Edit tour

Windows Analysis Report
UdY4Kc66Bc.exe

Overview

General Information

Sample name:	UdY4Kc66Bc.exe renamed because original name is a hash value
Original sample name:	511ca3f9e84a22885d9dac546aba034373a63a83825a058320713180ef485d74.exe
Analysis ID:	1560270
MD5:	739682b6fd2b25f2a6234b733090735b
SHA1:	171b56b4dcb6a37cc9ec3704be6982f042f1c461
SHA256:	511ca3f9e84a22885d9dac546aba034373a63a83825a058320713180ef485d74
Tags:	exefnback9636-siteuser-JAMESWT_MHT
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Detected potential unwanted application

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Stores large binary data to the registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

UdY4Kc66Bc.exe (PID: 5048 cmdline: "C:\Users\user\Desktop\UdY4Kc66Bc.exe" MD5: 739682B6FD2B25F2A6234B733090735B)

dfsvc.exe (PID: 1688 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe" MD5: B4088F44B80D363902E11F897A7BAC09)

WerFault.exe (PID: 772 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 880 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Sigma Signatures

System Summary

Sigma detected: Dfsvc.EXE Network Connection To Uncommon Ports

Source: Network Connection

Author: Nasreddine Bencherchali (Nextron Systems): Data: DesusertionIp: 192.168.2.9, DesusertionIsIpv6: false, DesusertionPort: 49713, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe, Initiated: true, ProcessId: 1688, Protocol: tcp, SourceIp: 37.221.65.128, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: UdY4Kc66Bc.exe

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Code function: 0_2_00B81000 LocalAlloc,LocalAlloc,GetModuleFileNameW,CertOpenSystemStoreA,LocalAlloc,LocalAlloc,CryptQueryObject,LocalFree,CryptMsgGetParam,CryptMsgGetParam,LocalAlloc,LocalAlloc,CryptMsgGetParam,CertCreateCertificateContext,CertAddCertificateContextToStore,CertFreeCertificateContext,LocalFree,CryptMsgGetParam,LocalFree,LocalFree,CryptMsgGetParam,CryptMsgGetParam,CertFindAttribute,CertFindAttribute,CertFindAttribute,LoadLibraryA,GetProcAddress,Sleep,CertDeleteCertificateFromStore,CertDeleteCertificateFromStore,CertCloseStore,LocalFree,LocalFree,LocalFree,

0_2_00B81000

Source: UdY4Kc66Bc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: UdY4Kc66Bc.exe

Static PE information: certificate valid

Source: UdY4Kc66Bc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: UdY4Kc66Bc.exe
Source:	Binary string: .Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: dfsvc.exe, 00000001.00000002.2283644187.000001A3E5ED0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbllrT source: dfsvc.exe, 00000001.00000002.2283950958.000001A3E5F69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: dfsvc.exe, 00000001.00000002.2283644187.000001A3E5ED0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdbrap source: dfsvc.exe, 00000001.00000002.2284401483.000001A3E5FA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdbb~@ source: dfsvc.exe, 00000001.00000002.2284401483.000001A3E5FA0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Code function: 0_2_00B84A4B FindFirstFileExA,

0_2_00B84A4B

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fn3699.kafinora.cyou

Source: UdY4Kc66Bc.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: UdY4Kc66Bc.exe, 00000000.00000002.1461015578.00000000010C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustefR
Source: UdY4Kc66Bc.exe, 00000000.00000002.1461015578.00000000010C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digic
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: UdY4Kc66Bc.exe, 00000000.00000002.1461015578.00000000010C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeSBS
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dfsvc.exe, 00000001.00000002.2282085524.000001A3CD66C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2282085524.000001A3CD69B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fn3699.kafinora.cyou
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: dfsvc.exe, 00000001.00000002.2282085524.000001A3CD5C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: UdY4Kc66Bc.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: dfsvc.exe, 00000001.00000002.2282085524.000001A3CD65C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2282085524.000001A3CD60B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fn3699.kafinora.cyou
Source: dfsvc.exe, 00000001.00000002.2282085524.000001A3CD66C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fn3699.kafinora.cyou(
Source: dfsvc.exe, 00000001.00000002.2282085524.000001A3CD70D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2282085524.000001A3CD6D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fn3699.kafinora.cyou/Bin/ScreenConnect.Client.application?e=Support&y=Gues
Source: DJY51CAU.log.1.dr	String found in binary or memory: https://fn3699.kafinora.cyou/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=fnback9636.sit

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

System Summary

Detected potential unwanted application

Source: UdY4Kc66Bc.exe

PE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Code function: 0_2_00B8A495	0_2_00B8A495
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E4D099	1_2_00007FF886E4D099
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E4AEF5	1_2_00007FF886E4AEF5
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E564B9	1_2_00007FF886E564B9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E540D9	1_2_00007FF886E540D9
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E566D4	1_2_00007FF886E566D4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E4F441	1_2_00007FF886E4F441
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E41211	1_2_00007FF886E41211

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 880

Source: UdY4Kc66Bc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal42.evad.winEXE@4/7@1/1

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

0_2_00B81000

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Deployment

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5048

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File created: C:\Users\user\AppData\Local\Temp\Deployment

Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Command line argument: dfshim

0_2_00B81000

Source: UdY4Kc66Bc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UdY4Kc66Bc.exe

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\UdY4Kc66Bc.exe "C:\Users\user\Desktop\UdY4Kc66Bc.exe"
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 880
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dfshim.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Section loaded: propsys.dll	Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: UdY4Kc66Bc.exe

Static PE information: certificate valid

Source: UdY4Kc66Bc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: UdY4Kc66Bc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: UdY4Kc66Bc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: UdY4Kc66Bc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: UdY4Kc66Bc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: UdY4Kc66Bc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: UdY4Kc66Bc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: UdY4Kc66Bc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb source: UdY4Kc66Bc.exe
Source:	Binary string: .Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: dfsvc.exe, 00000001.00000002.2283644187.000001A3E5ED0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbllrT source: dfsvc.exe, 00000001.00000002.2283950958.000001A3E5F69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: dfsvc.exe, 00000001.00000002.2283644187.000001A3E5ED0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdbrap source: dfsvc.exe, 00000001.00000002.2284401483.000001A3E5FA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.pdbb~@ source: dfsvc.exe, 00000001.00000002.2284401483.000001A3E5FA0000.00000004.00000020.00020000.00000000.sdmp

Source: UdY4Kc66Bc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: UdY4Kc66Bc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: UdY4Kc66Bc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: UdY4Kc66Bc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: UdY4Kc66Bc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

0_2_00B81000

Source: UdY4Kc66Bc.exe

Static PE information: real checksum: 0x1979e should be: 0x18f01

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Code function: 0_2_00B81BC0 push ecx; ret	0_2_00B81BD3
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E400BD pushad ; iretd	1_2_00007FF886E400C1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E4845E push eax; ret	1_2_00007FF886E4846D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E4842E pushad ; ret	1_2_00007FF886E4845D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Code function: 1_2_00007FF886E47C35 push eax; retf	1_2_00007FF886E47C6D

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1A3CBAE0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Memory allocated: 1A3E54F0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599668	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599554	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599262	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599149	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597952	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597836	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597622	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597514	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597077	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596202	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595533	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594858	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593543	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593437	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 1950			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Window / User API: threadDelayed 7729			Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe TID: 5340	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -599780s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -599668s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -599554s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -599262s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -599149s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -598828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -598062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -597952s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -597836s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -597622s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -597514s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -597077s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -596639s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -596421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -596202s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -595875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -595764s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -595653s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -595533s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -594858s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -594749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -594530s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -594421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -594312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -594203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -594093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -593984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -593874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -593765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -593656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -593543s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe TID: 6916	Thread sleep time: -593437s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Code function: 0_2_00B84A4B FindFirstFileExA,

0_2_00B84A4B

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599668	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599554	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599262	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 599149	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597952	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597836	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597622	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597514	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 597077	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596202	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595533	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594858	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 594093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593543	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Thread delayed: delay time: 593437	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: dfsvc.exe, 00000001.00000002.2283950958.000001A3E5F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Code function: 0_2_00B8191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00B8191F

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

0_2_00B81000

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Code function: 0_2_00B83677 mov eax, dword ptr fs:[00000030h]

0_2_00B83677

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Code function: 0_2_00B86893 GetProcessHeap,

0_2_00B86893

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Code function: 0_2_00B81493 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B81493
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Code function: 0_2_00B8191F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B8191F
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Code function: 0_2_00B84573 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B84573
Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe	Code function: 0_2_00B81AAC SetUnhandledExceptionFilter,	0_2_00B81AAC

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Code function: 0_2_00B81BD4 cpuid

0_2_00B81BD4

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Code function: 0_2_00B81806 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B81806

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\UdY4Kc66Bc.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Disable or Modify Tools	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	41 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Install Root Certificate	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
UdY4Kc66Bc.exe	24%	ReversingLabs	Win32.PUA.ScreenConnect

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://fn3699.kafinora.cyou/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=fnback9636.sit	0%	Avira URL Cloud	safe
https://fn3699.kafinora.cyou(	0%	Avira URL Cloud	safe
https://fn3699.kafinora.cyou/Bin/ScreenConnect.Client.application?e=Support&y=Gues	0%	Avira URL Cloud	safe
http://fn3699.kafinora.cyou	0%	Avira URL Cloud	safe
https://fn3699.kafinora.cyou	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false		high
fn3699.kafinora.cyou	37.221.65.128	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl3.digic	UdY4Kc66Bc.exe, 00000000.00000002.1461015578.00000000010C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fn3699.kafinora.cyou/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=fnback9636.sit	DJY51CAU.log.1.dr	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
https://fn3699.kafinora.cyou	dfsvc.exe, 00000001.00000002.2282085524.000001A3CD65C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2282085524.000001A3CD60B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fn3699.kafinora.cyou/Bin/ScreenConnect.Client.application?e=Support&y=Gues	dfsvc.exe, 00000001.00000002.2282085524.000001A3CD70D000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2282085524.000001A3CD6D9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	dfsvc.exe, 00000001.00000002.2282085524.000001A3CD5C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fn3699.kafinora.cyou	dfsvc.exe, 00000001.00000002.2282085524.000001A3CD66C000.00000004.00000800.00020000.00000000.sdmp, dfsvc.exe, 00000001.00000002.2282085524.000001A3CD69B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fn3699.kafinora.cyou(	dfsvc.exe, 00000001.00000002.2282085524.000001A3CD66C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
37.221.65.128	fn3699.kafinora.cyou	Russian Federation		48430	FIRSTDC-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560270
Start date and time:	2024-11-21 15:55:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UdY4Kc66Bc.exe renamed because original name is a hash value
Original Sample Name:	511ca3f9e84a22885d9dac546aba034373a63a83825a058320713180ef485d74.exe
Detection:	MAL
Classification:	mal42.evad.winEXE@4/7@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 5 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: UdY4Kc66Bc.exe

Simulations

Behavior and APIs

Time	Type	Description
09:56:04	API Interceptor	641267x Sleep call for process: dfsvc.exe modified
09:56:04	API Interceptor	1x Sleep call for process: UdY4Kc66Bc.exe modified
09:56:15	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
37.221.65.128	4GO734bOd8.exe	Get hash	malicious	Unknown	Browse
	814iXDSMYu.exe	Get hash	malicious	Unknown	Browse
	Statement-110122025.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Statement-110122025.exe	Get hash	malicious	ScreenConnect Tool	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fn3699.kafinora.cyou	4GO734bOd8.exe	Get hash	malicious	Unknown	Browse	37.221.65.128
fn3699.kafinora.cyou	814iXDSMYu.exe	Get hash	malicious	Unknown	Browse	37.221.65.128
s-part-0015.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.43
	file.exe	Get hash	malicious	Remcos	Browse	13.107.246.43
	zhbEGHo55P.exe	Get hash	malicious	LockBit ransomware	Browse	13.107.246.43
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.43
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.43
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.43
	VNC Sales.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.43
	https://midlandtxconstruction.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU5VVmliM0U9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FIRSTDC-ASRU	4GO734bOd8.exe	Get hash	malicious	Unknown	Browse	37.221.65.128
	814iXDSMYu.exe	Get hash	malicious	Unknown	Browse	37.221.65.128
	Statement-110122025.exe	Get hash	malicious	ScreenConnect Tool	Browse	37.221.65.128
	Statement-110122025.exe	Get hash	malicious	ScreenConnect Tool	Browse	37.221.65.128
	https://cp9856.chelokipotlester.icu/Bin/support.Client.exe?h=cp3back96.site&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQB9zMUOcnsRaC12buOM5jB%2F0aQdWfMpUKDaWi13yRXoM16W00nLl4p0ZtEhANoxvmcw0wWFEBncKj1h1Sizr06d2epn5Y1la%2FZuAUNQxVB6zV6MkV%2FQ3PQ8O4IKEUzM%2B1uTT6bVi8cjhVOM7wlYYJcudQAB6Dwlh4JaUc5YEBvhT8MaZnAIYPqnbmxNwUw1RDlaRh5YJbZGPTJPIJpusdEO4D%2FCUtP6CZ%2F6LBYCi1k6apr4NFJdoCsgYMmz0ueWApW6fnSWePa0E3G6vxJQsjXUZXU7nn2pC9y84o5L0uqvKTZ239UPNomZv8wnSyaubzULL%2B48fuhT%2FYi9ukTBmorR&s=5999b697-2fc8-47f6-a1dc-4d0d274c363e&i=Untitled%20Session&e=Support&y=Guest&r=	Get hash	malicious	ScreenConnect Tool	Browse	37.221.67.19
	meow.arm5.elf	Get hash	malicious	Unknown	Browse	45.89.63.16
	BLh4H2eIU9.exe	Get hash	malicious	RHADAMANTHYS	Browse	37.221.67.152
	vsYkceYJOX.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RedLine, Stealc, Vidar	Browse	62.133.62.93
	6.dll	Get hash	malicious	Unknown	Browse	141.98.169.154
	build.exe	Get hash	malicious	PureLog Stealer	Browse	93.185.167.95

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UdY4Kc66Bc.exe_a8a277acefd3409613122e36fa81eae6606dbdad_d91d52ad_41794d01-c599-49cc-99fa-a17bb59c0039\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9120542837260193
Encrypted:	false
SSDEEP:	96:141F/y/GS/sYhq2GXyf8QXIDcQvc6QcEVcw3cE/jmi+HbHg/Jg+OgBCXEYcI+1sO:1QM/E20BU/HmLji0ozuiFhZ24IO8ql5
MD5:	CD89DBADFF646A33F1A5BE6A16FFD566
SHA1:	80CC650B20111A0D07C93EFE619BBB44B76454C1
SHA-256:	ACBBCEC3BD57AAFDA1BA3673CF5865D8E55A52386C32A68E7E27A9AFA11F00C9
SHA-512:	9B60CF30FCE51CB6EE447D63B4F87D65A2F63EC5853DCAE1F85C939C1D976F53AFC30BE6F5E69AB31D59B0D73C3459CCB234D1774A977AE9BB51782F14897F8B
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.6.7.4.5.6.5.8.7.1.7.0.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.6.7.4.5.6.7.1.5.2.9.5.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.7.9.4.d.0.1.-.c.5.9.9.-.4.9.c.c.-.9.9.f.a.-.a.1.7.b.b.5.9.c.0.0.3.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.5.d.7.7.f.2.b.-.1.1.5.d.-.4.5.3.0.-.8.8.4.b.-.2.f.a.4.4.5.9.e.b.5.3.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.U.d.Y.4.K.c.6.6.B.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.b.8.-.0.0.0.1.-.0.0.1.4.-.8.3.2.a.-.a.5.7.c.2.5.3.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.1.7.c.5.7.8.7.c.d.9.4.7.1.3.4.d.d.2.5.a.4.1.e.d.1.7.2.2.b.1.a.0.0.0.0.f.f.f.f.!.0.0.0.0.1.7.1.b.5.6.b.4.d.c.b.6.a.3.7.c.c.9.e.c.3.7.0.4.b.e.6.9.8.2.f.0.4.2.f.1.c.4.6.1.!.U.d.Y.4.K.c.6.6.B.c...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FD0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 21 14:56:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	82532
Entropy (8bit):	1.6775158929375191
Encrypted:	false
SSDEEP:	192:EK2ZHfD0XkROhI/sFv9HGZtfQUrtbUTTuu2dYADfqil7/l2kBRBx3w1GcO1q/+wy:AHfahI/44tbUs242YwTt8m
MD5:	6E10DB9D31B8FFBC8CEDC013B133E38A
SHA1:	4AF48F1F9E78511893CB1202C545B84BA0B0E908
SHA-256:	3B76ED5B7D20972E29026471E994B74E23E6D889547A4B0BD09C18E50EEA483C
SHA-512:	2A199AA15757322C7B6AA623375D7F6FEE2012BC6F0F11E7B73C9B5D488C968008A46B3B3BAAA07BBFA6EB97E9BEBB9D9A2BAD4110BF4A7FBC536D694B4C9F61
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........J?g.........................................;..........T.......8...........T............!... .......... ...........................................................................................eJ..............GenuineIntel............T............J?g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER330E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.702253782592016
Encrypted:	false
SSDEEP:	192:R6l7wVeJds6l6YcDZSU9IgmfvtlprR89bFnsf/3m:R6lXJ26l6YeSU9Igmfvt2Fsf+
MD5:	721D55CB39FFF58A0141D19159923DDC
SHA1:	ED7FC3BA345832C397383F02C3BED4A583B862F4
SHA-256:	7DB4C7208D249F070CD775C57BF3F5C6BC10B4C23C2F84011AAED5CC5D75C5D2
SHA-512:	5E1D987A585B56D3FCCE491141D6F68A25602FD63A9F2E7D2C5444F5EB4F959B1BE4117EA1F5D33B4726BC88149CC44952466B51ABC35944C28AEF6F00BC8E6B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER335D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.483133439832674
Encrypted:	false
SSDEEP:	48:cvIwWl8zsBJg77aI9HEWpW8VYrYm8M4JxsLFC++q8XQVWMdg/Yd:uIjfTI7pd7VPJxj+YwWog/Yd
MD5:	C0ABA4B12A7AC5F777926FF2A7849A35
SHA1:	10A24B1A3A029B4A24829C41E4069C147A6D5F00
SHA-256:	FC0F5F12BAD201BD639A7067823DE7E74197E75EC522E98CDD2C7C5DFE21B70A
SHA-512:	551DBEBE8009DB5F6F1BEB6A62A8981B4A4FAC4C602F99FE03D7A91B3240997649E43C865E0CDDD8A1BB5AA20776E6C3DC39C0CF5CCF2163FC0F0778707B6ED4
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="597958" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dfsvc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1373
Entropy (8bit):	5.369201792577388
Encrypted:	false
SSDEEP:	24:ML1XE4qpE4KQ71qE4GIs0E4KGAE4KKUNKKDE4KGKZI6KhPKIE4TKBGKoM:M1H2HKQ71qHGIs0HKGAHKKkKYHKGSI65
MD5:	AE112903AD8CD5C130DF44E7E1601F48
SHA1:	A3D879E7F63259F5C76C846DC8A59E5AA36EC5F6
SHA-256:	FAFA70F9D4F34235B7681A6296CA5B27A7932EDFF8A029BE748810DC2547C2ED
SHA-512:	29388D9599B400D9BDC2F869548A0448470755C7A3AFA24955B768D214A7E5802BB655C1EB4C679E308916266DFA5C2FA7CE3A3F10E802D349C63588C735984F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, Pu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\DJY51CAU.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (650), with CRLF line terminators
Category:	dropped
Size (bytes):	15916
Entropy (8bit):	3.8516472810422253
Encrypted:	false
SSDEEP:	192:XCmjtLCmjtuknlWSCmjt0knQ4e1uSOCp4y53n:XCKtLCKtuslNCKt0sQ4e1uS1myJ
MD5:	F66B10D32C6B698D9B68240C0D8D9D53
SHA1:	F5D2D932EAFF32FBB6F64D963032005512922D69
SHA-256:	5BBFB2A08E2CC78B8EE9580901CD8165842F40533ED8CB168A0AC99F3A1F56AF
SHA-512:	79261830E099C1EEA4C15AD468CA450F33631D0CDF7FD3883B3EA13E90C9B03FF7D047A0E96C949C92F395522B185287A14348B4119A8B595D28CB333F0A8A34
Malicious:	false
Reputation:	low
Preview:	..P.L.A.T.F.O.R.M. .V.E.R.S.I.O.N. .I.N.F.O.......W.i.n.d.o.w.s. .......:. .1.0...0...1.9.0.4.5...0. .(.W.i.n.3.2.N.T.).......C.o.m.m.o.n. .L.a.n.g.u.a.g.e. .R.u.n.t.i.m.e. ...:. .4...0...3.0.3.1.9...4.2.0.0.0.......S.y.s.t.e.m...D.e.p.l.o.y.m.e.n.t...d.l.l. .....:. .4...8...4.2.7.0...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......c.l.r...d.l.l. .......:. .4...8...4.5.1.5...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......d.f.d.l.l...d.l.l. .......:. .4...8...4.2.7.0...0. .b.u.i.l.t. .b.y.:. .N.E.T.4.8.R.E.L.1.L.A.S.T._.C.......d.f.s.h.i.m...d.l.l. .......:. .1.0...0...1.9.0.4.1...3.0.0.0.0. .(.W.i.n.B.u.i.l.d...1.6.0.1.0.1...0.8.0.0.).........S.O.U.R.C.E.S.......D.e.p.l.o.y.m.e.n.t. .u.r.l.......:. .h.t.t.p.s.:././.f.n.3.6.9.9...k.a.f.i.n.o.r.a...c.y.o.u./.B.i.n./.S.c.r.e.e.n.C.o.n.n.e.c.t...C.l.i.e.n.t...a.p.p.l.i.c.a.t.i.o.n.?.e.=.S.u.p.p.o.r.t.&.y.=.G.u.e.s.t.&.h.=.f.n.b.a.c.k.9.6.3.6...s.i.t.e.&.p.=.8.0.4.1.&.s.=.0.8.e.b.8.7.7.0.-.c.8.b.8.-.4.d.5.8.-.9.0.a.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.39382429233197
Encrypted:	false
SSDEEP:	6144:al4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNAJOBSqa:K4vF0MYQUMM6VFYSJU
MD5:	47CFB63F3B6978C36135FB660C72B15F
SHA1:	EBAE592313DDFA580FB69B7C02F6F6729382A056
SHA-256:	D1E7279A9459E694127CBD1A08BA8EC197C0229FF645F632EC684913989905EF
SHA-512:	7ED02E64027403996BE385367B16654C5B0025B1EFC98AF89E0BEFC44889B673E737C1A943B3439C191A3CA09B41578BA0A20BA8508A39991C984054ECE92EF9
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.u.}%<..............................................................................................................................................................................................................................................................................................................................................1C.I........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.514893710192672
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UdY4Kc66Bc.exe
File size:	83'368 bytes
MD5:	739682b6fd2b25f2a6234b733090735b
SHA1:	171b56b4dcb6a37cc9ec3704be6982f042f1c461
SHA256:	511ca3f9e84a22885d9dac546aba034373a63a83825a058320713180ef485d74
SHA512:	f1c886e79dd1e6dad08f24417e4a9675cc125a0524bf593341729cfa97e634424832289fb03bcd92084563cf82c8524b5b7a4946c89b7441c3e48090b7e2b2c5
SSDEEP:	1536:7oG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cda2PBJYY27SxO:VenkyfPAwiMq0RqRfba2ZJYY2v
TLSH:	8F836C43B5D18875E9720D3118B1D9B4593FBE110E948EAF3398826E0F391D19E3AE7B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ycId...d...d.......n...............\|.......A.......v.......v...m`..a...d...........e.......e.......e...Richd...........PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401489
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A1348F [Wed Jul 24 17:06:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	37d5c89163970dd3cc69230538a1b72b

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	17/08/2022 01:00:00 16/08/2025 00:59:59
Subject Chain	CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
Version:	3
Thumbprint MD5:	AAE704EC2810686C3BF7704E660AFB5D
Thumbprint SHA-1:	4C2272FBA7A7380F55E2A424E9E624AEE1C14579
Thumbprint SHA-256:	82B4E7924D5BED84FB16DDF8391936EB301479CEC707DC14E23BC22B8CDEAE28
Serial:	0B9360051BCCF66642998998D5BA97CE

Entrypoint Preview

Instruction
call 00007F0D0883624Ah
jmp 00007F0D08835CFFh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0040B048h]
push dword ptr [ebp+08h]
call dword ptr [0040B044h]
push C0000409h
call dword ptr [0040B04Ch]
push eax
call dword ptr [0040B050h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [0040B054h]
test eax, eax
je 00007F0D08835E87h
push 00000002h
pop ecx
int 29h
mov dword ptr [004118C0h], eax
mov dword ptr [004118BCh], ecx
mov dword ptr [004118B8h], edx
mov dword ptr [004118B4h], ebx
mov dword ptr [004118B0h], esi
mov dword ptr [004118ACh], edi
mov word ptr [004118D8h], ss
mov word ptr [004118CCh], cs
mov word ptr [004118A8h], ds
mov word ptr [004118A4h], es
mov word ptr [004118A0h], fs
mov word ptr [0041189Ch], gs
pushfd
pop dword ptr [004118D0h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004118C4h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004118C8h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004118D4h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00411810h], 00010001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1060c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11800	0x2da8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xddc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xfe38	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xfd78	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb000	0x13c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9cf8	0x9e00	bae4521030709e187bdbe8a34d7bf731	False	0.6035650712025317	data	6.581464957368758	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x5d58	0x5e00	128d20faa5b43ccea3bd795f74eb5527	False	0.4178025265957447	Applesoft BASIC program data, first line number 1	4.843109417397977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11000	0x11cc	0x800	04a548a5c04675d08166d3823a6bf61b	False	0.16357421875	data	2.0120795802951505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x13000	0x1e0	0x200	aa256780346be2e1ee49ac6d69d2faff	False	0.52734375	data	4.703723272345726	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xddc	0xe00	908329e10a1923a3c4938a10d44237d9	False	0.7776227678571429	data	6.495696626464028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x13060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

LocalFree, GetProcAddress, LoadLibraryA, Sleep, LocalAlloc, GetModuleFileNameW, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetACP, CloseHandle, HeapAlloc, HeapFree, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, WriteConsoleW, CreateFileW

CRYPT32.dll

CertDeleteCertificateFromStore, CryptMsgGetParam, CertCloseStore, CryptQueryObject, CertAddCertificateContextToStore, CertFindAttribute, CertFreeCertificateContext, CertCreateCertificateContext, CertOpenSystemStoreA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 15:56:08.167907000 CET	49713	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:08.167941093 CET	443	49713	37.221.65.128	192.168.2.9
Nov 21, 2024 15:56:08.168008089 CET	49713	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:08.234174967 CET	49713	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:08.234193087 CET	443	49713	37.221.65.128	192.168.2.9
Nov 21, 2024 15:56:11.272259951 CET	443	49713	37.221.65.128	192.168.2.9
Nov 21, 2024 15:56:11.272367001 CET	49713	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:11.300631046 CET	49713	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:11.300657034 CET	443	49713	37.221.65.128	192.168.2.9
Nov 21, 2024 15:56:11.303788900 CET	49726	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:11.303853035 CET	443	49726	37.221.65.128	192.168.2.9
Nov 21, 2024 15:56:11.303927898 CET	49726	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:11.304522038 CET	49726	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:11.304536104 CET	443	49726	37.221.65.128	192.168.2.9
Nov 21, 2024 15:56:14.304800987 CET	443	49726	37.221.65.128	192.168.2.9
Nov 21, 2024 15:56:14.304905891 CET	49726	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:14.323950052 CET	49726	443	192.168.2.9	37.221.65.128
Nov 21, 2024 15:56:14.323992014 CET	443	49726	37.221.65.128	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 15:56:07.967323065 CET	63584	53	192.168.2.9	1.1.1.1
Nov 21, 2024 15:56:08.106595039 CET	53	63584	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 15:56:07.967323065 CET	192.168.2.9	1.1.1.1	0x1806	Standard query (0)	fn3699.kafinora.cyou	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 15:56:03.236252069 CET	1.1.1.1	192.168.2.9	0xe968	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 15:56:03.236252069 CET	1.1.1.1	192.168.2.9	0xe968	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Nov 21, 2024 15:56:08.106595039 CET	1.1.1.1	192.168.2.9	0x1806	No error (0)	fn3699.kafinora.cyou		37.221.65.128	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:56:04
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\UdY4Kc66Bc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UdY4Kc66Bc.exe"
Imagebase:	0xb80000
File size:	83'368 bytes
MD5 hash:	739682B6FD2B25F2A6234B733090735B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:56:04
Start date:	21/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
Imagebase:	0x1a3cb7b0000
File size:	24'856 bytes
MD5 hash:	B4088F44B80D363902E11F897A7BAC09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:56:05
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 880
Imagebase:	0xc50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	1465
Total number of Limit Nodes:	4

Executed Functions

Function 00B81000 Relevance: 54.4, APIs: 27, Strings: 4, Instructions: 199
encryptionmemorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000000,00000104), ref: 00B81016
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 00B81025
CertOpenSystemStoreA.CRYPT32(00000000,TrustedPublisher), ref: 00B81032
LocalAlloc.KERNELBASE(00000000,00040000), ref: 00B81057
LocalAlloc.KERNEL32(00000000,00040000), ref: 00B81063
CryptQueryObject.CRYPT32(00000001,00000000,00000400,00000002,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00B81082
CryptMsgGetParam.CRYPT32(?,0000000B,00000000,?,?), ref: 00B810B2
LocalAlloc.KERNEL32(00000000,?), ref: 00B810C5
LocalAlloc.KERNEL32(00000000,00002000), ref: 00B810F4
CryptMsgGetParam.CRYPT32(?,0000000C,00000000,00000000,00002000), ref: 00B8110A
CertCreateCertificateContext.CRYPT32(00000001,00000000,00002000), ref: 00B8111A
CertAddCertificateContextToStore.CRYPT32(?,00000000,00000001,00000000), ref: 00B8112D
CertFreeCertificateContext.CRYPT32(00000000), ref: 00B81134
LocalFree.KERNEL32(00000000), ref: 00B8113E
LocalFree.KERNEL32(00000000), ref: 00B8115D
CryptMsgGetParam.CRYPT32(?,00000009,00000000,00000000,00040000), ref: 00B8116E
CryptMsgGetParam.CRYPT32(?,0000000A,00000000,?,00040000), ref: 00B81182
CertFindAttribute.CRYPT32(1.3.6.1.4.1.311.4.1.1,00000000,?), ref: 00B81198
CertFindAttribute.CRYPT32(1.3.6.1.4.1.311.4.1.1,?,?), ref: 00B811A9
LoadLibraryA.KERNELBASE(dfshim), ref: 00B811BA
GetProcAddress.KERNEL32(00000000,ShOpenVerbApplicationW), ref: 00B811C6
Sleep.KERNELBASE(00009C40), ref: 00B811E8
CertDeleteCertificateFromStore.CRYPT32(?), ref: 00B8120B
CertCloseStore.CRYPT32(?,00000000), ref: 00B8121A
LocalFree.KERNEL32(?), ref: 00B81223
LocalFree.KERNEL32(?), ref: 00B81228
LocalFree.KERNEL32(?), ref: 00B8122D

Strings

dfshim, xrefs: 00B811B5
TrustedPublisher, xrefs: 00B8102B
ShOpenVerbApplicationW, xrefs: 00B811C0
1.3.6.1.4.1.311.4.1.1, xrefs: 00B81193, 00B811A4

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: Local$Cert$Free$AllocCrypt$CertificateParamStore$Context$AttributeFind$AddressCloseCreateDeleteFileFromLibraryLoadModuleNameObjectOpenProcQuerySleepSystem
String ID: 1.3.6.1.4.1.311.4.1.1$ShOpenVerbApplicationW$TrustedPublisher$dfshim
API String ID: 335784236-860318880
Opcode ID: 854d2b1140725a0bce5d28b6a848a54b3c27fd0e0d27422eb382f9390f45dd09
Instruction ID: 8f245fc1f75a25bf4d580f758c3386be75f243bb0229720d690618cd95255a12
Opcode Fuzzy Hash: 854d2b1140725a0bce5d28b6a848a54b3c27fd0e0d27422eb382f9390f45dd09
Instruction Fuzzy Hash: 09613E71A40219ABEB11AFA4DC49FAFBBB9EF48B50F100055E614B72B0CB719901DBA4

Non-executed Functions

Function 00B8191F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00B8192B
IsDebuggerPresent.KERNEL32 ref: 00B819F7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B81A10
UnhandledExceptionFilter.KERNEL32(?), ref: 00B81A1A

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e655ad9f733c6edce580e2ebc503ae53a090fabc442a323f6a28856ce4382d42
Instruction ID: 8513504ce83a8b97a7e45ed586f61510539cbfdbb194d7381d47f272e738e38c
Opcode Fuzzy Hash: e655ad9f733c6edce580e2ebc503ae53a090fabc442a323f6a28856ce4382d42
Instruction Fuzzy Hash: 8831F875D012189BDB21EF64D949BCDBBF8AF08300F1041EAE50CAB260EB759A85CF45

Function 00B84573 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00B8466B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00B84675
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B84682

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: bc74a99c119bb977e002eb1b3513b33c9e0f1d2abbac8a964ecc09fa7f3bb1af
Instruction ID: c4e9b37a9a80926d97ea9b8758d64cf2fb7fb501dbef046463e9b0ca62f5f7d0
Opcode Fuzzy Hash: bc74a99c119bb977e002eb1b3513b33c9e0f1d2abbac8a964ecc09fa7f3bb1af
Instruction Fuzzy Hash: 2231B2749012199BCB21EF68DD89B8DBBF8EF08310F5045EAE41CA7260EB709B85CF45

Function 00B83677 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00B8364D,?,00B902E0,0000000C,00B837A4,?,00000002,00000000,?,00B83F66,00000003,00B8209F,00B81AFC), ref: 00B83698
TerminateProcess.KERNEL32(00000000,?,00B8364D,?,00B902E0,0000000C,00B837A4,?,00000002,00000000,?,00B83F66,00000003,00B8209F,00B81AFC), ref: 00B8369F
ExitProcess.KERNEL32 ref: 00B836B1

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4a4da21198cb1ad8f3435973b1abb9b7fe99d0788ad0d13b47af27c220fe1010
Instruction ID: a0e83d33bb9cc6f0a3d1e35e7aae801aa203a3888c5786e2008b773af7ca453e
Opcode Fuzzy Hash: 4a4da21198cb1ad8f3435973b1abb9b7fe99d0788ad0d13b47af27c220fe1010
Instruction Fuzzy Hash: 4CE0B631014548AFCF11BF68DD09E5A3BAAEF40B45B004094FA559B231EF35DE42CB50

Function 00B84A4B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00B84BDE

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: ce476cd0276c51d9be60fffdad3783c28c1c97c4e75cacebbd402a65132aaebb
Instruction ID: 65ca41977c3fc81b13b4860b444e054c858c398e862fed35b8cdd24fdf8174bd
Opcode Fuzzy Hash: ce476cd0276c51d9be60fffdad3783c28c1c97c4e75cacebbd402a65132aaebb
Instruction Fuzzy Hash: CD31D07290024AABCB28AE78CC84EEA7BFDEB85314F1441E9E51997261E730DD45CB50

Function 00B8A495 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00B8A490,?,?,00000008,?,?,00B8A130,00000000), ref: 00B8A6C2

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 65d48d9d5e9d9b082275c534cdcf195aac9f3b14c7cf3a34eb718a42a334ad44
Instruction ID: 6cfd201fc30f7587e6582aa2d23872a8ab881a6477ad10d8ec9f922e49f2bf0c
Opcode Fuzzy Hash: 65d48d9d5e9d9b082275c534cdcf195aac9f3b14c7cf3a34eb718a42a334ad44
Instruction Fuzzy Hash: BEB15E352106088FE715DF28C48ABA47BE0FF04364F298699E89ACF2B1D335DD91CB41

Function 00B81BD4 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B81BEA

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: db83586990e6de501eff9e4cc4c98c360b1d07f4c024213ce4e2fe3e0f420225
Instruction ID: d8261c8ce37745ebf5adb251590ea67a9d669988f885fcf90b65077709c3efb2
Opcode Fuzzy Hash: db83586990e6de501eff9e4cc4c98c360b1d07f4c024213ce4e2fe3e0f420225
Instruction Fuzzy Hash: 1D51AEB1E122068FEB14CF6DD9817AEBBF5FB48340F1488AAC401EB2A0D7759942CF50

Function 00B81AAC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001AB8,00B81300), ref: 00B81AB1

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dbcffeb582e53177c0e1011fa62c408d5a8bbc632e074a59ce207ddc6cdb7025
Instruction ID: 6d1eea477546ae4c539eae8f10e6bc3c3af67a8cf573b1fc02bdeaf9743dd8eb
Opcode Fuzzy Hash: dbcffeb582e53177c0e1011fa62c408d5a8bbc632e074a59ce207ddc6cdb7025
Instruction Fuzzy Hash:

Function 00B86893 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00B86893

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2936c2fe9b64675f118ceb3b977bde004123ce92c101b2015ce77f9e84adb994
Instruction ID: fdb55ab4dbb937123ed6c2862012bf6e07e6de89dc90780baf9b1f1ca5145125
Opcode Fuzzy Hash: 2936c2fe9b64675f118ceb3b977bde004123ce92c101b2015ce77f9e84adb994
Instruction Fuzzy Hash: D6A01130A00202EB83008F30AB8A2083AA8AA00A80B02002AA008EA030EF3080A0AB02

Function 00B86507 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 00B8654B

Part of subcall function 00B86078: _free.LIBCMT ref: 00B86095
Part of subcall function 00B86078: _free.LIBCMT ref: 00B860A7
Part of subcall function 00B86078: _free.LIBCMT ref: 00B860B9
Part of subcall function 00B86078: _free.LIBCMT ref: 00B860CB
Part of subcall function 00B86078: _free.LIBCMT ref: 00B860DD
Part of subcall function 00B86078: _free.LIBCMT ref: 00B860EF
Part of subcall function 00B86078: _free.LIBCMT ref: 00B86101
Part of subcall function 00B86078: _free.LIBCMT ref: 00B86113
Part of subcall function 00B86078: _free.LIBCMT ref: 00B86125
Part of subcall function 00B86078: _free.LIBCMT ref: 00B86137
Part of subcall function 00B86078: _free.LIBCMT ref: 00B86149
Part of subcall function 00B86078: _free.LIBCMT ref: 00B8615B
Part of subcall function 00B86078: _free.LIBCMT ref: 00B8616D

_free.LIBCMT ref: 00B86540

Part of subcall function 00B84869: HeapFree.KERNEL32(00000000,00000000,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?), ref: 00B8487F
Part of subcall function 00B84869: GetLastError.KERNEL32(?,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?,?), ref: 00B84891

_free.LIBCMT ref: 00B86562
_free.LIBCMT ref: 00B86577
_free.LIBCMT ref: 00B86582
_free.LIBCMT ref: 00B865A4
_free.LIBCMT ref: 00B865B7
_free.LIBCMT ref: 00B865C5
_free.LIBCMT ref: 00B865D0
_free.LIBCMT ref: 00B86608
_free.LIBCMT ref: 00B8660F
_free.LIBCMT ref: 00B8662C
_free.LIBCMT ref: 00B86644

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 42a712ebfcf84b6093adecc72c19ca7ddf2f5ad4a74fa2167d7cc1d38142e2ae
Instruction ID: aa2b41c6e8694657a5f3db461de1921ca2f21e8f7c21beb24da40b10e2f8968e
Opcode Fuzzy Hash: 42a712ebfcf84b6093adecc72c19ca7ddf2f5ad4a74fa2167d7cc1d38142e2ae
Instruction Fuzzy Hash: 94313B71600246DFEB61BA7AE849B9A73E8EF50314F1449AAF449D71B1DF31ED40CB50

Function 00B84330 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00B84344

Part of subcall function 00B84869: HeapFree.KERNEL32(00000000,00000000,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?), ref: 00B8487F
Part of subcall function 00B84869: GetLastError.KERNEL32(?,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?,?), ref: 00B84891

_free.LIBCMT ref: 00B84350
_free.LIBCMT ref: 00B8435B
_free.LIBCMT ref: 00B84366
_free.LIBCMT ref: 00B84371
_free.LIBCMT ref: 00B8437C
_free.LIBCMT ref: 00B84387
_free.LIBCMT ref: 00B84392
_free.LIBCMT ref: 00B8439D
_free.LIBCMT ref: 00B843AB

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e300e69031d3a071499d2849c2642482825d4fc5b60e13a081148624893ac81d
Instruction ID: ac824a7160a8393b02ca7df73991e546d06b4674aa6c71e48a6323524b936816
Opcode Fuzzy Hash: e300e69031d3a071499d2849c2642482825d4fc5b60e13a081148624893ac81d
Instruction Fuzzy Hash: CA119076A00149EFCB81FF96D846CD93BA5EF44754F0140A2BA088B272DB31EE50DB80

Function 00B87AB4 Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,00B854C8,00000000,?,?,?,00B87D05,?,?,00000100), ref: 00B87B0E
__alloca_probe_16.LIBCMT ref: 00B87B46
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,00B87D05,?,?,00000100,5EFC4D8B,?,?), ref: 00B87B94
__alloca_probe_16.LIBCMT ref: 00B87C2B
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00B87C8E
__freea.LIBCMT ref: 00B87C9B

Part of subcall function 00B862FF: HeapAlloc.KERNEL32(00000000,?,00000004,?,00B87E5B,?,00000000,?,00B8686F,?,00000004,00000000,?,?,?,00B83BCD), ref: 00B86331

__freea.LIBCMT ref: 00B87CA4
__freea.LIBCMT ref: 00B87CC9

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: b71f3e098b26c77c234633378cc79db2455a1dbcd71119cb87f94da7a927fdfb
Instruction ID: e1f8c8ec1b8c989c97f8430ed63d33707bf35c6db9b8a01ea9e0bdcf987f2095
Opcode Fuzzy Hash: b71f3e098b26c77c234633378cc79db2455a1dbcd71119cb87f94da7a927fdfb
Instruction Fuzzy Hash: D551F072654206ABEB25AF64CC81EAF77EAEB40758F2446A8FC04D7160EF34DC40DB90

Function 00B88417 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00B88B8C,?,00000000,?,00000000,00000000), ref: 00B88459
__fassign.LIBCMT ref: 00B884D4
__fassign.LIBCMT ref: 00B884EF
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00B88515
WriteFile.KERNEL32(?,?,00000000,00B88B8C,00000000,?,?,?,?,?,?,?,?,?,00B88B8C,?), ref: 00B88534
WriteFile.KERNEL32(?,?,00000001,00B88B8C,00000000,?,?,?,?,?,?,?,?,?,00B88B8C,?), ref: 00B8856D

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 2075bf4041de9bb67dded5baa0ee9a4a692b721e3af1946dea1cfa05a619f83e
Instruction ID: 0236fae686e7b42707bda247324c564ebd4ac11a04bd2a8d9744f6eea2e10126
Opcode Fuzzy Hash: 2075bf4041de9bb67dded5baa0ee9a4a692b721e3af1946dea1cfa05a619f83e
Instruction Fuzzy Hash: 68519471A002499FDB10DFA8DC85AEEBBF9EF19300F14455AE955E72A1DB309A41CB60

Function 00B81E00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 00B81E37
___except_validate_context_record.LIBVCRUNTIME ref: 00B81E3F
_ValidateLocalCookies.LIBCMT ref: 00B81EC8
__IsNonwritableInCurrentImage.LIBCMT ref: 00B81EF3
_ValidateLocalCookies.LIBCMT ref: 00B81F48

Strings

csm, xrefs: 00B81EDD

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 2cbdbc600a7d3cd7d4d66be0581412becb471ad862e3bdaafa8c72bb02916bef
Instruction ID: b83c7e94ae02e524ac3755ef5222805f9d66a3ca4a1e179860ca592308fc4f89
Opcode Fuzzy Hash: 2cbdbc600a7d3cd7d4d66be0581412becb471ad862e3bdaafa8c72bb02916bef
Instruction Fuzzy Hash: BF41B034A012089FCF10EF6CC894A9EBBF9EF45354F1488D5E818AB3B2D7359902CB90

Function 00B8621B Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B861DF: _free.LIBCMT ref: 00B86208

_free.LIBCMT ref: 00B86269

Part of subcall function 00B84869: HeapFree.KERNEL32(00000000,00000000,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?), ref: 00B8487F
Part of subcall function 00B84869: GetLastError.KERNEL32(?,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?,?), ref: 00B84891

_free.LIBCMT ref: 00B86274
_free.LIBCMT ref: 00B8627F
_free.LIBCMT ref: 00B862D3
_free.LIBCMT ref: 00B862DE
_free.LIBCMT ref: 00B862E9
_free.LIBCMT ref: 00B862F4

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1d7f3cd73ca15569adc6f3b3063faa031294499d8d9ad134557c71114fc07fde
Instruction ID: 15df3be814ee0b2a8e242f85f3d8692479eede7c3573b70aea713145da8ea519
Opcode Fuzzy Hash: 1d7f3cd73ca15569adc6f3b3063faa031294499d8d9ad134557c71114fc07fde
Instruction Fuzzy Hash: 76110771950B54AAD660BBB1CC0BFCB77DCAF44700F4058A5B69AA60B3EB65AE04C790

Function 00B823D1 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00B823C8,00B8209F,00B81AFC), ref: 00B823DF
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B823ED
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B82406
SetLastError.KERNEL32(00000000,00B823C8,00B8209F,00B81AFC), ref: 00B82458

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c7e0332bc4d3f43384faf8c2793fd10c25a2e9326f244ea1744b31042c0c1cf3
Instruction ID: aa88c51fb16bdf3c5954716cafb681f98f73f0355b5e8219041da3faa47450fc
Opcode Fuzzy Hash: c7e0332bc4d3f43384faf8c2793fd10c25a2e9326f244ea1744b31042c0c1cf3
Instruction Fuzzy Hash: A40184321092166FAA2437B8AC85A6727D4DB117F573407BAFA20862F9FF524C91E364

Function 00B84424 Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000008,?,00B86D69,?,?,?,00B904C8,0000002C,00B83F34,00000016,00B8209F,00B81AFC), ref: 00B84428
_free.LIBCMT ref: 00B8445B
_free.LIBCMT ref: 00B84483
SetLastError.KERNEL32(00000000), ref: 00B84490
SetLastError.KERNEL32(00000000), ref: 00B8449C
_abort.LIBCMT ref: 00B844A2

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 828d5d5146381f92b92f3da22a3ea8ab807715c2a49c78d77cf235eaf5d626c4
Instruction ID: 01ecde3e63a950673ba437e99570add5e77ac7ae6a62b8de156511a4dfebd78e
Opcode Fuzzy Hash: 828d5d5146381f92b92f3da22a3ea8ab807715c2a49c78d77cf235eaf5d626c4
Instruction Fuzzy Hash: FFF0FC35500643B7C6227B34AC59F2B26EADFD1771B294595F528D33F1EF218901D321

Function 00B836FC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00B836AD,?,?,00B8364D,?,00B902E0,0000000C,00B837A4,?,00000002), ref: 00B8371C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B8372F
FreeLibrary.KERNEL32(00000000,?,?,?,00B836AD,?,?,00B8364D,?,00B902E0,0000000C,00B837A4,?,00000002,00000000), ref: 00B83752

Strings

mscoree.dll, xrefs: 00B83715
CorExitProcess, xrefs: 00B83727

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3018e533cfa0eb63d5113c6c68341f57b6fd9db97d9023c4a6adb52c463d5ea7
Instruction ID: 3f3dff58257643a84861c857c1468fe8bedd36666c56b994472f64fd8beb8971
Opcode Fuzzy Hash: 3018e533cfa0eb63d5113c6c68341f57b6fd9db97d9023c4a6adb52c463d5ea7
Instruction Fuzzy Hash: 96F03C75A00209BBDB11ABA4DC59FAEBBF8EF08B52F0040A5E805A6170DF359E45DB90

Function 00B8634D Relevance: 7.6, APIs: 5, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,00B854C8,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 00B8639A
__alloca_probe_16.LIBCMT ref: 00B863D2
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B86423
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00B86435
__freea.LIBCMT ref: 00B8643E

Part of subcall function 00B862FF: HeapAlloc.KERNEL32(00000000,?,00000004,?,00B87E5B,?,00000000,?,00B8686F,?,00000004,00000000,?,?,?,00B83BCD), ref: 00B86331

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: feaab26826358c0e930c75a3f228870e69ef0fde84da745504aaa31ae9834198
Instruction ID: 98bb0cf82acc14ae62e2f9a3982286ab39d58f79c12f37f640c352dfdfdd35df
Opcode Fuzzy Hash: feaab26826358c0e930c75a3f228870e69ef0fde84da745504aaa31ae9834198
Instruction Fuzzy Hash: D331CF72A0021AABDF25AF68DC85DAE7BE5EF00710F0841A9FC14D7260EB35CD55CBA1

Function 00B8561E Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B85627
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B8564A

Part of subcall function 00B862FF: HeapAlloc.KERNEL32(00000000,?,00000004,?,00B87E5B,?,00000000,?,00B8686F,?,00000004,00000000,?,?,?,00B83BCD), ref: 00B86331

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00B85670
_free.LIBCMT ref: 00B85683
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B85692

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: 81e00a0056eded2a40fa463e1eb2d250ffa132215fab1c698fc08561f24cea9d
Instruction ID: 9e316cb1a54a59acd153070d0b90c594202c7ae5a1fd3cc2d9bc3309b57c49ce
Opcode Fuzzy Hash: 81e00a0056eded2a40fa463e1eb2d250ffa132215fab1c698fc08561f24cea9d
Instruction Fuzzy Hash: 19017172601A597FA7313AB65C9DCBB6AADDEC2BA135501A9F904D7170FF608C01C3B0

Function 00B844A8 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00B847FE,00B87E79,?,00B8686F,?,00000004,00000000,?,?,?,00B83BCD,?,00000000), ref: 00B844AD
_free.LIBCMT ref: 00B844E2
_free.LIBCMT ref: 00B84509
SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 00B84516
SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 00B8451F

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 11a9d8bd6aa8a38b7389acaccbdf4b9c86bbf79cfcaffb87111f2bbe594e3fb2
Instruction ID: 84e6a00d253c18f7b903cbf19a4c738f69ff22d08bbad2dd7f02b9404c0345b3
Opcode Fuzzy Hash: 11a9d8bd6aa8a38b7389acaccbdf4b9c86bbf79cfcaffb87111f2bbe594e3fb2
Instruction Fuzzy Hash: 44012836200603ABC2227B346C89E6F26EEEBD177573400A5F519E32B2EF718E01C320

Function 00B86176 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00B8618E

Part of subcall function 00B84869: HeapFree.KERNEL32(00000000,00000000,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?), ref: 00B8487F
Part of subcall function 00B84869: GetLastError.KERNEL32(?,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?,?), ref: 00B84891

_free.LIBCMT ref: 00B861A0
_free.LIBCMT ref: 00B861B2
_free.LIBCMT ref: 00B861C4
_free.LIBCMT ref: 00B861D6

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b99139998e9afa0b66b72ef56ad429781edce1b454881bd1cd9133388fe08c43
Instruction ID: 2c68f71d861efc2e73f5aa3395a656c1d9ec343669388ac9e4ed03ec0a1926af
Opcode Fuzzy Hash: b99139998e9afa0b66b72ef56ad429781edce1b454881bd1cd9133388fe08c43
Instruction Fuzzy Hash: 0CF01232A14251AF86A0FF59FA89C1A77DDEA40B547581C96F409E7573CB30FC80D754

Function 00B83D8F Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B83DAD

Part of subcall function 00B84869: HeapFree.KERNEL32(00000000,00000000,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?), ref: 00B8487F
Part of subcall function 00B84869: GetLastError.KERNEL32(?,?,00B8620D,?,00000000,?,00000000,?,00B86234,?,00000007,?,?,00B8669F,?,?), ref: 00B84891

_free.LIBCMT ref: 00B83DBF
_free.LIBCMT ref: 00B83DD2
_free.LIBCMT ref: 00B83DE3
_free.LIBCMT ref: 00B83DF4

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8c661f009d9546379b15d37002f147c2da25825acdf6502904e4a33f614ecc32
Instruction ID: 42be00c1f21c63c44396bea47e6fe897f30b26cb7fb9422b98b867f276831b7d
Opcode Fuzzy Hash: 8c661f009d9546379b15d37002f147c2da25825acdf6502904e4a33f614ecc32
Instruction Fuzzy Hash: 7FF03A78801262AFDB817F29FE054093BA0EF54B203020AA7F416A72B1CF350951EBC4

Function 00B82F53 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\UdY4Kc66Bc.exe,00000104), ref: 00B82F93
_free.LIBCMT ref: 00B8305E
_free.LIBCMT ref: 00B83068

Strings

C:\Users\user\Desktop\UdY4Kc66Bc.exe, xrefs: 00B82F8A, 00B82F91, 00B82FC0, 00B82FF8

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\UdY4Kc66Bc.exe
API String ID: 2506810119-358099547
Opcode ID: 16c3ef11e8994b1d959ac6d755a15af538e874c7e5c73c25cc4a5a52e4234f15
Instruction ID: a14d507c12582d3968b1a91befb3cf359f1460f6db0991f4bf75603bc332c1de
Opcode Fuzzy Hash: 16c3ef11e8994b1d959ac6d755a15af538e874c7e5c73c25cc4a5a52e4234f15
Instruction Fuzzy Hash: 8B317075A00249AFCB21BB99D88199EBBFCEF85B10B1040A6E504A7261DB718E40DB51

Function 00B825E3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00B82594,00000000,?,00B91B50,?,?,?,00B82737,00000004,InitializeCriticalSectionEx,00B8BC48,InitializeCriticalSectionEx), ref: 00B825F0
GetLastError.KERNEL32(?,00B82594,00000000,?,00B91B50,?,?,?,00B82737,00000004,InitializeCriticalSectionEx,00B8BC48,InitializeCriticalSectionEx,00000000,?,00B824C7), ref: 00B825FA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00B82622

Strings

api-ms-, xrefs: 00B82607

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 60a74a5a2cc85ade3c220f55cb51a4f7d88272100eb31891120b50ab0f622c26
Instruction ID: 80251a4a0ea4e55394bf51489585aed27e48a3a5c99719d2fcc6416f70a7b2d9
Opcode Fuzzy Hash: 60a74a5a2cc85ade3c220f55cb51a4f7d88272100eb31891120b50ab0f622c26
Instruction Fuzzy Hash: DCE01A30680205FBEF212B70EC06F5A3B98EB10B51F104460F90DA80B1EBB2A954EB49

Function 00B857DD Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00B85784,00000000,00000000,00000000,00000000,?,00B85981,00000006,FlsSetValue), ref: 00B8580F
GetLastError.KERNEL32(?,00B85784,00000000,00000000,00000000,00000000,?,00B85981,00000006,FlsSetValue,00B8C4D8,FlsSetValue,00000000,00000364,?,00B844F6), ref: 00B8581B
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00B85784,00000000,00000000,00000000,00000000,?,00B85981,00000006,FlsSetValue,00B8C4D8,FlsSetValue,00000000), ref: 00B85829

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: aef722afbf42cd22f35430837c6a07611af93c14c12a02030cb5cddea7fbd7d4
Instruction ID: 356a1314284bc084a28af6c1279ae193a482fda0299644ffa10cbc4488cd7471
Opcode Fuzzy Hash: aef722afbf42cd22f35430837c6a07611af93c14c12a02030cb5cddea7fbd7d4
Instruction Fuzzy Hash: 4D01A236605A22EBCB315B78AC84E5777D8EF05BA1B210665FA2AD7161DF20DC00C7E0

Function 00B848BB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B84A27

Part of subcall function 00B8474D: IsProcessorFeaturePresent.KERNEL32(00000017,00B8473C,00000000,?,00000004,00000000,?,?,?,?,00B84749,00000000,00000000,00000000,00000000,00000000), ref: 00B8474F
Part of subcall function 00B8474D: GetCurrentProcess.KERNEL32(C0000417), ref: 00B84771
Part of subcall function 00B8474D: TerminateProcess.KERNEL32(00000000), ref: 00B84778

Strings

., xrefs: 00B84BDE
*?, xrefs: 00B848FE

Memory Dump Source

Source File: 00000000.00000002.1460710481.0000000000B81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B80000, based on PE: true

Associated: 00000000.00000002.1460680288.0000000000B80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460730799.0000000000B8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460753992.0000000000B91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460781447.0000000000B93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b80000_UdY4Kc66Bc.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: b5ebe54ac363d96a5ffd237f2e5e25fa63b2e5d383b99c3f0f4b770ea8c32303
Instruction ID: 574d9da84382bb66c40a1f9d74731b1dc5aaa395b3c19ed9515271984696a6b4
Opcode Fuzzy Hash: b5ebe54ac363d96a5ffd237f2e5e25fa63b2e5d383b99c3f0f4b770ea8c32303
Instruction Fuzzy Hash: 6A518275E0011AAFDF14EFA8C881AAEB7F5EF58314F2441AAE454E7351E7359E01CB50

Analysis Process: dfsvc.exePID: 1688, Parent PID: 5048COMMON

Execution Graph

Execution Coverage:	20.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF886E415D8 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 279
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF886E41827

Strings

1M_I, xrefs: 00007FF886E41604

Memory Dump Source

Source File: 00000001.00000002.2287408195.00007FF886E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff886e40000_dfsvc.jbxd

Similarity

API ID: LibraryLoad
String ID: 1M_I
API String ID: 1029625771-598927076
Opcode ID: a931b1573b69473138e81ffefbf9be078e28ae1907b1277f2acb02fae619a2fd
Instruction ID: 0ad9ed6d4e24f32b467b8590814219e5aa24f6423e8bcbba36087057439d5e2b
Opcode Fuzzy Hash: a931b1573b69473138e81ffefbf9be078e28ae1907b1277f2acb02fae619a2fd
Instruction Fuzzy Hash: AA81D431E5CA894FEB59DB7C98592F97BE1FF96350F1841BAC00DC7292EE249805C741

Function 00007FF886E52EF9 Relevance: 1.8, APIs: 1, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateUrlCacheEntryW.WININET ref: 00007FF886E53103

Memory Dump Source

Source File: 00000001.00000002.2287408195.00007FF886E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff886e40000_dfsvc.jbxd

Similarity

API ID: CacheCreateEntry
String ID:
API String ID: 3741994674-0
Opcode ID: 99e259ecd8a984423b3c701095d91f42b89a0281608d728894de18ec59a8cf42
Instruction ID: ac004a92186f76eaf9a5fc5a287693e7967dafb7e7aa62e8a6fa0d9ed3f8753a
Opcode Fuzzy Hash: 99e259ecd8a984423b3c701095d91f42b89a0281608d728894de18ec59a8cf42
Instruction Fuzzy Hash: C8A1F27051CA8D8FDBA9DF2898497E53BE0FF55310F10426EE88DC7292DA789845CB91

Function 00007FF886E50A02 Relevance: 1.8, APIs: 1, Instructions: 280
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetGetCookieW.WININET ref: 00007FF886E50BE6

Memory Dump Source

Source File: 00000001.00000002.2287408195.00007FF886E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff886e40000_dfsvc.jbxd

Similarity

API ID: CookieInternet
String ID:
API String ID: 930238652-0
Opcode ID: c2d8192f53cbfff796b254ed03fcc2a6e12be3f56a6c6d9e34daad4ea7fae688
Instruction ID: 3173fe9c92bb32e515dbf4aa3c0a1e57305ab872821d2498cf367b5d8ece3fb1
Opcode Fuzzy Hash: c2d8192f53cbfff796b254ed03fcc2a6e12be3f56a6c6d9e34daad4ea7fae688
Instruction Fuzzy Hash: 5291C170508B8D8FDBA9DF28C8597E93BE1FF59310F04426EE84DC7292DA749945CB81

Function 00007FF886E4994B Relevance: 1.7, APIs: 1, Instructions: 179
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF886E49A7C

Memory Dump Source

Source File: 00000001.00000002.2287408195.00007FF886E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff886e40000_dfsvc.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 57d5b296c80ce097b837757f2d785cbf4fecf83a07f7e7657a2c462e8a3768f7
Instruction ID: b31f3c98ba8f82c5cd5026c7bfa8a5adeebbde74625888dbc7c96e467ee8cb53
Opcode Fuzzy Hash: 57d5b296c80ce097b837757f2d785cbf4fecf83a07f7e7657a2c462e8a3768f7
Instruction Fuzzy Hash: DC518F7191CA5C8FDB58EF68D845BE9BBE0FB69310F1442AED04DD3252CB35A845CB81

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UdY4Kc66Bc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UdY4Kc66Bc.exe_a8a277acefd3409613122e36fa81eae6606dbdad_d91d52ad_41794d01-c599-49cc-99fa-a17bb59c0039\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FD0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER330E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER335D.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dfsvc.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\DJY51CAU.log

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
UdY4Kc66Bc.exe

Function 00B81000 Relevance: 54.4, APIs: 27, Strings: 4, Instructions: 199
encryptionmemorylibraryCOMMON

Function 00B86507 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Function 00B84330 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Function 00B87AB4 Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Function 00B88417 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Function 00B81E00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Function 00B8621B Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Function 00B823D1 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Function 00B84424 Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Function 00B836FC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Function 00B8634D Relevance: 7.6, APIs: 5, Instructions: 110
COMMON

Function 00B8561E Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Function 00B844A8 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Function 00B86176 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE