53.502202988 CET	62592	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:53.633871078 CET	62644	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:53.636389971 CET	62646	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:54.688687086 CET	62592	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:54.688776016 CET	62646	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:54.688776970 CET	62644	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:56.688708067 CET	62592	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:56.688782930 CET	62646	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:56.688781023 CET	62644	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:57.503460884 CET	64939	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:57.619721889 CET	65000	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:57.620663881 CET	65001	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:26:58.579349995 CET	64939	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:58.688714027 CET	65000	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:26:58.688723087 CET	65001	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:00.688707113 CET	64939	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:00.688729048 CET	65000	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:00.688729048 CET	65001	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:01.518512964 CET	51280	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:01.633598089 CET	51385	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:01.637638092 CET	51387	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:02.579363108 CET	51280	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:02.688705921 CET	51385	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:02.688709021 CET	51387	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:04.579341888 CET	51280	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:04.688705921 CET	51385	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:04.688724995 CET	51387	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:05.519896030 CET	53282	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:05.639990091 CET	53342	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:05.693483114 CET	53385	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:06.579467058 CET	53282	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:06.688720942 CET	53342	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:06.876663923 CET	53385	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:08.579668999 CET	53282	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:08.691274881 CET	53342	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:08.876363039 CET	53385	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:09.534600973 CET	56273	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:09.662786961 CET	56331	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:09.665492058 CET	56333	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:10.579500914 CET	56273	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:10.688755035 CET	56333	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:10.688762903 CET	56331	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:12.688757896 CET	56273	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:12.688761950 CET	56333	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:12.688766003 CET	56331	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:13.550123930 CET	59046	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:13.665581942 CET	59091	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:13.667083979 CET	59092	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:14.579478025 CET	59046	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:14.688765049 CET	59091	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:14.689791918 CET	59092	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:16.579472065 CET	59046	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:16.688816071 CET	59092	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:16.782510996 CET	59091	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:17.571221113 CET	61468	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:17.684721947 CET	61538	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:17.685092926 CET	61539	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:18.581572056 CET	61468	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:18.688780069 CET	61538	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:18.688780069 CET	61539	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:20.579550028 CET	61468	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:20.688770056 CET	61538	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:20.688805103 CET	61539	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:21.584034920 CET	64314	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:21.697453022 CET	64340	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:21.699865103 CET	64341	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:22.579834938 CET	64314	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:22.688770056 CET	64341	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:22.891901016 CET	64340	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:24.688782930 CET	64314	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:24.688782930 CET	64341	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:24.891907930 CET	64340	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:25.708920002 CET	50715	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:25.711210966 CET	50716	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:25.730297089 CET	50719	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:26.876280069 CET	50719	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:26.891935110 CET	50715	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:26.891957045 CET	50716	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:28.876291990 CET	50719	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:28.891906023 CET	50715	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:28.893352032 CET	50716	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:29.706254959 CET	53174	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:29.823767900 CET	53241	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:29.828819036 CET	53243	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:30.876286983 CET	53241	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:30.876584053 CET	53243	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:30.894825935 CET	53174	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:32.876311064 CET	53243	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:32.876310110 CET	53241	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:33.079502106 CET	53174	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:33.722116947 CET	55701	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:33.842988968 CET	55749	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:33.853442907 CET	55756	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:34.876313925 CET	55749	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:34.891946077 CET	55701	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:34.891988039 CET	55756	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:36.876482010 CET	55749	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:36.891963005 CET	55756	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:36.892138958 CET	55701	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:37.737807989 CET	58199	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:37.853638887 CET	58255	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:37.855684042 CET	58256	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:38.876311064 CET	58255	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:38.891944885 CET	58199	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:38.892086983 CET	58256	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:40.879108906 CET	58255	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:40.891974926 CET	58199	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:40.891977072 CET	58256	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:41.742420912 CET	61154	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:41.854506969 CET	61193	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:41.857969046 CET	61194	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:42.876327038 CET	61193	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:42.891963959 CET	61154	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:42.895358086 CET	61194	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:44.876343012 CET	61193	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:44.891971111 CET	61154	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:44.891973972 CET	61194	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:45.753154993 CET	63604	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:45.869000912 CET	63650	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:45.871989965 CET	63651	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:46.782814026 CET	63604	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:46.876339912 CET	63650	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:46.876442909 CET	63651	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:48.787369013 CET	63604	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:48.876368999 CET	63650	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:48.879753113 CET	63651	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:49.768950939 CET	49759	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:49.885262012 CET	49810	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:49.887161016 CET	49811	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:50.892050982 CET	49759	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:50.985714912 CET	49810	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:50.985944033 CET	49811	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:52.891973019 CET	49759	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:52.985709906 CET	49810	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:52.985723019 CET	49811	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:53.785599947 CET	52025	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:53.979168892 CET	52058	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:53.983279943 CET	52060	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:54.891977072 CET	52025	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:54.985748053 CET	52058	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:54.985837936 CET	52060	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:56.892059088 CET	52025	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:56.985723972 CET	52058	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:56.988734961 CET	52060	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:57.809887886 CET	54186	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:57.935857058 CET	54196	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:57.943892002 CET	54198	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:27:58.893523932 CET	54186	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:58.985755920 CET	54196	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:27:58.985759020 CET	54198	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:00.895406961 CET	54186	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:00.985743999 CET	54196	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:00.986145020 CET	54198	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:01.818099022 CET	56776	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:01.932241917 CET	56820	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:01.935075998 CET	56821	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:02.883416891 CET	56776	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:03.079662085 CET	56821	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:03.079663992 CET	56820	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:04.876396894 CET	56776	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:05.079550028 CET	56820	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:05.079616070 CET	56821	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:05.836056948 CET	59032	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:05.959243059 CET	59077	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:05.964421034 CET	59078	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:06.892033100 CET	59032	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:06.987431049 CET	59078	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:07.083461046 CET	59077	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:08.892007113 CET	59032	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:08.985789061 CET	59078	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:09.188894033 CET	59077	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:09.841046095 CET	61280	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:09.961762905 CET	61388	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:10.892193079 CET	61280	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:10.985776901 CET	61388	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:12.892016888 CET	61280	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:12.985788107 CET	61388	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:13.847321987 CET	59350	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:13.973267078 CET	59429	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:14.892014027 CET	59350	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:15.095474958 CET	59429	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:16.892029047 CET	59350	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:17.095176935 CET	59429	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:17.871402025 CET	61975	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:18.380880117 CET	61978	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:18.892025948 CET	61975	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:19.392050982 CET	61978	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:20.574270010 CET	63061	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:20.892103910 CET	61975	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:21.392050028 CET	61978	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:21.579560995 CET	63061	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:21.875798941 CET	63697	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:21.994311094 CET	63768	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:21.994909048 CET	63769	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:22.907994032 CET	63697	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:23.079560041 CET	63768	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:23.080167055 CET	63769	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:25.019185066 CET	63697	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:25.079544067 CET	63768	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:25.079560995 CET	63769	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:25.878392935 CET	49160	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:26.017760992 CET	49254	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:26.019459009 CET	49255	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:26.892057896 CET	49160	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:27.138370037 CET	49254	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:27.138442039 CET	49255	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:28.892065048 CET	49160	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:29.149811983 CET	49254	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:29.149903059 CET	49255	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:29.924071074 CET	51840	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:30.040077925 CET	51877	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:30.041276932 CET	51879	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:31.079632998 CET	51877	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:31.079633951 CET	51840	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:31.079709053 CET	51879	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:33.079588890 CET	51877	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:33.079597950 CET	51879	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:33.113887072 CET	51840	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:33.943373919 CET	54552	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:34.056288958 CET	54679	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:34.056289911 CET	54680	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:34.985831976 CET	54552	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:35.079586983 CET	54679	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:35.079612017 CET	54680	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:36.985846043 CET	54552	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:37.079605103 CET	54679	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:37.079618931 CET	54680	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:37.956382036 CET	57187	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:38.084666967 CET	57240	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:38.084669113 CET	57242	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:38.985863924 CET	57187	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:39.087794065 CET	57240	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:39.087802887 CET	57242	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:40.985831976 CET	57187	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:41.152759075 CET	57240	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:41.152913094 CET	57242	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:42.045383930 CET	58891	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:42.324048996 CET	58894	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:42.324541092 CET	58895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:43.079623938 CET	58891	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:43.392088890 CET	58894	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:43.392098904 CET	58895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:45.079659939 CET	58891	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:45.392220020 CET	58894	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:45.392225027 CET	58895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:49.079623938 CET	58891	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:49.392111063 CET	58894	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:49.392184973 CET	58895	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:57.079668045 CET	58891	23588	192.168.2.8	107.160.131.254
Nov 19, 2024 14:28:57.392128944 CET	58894	80	192.168.2.8	202.108.0.52
Nov 19, 2024 14:28:57.393249989 CET	58895	23588	192.168.2.8	107.160.131.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:25:02.682295084 CET	61561	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:02.689649105 CET	53	61561	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:07.439935923 CET	57022	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:07.448739052 CET	53	57022	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:08.844156981 CET	59402	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:08.851649046 CET	53	59402	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:12.424705982 CET	60275	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:12.927687883 CET	53	60275	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:17.460808039 CET	52991	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:17.468424082 CET	53	52991	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:22.455702066 CET	60711	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:22.463224888 CET	53	60711	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:27.518908024 CET	51252	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:27.526247025 CET	53	51252	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:30.001863956 CET	53239	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:30.322807074 CET	53	53239	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:32.443738937 CET	64770	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:32.451770067 CET	53	64770	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:37.533169031 CET	59582	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:38.046952963 CET	53	59582	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:42.439436913 CET	64357	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:42.447223902 CET	53	64357	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:47.486337900 CET	63486	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:47.493582964 CET	53	63486	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:52.471498013 CET	56591	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:52.479806900 CET	53	56591	1.1.1.1	192.168.2.8
Nov 19, 2024 14:25:57.455539942 CET	49932	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:25:57.462965012 CET	53	49932	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:02.468851089 CET	54461	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:02.476084948 CET	53	54461	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:07.424005985 CET	51684	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:07.967272997 CET	53	51684	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:12.528201103 CET	56158	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:12.535715103 CET	53	56158	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:17.432022095 CET	53253	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:17.439743996 CET	53	53253	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:22.426475048 CET	63557	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:22.433978081 CET	53	63557	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:27.425965071 CET	54117	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:27.434043884 CET	53	54117	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:30.168071985 CET	51835	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:30.646616936 CET	53	51835	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:32.432154894 CET	63013	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:32.439722061 CET	53	63013	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:37.426999092 CET	63081	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:37.434618950 CET	53	63081	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:42.427570105 CET	65056	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:42.437283993 CET	53	65056	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:47.424005032 CET	62102	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:47.431242943 CET	53	62102	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:52.437810898 CET	54386	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:52.446202993 CET	53	54386	1.1.1.1	192.168.2.8
Nov 19, 2024 14:26:57.423410892 CET	58306	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:26:57.430773020 CET	53	58306	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:02.435044050 CET	57071	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:02.442382097 CET	53	57071	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:07.423933983 CET	60156	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:07.431350946 CET	53	60156	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:12.424355984 CET	62615	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:12.431884050 CET	53	62615	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:17.480093956 CET	62247	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:17.487660885 CET	53	62247	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:22.423556089 CET	63585	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:22.431140900 CET	53	63585	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:27.425457954 CET	57524	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:27.433211088 CET	53	57524	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:32.425044060 CET	51844	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:32.432256937 CET	53	51844	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:33.844614029 CET	49710	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:33.852269888 CET	53	49710	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:37.429163933 CET	52470	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:37.436516047 CET	53	52470	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:42.424137115 CET	63749	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:42.973465919 CET	53	63749	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:47.427387953 CET	53177	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:47.436167955 CET	53	53177	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:52.425645113 CET	58124	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:52.540406942 CET	53	58124	1.1.1.1	192.168.2.8
Nov 19, 2024 14:27:57.424582958 CET	58525	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:27:57.431771994 CET	53	58525	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:02.423815012 CET	63086	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:02.432440042 CET	53	63086	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:07.451950073 CET	63968	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:07.459525108 CET	53	63968	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:09.964345932 CET	62800	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:09.986568928 CET	62800	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:09.993688107 CET	53	62800	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:10.437556982 CET	53	62800	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:12.424608946 CET	64072	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:12.431502104 CET	53	64072	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:17.423834085 CET	63188	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:17.454699039 CET	63188	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:17.935024977 CET	53	63188	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:17.935071945 CET	53	63188	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:20.149029970 CET	58800	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:20.174072981 CET	58800	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:20.565541983 CET	53	58800	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:20.565623999 CET	53	58800	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:22.424654007 CET	59162	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:22.454890966 CET	59162	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:23.611974955 CET	59162	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:23.952347040 CET	53	59162	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:23.952363968 CET	53	59162	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:23.952373028 CET	53	59162	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:27.423804998 CET	56893	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:27.431349993 CET	53	56893	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:32.424931049 CET	58113	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:32.432806969 CET	53	58113	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:37.425646067 CET	50006	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:37.455241919 CET	50006	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:37.947464943 CET	53	50006	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:37.947490931 CET	53	50006	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:42.516774893 CET	65158	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:42.551462889 CET	65158	53	192.168.2.8	1.1.1.1
Nov 19, 2024 14:28:43.032388926 CET	53	65158	1.1.1.1	192.168.2.8
Nov 19, 2024 14:28:43.032435894 CET	53	65158	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 14:25:02.682295084 CET	192.168.2.8	1.1.1.1	0x931f	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:07.439935923 CET	192.168.2.8	1.1.1.1	0x6294	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:08.844156981 CET	192.168.2.8	1.1.1.1	0xda9f	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:12.424705982 CET	192.168.2.8	1.1.1.1	0xd3bd	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:17.460808039 CET	192.168.2.8	1.1.1.1	0xaa20	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:22.455702066 CET	192.168.2.8	1.1.1.1	0xe791	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:27.518908024 CET	192.168.2.8	1.1.1.1	0x546d	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:30.001863956 CET	192.168.2.8	1.1.1.1	0xa115	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:32.443738937 CET	192.168.2.8	1.1.1.1	0x5527	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:37.533169031 CET	192.168.2.8	1.1.1.1	0xfc96	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:42.439436913 CET	192.168.2.8	1.1.1.1	0xc200	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:47.486337900 CET	192.168.2.8	1.1.1.1	0xa38c	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:52.471498013 CET	192.168.2.8	1.1.1.1	0x444f	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:57.455539942 CET	192.168.2.8	1.1.1.1	0xa039	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:02.468851089 CET	192.168.2.8	1.1.1.1	0x5e9e	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:07.424005985 CET	192.168.2.8	1.1.1.1	0x4c6	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:12.528201103 CET	192.168.2.8	1.1.1.1	0x1675	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:17.432022095 CET	192.168.2.8	1.1.1.1	0xfa92	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:22.426475048 CET	192.168.2.8	1.1.1.1	0xd09c	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:27.425965071 CET	192.168.2.8	1.1.1.1	0xbf37	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:30.168071985 CET	192.168.2.8	1.1.1.1	0x4b6	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:32.432154894 CET	192.168.2.8	1.1.1.1	0x7bb8	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:37.426999092 CET	192.168.2.8	1.1.1.1	0x1449	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:42.427570105 CET	192.168.2.8	1.1.1.1	0x1db2	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:47.424005032 CET	192.168.2.8	1.1.1.1	0x563a	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:52.437810898 CET	192.168.2.8	1.1.1.1	0x6ffd	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:57.423410892 CET	192.168.2.8	1.1.1.1	0x8e10	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:02.435044050 CET	192.168.2.8	1.1.1.1	0x374f	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:07.423933983 CET	192.168.2.8	1.1.1.1	0xd437	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:12.424355984 CET	192.168.2.8	1.1.1.1	0xa916	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:17.480093956 CET	192.168.2.8	1.1.1.1	0x11fa	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:22.423556089 CET	192.168.2.8	1.1.1.1	0x2fbe	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:27.425457954 CET	192.168.2.8	1.1.1.1	0xda4a	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:32.425044060 CET	192.168.2.8	1.1.1.1	0x3f00	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:33.844614029 CET	192.168.2.8	1.1.1.1	0xca17	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:37.429163933 CET	192.168.2.8	1.1.1.1	0xd739	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:42.424137115 CET	192.168.2.8	1.1.1.1	0xe3c1	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:47.427387953 CET	192.168.2.8	1.1.1.1	0x9e02	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:52.425645113 CET	192.168.2.8	1.1.1.1	0x7a18	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:57.424582958 CET	192.168.2.8	1.1.1.1	0x9d95	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:02.423815012 CET	192.168.2.8	1.1.1.1	0x4638	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:07.451950073 CET	192.168.2.8	1.1.1.1	0x9830	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:09.964345932 CET	192.168.2.8	1.1.1.1	0x566	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:09.986568928 CET	192.168.2.8	1.1.1.1	0x566	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:12.424608946 CET	192.168.2.8	1.1.1.1	0x15a6	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:17.423834085 CET	192.168.2.8	1.1.1.1	0x3434	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:17.454699039 CET	192.168.2.8	1.1.1.1	0x3434	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:20.149029970 CET	192.168.2.8	1.1.1.1	0x7e0d	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:20.174072981 CET	192.168.2.8	1.1.1.1	0x7e0d	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:22.424654007 CET	192.168.2.8	1.1.1.1	0x1bde	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:22.454890966 CET	192.168.2.8	1.1.1.1	0x1bde	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:23.611974955 CET	192.168.2.8	1.1.1.1	0x1bde	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:27.423804998 CET	192.168.2.8	1.1.1.1	0xff5c	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:32.424931049 CET	192.168.2.8	1.1.1.1	0x1ef	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:37.425646067 CET	192.168.2.8	1.1.1.1	0xba38	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:37.455241919 CET	192.168.2.8	1.1.1.1	0xba38	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:42.516774893 CET	192.168.2.8	1.1.1.1	0xc19e	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:42.551462889 CET	192.168.2.8	1.1.1.1	0xc19e	Standard query (0)	host123.zz.am	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 14:25:02.689649105 CET	1.1.1.1	192.168.2.8	0x931f	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:07.448739052 CET	1.1.1.1	192.168.2.8	0x6294	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:08.851649046 CET	1.1.1.1	192.168.2.8	0xda9f	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:25:08.851649046 CET	1.1.1.1	192.168.2.8	0xda9f	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:12.927687883 CET	1.1.1.1	192.168.2.8	0xd3bd	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:17.468424082 CET	1.1.1.1	192.168.2.8	0xaa20	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:22.463224888 CET	1.1.1.1	192.168.2.8	0xe791	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:27.526247025 CET	1.1.1.1	192.168.2.8	0x546d	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:30.322807074 CET	1.1.1.1	192.168.2.8	0xa115	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:25:30.322807074 CET	1.1.1.1	192.168.2.8	0xa115	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:32.451770067 CET	1.1.1.1	192.168.2.8	0x5527	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:38.046952963 CET	1.1.1.1	192.168.2.8	0xfc96	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:42.447223902 CET	1.1.1.1	192.168.2.8	0xc200	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:47.493582964 CET	1.1.1.1	192.168.2.8	0xa38c	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:52.479806900 CET	1.1.1.1	192.168.2.8	0x444f	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:57.462965012 CET	1.1.1.1	192.168.2.8	0xa039	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:02.476084948 CET	1.1.1.1	192.168.2.8	0x5e9e	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:07.967272997 CET	1.1.1.1	192.168.2.8	0x4c6	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:12.535715103 CET	1.1.1.1	192.168.2.8	0x1675	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:17.439743996 CET	1.1.1.1	192.168.2.8	0xfa92	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:22.433978081 CET	1.1.1.1	192.168.2.8	0xd09c	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:27.434043884 CET	1.1.1.1	192.168.2.8	0xbf37	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:30.646616936 CET	1.1.1.1	192.168.2.8	0x4b6	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:26:30.646616936 CET	1.1.1.1	192.168.2.8	0x4b6	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:32.439722061 CET	1.1.1.1	192.168.2.8	0x7bb8	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:37.434618950 CET	1.1.1.1	192.168.2.8	0x1449	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:42.437283993 CET	1.1.1.1	192.168.2.8	0x1db2	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:47.431242943 CET	1.1.1.1	192.168.2.8	0x563a	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:52.446202993 CET	1.1.1.1	192.168.2.8	0x6ffd	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:57.430773020 CET	1.1.1.1	192.168.2.8	0x8e10	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:02.442382097 CET	1.1.1.1	192.168.2.8	0x374f	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:07.431350946 CET	1.1.1.1	192.168.2.8	0xd437	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:12.431884050 CET	1.1.1.1	192.168.2.8	0xa916	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:17.487660885 CET	1.1.1.1	192.168.2.8	0x11fa	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:22.431140900 CET	1.1.1.1	192.168.2.8	0x2fbe	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:27.433211088 CET	1.1.1.1	192.168.2.8	0xda4a	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:32.432256937 CET	1.1.1.1	192.168.2.8	0x3f00	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:33.852269888 CET	1.1.1.1	192.168.2.8	0xca17	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:27:33.852269888 CET	1.1.1.1	192.168.2.8	0xca17	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:37.436516047 CET	1.1.1.1	192.168.2.8	0xd739	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:42.973465919 CET	1.1.1.1	192.168.2.8	0xe3c1	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:47.436167955 CET	1.1.1.1	192.168.2.8	0x9e02	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:52.540406942 CET	1.1.1.1	192.168.2.8	0x7a18	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:27:57.431771994 CET	1.1.1.1	192.168.2.8	0x9d95	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:02.432440042 CET	1.1.1.1	192.168.2.8	0x4638	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:07.459525108 CET	1.1.1.1	192.168.2.8	0x9830	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:10.437556982 CET	1.1.1.1	192.168.2.8	0x566	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:28:10.437556982 CET	1.1.1.1	192.168.2.8	0x566	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:12.431502104 CET	1.1.1.1	192.168.2.8	0x15a6	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:17.935024977 CET	1.1.1.1	192.168.2.8	0x3434	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:17.935071945 CET	1.1.1.1	192.168.2.8	0x3434	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:20.565541983 CET	1.1.1.1	192.168.2.8	0x7e0d	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:28:20.565541983 CET	1.1.1.1	192.168.2.8	0x7e0d	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:20.565623999 CET	1.1.1.1	192.168.2.8	0x7e0d	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:28:20.565623999 CET	1.1.1.1	192.168.2.8	0x7e0d	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:23.952347040 CET	1.1.1.1	192.168.2.8	0x1bde	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:23.952363968 CET	1.1.1.1	192.168.2.8	0x1bde	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:23.952373028 CET	1.1.1.1	192.168.2.8	0x1bde	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:27.431349993 CET	1.1.1.1	192.168.2.8	0xff5c	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:32.432806969 CET	1.1.1.1	192.168.2.8	0x1ef	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:37.947464943 CET	1.1.1.1	192.168.2.8	0xba38	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:37.947490931 CET	1.1.1.1	192.168.2.8	0xba38	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:43.032388926 CET	1.1.1.1	192.168.2.8	0xc19e	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:28:43.032435894 CET	1.1.1.1	192.168.2.8	0xc19e	Name error (3)	host123.zz.am	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	08:24:36
Start date:	19/11/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll"
Imagebase:	0x170000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:24:36
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:24:36
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",#1
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:24:36
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,DoAddToFavDlg
Imagebase:	0x5d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:24:36
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",#1
Imagebase:	0x5d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:24:36
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:24:36
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:24:36
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0xc80000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:24:39
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,InputFile
Imagebase:	0x5d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:24:42
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\08e2VwqyI0.dll,PrintFile
Imagebase:	0x5d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:24:42
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 672
Imagebase:	0x90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:24:45
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg
Imagebase:	0x5d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:24:45
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",InputFile
Imagebase:	0x5d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:24:45
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\08e2VwqyI0.dll",PrintFile
Imagebase:	0x5d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:24:45
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 740, Parent PID: 2100

General

Target ID:	22
Start time:	08:24:45
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:24:45
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 668
Imagebase:	0x90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:24:45
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0xc80000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:25:08
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg
Imagebase:	0x5d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:25:09
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 760, Parent PID: 5736

General

Target ID:	28
Start time:	08:25:09
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:25:09
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0xc80000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:25:16
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\08e2VwqyI0.dll",DoAddToFavDlg
Imagebase:	0x5d0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 1160, Parent PID: 2300

General

Target ID:	31
Start time:	08:25:17
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1308, Parent PID: 1160

General

Target ID:	32
Start time:	08:25:17
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:25:17
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0xc80000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.9%
Total number of Nodes:	63
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02450C8D Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?), ref: 02450D78
wsprintfA.USER32(?,?,?,?), ref: 02450E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 02450E34
ExitProcess.KERNEL32(00000000), ref: 02450E3C

Strings

Application error, xrefs: 02450E30
The procedure %s could not be located in the DLL %s., xrefs: 02450E14
SWVU, xrefs: 02450D80, 02450D94, 02450D9A, 02450DA0, 02450DBD

Memory Dump Source

Source File: 00000000.00000002.1498542174.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_loaddll32.jbxd

Similarity

API ID: AllocExitMessageProcessVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 1926473177-4283279704
Opcode ID: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction ID: 6662643a65ef3f35612ce979159e1844298f55197b153730f20b1bbd481c7f88
Opcode Fuzzy Hash: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction Fuzzy Hash: 9351E2321057959FDB368F20CC50BEB7BB5AF0A304F09419EDD869B297EB34A819CB51

Function 02450CF9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?), ref: 02450D78
wsprintfA.USER32(?,?,?,?), ref: 02450E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 02450E34
ExitProcess.KERNEL32(00000000), ref: 02450E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 02450E85

Strings

Application error, xrefs: 02450E30
The procedure %s could not be located in the DLL %s., xrefs: 02450E14
SWVU, xrefs: 02450D80, 02450D94, 02450D9A, 02450DA0, 02450DBD

Memory Dump Source

Source File: 00000000.00000002.1498542174.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_loaddll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction ID: e314553602c3854b2d4546a4f276e811bdb11a5099f4bd92a7cbcf2b37e10f11
Opcode Fuzzy Hash: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction Fuzzy Hash: B2418C362007169BEB348F15CC44FEB73A5AF48351F04451EED8AA7646EB70A815CB90

Function 02450D32 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?), ref: 02450D78
wsprintfA.USER32(?,?,?,?), ref: 02450E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 02450E34
ExitProcess.KERNEL32(00000000), ref: 02450E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 02450E85

Strings

Application error, xrefs: 02450E30
The procedure %s could not be located in the DLL %s., xrefs: 02450E14
SWVU, xrefs: 02450D80, 02450D94, 02450D9A, 02450DA0, 02450DBD

Memory Dump Source

Source File: 00000000.00000002.1498542174.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_loaddll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction ID: e0efd59c8e17868e11c7f77e9929977c5de696726f0cfd490e123f10f31ea5de
Opcode Fuzzy Hash: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction Fuzzy Hash: 4C31C9362013569FEB399F11CC80FEB77A6AF49351F00411EEE8A97686EB70A810CB50

Function 024514C0 Relevance: 3.0, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,?), ref: 024514EF
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 0245150D

Memory Dump Source

Source File: 00000000.00000002.1498542174.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: fac49d679feb86cac87c3b4894642fe879772b509f97c875d5e00b37d2dd6787
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 20F0E933240245AFEB098F64D885FEE7768DF49398B20006BF7429A286CA71E551C754

Function 02450063 Relevance: 2.6, APIs: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0245007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 024500BE

Memory Dump Source

Source File: 00000000.00000002.1498542174.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_loaddll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction ID: 7b2a44f1f2ccb7c35106f6d1c29af567ce6e098585882c29fe9dd6ed246f0706
Opcode Fuzzy Hash: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction Fuzzy Hash: 4D014B7620A6116EE6314AA1AC00F37BBDCEF4CB12F14485ABED5C1191DA25E4418F70

Function 0245002A Relevance: 1.3, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 024500BE

Memory Dump Source

Source File: 00000000.00000002.1498542174.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_loaddll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: b6b961f632e45adf2d2206f9146b4b5f6f730b3e12911d844d034db5a1121d65
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: 89F0592614A32129F22067357D44A27BB98EF0A721B05299BDC80D2093DD11C8028EA4

Non-executed Functions

Function 02450E9F Relevance: 3.0, APIs: 2, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 02450EAE
GetProcAddress.KERNEL32(?,00000000), ref: 02450ED0

Memory Dump Source

Source File: 00000000.00000002.1498542174.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_loaddll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: fb92c6333be858c605df516a8dbac1de34355592668ca30c740f87b13d0c7776
Instruction ID: 7423a25bb6470294071c3630cdc00c7104a739653fb866cec93bf927d4e1ba91
Opcode Fuzzy Hash: fb92c6333be858c605df516a8dbac1de34355592668ca30c740f87b13d0c7776
Instruction Fuzzy Hash: 72F082B7A101049FDB10CF18CCC49AAF3B1EF98369329847ADC86A7715D735FD568A10

Function 024500CD Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498542174.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62f34c450c3ba46a9bfd7c7600c86e50cf775180cb61537211fd409f1f57de4
Instruction ID: 07bed9dd7cc8f974899cd8c0df6e63197d07e44f897ddbb3771aed56e9a27410
Opcode Fuzzy Hash: e62f34c450c3ba46a9bfd7c7600c86e50cf775180cb61537211fd409f1f57de4
Instruction Fuzzy Hash: D55217766083618BC708CE29C59026EFBE2FFC8344F155A2EE8D687395D7709949CB82

Analysis Process: rundll32.exePID: 1160, Parent PID: 1996COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 026B0C8D Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 026B0D78
wsprintfA.USER32(?,?,?,?), ref: 026B0E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 026B0E34
ExitProcess.KERNEL32(00000000), ref: 026B0E3C

Strings

Application error, xrefs: 026B0E30
SWVU, xrefs: 026B0D80, 026B0D94, 026B0D9A, 026B0DA0, 026B0DBD
The procedure %s could not be located in the DLL %s., xrefs: 026B0E14

Memory Dump Source

Source File: 00000003.00000002.1428208301.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_rundll32.jbxd

Similarity

API ID: AllocExitMessageProcessVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 1926473177-4283279704
Opcode ID: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction ID: a9f2609d8d99b985d985e046cf9cf7e5a90e7c153e2a1911beab176ce6f26730
Opcode Fuzzy Hash: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction Fuzzy Hash: 9E5114312057859FDB3B8F20CC50BEB3BB5AF06304F09419EDD869B296EB34A855CB95

Function 026B0CF9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 026B0D78
wsprintfA.USER32(?,?,?,?), ref: 026B0E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 026B0E34
ExitProcess.KERNEL32(00000000), ref: 026B0E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 026B0E85

Strings

Application error, xrefs: 026B0E30
SWVU, xrefs: 026B0D80, 026B0D94, 026B0D9A, 026B0DA0, 026B0DBD
The procedure %s could not be located in the DLL %s., xrefs: 026B0E14

Memory Dump Source

Source File: 00000003.00000002.1428208301.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction ID: 449f0bfe383c7d9a288bc2a808756e8eeb5173c59921672a0b5dd90848a6a818
Opcode Fuzzy Hash: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction Fuzzy Hash: C0418A362007069BEB3A8F14CC44FEB77A5AF49351F04421DEE4AA7688EB70A851CB94

Function 026B0D32 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 026B0D78
wsprintfA.USER32(?,?,?,?), ref: 026B0E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 026B0E34
ExitProcess.KERNEL32(00000000), ref: 026B0E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 026B0E85

Strings

Application error, xrefs: 026B0E30
SWVU, xrefs: 026B0D80, 026B0D94, 026B0D9A, 026B0DA0, 026B0DBD
The procedure %s could not be located in the DLL %s., xrefs: 026B0E14

Memory Dump Source

Source File: 00000003.00000002.1428208301.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction ID: 82d5515ce965983fa0da78a9b8faf607a2d65072588a302f6e718a12b82bba7a
Opcode Fuzzy Hash: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction Fuzzy Hash: 7131CB362003469FDB3A9F10CC84FEB7BA6AF45351F00415DEE4697285EF70A851CB94

Function 026B14C0 Relevance: 3.0, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 026B14EF
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 026B150D

Memory Dump Source

Source File: 00000003.00000002.1428208301.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: 34583468385557dc039e451c542ff9b6cdbfcf854f9d7b665f694bdf37f935bb
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 34F0E933240245AFEB098F64D895EEE7768DF49398B2000AAF7029A286CA71D551C754

Function 026B0063 Relevance: 2.6, APIs: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 026B007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 026B00BE

Memory Dump Source

Source File: 00000003.00000002.1428208301.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction ID: dcd0856e75538f2999daad4a6792d76ba7ea0d96acf1c113b21194be6c5f0ba9
Opcode Fuzzy Hash: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction Fuzzy Hash: A001AF72209682BEE7324AA19C00F77BFECDF48712F144C5AFAD5C2190DA26E4818B70

Function 026B002A Relevance: 1.3, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 026B00BE

Memory Dump Source

Source File: 00000003.00000002.1428208301.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: ae674e14619bcb59e0a0ceaf2b73211771bfcdde9d018070658d59be1a142ed8
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: 91F02E2254E3916DF62677347C44AA7BF98EF43325B150D9BDC40D6091DE11D882CBF4

Analysis Process: rundll32.exePID: 3580, Parent PID: 5540COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	11%
Signature Coverage:	1.1%
Total number of Nodes:	282
Total number of Limit Nodes:	12

Executed Functions

Function 10007F3E Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*.*, xrefs: 10007F8C
L2ltYWdlLnBocA==, xrefs: 1000818B
P, xrefs: 100080F7
NPKI, xrefs: 1000802C
., xrefs: 10007FCF
12010043, xrefs: 1000805B
%s\%s, xrefs: 10008067
107.160.131.254:23588/article.php, xrefs: 10008113

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %s\%s$*.*$.$107.160.131.254:23588/article.php$12010043$L2ltYWdlLnBocA==$NPKI$P
API String ID: 0-3984435826
Opcode ID: 0a215aef5ca7b5c606a273fdfbec72fd9b9d822c18bbfb0613fe871d940a9004
Instruction ID: 154fd83921e69bd95517e48f0429fd4d3315e101fc3602ca34ca7394d0d5f03d
Opcode Fuzzy Hash: 0a215aef5ca7b5c606a273fdfbec72fd9b9d822c18bbfb0613fe871d940a9004
Instruction Fuzzy Hash: C371517690425DBEEB61D7A4DC45FEEB7BCEB48240F1004E6F608E6041DB74AB898F61

Function 10003FB7 Relevance: 1.5, APIs: 1, Instructions: 4processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000000,00000000,10005931,00000002,00000000,00000000,00000000), ref: 10003FBF

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 1e956e5b503a472c93e19a4642fd5130f6607d7bc175f230498bf039bbf47dc4
Instruction ID: ca46abfd3f4ae67059df7024880e3d5c8c44562ed1dec37196b9e10746ab925e
Opcode Fuzzy Hash: 1e956e5b503a472c93e19a4642fd5130f6607d7bc175f230498bf039bbf47dc4
Instruction Fuzzy Hash: D5A00136408212ABDA42AB50CD48D4AFFA2BBA8781F02C819F19980034CB32C5A5EB12

Function 10006EDE Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 174
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(0000EA60), ref: 10006F24
Sleep.KERNEL32 ref: 10007059
wsprintfA.USER32 ref: 1000709D
PrintFile.08E2VWQYI0(00000000,?,00000000), ref: 100070D6
PrintFile.08E2VWQYI0(00000000,?,00000000,?,00000000), ref: 100070E9

Strings

XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 10006F79
http://107.160.131.254:23588/article.php, xrefs: 10007007
iOffset, xrefs: 10007042
c:\1.txt, xrefs: 10007047
QVlSVFNydi5heWU=, xrefs: 10006EFA
QVNEU3ZjLmV4ZQ==, xrefs: 10006EEE
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 10006F90

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: FilePrintSleep$wsprintf
String ID: QVNEU3ZjLmV4ZQ==$QVlSVFNydi5heWU=$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$c:\1.txt$http://107.160.131.254:23588/article.php$iOffset
API String ID: 1547040302-3813294871
Opcode ID: 6901e9babde4ee68b3136e4664651ea7350d119c703396e769bb1a0f608c4114
Instruction ID: e128ca64511400ca05deee7795c3814a468ccd3a13c6d035e862ae5cb279fd62
Opcode Fuzzy Hash: 6901e9babde4ee68b3136e4664651ea7350d119c703396e769bb1a0f608c4114
Instruction Fuzzy Hash: AC51D9B6D04359E6FB22D764CC56FCF77ACEB083C1F1045A5F208EA086DA75AB808E55

Function 10006499 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 272
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 100064F7

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 10006546

Part of subcall function 10003F24: InternetOpenUrlA.WININET(80000100,00000000,00000000,00000000,00000000,10006206), ref: 10003F39

Part of subcall function 10003F41: InternetReadFile.WININET(?,?,?,?), ref: 10003F51

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,75570ECC,0007D000,00000000,00000000), ref: 100065C8
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,?,?,?,75570ECC,0007D000,00000000,00000000), ref: 100065E6
wsprintfA.USER32 ref: 100066E9

Strings

aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==, xrefs: 100064DF
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 1000651A
title, xrefs: 10006647, 1000664C, 10006655

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Internet$ByteCharMultiOpenWidewsprintf$FileFormatReadTime___crt
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==$title
API String ID: 4077377486-2496724313
Opcode ID: 75abeeb0c1ce65552ecf3d51c3df04188886b104fd09b7b212ed437500202792
Instruction ID: 9bb45785208bde0406de56643d62444fa716b577ceefe44749a59ab2aa42cbd8
Opcode Fuzzy Hash: 75abeeb0c1ce65552ecf3d51c3df04188886b104fd09b7b212ed437500202792
Instruction Fuzzy Hash: 9C81E5B5C05248BEFB01DBA4DC82EEF7B7EEF09394F244059F504A7186DA356E4187A1

Function 03390C8D Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 03390D78
wsprintfA.USER32(?,?,?,?), ref: 03390E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 03390E34
ExitProcess.KERNEL32(00000000), ref: 03390E3C

Strings

The procedure %s could not be located in the DLL %s., xrefs: 03390E14
Application error, xrefs: 03390E30
SWVU, xrefs: 03390D80, 03390D94, 03390D9A, 03390DA0, 03390DBD

Memory Dump Source

Source File: 00000004.00000002.3874703382.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3390000_rundll32.jbxd

Similarity

API ID: AllocExitMessageProcessVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 1926473177-4283279704
Opcode ID: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction ID: 0dc3fe3d50238f7a50c6b9f96ad1a76187ac6ca5bb2fe5830f4f3f35f94fb1a2
Opcode Fuzzy Hash: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction Fuzzy Hash: 1251F731505785DFEB3ACF20CC80BEB7BB5AF06200F09419BDD469B296EB34A815CB51

Function 03390CF9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 03390D78
wsprintfA.USER32(?,?,?,?), ref: 03390E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 03390E34
ExitProcess.KERNEL32(00000000), ref: 03390E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 03390E85

Strings

The procedure %s could not be located in the DLL %s., xrefs: 03390E14
Application error, xrefs: 03390E30
SWVU, xrefs: 03390D80, 03390D94, 03390D9A, 03390DA0, 03390DBD

Memory Dump Source

Source File: 00000004.00000002.3874703382.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3390000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction ID: 207c62f5f311e2eb6d48a7fcc404602473ee88d5797fa62d5cbabc7eeb6c2b47
Opcode Fuzzy Hash: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction Fuzzy Hash: D4417D36A40706DFEB38DF14CC84EEB73A5AF48351F04421AED46A7644EB70B911CB90

Function 10005DB4 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 116
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtGetTimeFormatEx.LIBCMT ref: 10005E11

Part of subcall function 1000409D: RegQueryValueExA.KERNEL32(00000000,?,000F003F,00000000,?,80000002,?,10005E16,?,ProcessorNameString,00000000,00000004,?,?,80000002,?), ref: 100040B2

Part of subcall function 10004092: RegCloseKey.KERNEL32(?,10006DBE,?), ref: 10004096

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10005DC5
Find CPU Error, xrefs: 10005E36
ProcessorNameString, xrefs: 10005E02
@, xrefs: 10005E57
http://107.160.131.254:23588/article.php, xrefs: 10005EF8
%u MB, xrefs: 10005E7E
12010043, xrefs: 10005E8F

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CloseFormatQueryTimeValue___crt
String ID: %u MB$12010043$@$Find CPU Error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$http://107.160.131.254:23588/article.php
API String ID: 271660946-3893357082
Opcode ID: 37022121a03464651817a9c0c5e1d81c5aa94c867a3c5e15367f04ef0a505e5e
Instruction ID: 4f35d1d9e5d3edf0c8f7125bb17b53cb037807f44d0344e2d1e4939474d77481
Opcode Fuzzy Hash: 37022121a03464651817a9c0c5e1d81c5aa94c867a3c5e15367f04ef0a505e5e
Instruction Fuzzy Hash: 6531C0B6804208BAFB10C764DC42FDF77BCEB08351F10406AFA18BA082EB75BA458B55

Function 03390D32 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 03390D78
wsprintfA.USER32(?,?,?,?), ref: 03390E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 03390E34
ExitProcess.KERNEL32(00000000), ref: 03390E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 03390E85

Strings

The procedure %s could not be located in the DLL %s., xrefs: 03390E14
Application error, xrefs: 03390E30
SWVU, xrefs: 03390D80, 03390D94, 03390D9A, 03390DA0, 03390DBD

Memory Dump Source

Source File: 00000004.00000002.3874703382.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3390000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction ID: 7e9fcf6cf0729449e694010dcecbb12c12aa84c6529f573c3c16f81776767656
Opcode Fuzzy Hash: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction Fuzzy Hash: 4D31A936A00746DFEB38DF10CC80EEB77A9AF44351F04411EED469B684EB70A810CB50

Function 10006CF7 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 72
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10003FF7: GetShortPathNameA.KERNEL32(?,?,?), ref: 10004003

Part of subcall function 1000406C: RegCreateKeyExA.KERNEL32(?,00000000,000F003F,00000000,?,00000000,00000000,80000001,10006D60,?,10006D60,80000001,00000000,00000000,REG_SZ,00000000), ref: 1000408A

wsprintfA.USER32 ref: 10006D88
___crtGetTimeFormatEx.LIBCMT ref: 10006DAE

Part of subcall function 100040D4: RegSetValueExA.KERNEL32(00000001,?,00000001,00000000,?,?,?,10006DB3,?,dtfd,00000000,00000001,?,00000001,?), ref: 100040E9

Part of subcall function 10004092: RegCloseKey.KERNEL32(?,10006DBE,?), ref: 10004096

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 10006D77
C:\Users\user\Desktop\08e2VwqyI0.dll, xrefs: 10006D26, 10006D2C, 10006D71
REG_SZ, xrefs: 10006D44
U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 10006D4A
%s "%s",DoAddToFavDlg, xrefs: 10006D82
dtfd, xrefs: 10006DA6

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateFormatNamePathShortTimeValue___crtwsprintf
String ID: %s "%s",DoAddToFavDlg$C:\Users\user\Desktop\08e2VwqyI0.dll$C:\Windows\SysWOW64\rundll32.exe$REG_SZ$U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$dtfd
API String ID: 1762869224-1979437191
Opcode ID: fe4a6ca71fda934b348afe6d657169d78400bf351d74a23e551a426737a6504a
Instruction ID: 20d4b35ab7fa00c236079ec8a4dd8982143edab80ee48f6a2419757257224b01
Opcode Fuzzy Hash: fe4a6ca71fda934b348afe6d657169d78400bf351d74a23e551a426737a6504a
Instruction Fuzzy Hash: 451160B694415CBEFB11D7A4DC86FEA776CEB14340F1404A1F704FA085DAB16F988AA4

Function 1000826C Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 145
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00080000,00000000,00000000), ref: 10008394
wsprintfA.USER32 ref: 100083E6

Strings

XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 100082C5
Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=, xrefs: 10008405
http://107.160.131.254:23588/article.php, xrefs: 10008353
8.8.8.8, xrefs: 100083EF
127.0.0.1, xrefs: 100083F4
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 100082DC

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: 127.0.0.1$8.8.8.8$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=$http://107.160.131.254:23588/article.php
API String ID: 1749205058-626475063
Opcode ID: 54eedc971582e05c3486c3a0f88f100d4df9f5038933db9e4620657874ea0a6d
Instruction ID: 78e0688a60563a7bb1736696f6623559e09cac3deedd02f0104af55f58a5e4a8
Opcode Fuzzy Hash: 54eedc971582e05c3486c3a0f88f100d4df9f5038933db9e4620657874ea0a6d
Instruction Fuzzy Hash: 9E4106B6D04258B6F721D364CC46FCF77ACEB457C0F2400A6F248A9086EAB4AB848E51

Function 10006A6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10003ECE: CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

GetLastError.KERNEL32 ref: 10006AA8

Part of subcall function 10006499: wsprintfA.USER32 ref: 100064F7
Part of subcall function 10006499: ___crtGetTimeFormatEx.LIBCMT ref: 10006546

Sleep.KERNEL32(0002BF20,00000000,00000000,00000000,00000000,000000FF), ref: 10006ADD
CreateThread.KERNEL32(00000000,00000000,1000687E,00000000,00000000,00000000), ref: 10006AF1

Strings

5762479093, xrefs: 10006AC7
0x5d65r455f, xrefs: 10006A97

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Create$ErrorFormatLastMutexSleepThreadTime___crtwsprintf
String ID: 0x5d65r455f$5762479093
API String ID: 3244495550-2446933972
Opcode ID: 3b97f3ef57c6d34437c21e844b3cc3d0ae84d0d31088cb251ee543bf93b7c76e
Instruction ID: bd1adab126fe453b34de0ea9e0b5f284958d10fa0a203dc352c1be2a30225ce5
Opcode Fuzzy Hash: 3b97f3ef57c6d34437c21e844b3cc3d0ae84d0d31088cb251ee543bf93b7c76e
Instruction Fuzzy Hash: 9701F2A4844228BAF211F3704CCADBF395DDB563D4F200528F915A908BDB24EC0145B3

Function 10008567 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 79
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00002710), ref: 1000857E
Sleep.KERNEL32(001B7740,?,00000000,80000002,00000000,00000000,000F003F,?), ref: 100085BF

Strings

aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=, xrefs: 10008580
D, xrefs: 10008612
wINsTA0\dEFauLT, xrefs: 1000862C

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: D$aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=$wINsTA0\dEFauLT
API String ID: 3472027048-3516831565
Opcode ID: 97b5d75c4eae03a1f54d307b40641d8b725bb66f95620e0adc97901586be56a8
Instruction ID: 69b21accf233d090089117fd856bc82e5cd65d02c06b2ff4ec7ccf08b8a7457c
Opcode Fuzzy Hash: 97b5d75c4eae03a1f54d307b40641d8b725bb66f95620e0adc97901586be56a8
Instruction Fuzzy Hash: 6421817680525CBAEB11EBE4CC46EDFBB7CEF08390F1400A9F604BB151DB765A458B91

Function 100044AD Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000,?,00000000,GetExtendedUdpTable,?,iphlpapi.dll), ref: 100044E9
GetExtendedUdpTable.IPHLPAPI(?,?,00000001,00000002,00000001,00000000,?,00000000,GetExtendedUdpTable,?,iphlpapi.dll), ref: 10004513

Strings

GetExtendedUdpTable, xrefs: 100044CA
iphlpapi.dll, xrefs: 100044BC

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExtendedTable
String ID: GetExtendedUdpTable$iphlpapi.dll
API String ID: 2407854163-1809394930
Opcode ID: 8f3a0eb883154a3195ca5da507f2da972492a258440e1d6e2132d319b0eaf8e7
Instruction ID: 6449560a486cb6172ee975f2d37c1f40bf8993c7a1880d61e14318031523e361
Opcode Fuzzy Hash: 8f3a0eb883154a3195ca5da507f2da972492a258440e1d6e2132d319b0eaf8e7
Instruction Fuzzy Hash: D1215CB5500508BFEB20DB69DC46EAF77BCDF813D1F214519F9119A086DE30AE808674

Function 1000841C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,00000800,?,?,?,svchsot.exe,?,?,?,?,00000000,?,?,?), ref: 1000855C

Strings

svchsot.exe, xrefs: 10008524
U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 1000846F

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$svchsot.exe
API String ID: 3472027048-2214221337
Opcode ID: d2131fb9256a9d085b7213a385e4fb7e2e0d0505dace0aeb26e32ec0842a8d4a
Instruction ID: e8defaa02cb337ec462540d7064ad22b690c993f3d196736069eab589a90189d
Opcode Fuzzy Hash: d2131fb9256a9d085b7213a385e4fb7e2e0d0505dace0aeb26e32ec0842a8d4a
Instruction Fuzzy Hash: EE314D7290015DBEEB01DBA4CD81DEFB7FDFB48284F1440A6F644E6105EA30AF858BA1

Function 100087B6 Relevance: 6.0, APIs: 4, Instructions: 27
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00006A6E), ref: 100087D1
Sleep.KERNEL32(00001388,?,?,Function_00006A6E), ref: 100087D8
CreateThread.KERNEL32(?,?,Function_0000841C,?,?,?,?,?,Function_00006A6E), ref: 100087E4
Sleep.KERNEL32(000000FF,?,?,Function_0000841C,?,?,?,?,?,Function_00006A6E), ref: 100087E8

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 7611a2c7549d694aa888d6d647670ac1460baf17db733e16608d155f4bf44ca4
Instruction ID: 2df9746d7e78e8372c6e87ac4aa0691d1060a96339f5c4ce5d4c7b8b7a8da0f8
Opcode Fuzzy Hash: 7611a2c7549d694aa888d6d647670ac1460baf17db733e16608d155f4bf44ca4
Instruction Fuzzy Hash: 46E05EE024435DBDF321B2791CC8DFF1E0DEB812FCB254252F528100CB6A540D048AB2

Function 10006B1F Relevance: 4.6, APIs: 3, Instructions: 122sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 10003ECE: CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

GetLastError.KERNEL32 ref: 10006B55
CreateThread.KERNEL32(?,?,1000687E), ref: 10006B6B
Sleep.KERNEL32(00002710,?,00000000,00000000,000000FF,?,?,1000687E), ref: 10006B88

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Create$ErrorLastMutexSleepThread
String ID:
API String ID: 145085098-0
Opcode ID: 9fdb200d5929ef7e8f6a96f443088d0c96ecfb43422a1e838647d38a76ea70c1
Instruction ID: 4f35827bfa7b5ea93410d600da94e256639eda4c8ceaa52b9f8b13dee9a51c26
Opcode Fuzzy Hash: 9fdb200d5929ef7e8f6a96f443088d0c96ecfb43422a1e838647d38a76ea70c1
Instruction Fuzzy Hash: 463182714043905EF716DB284C45EA7BFAEDF5A390B14416AF8A5CB287D620D941C771

Function 10007101 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 95sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 100071AC
wsprintfA.USER32 ref: 100071FE

Strings

http://107.160.131.254:23588/article.php, xrefs: 1000716B

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: http://107.160.131.254:23588/article.php
API String ID: 1749205058-3833642815
Opcode ID: 97092958d065cc5244b5ac70b0ba84f38b29928c2b3a7baf181ba609d4b8ef37
Instruction ID: aabc6cc0ccec88c78b37051fa20fdae4f9ca8aa4d7268392f08ad21868547801
Opcode Fuzzy Hash: 97092958d065cc5244b5ac70b0ba84f38b29928c2b3a7baf181ba609d4b8ef37
Instruction Fuzzy Hash: 462129B6D046557AF724D368CC56FCF37ACEF053D0F2000A6F608A50C6E679AE818A11

Function 100061BD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 10006201

Strings

TW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNi4xOyB6aC1DTjsgcnY6MS45LjIuMTUpIEdlY2tvLzIwMTEwMzAzIEZpcmVmb3gvMy42LjE1, xrefs: 100061D0

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: FormatInternetOpenTime___crt
String ID: TW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNi4xOyB6aC1DTjsgcnY6MS45LjIuMTUpIEdlY2tvLzIwMTEwMzAzIEZpcmVmb3gvMy42LjE1
API String ID: 483802873-1756078650
Opcode ID: 82af1a15f59e1fdef4f373340f409e9f860dae93766629ca999b654561017b81
Instruction ID: f0c3526304c825564c5c4eb44b26f53dc373e74deb03e814873fed5b313e77ee
Opcode Fuzzy Hash: 82af1a15f59e1fdef4f373340f409e9f860dae93766629ca999b654561017b81
Instruction Fuzzy Hash: 1C21C575D0014DBAEF21DB55DC45D9F7B7DDB852D0F20807AF608E6045DA319A818660

Function 10006290 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F0A: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 100062BF

Part of subcall function 10003F24: InternetOpenUrlA.WININET(80000100,00000000,00000000,00000000,00000000,10006206), ref: 10003F39

Strings

TW96aWxsYS80LjAgKGNvbXBhdGlibGUp, xrefs: 10006298

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen$FormatTime___crt
String ID: TW96aWxsYS80LjAgKGNvbXBhdGlibGUp
API String ID: 1165476586-1918919809
Opcode ID: 5c4a45e9f88b1cdcaa63395fc832ffbcbaa15b587116e0ae30a38edddbb0ae5c
Instruction ID: e1df23a7d6fc88136f19512af0817ca3ec1a39d4f872029b50130054e15d899c
Opcode Fuzzy Hash: 5c4a45e9f88b1cdcaa63395fc832ffbcbaa15b587116e0ae30a38edddbb0ae5c
Instruction Fuzzy Hash: 61E0D832D089D238BA33E1671C0ED9F1EBDCBC7AF0B71402DF9489100EE8556485C0B5

Function 100081F7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0036EE80), ref: 10008264

Strings

C:\Program Files, xrefs: 10008200

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: C:\Program Files
API String ID: 3472027048-1387799010
Opcode ID: ef70be951d54eb09da497d03d6b876b815efcf974a7af6f3814c100205ad0eea
Instruction ID: c9703108929f2dc2805788eab40c91aa3f5a92b87bc929f4f41ff718cce9746c
Opcode Fuzzy Hash: ef70be951d54eb09da497d03d6b876b815efcf974a7af6f3814c100205ad0eea
Instruction Fuzzy Hash: 40F0723A905AA1A6F701DFA409C068B776DFF022A0B210026F840BF047C7B18E0243E2

Function 033914C0 Relevance: 3.0, APIs: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 033914EF
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 0339150D

Memory Dump Source

Source File: 00000004.00000002.3874703382.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3390000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: 14ecbab0e9fc75e24908ad7a18ec83704a7a92c03326c84d4ceafe30f4b9406c
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 20F0E933240245EFEF098F64D885EFE7768DF48398B20006BF702AA286CA71D551C754

Function 03390063 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0339007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 033900BE

Memory Dump Source

Source File: 00000004.00000002.3874703382.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3390000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction ID: 46510404fb69bad03e18a186c3725145e2027c2b4d44e9ffc704eef1bbdcbdeb
Opcode Fuzzy Hash: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction Fuzzy Hash: D801A476209712BEFB318AA19C41F37BBDCDF48612F184C5BFAD5C6190D929E4409B70

Function 1000406C Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(?,00000000,000F003F,00000000,?,00000000,00000000,80000001,10006D60,?,10006D60,80000001,00000000,00000000,REG_SZ,00000000), ref: 1000408A

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8241c048834319a8777681939fd791c1f2bb79611796acde0cc24ef85fc7be79
Instruction ID: 2e24eff2bcdac0d7bb79d22e3b0edd8e416dbe054c2d5b18b585679418e55d12
Opcode Fuzzy Hash: 8241c048834319a8777681939fd791c1f2bb79611796acde0cc24ef85fc7be79
Instruction Fuzzy Hash: 8DD0AE3200014EFBCF025F81ED05CDA3F6AFB0C2A9B068254FA1825030C777D9B1AB91

Function 100040BA Relevance: 1.5, APIs: 1, Instructions: 10registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,?), ref: 100040CC

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a195baf415497c3f6e756206114371a6254dc762b0ba02df47c96a08b610d07e
Instruction ID: 17287b262fc42a8ef4c3757039caf17c8ec33028492a73a8645d3109de99ba33
Opcode Fuzzy Hash: a195baf415497c3f6e756206114371a6254dc762b0ba02df47c96a08b610d07e
Instruction Fuzzy Hash: 40C0013200420EFBCF025F81EC058DA3F2AFB082A1B008010FE1804030C773D9B1EBA1

Function 10003F0A Relevance: 1.5, APIs: 1, Instructions: 10networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 10003F1C

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 8fdbf6ddd27a1d6b462f044f687e1b09091a90aa3cf3341bbc8376c5064c6b07
Instruction ID: b95a3e5d4d1581b579a43ffb785aa3053a804adf9b6b5080047aec5b24f95343
Opcode Fuzzy Hash: 8fdbf6ddd27a1d6b462f044f687e1b09091a90aa3cf3341bbc8376c5064c6b07
Instruction Fuzzy Hash: 32C0013200020EFBCF025F81EC058DA7F2AFB092A0B008010FA1804031C733D971AB95

Function 10003ECE Relevance: 1.5, APIs: 1, Instructions: 5synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: f03030767440787e5e8ee563cbeb237b89049fd46284869140ae0419c91515a8
Instruction ID: 0bba5641deb9fc7c6708226b57f3740a3060a6e77b98bc1f4937df3feb83fb0f
Opcode Fuzzy Hash: f03030767440787e5e8ee563cbeb237b89049fd46284869140ae0419c91515a8
Instruction Fuzzy Hash: 51B0093A408220BFDF025F90DD4880ABBA2BB88362F24C958F6A941031C7328420EB02

Function 10003FF7 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32(?,?,?), ref: 10004003

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: b2e0d57d01f7aa481c28775ec103b2c79e6903a2f37fda92ba0980fa6487b9be
Instruction ID: 299f2b121c0b8d63d2f16659a91a8a26a6eb1e7383ee0b7c2fbbf344de06ce20
Opcode Fuzzy Hash: b2e0d57d01f7aa481c28775ec103b2c79e6903a2f37fda92ba0980fa6487b9be
Instruction Fuzzy Hash: BCB0097A509210BFDF025B91DE4880ABBA2AB89321F10C958F2A940031C7328520EB12

Function 10004104 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

Process32First.KERNEL32(00000000,00000000), ref: 1000410C

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 4be810b948c5642b78a3303991c31d5753e2f497cabb41971bfbf009a223d646
Instruction ID: d0469a6573cf8832cc4e791a541241725128130187f64684ac8c75673cb250d8
Opcode Fuzzy Hash: 4be810b948c5642b78a3303991c31d5753e2f497cabb41971bfbf009a223d646
Instruction Fuzzy Hash: B8A00176509612ABDA42AB51CE4884ABEA2FBA8381F01C819F18940434CB3284A5EB12

Function 10004115 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(00000000,00000000), ref: 1000411D

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 96d6b844675e51e99f82aec0d05e68cf0a3385db677bffcb7afb410fd8c547f0
Instruction ID: 2ceb7d0ae5350f2ffb1294a1e21229299d690b4e3dcfc0507f8b466183483048
Opcode Fuzzy Hash: 96d6b844675e51e99f82aec0d05e68cf0a3385db677bffcb7afb410fd8c547f0
Instruction Fuzzy Hash: B1A00136408612ABDA42AB50CD4884ABEA2FBA8381F11C819F18941034CB3684A5EB12

Function 1000400A Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,1000824C,10015940), ref: 1000400E

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 2ee3dedfe077572030ca3591167bf26a544b4eb7bba9e94adf73c1260513ac4d
Instruction ID: e310fc801df329cbdffcf5e880badee8d9e0b58f708c6ac467addbfbb1e58057
Opcode Fuzzy Hash: 2ee3dedfe077572030ca3591167bf26a544b4eb7bba9e94adf73c1260513ac4d
Instruction Fuzzy Hash: 029002305055119BDE015B10CE4940A7E71AB84701B00C4A4E04541130C7328810EE01

Function 10004092 Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,10006DBE,?), ref: 10004096

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 2d988dbd5b15decafcf846d532543195a702f6c68f6a27351b5815321025a744
Instruction ID: c461232d01f39555025ee1551a6f08c036cd225bd5518e59674b318f5e785400
Opcode Fuzzy Hash: 2d988dbd5b15decafcf846d532543195a702f6c68f6a27351b5815321025a744
Instruction Fuzzy Hash: 799002705055119BDE415B11CF494097AA5AB84701B008458E04A41030C7318810EA01

Function 10003EB4 Relevance: 1.5, APIs: 1, Instructions: 3networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(00000000), ref: 10003EB8

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: dcfbcd4351272649fb1253f470343220905ed4c20dbbca1a40d0a1126bf3fd71
Instruction ID: ddc175de635f80408d7ee48a1059bf0ffdd1ba2c9e36570999931cb834b2f0bc
Opcode Fuzzy Hash: dcfbcd4351272649fb1253f470343220905ed4c20dbbca1a40d0a1126bf3fd71
Instruction Fuzzy Hash: F7900270545110ABDE015B21CF4A4097A61AB85B01B048454E14940031C7318810EA12

Function 10003F72 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(00080000,10005C92,?,?,%s\lang.ini,C:\Users\user\Desktop,?,00000000,00080000), ref: 10003F76

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 6dc1e466dda3ac71b59e7395498c1fa1529f77b3beb14a38e7d5df6994b7eb4f
Instruction ID: df56204a28902bd86cd8e7b59e1535f4ff11cbe2af3c274bf077f84441daad3a
Opcode Fuzzy Hash: 6dc1e466dda3ac71b59e7395498c1fa1529f77b3beb14a38e7d5df6994b7eb4f
Instruction Fuzzy Hash: 869002705051109BDF015B11CF494497A65AB84701B00855CF05A41431C7318910EA01

Function 0339002A Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 033900BE

Memory Dump Source

Source File: 00000004.00000002.3874703382.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3390000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: 737cc61f8d8c321ac22aab0ee3ceae0b3c58cf4e578e70d008536bacd0ee513f
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: 7FF02E2695A311ADFE18F7347CC8A27FB98DF43221B170D97DC40D7191DD19D84296E4

Non-executed Functions

Function 10003F41 Relevance: 1.5, APIs: 1, Instructions: 6filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,?,?), ref: 10003F51

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 17794e789735475d89bbd1f9c593eb9d99e0ec2b66a06d8a24d179cffc3f724c
Instruction ID: 66c4406e5843dae4aa23aa47ff20fa86481cf42106c3819bfbf8a2f6b8e79ef1
Opcode Fuzzy Hash: 17794e789735475d89bbd1f9c593eb9d99e0ec2b66a06d8a24d179cffc3f724c
Instruction Fuzzy Hash: 20B00872519392ABDF02DF91CD4482ABAA6BB89301F084C5CF2A540071C7328428EB02

Function 10003F63 Relevance: 1.5, APIs: 1, Instructions: 4shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(000000BC,000000BC), ref: 10003F6B

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExitWindows
String ID:
API String ID: 1089080001-0
Opcode ID: ddd05c4d22fa51185853cbc8baa1bf28f6a18d545d76c7cc1a4f4cf3c1112b8e
Instruction ID: a0a7e03ceb7acd9bb0d3454ea8bb5ca0f40435505fc546ba40186378cb909d0a
Opcode Fuzzy Hash: ddd05c4d22fa51185853cbc8baa1bf28f6a18d545d76c7cc1a4f4cf3c1112b8e
Instruction Fuzzy Hash: 81A00175509222EBDE025B51CE4888ABEA6AB88381F008858F28940031C77284A2EB02

Function 10008AAD Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e333d78722ad0821d4e98b6652e5a75445b5621be3666c330cc0561f1e3ae06e
Instruction ID: 9deb1ace0ade157a7cf376dc79b16b2541233208deadd1a3cef8bf08dc3f5488
Opcode Fuzzy Hash: e333d78722ad0821d4e98b6652e5a75445b5621be3666c330cc0561f1e3ae06e
Instruction Fuzzy Hash: 43F0682128E3C15DE30186685441BC1FF846B76314F0CC7CDB1D40B283C1954084CBA6

Function 1001E1FE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b9005d6082dbdac1a2845a9fd333a3e7a79171a5b874446ea0314262c5ac30
Instruction ID: f0cb1bca0584f7cb9865d2b0003cd1252f49916ae924d73bcd8c513b2b9b2d6d
Opcode Fuzzy Hash: 12b9005d6082dbdac1a2845a9fd333a3e7a79171a5b874446ea0314262c5ac30
Instruction Fuzzy Hash: 11E0E5A440C38AFEC703AB3488840E93FA6EE91310F04840CF4C403A02E3B589A09332

Function 1000720E Relevance: 28.4, APIs: 6, Strings: 10, Instructions: 366COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000008,00000001,?), ref: 10007338
VariantInit.OLEAUT32(?), ref: 1000734D
SafeArrayCreate.OLEAUT32(00000003,00000001,?), ref: 10007368
VariantInit.OLEAUT32(?), ref: 10007377

Part of subcall function 10007A62: VariantInit.OLEAUT32(?), ref: 10007AA1

SafeArrayCreate.OLEAUT32(00000008,00000001,00000002), ref: 10007505
VariantInit.OLEAUT32(?), ref: 10007513

Strings

Win32_NetworkAdapterConfiguration.Index=, xrefs: 100072A7
SetDNSServerSearchOrder, xrefs: 1000749B, 1000755F
SetGateways, xrefs: 100072F1, 100073F7
Index, xrefs: 1000725D
IPEnabled=TRUE, xrefs: 10007226
p=5w, xrefs: 1000733A, 10007513
DNSServerSearchOrder, xrefs: 10007519
Win32_NetworkAdapterConfiguration, xrefs: 1000722B
DefaultIPGateway, xrefs: 1000737C
GatewayCostMetric, xrefs: 100073BE

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant$ArrayCreateSafe
String ID: DNSServerSearchOrder$DefaultIPGateway$GatewayCostMetric$IPEnabled=TRUE$Index$SetDNSServerSearchOrder$SetGateways$Win32_NetworkAdapterConfiguration$Win32_NetworkAdapterConfiguration.Index=$p=5w
API String ID: 2640012081-3861124693
Opcode ID: 12229ab9ea9be2b5515b3a4e7304c5cbd28c893a32b3e86cd77fead74930fbe5
Instruction ID: ecf29a1c47d91b81846b45f5da98bbb69cd4e5f42de0d6ad34227a81938465a8
Opcode Fuzzy Hash: 12229ab9ea9be2b5515b3a4e7304c5cbd28c893a32b3e86cd77fead74930fbe5
Instruction Fuzzy Hash: DAD17E70D00209EFEB15CFA4C8809EEBBB8FF49780F104419F419AB259DB75AA45CFA1

Function 10005989 Relevance: 25.6, APIs: 4, Strings: 13, Instructions: 81COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100059AE
wsprintfA.USER32 ref: 100059FB
wsprintfA.USER32 ref: 10005A08
wsprintfA.USER32 ref: 10005A19

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 100059BF
C:\Users\user\Desktop\08e2VwqyI0.dll, xrefs: 100059C9, 100059CE, 100059DC
host123.zz.am:6658, xrefs: 10005A0A
C:\Users\user\Desktop\version.txt, xrefs: 10005A03
C:\Users\user\Desktop, xrefs: 100059D7, 100059DD, 100059E5, 100059F0, 100059FD
12010043, xrefs: 100059A9
M%s, xrefs: 10005A0F
Mhost123.zz.am:6658, xrefs: 10005A14
C:\Users\user\Desktop\12010043, xrefs: 100059F6
%s\%s, xrefs: 100059F1
ECF4BB45F69C, xrefs: 10005A4B
%s\version.txt, xrefs: 100059FE
12010043, xrefs: 1000599D, 100059A3

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %s\%s$%s\version.txt$12010043$12010043$C:\Users\user\Desktop$C:\Users\user\Desktop\08e2VwqyI0.dll$C:\Users\user\Desktop\12010043$C:\Users\user\Desktop\version.txt$C:\Windows\SysWOW64\rundll32.exe$ECF4BB45F69C$M%s$Mhost123.zz.am:6658$host123.zz.am:6658
API String ID: 2111968516-1096733929
Opcode ID: 857beac2df9e912fa28a8a8c5910c135d4b4ee4941f056ece51d960c3556155a
Instruction ID: 32e0762688fea209a997a92a9e142d3ada4c65c650573aee4fc5e34dd7d3b294
Opcode Fuzzy Hash: 857beac2df9e912fa28a8a8c5910c135d4b4ee4941f056ece51d960c3556155a
Instruction Fuzzy Hash: 961159356007197BF210E7919C45F5F7E9CDF896A6F01021DFB01AE181DB76F9818A72

Function 10004D36 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 308COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10004EC5
VariantInit.OLEAUT32(?), ref: 10004ECB
VariantInit.OLEAUT32(?), ref: 10004ED1
VariantInit.OLEAUT32(?,?,?,?,?,?,?,?,?,10016AD0,00000000,00080000), ref: 10005009
VariantInit.OLEAUT32(?,?,?,?,?,?,?,?,?,10016AD0,00000000,00080000), ref: 1000500F

Strings

CommandLine, xrefs: 10004EF7
svchost.exe -k NetworkService, xrefs: 10004FE0
ProcessID, xrefs: 10004F0C
p=5w, xrefs: 10004E9C
Name, xrefs: 10004EE2
SELECT * FROM , xrefs: 10004DEA
svchost.exe, xrefs: 10004F6F
WQL, xrefs: 10004E42

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: CommandLine$Name$ProcessID$SELECT * FROM $WQL$p=5w$svchost.exe$svchost.exe -k NetworkService
API String ID: 1927566239-4270180057
Opcode ID: b6f3bf19f9a655f11ce33ea3d1eef9f97ff5ff13253a98ebad0314bfa4936779
Instruction ID: f681daf1cfe066dfb2c65bb1802d225618d831e3fba353d21c944956626e3e16
Opcode Fuzzy Hash: b6f3bf19f9a655f11ce33ea3d1eef9f97ff5ff13253a98ebad0314bfa4936779
Instruction Fuzzy Hash: 23A159B1900209AFEB04DFA4CC81DEEBBBDEF48394F104569F515AB295DB31AE45CB60

Function 1000570F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 102filethreadCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1000574F
wsprintfA.USER32 ref: 100057B1
wsprintfA.USER32 ref: 100057C5
PrintFile.08E2VWQYI0(?,?,00000000,?,?,?,?,?,?,?,10016AD0,00000000,00080000,?,1000720C), ref: 100057E8
CreateThread.KERNEL32(00000000,00000000,10005620,00000000,00000000,00000000), ref: 10005835

Strings

ROOT\CIMv2, xrefs: 100057F2
c:\windows\system32\drivers\%s, xrefs: 100057AB
c:\windows\system32\drivers\%s\%s, xrefs: 100057BF
%s\%s, xrefs: 10005749
Win32_process, xrefs: 100057ED

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$CreateFilePrintThread
String ID: %s\%s$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s
API String ID: 1788855648-1421401311
Opcode ID: ae8518da5cd223e832b712c6548c98f9a89997a3f3d4d6029e7fac4c4bf50c1f
Instruction ID: 590dfccee83cd698aee2aff2a0aef7bd89598b4f0e32949fa848c193a7d694e7
Opcode Fuzzy Hash: ae8518da5cd223e832b712c6548c98f9a89997a3f3d4d6029e7fac4c4bf50c1f
Instruction Fuzzy Hash: 0531EA72910238BBEB21D7A4CC45FCF7B6CEB08356F0404A6F708FA051DB75AA858A91

Function 100053B7 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 179sleepfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10005437
wsprintfA.USER32 ref: 1000549E
wsprintfA.USER32 ref: 100054BC
PrintFile.08E2VWQYI0(?,?,10016594,?,00000000), ref: 100054DE
wsprintfA.USER32 ref: 10005582
Sleep.KERNEL32(000003E8,00000000,76C08400,?,40000000,00000001,00000000,00000002,00000000,00000000,7541C650,?,?,00000009,00000000,10016594), ref: 100055AE

Strings

c:\windows\system32\drivers\%s, xrefs: 10005498
%s\%s, xrefs: 10005431
Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz, xrefs: 100054A9

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$FilePrintSleep
String ID: %s\%s$Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz$c:\windows\system32\drivers\%s
API String ID: 518940211-4228670124
Opcode ID: c361d524b353549e0f38205e8cfe1225c09218ba4335209976bd8a7148bd2516
Instruction ID: 3567043749f32881e03762bb9a57e308b600a04db8eea4acb5e64ce7ea9520bd
Opcode Fuzzy Hash: c361d524b353549e0f38205e8cfe1225c09218ba4335209976bd8a7148bd2516
Instruction Fuzzy Hash: 9751C272900658BFEB11CB68CC45FEE73ADEB48341F1404A5FA08AB191DBB1FE858B50

Function 10004351 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,cmd.exe), ref: 100043A6
Sleep.KERNEL32(000003E8), ref: 100043E5

Strings

QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LmV4ZQ==, xrefs: 100043A8, 100043AD, 100043CB
self, xrefs: 1000437E
cmd.exe, xrefs: 1000435C, 10004362, 10004370
QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LnZpcg==, xrefs: 100043BF

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LmV4ZQ==$QzpcXFdpbmRvd3NcXDZDNERBNkZCXFxzdmNoc290LnZpcg==$cmd.exe$self
API String ID: 3472027048-2620343502
Opcode ID: 3f59aa8a2a531e52e96b689b157fed57f8b0b4aca2b36427f54941e0ecbe5060
Instruction ID: 2962837d3e63ffe82077fec71eea4cc39f059f6aab2461bdb2792d37a05628b4
Opcode Fuzzy Hash: 3f59aa8a2a531e52e96b689b157fed57f8b0b4aca2b36427f54941e0ecbe5060
Instruction Fuzzy Hash: 370126BA000394BAFB12BB74EC46F9E3B5CDF452E2F120016F9446D086CEB5AA804565

Function 10005F15 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98timeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000001,SeShutdownPrivilege,00000001,00000000,00000000,?,000000BC,00000000,?,000000BC,00000000,?,00000128,00000000), ref: 10005F21

Part of subcall function 10004126: OpenProcessToken.ADVAPI32(00000028,00000028,00000028,10005F32,00000000,00000028,00000000,00000001,SeShutdownPrivilege,00000001,00000000,00000000,?,000000BC,00000000,?), ref: 10004132

Part of subcall function 100040F1: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,00000000), ref: 100040FD

___crtGetTimeFormatEx.LIBCMT ref: 10005F79

Part of subcall function 1000404F: AdjustTokenPrivileges.ADVAPI32(00000000,00000010,?,00000000,00000000,10005F7E,?,10005F7E,00000000,00000000,?,00000010,00000000,00000000), ref: 10004064

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005FD4

Strings

%s\lang.ini, xrefs: 10005FAE
C:\Users\user\Desktop, xrefs: 10005FA3

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessTimerToken$AdjustConcurrency::details::platform::__CreateCurrentFormatLookupOpenPrivilegePrivilegesQueueTimeValue___crt
String ID: %s\lang.ini$C:\Users\user\Desktop
API String ID: 3793502078-2679580386
Opcode ID: 4c2164c536502c8c7bf62064663df8d628c4358b27154a1aa27f72d12e264788
Instruction ID: ec7a4272703c46c275716bc18e38bfb45c62e376eb564a1a1e1e8047e794edd2
Opcode Fuzzy Hash: 4c2164c536502c8c7bf62064663df8d628c4358b27154a1aa27f72d12e264788
Instruction Fuzzy Hash: FE21BDB6D00119BEEB10DAA4CC02FEF7BBCDF04790F104021FA04E6185EA75AB809AE1

Function 10005CF7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F72: PathFileExistsA.SHLWAPI(00080000,10005C92,?,?,%s\lang.ini,C:\Users\user\Desktop,?,00000000,00080000), ref: 10003F76

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005D61

Strings

%s\lang.ini, xrefs: 10005D26
C:\Users\user\Desktop, xrefs: 10005D16
http://, xrefs: 10005D87
search, xrefs: 10005D9B

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Timer$Concurrency::details::platform::__CreateExistsFilePathQueue
String ID: %s\lang.ini$C:\Users\user\Desktop$http://$search
API String ID: 1721638100-2691734327
Opcode ID: d1da8393b741fbea104cea0a346650b348cc7a6ae7d15635f455682e2727de3c
Instruction ID: d10eea2e68a17fc7dae01a0a692719cf89fcc4e95e635f9962b470bf74251c26
Opcode Fuzzy Hash: d1da8393b741fbea104cea0a346650b348cc7a6ae7d15635f455682e2727de3c
Instruction Fuzzy Hash: D81106769081197FFB61DAA4CC42FDB776CDB143D5F1045B2FB48A9080EA72AFC44A60

Function 10005C4C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F72: PathFileExistsA.SHLWAPI(00080000,10005C92,?,?,%s\lang.ini,C:\Users\user\Desktop,?,00000000,00080000), ref: 10003F76

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005CB6

Strings

%s\lang.ini, xrefs: 10005C7B
C:\Users\user\Desktop, xrefs: 10005C6B
http://, xrefs: 10005CDC

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Timer$Concurrency::details::platform::__CreateExistsFilePathQueue
String ID: %s\lang.ini$C:\Users\user\Desktop$http://
API String ID: 1721638100-4272537799
Opcode ID: 354cb08d00e8bc516f166db664e2c84127a23412515739fcecc10b8ce6ebd26b
Instruction ID: 275623b6bb4d38d455d16e038d1f67d5d5eba5b08857937f3fa6caa2442e2442
Opcode Fuzzy Hash: 354cb08d00e8bc516f166db664e2c84127a23412515739fcecc10b8ce6ebd26b
Instruction Fuzzy Hash: 131104769041197EFB21DAA4CC42FDB776CDB14384F0085B1FA48B6080EA71AF884660

Function 100087F4 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 32sleepCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10008824
Sleep.KERNEL32(000007D0,?,?), ref: 10008845

Strings

C:\Users\user\Desktop, xrefs: 1000880B
Y21kLmV4ZSAvYyBwaW5nIDEyNy4wLjAuMSAtbiAzJnJkIC9zIC9xICIlcyI=, xrefs: 10008810

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: C:\Users\user\Desktop$Y21kLmV4ZSAvYyBwaW5nIDEyNy4wLjAuMSAtbiAzJnJkIC9zIC9xICIlcyI=
API String ID: 1749205058-715194466
Opcode ID: d826f062264427af496b9675ff0d63a37454a8e3147eb2671c5731483726d261
Instruction ID: cb8f3af107b47666e7401f40fe0349a9d09f1feb376e898973d7629cffdb37cc
Opcode Fuzzy Hash: d826f062264427af496b9675ff0d63a37454a8e3147eb2671c5731483726d261
Instruction Fuzzy Hash: 00F0AEF250019DABEB15CBA4CC857EA3768FF04285F040975F705F5051DBB19AC44A55

Function 10007A62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10007AA1

Strings

, xrefs: 10007B0D
p=5w, xrefs: 10007AA1

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: $p=5w
API String ID: 1927566239-2851331367
Opcode ID: d0ca9816adfda9363097ead228823b8de7426d0966cf0e74972078de5e0d5c66
Instruction ID: ef89c2eb01536c9538a48ebd5608185a951f11054c82c4a53c762a0a2007c409
Opcode Fuzzy Hash: d0ca9816adfda9363097ead228823b8de7426d0966cf0e74972078de5e0d5c66
Instruction Fuzzy Hash: AB41A475D002599FEF14DFA4C884AEEB7F8FF05284F10446DE91AA3245DB38AE48CB61

Function 10005F98 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31timeCOMMON

Download Yara Rule

APIs

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005FD4

Part of subcall function 10004015: CreateFileA.KERNEL32(00000080,00000003,00000000,00000000,80000000,?,10005CBB,?,10005CBB,?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 1000402D

Strings

%s\lang.ini, xrefs: 10005FAE
C:\Users\user\Desktop, xrefs: 10005FA3

Memory Dump Source

Source File: 00000004.00000002.3925361248.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3925334156.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925386960.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925411579.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925436103.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925470881.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3925504271.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CreateTimer$Concurrency::details::platform::__FileQueue
String ID: %s\lang.ini$C:\Users\user\Desktop
API String ID: 3486561800-2679580386
Opcode ID: b1726d4115c593d66bb357bf89ab1e7ee1f9c93add6e05033f4287082a534528
Instruction ID: 2e9b22e8cb94d114ab57fa925500967999958ebf182bde47e5e7f2d31677baea
Opcode Fuzzy Hash: b1726d4115c593d66bb357bf89ab1e7ee1f9c93add6e05033f4287082a534528
Instruction Fuzzy Hash: 23E0687290112432E670D1669C07FCF3E9CDB857F4F000220B688E60C4DAB4AAC4C6E0

Analysis Process: rundll32.exePID: 1308, Parent PID: 1996COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04710C8D Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 04710D78
wsprintfA.USER32(?,?,?,?), ref: 04710E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 04710E34
ExitProcess.KERNEL32(00000000), ref: 04710E3C

Strings

SWVU, xrefs: 04710D80, 04710D94, 04710D9A, 04710DA0, 04710DBD
Application error, xrefs: 04710E30
The procedure %s could not be located in the DLL %s., xrefs: 04710E14

Memory Dump Source

Source File: 0000000A.00000002.1436266774.0000000004710000.00000040.00001000.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4710000_rundll32.jbxd

Similarity

API ID: AllocExitMessageProcessVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 1926473177-4283279704
Opcode ID: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction ID: 2c9dd46cf9686134bcd8465d4408e129fc0587f713d2416b3b3a6723df39e800
Opcode Fuzzy Hash: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction Fuzzy Hash: 6F5103312057C58FDB368F24CC84ADB3BB5AF06304F09419EDD869B6A6EB34B818CB50

Function 04710CF9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 04710D78
wsprintfA.USER32(?,?,?,?), ref: 04710E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 04710E34
ExitProcess.KERNEL32(00000000), ref: 04710E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 04710E85

Strings

SWVU, xrefs: 04710D80, 04710D94, 04710D9A, 04710DA0, 04710DBD
Application error, xrefs: 04710E30
The procedure %s could not be located in the DLL %s., xrefs: 04710E14

Memory Dump Source

Source File: 0000000A.00000002.1436266774.0000000004710000.00000040.00001000.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4710000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction ID: 81f42de33e08f78c1601f8ed2f0f5fd2bc383c776d99eafd827dbb30f61b8df7
Opcode Fuzzy Hash: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction Fuzzy Hash: 61418C322007469BEB34DF29CC84EEB73A5EF48355F044118EE46A7798EB70B955CB90

Function 04710D32 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 04710D78
wsprintfA.USER32(?,?,?,?), ref: 04710E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 04710E34
ExitProcess.KERNEL32(00000000), ref: 04710E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 04710E85

Strings

SWVU, xrefs: 04710D80, 04710D94, 04710D9A, 04710DA0, 04710DBD
Application error, xrefs: 04710E30
The procedure %s could not be located in the DLL %s., xrefs: 04710E14

Memory Dump Source

Source File: 0000000A.00000002.1436266774.0000000004710000.00000040.00001000.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4710000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction ID: a6b36580d22fd4c26a6961609938a0eabdb25f74a4351e88f350dc6279e2fb90
Opcode Fuzzy Hash: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction Fuzzy Hash: A631A9322003869FEB389F29CC84FEB77A5AF48355F00411DEE4697A95EB70B814CB50

Function 047114C0 Relevance: 3.0, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 047114EF
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 0471150D

Memory Dump Source

Source File: 0000000A.00000002.1436266774.0000000004710000.00000040.00001000.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4710000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: 7e56a9df98f4e51ecf5612cc5e013fa7e4570dc312fc51ecf998214a7cf9962b
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 2FF0E933240245AFEB098F68D885EEE7768DF48398B20006AF7029E286CA71E551C754

Function 04710063 Relevance: 2.6, APIs: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0471007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 047100BE

Memory Dump Source

Source File: 0000000A.00000002.1436266774.0000000004710000.00000040.00001000.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4710000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction ID: d8b898f0a42fc4ce432f4baba8389eeee95ebcbd13c5f1be8cd0385d593b33a7
Opcode Fuzzy Hash: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction Fuzzy Hash: D001F4722096417EE7314AA59C00F33BBDCDF08316F044C9AFAD5C15A0D922F5808B30

Function 0471002A Relevance: 1.3, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 047100BE

Memory Dump Source

Source File: 0000000A.00000002.1436266774.0000000004710000.00000040.00001000.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4710000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: 956f17df4fc2b6097bdacbffc3e1b2349db9036a38f53b72c292ba346bb5c6fb
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: 4EF0593225A38169F31067387D48A27BB98DB02229B050D97DC40D25B1DD11E98286A4

Analysis Process: rundll32.exePID: 1976, Parent PID: 1996COMMON

Executed Functions

Function 1000CCF2 Relevance: 1.3, Strings: 1, Instructions: 2COMMON

Download Yara Rule

Strings

12010043, xrefs: 1000CCEC, 1000CCF7, 1000CCF8

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 12010043
API String ID: 0-1530405306
Opcode ID: 244b7cbdff811d894f755473b4da469e1646f99ca6ba9c142f7eec193f4a55a6
Instruction ID: d8f586cfb2acdd232f2dfe4693d98a20b48973cb1efe48d49be8cb568dbb4cca
Opcode Fuzzy Hash: 244b7cbdff811d894f755473b4da469e1646f99ca6ba9c142f7eec193f4a55a6
Instruction Fuzzy Hash:

Non-executed Functions

Function 1000720E Relevance: 28.4, APIs: 6, Strings: 10, Instructions: 366COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000008,00000001,?), ref: 10007338
VariantInit.OLEAUT32(?), ref: 1000734D
SafeArrayCreate.OLEAUT32(00000003,00000001,?), ref: 10007368
VariantInit.OLEAUT32(?), ref: 10007377

Part of subcall function 10007A62: VariantInit.OLEAUT32(?), ref: 10007AA1

SafeArrayCreate.OLEAUT32(00000008,00000001,00000002), ref: 10007505
VariantInit.OLEAUT32(?), ref: 10007513

Strings

DefaultIPGateway, xrefs: 1000737C
IPEnabled=TRUE, xrefs: 10007226
GatewayCostMetric, xrefs: 100073BE
Index, xrefs: 1000725D
DNSServerSearchOrder, xrefs: 10007519
SetDNSServerSearchOrder, xrefs: 1000749B, 1000755F
p=5w, xrefs: 1000733A, 10007513
Win32_NetworkAdapterConfiguration, xrefs: 1000722B
Win32_NetworkAdapterConfiguration.Index=, xrefs: 100072A7
SetGateways, xrefs: 100072F1, 100073F7

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant$ArrayCreateSafe
String ID: DNSServerSearchOrder$DefaultIPGateway$GatewayCostMetric$IPEnabled=TRUE$Index$SetDNSServerSearchOrder$SetGateways$Win32_NetworkAdapterConfiguration$Win32_NetworkAdapterConfiguration.Index=$p=5w
API String ID: 2640012081-3861124693
Opcode ID: 771ce970c353409643c1e51f5a1a866829e869cd5479564b662196a77da70a54
Instruction ID: ecf29a1c47d91b81846b45f5da98bbb69cd4e5f42de0d6ad34227a81938465a8
Opcode Fuzzy Hash: 771ce970c353409643c1e51f5a1a866829e869cd5479564b662196a77da70a54
Instruction Fuzzy Hash: DAD17E70D00209EFEB15CFA4C8809EEBBB8FF49780F104419F419AB259DB75AA45CFA1

Function 10004D36 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 308COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10004EC5
VariantInit.OLEAUT32(?), ref: 10004ECB
VariantInit.OLEAUT32(?), ref: 10004ED1
VariantInit.OLEAUT32(?), ref: 10005009
VariantInit.OLEAUT32(?), ref: 1000500F

Strings

WQL, xrefs: 10004E42
SELECT * FROM , xrefs: 10004DEA
Name, xrefs: 10004EE2
svchost.exe -k NetworkService, xrefs: 10004FE0
p=5w, xrefs: 10004E9C
svchost.exe, xrefs: 10004F6F
ProcessID, xrefs: 10004F0C
CommandLine, xrefs: 10004EF7

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: CommandLine$Name$ProcessID$SELECT * FROM $WQL$p=5w$svchost.exe$svchost.exe -k NetworkService
API String ID: 1927566239-4270180057
Opcode ID: b6f3bf19f9a655f11ce33ea3d1eef9f97ff5ff13253a98ebad0314bfa4936779
Instruction ID: f681daf1cfe066dfb2c65bb1802d225618d831e3fba353d21c944956626e3e16
Opcode Fuzzy Hash: b6f3bf19f9a655f11ce33ea3d1eef9f97ff5ff13253a98ebad0314bfa4936779
Instruction Fuzzy Hash: 23A159B1900209AFEB04DFA4CC81DEEBBBDEF48394F104569F515AB295DB31AE45CB60

Function 10006EDE Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 174sleepfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 10006F24
Sleep.KERNEL32 ref: 10007059
wsprintfA.USER32 ref: 1000709D
PrintFile.08E2VWQYI0(00000000,?,00000000), ref: 100070D6
PrintFile.08E2VWQYI0(00000000,?,00000000,?,00000000), ref: 100070E9

Strings

XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 10006F90
QVNEU3ZjLmV4ZQ==, xrefs: 10006EEE
http://107.160.131.254:23588/article.php, xrefs: 10007007
QVlSVFNydi5heWU=, xrefs: 10006EFA
c:\1.txt, xrefs: 10007047
iOffset, xrefs: 10007042
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 10006F79

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: FilePrintSleep$wsprintf
String ID: QVNEU3ZjLmV4ZQ==$QVlSVFNydi5heWU=$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$c:\1.txt$http://107.160.131.254:23588/article.php$iOffset
API String ID: 1547040302-3813294871
Opcode ID: 7c7c87d37a25e933c3930475f6f6c1f502c6fe5351302a316d4f9e37d4858cab
Instruction ID: e128ca64511400ca05deee7795c3814a468ccd3a13c6d035e862ae5cb279fd62
Opcode Fuzzy Hash: 7c7c87d37a25e933c3930475f6f6c1f502c6fe5351302a316d4f9e37d4858cab
Instruction Fuzzy Hash: AC51D9B6D04359E6FB22D764CC56FCF77ACEB083C1F1045A5F208EA086DA75AB808E55

Function 1000570F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 102filethreadCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1000574F
wsprintfA.USER32 ref: 100057B1
wsprintfA.USER32 ref: 100057C5
PrintFile.08E2VWQYI0(?,?,00000000), ref: 100057E8
CreateThread.KERNEL32(00000000,00000000,Function_00005620,00000000,00000000,00000000), ref: 10005835

Strings

%s\%s, xrefs: 10005749
ROOT\CIMv2, xrefs: 100057F2
c:\windows\system32\drivers\%s, xrefs: 100057AB
Win32_process, xrefs: 100057ED
c:\windows\system32\drivers\%s\%s, xrefs: 100057BF

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$CreateFilePrintThread
String ID: %s\%s$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s
API String ID: 1788855648-1421401311
Opcode ID: 6fb47a9fe862675510a1f075e21a27b9bead55373d009136fb6ced19a80d2edf
Instruction ID: 590dfccee83cd698aee2aff2a0aef7bd89598b4f0e32949fa848c193a7d694e7
Opcode Fuzzy Hash: 6fb47a9fe862675510a1f075e21a27b9bead55373d009136fb6ced19a80d2edf
Instruction Fuzzy Hash: 0531EA72910238BBEB21D7A4CC45FCF7B6CEB08356F0404A6F708FA051DB75AA858A91

Function 100053B7 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 179sleepfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10005437
wsprintfA.USER32 ref: 1000549E
wsprintfA.USER32 ref: 100054BC
PrintFile.08E2VWQYI0(?,?,10016594,?,00000000), ref: 100054DE
wsprintfA.USER32 ref: 10005582
Sleep.KERNEL32(000003E8,00000000,76C08400,?,40000000,00000001,00000000,00000002,00000000,00000000,7541C650,?,?,00000009,00000000,10016594), ref: 100055AE

Strings

%s\%s, xrefs: 10005431
c:\windows\system32\drivers\%s, xrefs: 10005498
Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz, xrefs: 100054A9

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$FilePrintSleep
String ID: %s\%s$Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz$c:\windows\system32\drivers\%s
API String ID: 518940211-4228670124
Opcode ID: 39048bcfdf3bf410764be82e0f082a0a9eec60ddbb964b0eb01d8c58901bbfe8
Instruction ID: 3567043749f32881e03762bb9a57e308b600a04db8eea4acb5e64ce7ea9520bd
Opcode Fuzzy Hash: 39048bcfdf3bf410764be82e0f082a0a9eec60ddbb964b0eb01d8c58901bbfe8
Instruction Fuzzy Hash: 9751C272900658BFEB11CB68CC45FEE73ADEB48341F1404A5FA08AB191DBB1FE858B50

Function 10005989 Relevance: 15.1, APIs: 4, Strings: 6, Instructions: 81COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100059AE
wsprintfA.USER32 ref: 100059FB
wsprintfA.USER32 ref: 10005A08
wsprintfA.USER32 ref: 10005A19

Strings

12010043, xrefs: 1000599D, 100059A3
%s\%s, xrefs: 100059F1
F896SD5DAE, xrefs: 10005A14
host123.zz.am:6658, xrefs: 10005A0A
M%s, xrefs: 10005A0F
%s\version.txt, xrefs: 100059FE

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %s\%s$%s\version.txt$12010043$F896SD5DAE$M%s$host123.zz.am:6658
API String ID: 2111968516-3890874662
Opcode ID: 3118e657eae3f5d2f61f4ee869a04ddae59cc99c3ba34e718331a143210d2a8d
Instruction ID: 32e0762688fea209a997a92a9e142d3ada4c65c650573aee4fc5e34dd7d3b294
Opcode Fuzzy Hash: 3118e657eae3f5d2f61f4ee869a04ddae59cc99c3ba34e718331a143210d2a8d
Instruction Fuzzy Hash: 961159356007197BF210E7919C45F5F7E9CDF896A6F01021DFB01AE181DB76F9818A72

Function 10006499 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 272timeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100064F7

Part of subcall function 10003F0A: InternetOpenA.WININET(?,?,?,?,?), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 10006546

Part of subcall function 10003F24: InternetOpenUrlA.WININET(?,?,?,?,?,?), ref: 10003F39

Part of subcall function 10003F41: InternetReadFile.WININET(?,?,?,?), ref: 10003F51

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,0007D000,00000000,00000000), ref: 100065C8
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,?,?,?,?,0007D000,00000000,00000000), ref: 100065E6
wsprintfA.USER32 ref: 100066E9

Strings

title, xrefs: 10006647, 1000664C, 10006655
aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==, xrefs: 100064DF
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 1000651A

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: Internet$ByteCharMultiOpenWidewsprintf$FileFormatReadTime___crt
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==$title
API String ID: 4077377486-2496724313
Opcode ID: 5ec698da00dc29de8f7ffc8bf67f0a9d9225dbf0750770383525da2cc9019453
Instruction ID: 9bb45785208bde0406de56643d62444fa716b577ceefe44749a59ab2aa42cbd8
Opcode Fuzzy Hash: 5ec698da00dc29de8f7ffc8bf67f0a9d9225dbf0750770383525da2cc9019453
Instruction Fuzzy Hash: 9C81E5B5C05248BEFB01DBA4DC82EEF7B7EEF09394F244059F504A7186DA356E4187A1

Function 10005DB4 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 116timeCOMMON

Download Yara Rule

APIs

___crtGetTimeFormatEx.LIBCMT ref: 10005E11

Part of subcall function 1000409D: RegQueryValueExA.ADVAPI32(?,?,?,?,?,?), ref: 100040B2

Part of subcall function 10004092: RegCloseKey.ADVAPI32(?,10005E1E,?,?,ProcessorNameString,00000000,00000004,?,?,80000002,?,00000000,000F003F,?), ref: 10004096

Strings

12010043, xrefs: 10005E8F
%u MB, xrefs: 10005E7E
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10005DC5
http://107.160.131.254:23588/article.php, xrefs: 10005EF8
Find CPU Error, xrefs: 10005E36
ProcessorNameString, xrefs: 10005E02
@, xrefs: 10005E57

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: CloseFormatQueryTimeValue___crt
String ID: %u MB$12010043$@$Find CPU Error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$http://107.160.131.254:23588/article.php
API String ID: 271660946-3893357082
Opcode ID: 6ebe894f3437417800d54ef2792eb82f2068fe9e67a777853d7c8d0efda6717d
Instruction ID: 4f35d1d9e5d3edf0c8f7125bb17b53cb037807f44d0344e2d1e4939474d77481
Opcode Fuzzy Hash: 6ebe894f3437417800d54ef2792eb82f2068fe9e67a777853d7c8d0efda6717d
Instruction Fuzzy Hash: 6531C0B6804208BAFB10C764DC42FDF77BCEB08351F10406AFA18BA082EB75BA458B55

Function 10007F3E Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 230COMMON

Download Yara Rule

Strings

107.160.131.254:23588/article.php, xrefs: 10008113
%s\%s, xrefs: 10008067
L2ltYWdlLnBocA==, xrefs: 1000818B
P, xrefs: 100080F7
*.*, xrefs: 10007F8C
., xrefs: 10007FCF
NPKI, xrefs: 1000802C

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %s\%s$*.*$.$107.160.131.254:23588/article.php$L2ltYWdlLnBocA==$NPKI$P
API String ID: 0-2039984758
Opcode ID: bd2d39ad8c3f066515e4f40e719d80e45a5746cb50308c2dc9da521a7abe9638
Instruction ID: 154fd83921e69bd95517e48f0429fd4d3315e101fc3602ca34ca7394d0d5f03d
Opcode Fuzzy Hash: bd2d39ad8c3f066515e4f40e719d80e45a5746cb50308c2dc9da521a7abe9638
Instruction Fuzzy Hash: C371517690425DBEEB61D7A4DC45FEEB7BCEB48240F1004E6F608E6041DB74AB898F61

Function 1000826C Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 145sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00080000,00000000,00000000), ref: 10008394
wsprintfA.USER32 ref: 100083E6

Strings

XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 100082DC
Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=, xrefs: 10008405
http://107.160.131.254:23588/article.php, xrefs: 10008353
8.8.8.8, xrefs: 100083EF
127.0.0.1, xrefs: 100083F4
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 100082C5

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: 127.0.0.1$8.8.8.8$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=$http://107.160.131.254:23588/article.php
API String ID: 1749205058-626475063
Opcode ID: 9f7dfab18579cecf97e90eb8dea0a0d842579079791f42c3668da9ca524ab5bf
Instruction ID: 78e0688a60563a7bb1736696f6623559e09cac3deedd02f0104af55f58a5e4a8
Opcode Fuzzy Hash: 9f7dfab18579cecf97e90eb8dea0a0d842579079791f42c3668da9ca524ab5bf
Instruction Fuzzy Hash: 9E4106B6D04258B6F721D364CC46FCF77ACEB457C0F2400A6F248A9086EAB4AB848E51

Function 10006CF7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003FF7: GetShortPathNameA.KERNEL32(?,?,?), ref: 10004003

Part of subcall function 1000406C: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 1000408A

wsprintfA.USER32 ref: 10006D88
___crtGetTimeFormatEx.LIBCMT ref: 10006DAE

Part of subcall function 100040D4: RegSetValueExA.ADVAPI32(?,?,?,?,?,?), ref: 100040E9

Part of subcall function 10004092: RegCloseKey.ADVAPI32(?,10005E1E,?,?,ProcessorNameString,00000000,00000004,?,?,80000002,?,00000000,000F003F,?), ref: 10004096

Strings

dtfd, xrefs: 10006DA6
U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 10006D4A
REG_SZ, xrefs: 10006D44
%s "%s",DoAddToFavDlg, xrefs: 10006D82

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateFormatNamePathShortTimeValue___crtwsprintf
String ID: %s "%s",DoAddToFavDlg$REG_SZ$U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$dtfd
API String ID: 1762869224-3711648159
Opcode ID: 61d0bd0e05473ddd948e32944040b939d5f1ffa9c41235ae9aa68812b1daf432
Instruction ID: 20d4b35ab7fa00c236079ec8a4dd8982143edab80ee48f6a2419757257224b01
Opcode Fuzzy Hash: 61d0bd0e05473ddd948e32944040b939d5f1ffa9c41235ae9aa68812b1daf432
Instruction Fuzzy Hash: 451160B694415CBEFB11D7A4DC86FEA776CEB14340F1404A1F704FA085DAB16F988AA4

Function 10006A6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 10003ECE: CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

GetLastError.KERNEL32 ref: 10006AA8

Part of subcall function 10006499: wsprintfA.USER32 ref: 100064F7
Part of subcall function 10006499: ___crtGetTimeFormatEx.LIBCMT ref: 10006546

Sleep.KERNEL32(0002BF20,00000000,00000000,00000000,00000000,000000FF), ref: 10006ADD
CreateThread.KERNEL32(00000000,00000000,Function_0000687E,00000000,00000000,00000000), ref: 10006AF1

Strings

0x5d65r455f, xrefs: 10006A97
5762479093, xrefs: 10006AC7

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: Create$ErrorFormatLastMutexSleepThreadTime___crtwsprintf
String ID: 0x5d65r455f$5762479093
API String ID: 3244495550-2446933972
Opcode ID: 19283e5acea808ec0441168ab06e47d1eb0b849edc2e8a1a8406e88d778b2533
Instruction ID: bd1adab126fe453b34de0ea9e0b5f284958d10fa0a203dc352c1be2a30225ce5
Opcode Fuzzy Hash: 19283e5acea808ec0441168ab06e47d1eb0b849edc2e8a1a8406e88d778b2533
Instruction Fuzzy Hash: 9701F2A4844228BAF211F3704CCADBF395DDB563D4F200528F915A908BDB24EC0145B3

Function 10008567 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 79sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 1000857E
Sleep.KERNEL32(001B7740,?,00000000,80000002,00000000,00000000,000F003F,?), ref: 100085BF

Strings

aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=, xrefs: 10008580
wINsTA0\dEFauLT, xrefs: 1000862C
D, xrefs: 10008612

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: D$aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=$wINsTA0\dEFauLT
API String ID: 3472027048-3516831565
Opcode ID: a435b5dfb969170efa786a49c8884d6de8dbe2a3431997f47b479d14d9b9b80c
Instruction ID: 69b21accf233d090089117fd856bc82e5cd65d02c06b2ff4ec7ccf08b8a7457c
Opcode Fuzzy Hash: a435b5dfb969170efa786a49c8884d6de8dbe2a3431997f47b479d14d9b9b80c
Instruction Fuzzy Hash: 6421817680525CBAEB11EBE4CC46EDFBB7CEF08390F1400A9F604BB151DB765A458B91

Function 10005F15 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98timeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 10005F21

Part of subcall function 10004126: OpenProcessToken.ADVAPI32(00000028,00000028,00000028,10005F32,00000000,00000028,?), ref: 10004132

Part of subcall function 100040F1: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,00000000), ref: 100040FD

___crtGetTimeFormatEx.LIBCMT ref: 10005F79

Part of subcall function 1000404F: AdjustTokenPrivileges.ADVAPI32(?,?,?,?,?,?), ref: 10004064

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005FD4

Strings

%s\lang.ini, xrefs: 10005FAE

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessTimerToken$AdjustConcurrency::details::platform::__CreateCurrentFormatLookupOpenPrivilegePrivilegesQueueTimeValue___crt
String ID: %s\lang.ini
API String ID: 3793502078-1858510373
Opcode ID: 943eacc63be365ee390a7fa6fdfefc3784325c993301e913e17fb999f353862f
Instruction ID: ec7a4272703c46c275716bc18e38bfb45c62e376eb564a1a1e1e8047e794edd2
Opcode Fuzzy Hash: 943eacc63be365ee390a7fa6fdfefc3784325c993301e913e17fb999f353862f
Instruction Fuzzy Hash: FE21BDB6D00119BEEB10DAA4CC02FEF7BBCDF04790F104021FA04E6185EA75AB809AE1

Function 10005CF7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F72: PathFileExistsA.SHLWAPI(?,10005C92,?,?,%s\lang.ini,100167C0), ref: 10003F76

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005D61

Strings

%s\lang.ini, xrefs: 10005D26
http://, xrefs: 10005D87
search, xrefs: 10005D9B

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: Timer$Concurrency::details::platform::__CreateExistsFilePathQueue
String ID: %s\lang.ini$http://$search
API String ID: 1721638100-482061809
Opcode ID: 33ea2848b0bc3da7384bcd1edad61293b65bebd0800f34c916c6c70b8e553ac8
Instruction ID: d10eea2e68a17fc7dae01a0a692719cf89fcc4e95e635f9962b470bf74251c26
Opcode Fuzzy Hash: 33ea2848b0bc3da7384bcd1edad61293b65bebd0800f34c916c6c70b8e553ac8
Instruction Fuzzy Hash: D81106769081197FFB61DAA4CC42FDB776CDB143D5F1045B2FB48A9080EA72AFC44A60

Function 1000841C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,00000800,?,?,?,svchsot.exe,?,?,?,?,00000000,?,?,?), ref: 1000855C

Strings

U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 1000846F
svchsot.exe, xrefs: 10008524

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$svchsot.exe
API String ID: 3472027048-2214221337
Opcode ID: d2131fb9256a9d085b7213a385e4fb7e2e0d0505dace0aeb26e32ec0842a8d4a
Instruction ID: e8defaa02cb337ec462540d7064ad22b690c993f3d196736069eab589a90189d
Opcode Fuzzy Hash: d2131fb9256a9d085b7213a385e4fb7e2e0d0505dace0aeb26e32ec0842a8d4a
Instruction Fuzzy Hash: EE314D7290015DBEEB01DBA4CD81DEFB7FDFB48284F1440A6F644E6105EA30AF858BA1

Function 10004630 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100046C3

Strings

%s\%s, xrefs: 100046BD
., xrefs: 100046E4
\*.*, xrefs: 10004668

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %s\%s$.$\*.*
API String ID: 2111968516-2210278135
Opcode ID: 4f2de8578788dcd6f15c30ab244c025409ca5a520a2ed8ecc6f1cbb160d50d59
Instruction ID: 8eec4f815dbe1efa717b949f22b0b4cf07a5e7ea20f36989431d082c549aebfc
Opcode Fuzzy Hash: 4f2de8578788dcd6f15c30ab244c025409ca5a520a2ed8ecc6f1cbb160d50d59
Instruction Fuzzy Hash: D9315CB6C0425CBBEF12DFA4CC46EDE7B7DEB09380F0004A6F618A6051DB719B988B51

Function 10007A62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10007AA1

Strings

p=5w, xrefs: 10007AA1
, xrefs: 10007B0D

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: $p=5w
API String ID: 1927566239-2851331367
Opcode ID: d0ca9816adfda9363097ead228823b8de7426d0966cf0e74972078de5e0d5c66
Instruction ID: ef89c2eb01536c9538a48ebd5608185a951f11054c82c4a53c762a0a2007c409
Opcode Fuzzy Hash: d0ca9816adfda9363097ead228823b8de7426d0966cf0e74972078de5e0d5c66
Instruction Fuzzy Hash: AB41A475D002599FEF14DFA4C884AEEB7F8FF05284F10446DE91AA3245DB38AE48CB61

Function 10005C4C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F72: PathFileExistsA.SHLWAPI(?,10005C92,?,?,%s\lang.ini,100167C0), ref: 10003F76

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005CB6

Strings

%s\lang.ini, xrefs: 10005C7B
http://, xrefs: 10005CDC

Memory Dump Source

Source File: 0000000B.00000002.3088978518.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.3088887387.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3089283708.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090215593.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090275197.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090340557.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3090387542.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10000000_rundll32.jbxd

Similarity

API ID: Timer$Concurrency::details::platform::__CreateExistsFilePathQueue
String ID: %s\lang.ini$http://
API String ID: 1721638100-679094439
Opcode ID: 628b499e9a68a97e2ed47c29d2a86c48c529a9e8e13b1be541f5ff1dba026eb1
Instruction ID: 275623b6bb4d38d455d16e038d1f67d5d5eba5b08857937f3fa6caa2442e2442
Opcode Fuzzy Hash: 628b499e9a68a97e2ed47c29d2a86c48c529a9e8e13b1be541f5ff1dba026eb1
Instruction Fuzzy Hash: 131104769041197EFB21DAA4CC42FDB776CDB14384F0085B1FA48B6080EA71AF884660

Analysis Process: rundll32.exePID: 5280, Parent PID: 1996COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03060C8D Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 03060D78
wsprintfA.USER32(?,?,?,?), ref: 03060E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 03060E34
ExitProcess.KERNEL32(00000000), ref: 03060E3C

Strings

Application error, xrefs: 03060E30
SWVU, xrefs: 03060D80, 03060D94, 03060D9A, 03060DA0, 03060DBD
The procedure %s could not be located in the DLL %s., xrefs: 03060E14

Memory Dump Source

Source File: 00000011.00000002.1518475643.0000000003060000.00000040.00001000.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3060000_rundll32.jbxd

Similarity

API ID: AllocExitMessageProcessVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 1926473177-4283279704
Opcode ID: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction ID: 16c203f210c199eec5e5c9761231a2c142e48a2dedc1432673bc71f2bf052f88
Opcode Fuzzy Hash: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction Fuzzy Hash: 1251163114A7859FDB3ACF20CC40BDB7BB9AF46300F09419EDD469B29AEB34A814CB51

Function 03060CF9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 03060D78
wsprintfA.USER32(?,?,?,?), ref: 03060E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 03060E34
ExitProcess.KERNEL32(00000000), ref: 03060E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 03060E85

Strings

Application error, xrefs: 03060E30
SWVU, xrefs: 03060D80, 03060D94, 03060D9A, 03060DA0, 03060DBD
The procedure %s could not be located in the DLL %s., xrefs: 03060E14

Memory Dump Source

Source File: 00000011.00000002.1518475643.0000000003060000.00000040.00001000.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3060000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction ID: c056d92dc2c50a53340e63c12937258293b06f0db908cd31dce0f1f5f733f562
Opcode Fuzzy Hash: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction Fuzzy Hash: 1E419D362417169FEB38CF14CC44FEB73A5AF44351F044618ED469B689EB70B911CB90

Function 03060D32 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 03060D78
wsprintfA.USER32(?,?,?,?), ref: 03060E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 03060E34
ExitProcess.KERNEL32(00000000), ref: 03060E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 03060E85

Strings

Application error, xrefs: 03060E30
SWVU, xrefs: 03060D80, 03060D94, 03060D9A, 03060DA0, 03060DBD
The procedure %s could not be located in the DLL %s., xrefs: 03060E14

Memory Dump Source

Source File: 00000011.00000002.1518475643.0000000003060000.00000040.00001000.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3060000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction ID: edcce62883e29a07068e50361eb99db082087d0211dd0322ef30be9d8e22b546
Opcode Fuzzy Hash: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction Fuzzy Hash: 1931A9362867469FDB38DF10CC80FEB77A9AF84351F04411DED469B689EB70A810CB50

Function 030614C0 Relevance: 3.0, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 030614EF
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 0306150D

Memory Dump Source

Source File: 00000011.00000002.1518475643.0000000003060000.00000040.00001000.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3060000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: ec6bc77671bef2c5afc818fa0ad32a5b2d9c608e0d4405a18c85efd481e7501b
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 8DF0E933240245AFEB0D8F64D885EEE7768DF48398B20006AF7029A58ACA71D551C754

Function 03060063 Relevance: 2.6, APIs: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0306007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 030600BE

Memory Dump Source

Source File: 00000011.00000002.1518475643.0000000003060000.00000040.00001000.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3060000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction ID: db82dc17b7b1d6a4d624b630e3cf66c1aafaf0859c2e8ef635d780305f46e239
Opcode Fuzzy Hash: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction Fuzzy Hash: C401817624AA017EF7718AA19C00F37BBDCDF48612F184C5AFAD5C5090DA26E4408B70

Function 0306002A Relevance: 1.3, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 030600BE

Memory Dump Source

Source File: 00000011.00000002.1518475643.0000000003060000.00000040.00001000.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3060000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: ad643e6b4d9600eaa03acacfd0df492284276328b7da61fb7f972ab6bf2d4168
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: 2EF0E92669FB1169F610E7347C44A67BBD8DB46221F150E97DC40D6095DD21D80286A4

Analysis Process: rundll32.exePID: 3404, Parent PID: 1996COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 049C0C8D Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 049C0D78
wsprintfA.USER32(?,?,?,?), ref: 049C0E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 049C0E34
ExitProcess.KERNEL32(00000000), ref: 049C0E3C

Strings

The procedure %s could not be located in the DLL %s., xrefs: 049C0E14
Application error, xrefs: 049C0E30
SWVU, xrefs: 049C0D80, 049C0D94, 049C0D9A, 049C0DA0, 049C0DBD

Memory Dump Source

Source File: 00000012.00000002.1500385010.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_49c0000_rundll32.jbxd

Similarity

API ID: AllocExitMessageProcessVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 1926473177-4283279704
Opcode ID: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction ID: 865a378dbe3d9cbec3500cc9407edf980bccd2e6d76bdce4bc67525784654184
Opcode Fuzzy Hash: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction Fuzzy Hash: 72510331145785CFEB368F60CC44ADB3BB9AF46304F0941AEDD869B296EB34B814CB52

Function 049C0CF9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 049C0D78
wsprintfA.USER32(?,?,?,?), ref: 049C0E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 049C0E34
ExitProcess.KERNEL32(00000000), ref: 049C0E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 049C0E85

Strings

The procedure %s could not be located in the DLL %s., xrefs: 049C0E14
Application error, xrefs: 049C0E30
SWVU, xrefs: 049C0D80, 049C0D94, 049C0D9A, 049C0DA0, 049C0DBD

Memory Dump Source

Source File: 00000012.00000002.1500385010.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_49c0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction ID: e6dfc35ed3041f05538e6551e30aebb9b534e8d47c8c2072b8c46ba3b61349d3
Opcode Fuzzy Hash: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction Fuzzy Hash: F4418C32240706DBEB34DF54CC44EEB73A5AF48355F04412CEE4A97685EB70B8118B95

Function 049C0D32 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 049C0D78
wsprintfA.USER32(?,?,?,?), ref: 049C0E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 049C0E34
ExitProcess.KERNEL32(00000000), ref: 049C0E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 049C0E85

Strings

The procedure %s could not be located in the DLL %s., xrefs: 049C0E14
Application error, xrefs: 049C0E30
SWVU, xrefs: 049C0D80, 049C0D94, 049C0D9A, 049C0DA0, 049C0DBD

Memory Dump Source

Source File: 00000012.00000002.1500385010.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_49c0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction ID: 025160fcb745dfa36209bd7f0658cc70ca901b03d7b7836fbad8fff22b54fc94
Opcode Fuzzy Hash: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction Fuzzy Hash: AD319832240746DFEB399F90CC84EEB77A9AF84355F00412DEE4697285EB70B8208B56

Function 049C14C0 Relevance: 3.0, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 049C14EF
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 049C150D

Memory Dump Source

Source File: 00000012.00000002.1500385010.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_49c0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: 493e329a4102c773fe98c61c4cda24348115e1597462ee8a589a65e54d89e816
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: EBF0E933240245AFEB098F64D885EEE7768DF48398B2000AAF7029A186CA71E551C754

Function 049C0063 Relevance: 2.6, APIs: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 049C007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 049C00BE

Memory Dump Source

Source File: 00000012.00000002.1500385010.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_49c0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction ID: 759de3f236402625561d78d08cdaaa424c9415d2497a27c242fe42d6cb3fac2f
Opcode Fuzzy Hash: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction Fuzzy Hash: 7F018C72209602BEE7318AA19C00F37BBECDF48616F144C6EFAD5C2090DA26E440DB72

Function 049C002A Relevance: 1.3, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 049C00BE

Memory Dump Source

Source File: 00000012.00000002.1500385010.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_49c0000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: f7e3f06ac5f202597dff423c5c19e211ea0a0b015cf5ade9c5697f084d3e52d4
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: 89F0E92264E311A9F610E7B47C44A27BB98EB4222AF160DBFDC40D6091DD11E902C6A6

Analysis Process: rundll32.exePID: 4032, Parent PID: 1996COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	2

Executed Functions

Function 04940C8D Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 04940D78
wsprintfA.USER32(?,?,?,?), ref: 04940E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 04940E34
ExitProcess.KERNEL32(00000000), ref: 04940E3C

Strings

The procedure %s could not be located in the DLL %s., xrefs: 04940E14
SWVU, xrefs: 04940D80, 04940D94, 04940D9A, 04940DA0, 04940DBD
Application error, xrefs: 04940E30

Memory Dump Source

Source File: 00000013.00000002.3407289657.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Offset: 04940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4940000_rundll32.jbxd

Similarity

API ID: AllocExitMessageProcessVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 1926473177-4283279704
Opcode ID: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction ID: 97e54e1bda7bbde43ddb9bcb4e37191b955044e5fa019b9a1545b89488e47bea
Opcode Fuzzy Hash: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction Fuzzy Hash: 5D51F3311057859FDB368F20CC54FDB3BB9AF86304F0941AADE869B296EB34B815CB51

Function 04940CF9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 04940D78
wsprintfA.USER32(?,?,?,?), ref: 04940E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 04940E34
ExitProcess.KERNEL32(00000000), ref: 04940E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 04940E85

Strings

The procedure %s could not be located in the DLL %s., xrefs: 04940E14
SWVU, xrefs: 04940D80, 04940D94, 04940D9A, 04940DA0, 04940DBD
Application error, xrefs: 04940E30

Memory Dump Source

Source File: 00000013.00000002.3407289657.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Offset: 04940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4940000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction ID: 72cef57de616412d0069af583be13d4044099416f9fa6fe33701ca57c0d5b910
Opcode Fuzzy Hash: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction Fuzzy Hash: 2A417D322407469FEB38DF14CC48FEB73A5AF88355F044529EE4A97645EB70B925CB90

Function 04940D32 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 04940D78
wsprintfA.USER32(?,?,?,?), ref: 04940E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 04940E34
ExitProcess.KERNEL32(00000000), ref: 04940E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 04940E85

Strings

The procedure %s could not be located in the DLL %s., xrefs: 04940E14
SWVU, xrefs: 04940D80, 04940D94, 04940D9A, 04940DA0, 04940DBD
Application error, xrefs: 04940E30

Memory Dump Source

Source File: 00000013.00000002.3407289657.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Offset: 04940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4940000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction ID: d96f9a8b4c2172372ca98e65763e4c23babdb30ed7e4aba61d2320920325b112
Opcode Fuzzy Hash: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction Fuzzy Hash: CB31AB322417469FEB399F10CC88FEB77A9AF85355F00412DEE4697685EB70B920CB50

Function 049414C0 Relevance: 3.0, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 049414EF
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 0494150D

Memory Dump Source

Source File: 00000013.00000002.3407289657.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Offset: 04940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4940000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: 13ba4dea0c425a21ffab38fee9b873d34075afb91ce07348e524a10eaf63868d
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 3AF0E933240245AFEB098F64D885EEE7768DF48398B20006AF7029A186CA71E551C754

Function 04940063 Relevance: 2.6, APIs: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0494007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 049400BE

Memory Dump Source

Source File: 00000013.00000002.3407289657.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Offset: 04940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4940000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction ID: e00e315d9a2adf3249a9bbce7fc259cbada2da7b56c2194d53272728bee51bbc
Opcode Fuzzy Hash: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction Fuzzy Hash: AE018C72209602BEE7315AA19C10F37BBECDF88616F144C6AFBD5C2090DA26E440DB70

Function 0494002A Relevance: 1.3, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 049400BE

Memory Dump Source

Source File: 00000013.00000002.3407289657.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Offset: 04940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4940000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: 840838c76310ac6cbce664d2cd3fa9f7f1a732ff89e37e43c521830c21d750a8
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: 5EF0E92264E31169F6247734FC58E27BB98DBC2229B150DB7DE40D6091DD15E802C6A4

Non-executed Functions

Function 1000720E Relevance: 28.4, APIs: 6, Strings: 10, Instructions: 366COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000008,00000001,?), ref: 10007338
VariantInit.OLEAUT32(?), ref: 1000734D
SafeArrayCreate.OLEAUT32(00000003,00000001,?), ref: 10007368
VariantInit.OLEAUT32(?), ref: 10007377

Part of subcall function 10007A62: VariantInit.OLEAUT32(?), ref: 10007AA1

SafeArrayCreate.OLEAUT32(00000008,00000001,00000002), ref: 10007505
VariantInit.OLEAUT32(?), ref: 10007513

Strings

DefaultIPGateway, xrefs: 1000737C
p=5w, xrefs: 1000733A, 10007513
DNSServerSearchOrder, xrefs: 10007519
Win32_NetworkAdapterConfiguration.Index=, xrefs: 100072A7
SetDNSServerSearchOrder, xrefs: 1000749B, 1000755F
Index, xrefs: 1000725D
SetGateways, xrefs: 100072F1, 100073F7
Win32_NetworkAdapterConfiguration, xrefs: 1000722B
GatewayCostMetric, xrefs: 100073BE
IPEnabled=TRUE, xrefs: 10007226

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant$ArrayCreateSafe
String ID: DNSServerSearchOrder$DefaultIPGateway$GatewayCostMetric$IPEnabled=TRUE$Index$SetDNSServerSearchOrder$SetGateways$Win32_NetworkAdapterConfiguration$Win32_NetworkAdapterConfiguration.Index=$p=5w
API String ID: 2640012081-3861124693
Opcode ID: 771ce970c353409643c1e51f5a1a866829e869cd5479564b662196a77da70a54
Instruction ID: ecf29a1c47d91b81846b45f5da98bbb69cd4e5f42de0d6ad34227a81938465a8
Opcode Fuzzy Hash: 771ce970c353409643c1e51f5a1a866829e869cd5479564b662196a77da70a54
Instruction Fuzzy Hash: DAD17E70D00209EFEB15CFA4C8809EEBBB8FF49780F104419F419AB259DB75AA45CFA1

Function 10004D36 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 308COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10004EC5
VariantInit.OLEAUT32(?), ref: 10004ECB
VariantInit.OLEAUT32(?), ref: 10004ED1
VariantInit.OLEAUT32(?), ref: 10005009
VariantInit.OLEAUT32(?), ref: 1000500F

Strings

SELECT * FROM , xrefs: 10004DEA
WQL, xrefs: 10004E42
p=5w, xrefs: 10004E9C
svchost.exe -k NetworkService, xrefs: 10004FE0
svchost.exe, xrefs: 10004F6F
ProcessID, xrefs: 10004F0C
Name, xrefs: 10004EE2
CommandLine, xrefs: 10004EF7

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: CommandLine$Name$ProcessID$SELECT * FROM $WQL$p=5w$svchost.exe$svchost.exe -k NetworkService
API String ID: 1927566239-4270180057
Opcode ID: b6f3bf19f9a655f11ce33ea3d1eef9f97ff5ff13253a98ebad0314bfa4936779
Instruction ID: f681daf1cfe066dfb2c65bb1802d225618d831e3fba353d21c944956626e3e16
Opcode Fuzzy Hash: b6f3bf19f9a655f11ce33ea3d1eef9f97ff5ff13253a98ebad0314bfa4936779
Instruction Fuzzy Hash: 23A159B1900209AFEB04DFA4CC81DEEBBBDEF48394F104569F515AB295DB31AE45CB60

Function 10006EDE Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 174sleepfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 10006F24
Sleep.KERNEL32 ref: 10007059
wsprintfA.USER32 ref: 1000709D
PrintFile.08E2VWQYI0(00000000,?,00000000), ref: 100070D6
PrintFile.08E2VWQYI0(00000000,?,00000000,?,00000000), ref: 100070E9

Strings

http://107.160.131.254:23588/article.php, xrefs: 10007007
c:\1.txt, xrefs: 10007047
QVNEU3ZjLmV4ZQ==, xrefs: 10006EEE
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 10006F90
QVlSVFNydi5heWU=, xrefs: 10006EFA
iOffset, xrefs: 10007042
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 10006F79

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: FilePrintSleep$wsprintf
String ID: QVNEU3ZjLmV4ZQ==$QVlSVFNydi5heWU=$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$c:\1.txt$http://107.160.131.254:23588/article.php$iOffset
API String ID: 1547040302-3813294871
Opcode ID: 7c7c87d37a25e933c3930475f6f6c1f502c6fe5351302a316d4f9e37d4858cab
Instruction ID: e128ca64511400ca05deee7795c3814a468ccd3a13c6d035e862ae5cb279fd62
Opcode Fuzzy Hash: 7c7c87d37a25e933c3930475f6f6c1f502c6fe5351302a316d4f9e37d4858cab
Instruction Fuzzy Hash: AC51D9B6D04359E6FB22D764CC56FCF77ACEB083C1F1045A5F208EA086DA75AB808E55

Function 1000570F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 102filethreadCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1000574F
wsprintfA.USER32 ref: 100057B1
wsprintfA.USER32 ref: 100057C5
PrintFile.08E2VWQYI0(?,?,00000000), ref: 100057E8
CreateThread.KERNEL32(00000000,00000000,Function_00005620,00000000,00000000,00000000), ref: 10005835

Strings

Win32_process, xrefs: 100057ED
c:\windows\system32\drivers\%s\%s, xrefs: 100057BF
%s\%s, xrefs: 10005749
c:\windows\system32\drivers\%s, xrefs: 100057AB
ROOT\CIMv2, xrefs: 100057F2

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$CreateFilePrintThread
String ID: %s\%s$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s
API String ID: 1788855648-1421401311
Opcode ID: 6fb47a9fe862675510a1f075e21a27b9bead55373d009136fb6ced19a80d2edf
Instruction ID: 590dfccee83cd698aee2aff2a0aef7bd89598b4f0e32949fa848c193a7d694e7
Opcode Fuzzy Hash: 6fb47a9fe862675510a1f075e21a27b9bead55373d009136fb6ced19a80d2edf
Instruction Fuzzy Hash: 0531EA72910238BBEB21D7A4CC45FCF7B6CEB08356F0404A6F708FA051DB75AA858A91

Function 100053B7 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 179sleepfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10005437
wsprintfA.USER32 ref: 1000549E
wsprintfA.USER32 ref: 100054BC
PrintFile.08E2VWQYI0(?,?,10016594,?,00000000), ref: 100054DE
wsprintfA.USER32 ref: 10005582
Sleep.KERNEL32(000003E8,00000000,76C08400,?,40000000,00000001,00000000,00000002,00000000,00000000,7541C650,?,?,00000009,00000000,10016594), ref: 100055AE

Strings

Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz, xrefs: 100054A9
%s\%s, xrefs: 10005431
c:\windows\system32\drivers\%s, xrefs: 10005498

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$FilePrintSleep
String ID: %s\%s$Yzpcd2luZG93c1xzeXN0ZW0zMlxkcml2ZXJzXCVzXCVz$c:\windows\system32\drivers\%s
API String ID: 518940211-4228670124
Opcode ID: 39048bcfdf3bf410764be82e0f082a0a9eec60ddbb964b0eb01d8c58901bbfe8
Instruction ID: 3567043749f32881e03762bb9a57e308b600a04db8eea4acb5e64ce7ea9520bd
Opcode Fuzzy Hash: 39048bcfdf3bf410764be82e0f082a0a9eec60ddbb964b0eb01d8c58901bbfe8
Instruction Fuzzy Hash: 9751C272900658BFEB11CB68CC45FEE73ADEB48341F1404A5FA08AB191DBB1FE858B50

Function 10005989 Relevance: 15.1, APIs: 4, Strings: 6, Instructions: 81COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100059AE
wsprintfA.USER32 ref: 100059FB
wsprintfA.USER32 ref: 10005A08
wsprintfA.USER32 ref: 10005A19

Strings

F896SD5DAE, xrefs: 10005A14
%s\version.txt, xrefs: 100059FE
%s\%s, xrefs: 100059F1
host123.zz.am:6658, xrefs: 10005A0A
M%s, xrefs: 10005A0F
12010043, xrefs: 1000599D, 100059A3

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %s\%s$%s\version.txt$12010043$F896SD5DAE$M%s$host123.zz.am:6658
API String ID: 2111968516-3890874662
Opcode ID: 3118e657eae3f5d2f61f4ee869a04ddae59cc99c3ba34e718331a143210d2a8d
Instruction ID: 32e0762688fea209a997a92a9e142d3ada4c65c650573aee4fc5e34dd7d3b294
Opcode Fuzzy Hash: 3118e657eae3f5d2f61f4ee869a04ddae59cc99c3ba34e718331a143210d2a8d
Instruction Fuzzy Hash: 961159356007197BF210E7919C45F5F7E9CDF896A6F01021DFB01AE181DB76F9818A72

Function 10006499 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 272timeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100064F7

Part of subcall function 10003F0A: InternetOpenA.WININET(?,?,?,?,?), ref: 10003F1C

___crtGetTimeFormatEx.LIBCMT ref: 10006546

Part of subcall function 10003F24: InternetOpenUrlA.WININET(?,?,?,?,?,?), ref: 10003F39

Part of subcall function 10003F41: InternetReadFile.WININET(?,?,?,?), ref: 10003F51

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,0007D000,00000000,00000000), ref: 100065C8
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,?,?,?,?,0007D000,00000000,00000000), ref: 100065E6
wsprintfA.USER32 ref: 100066E9

Strings

aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==, xrefs: 100064DF
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 1000651A
title, xrefs: 10006647, 1000664C, 10006655

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Internet$ByteCharMultiOpenWidewsprintf$FileFormatReadTime___crt
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$aHR0cDovL2Jsb2cuc2luYS5jb20uY24vdS8lcw==$title
API String ID: 4077377486-2496724313
Opcode ID: 5ec698da00dc29de8f7ffc8bf67f0a9d9225dbf0750770383525da2cc9019453
Instruction ID: 9bb45785208bde0406de56643d62444fa716b577ceefe44749a59ab2aa42cbd8
Opcode Fuzzy Hash: 5ec698da00dc29de8f7ffc8bf67f0a9d9225dbf0750770383525da2cc9019453
Instruction Fuzzy Hash: 9C81E5B5C05248BEFB01DBA4DC82EEF7B7EEF09394F244059F504A7186DA356E4187A1

Function 10005DB4 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 116timeCOMMON

Download Yara Rule

APIs

___crtGetTimeFormatEx.LIBCMT ref: 10005E11

Part of subcall function 1000409D: RegQueryValueExA.ADVAPI32(?,?,?,?,?,?), ref: 100040B2

Part of subcall function 10004092: RegCloseKey.ADVAPI32(?,10005E1E,?,?,ProcessorNameString,00000000,00000004,?,?,80000002,?,00000000,000F003F,?), ref: 10004096

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10005DC5
http://107.160.131.254:23588/article.php, xrefs: 10005EF8
Find CPU Error, xrefs: 10005E36
@, xrefs: 10005E57
%u MB, xrefs: 10005E7E
ProcessorNameString, xrefs: 10005E02
12010043, xrefs: 10005E8F

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: CloseFormatQueryTimeValue___crt
String ID: %u MB$12010043$@$Find CPU Error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$http://107.160.131.254:23588/article.php
API String ID: 271660946-3893357082
Opcode ID: 6ebe894f3437417800d54ef2792eb82f2068fe9e67a777853d7c8d0efda6717d
Instruction ID: 4f35d1d9e5d3edf0c8f7125bb17b53cb037807f44d0344e2d1e4939474d77481
Opcode Fuzzy Hash: 6ebe894f3437417800d54ef2792eb82f2068fe9e67a777853d7c8d0efda6717d
Instruction Fuzzy Hash: 6531C0B6804208BAFB10C764DC42FDF77BCEB08351F10406AFA18BA082EB75BA458B55

Function 10007F3E Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 230COMMON

Download Yara Rule

Strings

107.160.131.254:23588/article.php, xrefs: 10008113
NPKI, xrefs: 1000802C
L2ltYWdlLnBocA==, xrefs: 1000818B
%s\%s, xrefs: 10008067
., xrefs: 10007FCF
*.*, xrefs: 10007F8C
P, xrefs: 100080F7

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %s\%s$*.*$.$107.160.131.254:23588/article.php$L2ltYWdlLnBocA==$NPKI$P
API String ID: 0-2039984758
Opcode ID: bd2d39ad8c3f066515e4f40e719d80e45a5746cb50308c2dc9da521a7abe9638
Instruction ID: 154fd83921e69bd95517e48f0429fd4d3315e101fc3602ca34ca7394d0d5f03d
Opcode Fuzzy Hash: bd2d39ad8c3f066515e4f40e719d80e45a5746cb50308c2dc9da521a7abe9638
Instruction Fuzzy Hash: C371517690425DBEEB61D7A4DC45FEEB7BCEB48240F1004E6F608E6041DB74AB898F61

Function 1000826C Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 145sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00080000,00000000,00000000), ref: 10008394
wsprintfA.USER32 ref: 100083E6

Strings

http://107.160.131.254:23588/article.php, xrefs: 10008353
Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=, xrefs: 10008405
127.0.0.1, xrefs: 100083F4
8.8.8.8, xrefs: 100083EF
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 100082DC
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 100082C5

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Sleepwsprintf
String ID: 127.0.0.1$8.8.8.8$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$Y21kLmV4ZSAvYyBpcGNvbmZpZyAvZmx1c2hkbnM=$http://107.160.131.254:23588/article.php
API String ID: 1749205058-626475063
Opcode ID: 9f7dfab18579cecf97e90eb8dea0a0d842579079791f42c3668da9ca524ab5bf
Instruction ID: 78e0688a60563a7bb1736696f6623559e09cac3deedd02f0104af55f58a5e4a8
Opcode Fuzzy Hash: 9f7dfab18579cecf97e90eb8dea0a0d842579079791f42c3668da9ca524ab5bf
Instruction Fuzzy Hash: 9E4106B6D04258B6F721D364CC46FCF77ACEB457C0F2400A6F248A9086EAB4AB848E51

Function 10006CF7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003FF7: GetShortPathNameA.KERNEL32(?,?,?), ref: 10004003

Part of subcall function 1000406C: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 1000408A

wsprintfA.USER32 ref: 10006D88
___crtGetTimeFormatEx.LIBCMT ref: 10006DAE

Part of subcall function 100040D4: RegSetValueExA.ADVAPI32(?,?,?,?,?,?), ref: 100040E9

Part of subcall function 10004092: RegCloseKey.ADVAPI32(?,10005E1E,?,?,ProcessorNameString,00000000,00000004,?,?,80000002,?,00000000,000F003F,?), ref: 10004096

Strings

U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 10006D4A
dtfd, xrefs: 10006DA6
REG_SZ, xrefs: 10006D44
%s "%s",DoAddToFavDlg, xrefs: 10006D82

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateFormatNamePathShortTimeValue___crtwsprintf
String ID: %s "%s",DoAddToFavDlg$REG_SZ$U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$dtfd
API String ID: 1762869224-3711648159
Opcode ID: 61d0bd0e05473ddd948e32944040b939d5f1ffa9c41235ae9aa68812b1daf432
Instruction ID: 20d4b35ab7fa00c236079ec8a4dd8982143edab80ee48f6a2419757257224b01
Opcode Fuzzy Hash: 61d0bd0e05473ddd948e32944040b939d5f1ffa9c41235ae9aa68812b1daf432
Instruction Fuzzy Hash: 451160B694415CBEFB11D7A4DC86FEA776CEB14340F1404A1F704FA085DAB16F988AA4

Function 10006A6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 10003ECE: CreateMutexA.KERNEL32(?,?,?,10006B50,?,?,?,00000202,?), ref: 10003EDA

GetLastError.KERNEL32 ref: 10006AA8

Part of subcall function 10006499: wsprintfA.USER32 ref: 100064F7
Part of subcall function 10006499: ___crtGetTimeFormatEx.LIBCMT ref: 10006546

Sleep.KERNEL32(0002BF20,00000000,00000000,00000000,00000000,000000FF), ref: 10006ADD
CreateThread.KERNEL32(00000000,00000000,Function_0000687E,00000000,00000000,00000000), ref: 10006AF1

Strings

0x5d65r455f, xrefs: 10006A97
5762479093, xrefs: 10006AC7

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Create$ErrorFormatLastMutexSleepThreadTime___crtwsprintf
String ID: 0x5d65r455f$5762479093
API String ID: 3244495550-2446933972
Opcode ID: 19283e5acea808ec0441168ab06e47d1eb0b849edc2e8a1a8406e88d778b2533
Instruction ID: bd1adab126fe453b34de0ea9e0b5f284958d10fa0a203dc352c1be2a30225ce5
Opcode Fuzzy Hash: 19283e5acea808ec0441168ab06e47d1eb0b849edc2e8a1a8406e88d778b2533
Instruction Fuzzy Hash: 9701F2A4844228BAF211F3704CCADBF395DDB563D4F200528F915A908BDB24EC0145B3

Function 10008567 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 79sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 1000857E
Sleep.KERNEL32(001B7740,?,00000000,80000002,00000000,00000000,000F003F,?), ref: 100085BF

Strings

aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=, xrefs: 10008580
D, xrefs: 10008612
wINsTA0\dEFauLT, xrefs: 1000862C

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: D$aHR0cDovLzEwNy4xNjMuNTYuMTEwOjE4NTMwL3UxMTI5Lmh0bWw=$wINsTA0\dEFauLT
API String ID: 3472027048-3516831565
Opcode ID: a435b5dfb969170efa786a49c8884d6de8dbe2a3431997f47b479d14d9b9b80c
Instruction ID: 69b21accf233d090089117fd856bc82e5cd65d02c06b2ff4ec7ccf08b8a7457c
Opcode Fuzzy Hash: a435b5dfb969170efa786a49c8884d6de8dbe2a3431997f47b479d14d9b9b80c
Instruction Fuzzy Hash: 6421817680525CBAEB11EBE4CC46EDFBB7CEF08390F1400A9F604BB151DB765A458B91

Function 10005F15 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98timeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 10005F21

Part of subcall function 10004126: OpenProcessToken.ADVAPI32(00000028,00000028,00000028,10005F32,00000000,00000028,?), ref: 10004132

Part of subcall function 100040F1: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,00000000), ref: 100040FD

___crtGetTimeFormatEx.LIBCMT ref: 10005F79

Part of subcall function 1000404F: AdjustTokenPrivileges.ADVAPI32(?,?,?,?,?,?), ref: 10004064

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005FD4

Strings

%s\lang.ini, xrefs: 10005FAE

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessTimerToken$AdjustConcurrency::details::platform::__CreateCurrentFormatLookupOpenPrivilegePrivilegesQueueTimeValue___crt
String ID: %s\lang.ini
API String ID: 3793502078-1858510373
Opcode ID: 943eacc63be365ee390a7fa6fdfefc3784325c993301e913e17fb999f353862f
Instruction ID: ec7a4272703c46c275716bc18e38bfb45c62e376eb564a1a1e1e8047e794edd2
Opcode Fuzzy Hash: 943eacc63be365ee390a7fa6fdfefc3784325c993301e913e17fb999f353862f
Instruction Fuzzy Hash: FE21BDB6D00119BEEB10DAA4CC02FEF7BBCDF04790F104021FA04E6185EA75AB809AE1

Function 10005CF7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F72: PathFileExistsA.SHLWAPI(?,10005C92,?,?,%s\lang.ini,100167C0), ref: 10003F76

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005D61

Strings

search, xrefs: 10005D9B
http://, xrefs: 10005D87
%s\lang.ini, xrefs: 10005D26

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Timer$Concurrency::details::platform::__CreateExistsFilePathQueue
String ID: %s\lang.ini$http://$search
API String ID: 1721638100-482061809
Opcode ID: 33ea2848b0bc3da7384bcd1edad61293b65bebd0800f34c916c6c70b8e553ac8
Instruction ID: d10eea2e68a17fc7dae01a0a692719cf89fcc4e95e635f9962b470bf74251c26
Opcode Fuzzy Hash: 33ea2848b0bc3da7384bcd1edad61293b65bebd0800f34c916c6c70b8e553ac8
Instruction Fuzzy Hash: D81106769081197FFB61DAA4CC42FDB776CDB143D5F1045B2FB48A9080EA72AFC44A60

Function 1000841C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,00000800,?,?,?,svchsot.exe,?,?,?,?,00000000,?,?,?), ref: 1000855C

Strings

svchsot.exe, xrefs: 10008524
U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 1000846F

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: U09GVFdBUkVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$svchsot.exe
API String ID: 3472027048-2214221337
Opcode ID: d2131fb9256a9d085b7213a385e4fb7e2e0d0505dace0aeb26e32ec0842a8d4a
Instruction ID: e8defaa02cb337ec462540d7064ad22b690c993f3d196736069eab589a90189d
Opcode Fuzzy Hash: d2131fb9256a9d085b7213a385e4fb7e2e0d0505dace0aeb26e32ec0842a8d4a
Instruction Fuzzy Hash: EE314D7290015DBEEB01DBA4CD81DEFB7FDFB48284F1440A6F644E6105EA30AF858BA1

Function 10004630 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100046C3

Strings

., xrefs: 100046E4
\*.*, xrefs: 10004668
%s\%s, xrefs: 100046BD

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf
String ID: %s\%s$.$\*.*
API String ID: 2111968516-2210278135
Opcode ID: 4f2de8578788dcd6f15c30ab244c025409ca5a520a2ed8ecc6f1cbb160d50d59
Instruction ID: 8eec4f815dbe1efa717b949f22b0b4cf07a5e7ea20f36989431d082c549aebfc
Opcode Fuzzy Hash: 4f2de8578788dcd6f15c30ab244c025409ca5a520a2ed8ecc6f1cbb160d50d59
Instruction Fuzzy Hash: D9315CB6C0425CBBEF12DFA4CC46EDE7B7DEB09380F0004A6F618A6051DB719B988B51

Function 10007A62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 10007AA1

Strings

, xrefs: 10007B0D
p=5w, xrefs: 10007AA1

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: $p=5w
API String ID: 1927566239-2851331367
Opcode ID: d0ca9816adfda9363097ead228823b8de7426d0966cf0e74972078de5e0d5c66
Instruction ID: ef89c2eb01536c9538a48ebd5608185a951f11054c82c4a53c762a0a2007c409
Opcode Fuzzy Hash: d0ca9816adfda9363097ead228823b8de7426d0966cf0e74972078de5e0d5c66
Instruction Fuzzy Hash: AB41A475D002599FEF14DFA4C884AEEB7F8FF05284F10446DE91AA3245DB38AE48CB61

Function 10005C4C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63timeCOMMON

Download Yara Rule

APIs

Part of subcall function 10003F72: PathFileExistsA.SHLWAPI(?,10005C92,?,?,%s\lang.ini,100167C0), ref: 10003F76

Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 10005CB6

Strings

http://, xrefs: 10005CDC
%s\lang.ini, xrefs: 10005C7B

Memory Dump Source

Source File: 00000013.00000002.3408422372.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.3408336431.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408499837.000000001000E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408596428.0000000010012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408656520.000000001001E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408775433.000000001003D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.3408900426.000000001004F000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Timer$Concurrency::details::platform::__CreateExistsFilePathQueue
String ID: %s\lang.ini$http://
API String ID: 1721638100-679094439
Opcode ID: 628b499e9a68a97e2ed47c29d2a86c48c529a9e8e13b1be541f5ff1dba026eb1
Instruction ID: 275623b6bb4d38d455d16e038d1f67d5d5eba5b08857937f3fa6caa2442e2442
Opcode Fuzzy Hash: 628b499e9a68a97e2ed47c29d2a86c48c529a9e8e13b1be541f5ff1dba026eb1
Instruction Fuzzy Hash: 131104769041197EFB21DAA4CC42FDB776CDB14384F0085B1FA48B6080EA71AF884660

Analysis Process: rundll32.exePID: 3396, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02D90C8D Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 02D90D78
wsprintfA.USER32(?,?,?,?), ref: 02D90E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 02D90E34
ExitProcess.KERNEL32(00000000), ref: 02D90E3C

Strings

SWVU, xrefs: 02D90D80, 02D90D94, 02D90D9A, 02D90DA0, 02D90DBD
Application error, xrefs: 02D90E30
The procedure %s could not be located in the DLL %s., xrefs: 02D90E14

Memory Dump Source

Source File: 0000001A.00000002.1751321939.0000000002D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2d90000_rundll32.jbxd

Similarity

API ID: AllocExitMessageProcessVirtualwsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 1926473177-4283279704
Opcode ID: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction ID: 5d7e4e797c9aa0d490a3e353615793f30f98b0299f852dea113c3958edef2229
Opcode Fuzzy Hash: cc50955b1b3b8c90b3c42dad072ac0ae91170c06dcfb767a7f19b4557c02c924
Instruction Fuzzy Hash: B651E3311057859FDB368F24CC40BEB3BB9AF06305F09419AED869B296EB34AC15CB61

Function 02D90CF9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 02D90D78
wsprintfA.USER32(?,?,?,?), ref: 02D90E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 02D90E34
ExitProcess.KERNEL32(00000000), ref: 02D90E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 02D90E85

Strings

SWVU, xrefs: 02D90D80, 02D90D94, 02D90D9A, 02D90DA0, 02D90DBD
Application error, xrefs: 02D90E30
The procedure %s could not be located in the DLL %s., xrefs: 02D90E14

Memory Dump Source

Source File: 0000001A.00000002.1751321939.0000000002D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2d90000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction ID: 3fe8e0c115d4c9b630a4ebb3d05befbe9ff757164832f39346f73086e9663a86
Opcode Fuzzy Hash: 5ac14cd0858b29816220fc40dc497103b262a89f14b24465b356eb54b5511a25
Instruction Fuzzy Hash: EA4159322407069BEB389F14DC44BEB73A9EF48356F044219EE4AA7784EB71E911CB90

Function 02D90D32 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?), ref: 02D90D78
wsprintfA.USER32(?,?,?,?), ref: 02D90E1C
MessageBoxA.USER32(00000000,?,?,00000010), ref: 02D90E34
ExitProcess.KERNEL32(00000000), ref: 02D90E3C
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 02D90E85

Strings

SWVU, xrefs: 02D90D80, 02D90D94, 02D90D9A, 02D90DA0, 02D90DBD
Application error, xrefs: 02D90E30
The procedure %s could not be located in the DLL %s., xrefs: 02D90E14

Memory Dump Source

Source File: 0000001A.00000002.1751321939.0000000002D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2d90000_rundll32.jbxd

Similarity

API ID: Virtual$AllocExitFreeMessageProcesswsprintf
String ID: Application error$SWVU$The procedure %s could not be located in the DLL %s.
API String ID: 3261521767-4283279704
Opcode ID: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction ID: 34ebfa8a025d5704790a204aa2da11c1f23b79fc2b34201f2f2da1874347e7bc
Opcode Fuzzy Hash: f3f4ceec5dac74f6035a517ed20072721e7ea1b7e2d6ae06b7b7f5dbf5df774f
Instruction Fuzzy Hash: 0931863224174A9FDB399F10DC84FEB77AAEF45352F004219EE4A97685EB70A810CB60

Function 02D914C0 Relevance: 3.0, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 02D914EF
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 02D9150D

Memory Dump Source

Source File: 0000001A.00000002.1751321939.0000000002D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2d90000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: be39143ebcefc20333094dda4ff7f37f30657ab932889259c39861b6675ef7d6
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 2DF0E933340245AFEF098F64D885EEE7768DF49398B20006AF7029A286CA71D551C754

Function 02D90063 Relevance: 2.6, APIs: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02D9007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 02D900BE

Memory Dump Source

Source File: 0000001A.00000002.1751321939.0000000002D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2d90000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction ID: 4d803958fd30ddc7db044aa23e6e14465ffc97820af5b8224733637e05c92d2e
Opcode Fuzzy Hash: 65a02cd7260d18a01fc3f7ff89687da28b1d4c2f1c2c8b880b6d82bd0f9a86c6
Instruction Fuzzy Hash: D501A4722096117EEB315AA1AC01F37BBDCDF48712F244C5AFAD9C2190DA25E840DB70

Function 02D9002A Relevance: 1.3, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 02D900BE

Memory Dump Source

Source File: 0000001A.00000002.1751321939.0000000002D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_2d90000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: a55852334d7d689a6f1afac4a48ba1638253471489ae18406073c2e781ae4d9c
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: D9F0E93254A31169FB1077347C49A27BB99DB42327F250997FC44D7191DD11DC42DAB4

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 08e2VwqyI0.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\1.txt

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_43694ddf-2812-4925-b8af-347e7aeab431\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d2d6a05f617930bde2d4c76b2a5555e299272ba9_7522e4b5_a5abc924-2452-4abb-81bb-5fc932c8c5b9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA782.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA85E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA88E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB389.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB55E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB58E.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
08e2VwqyI0.dll

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre