Edit tour

Windows Analysis Report
f3aef511705f37f9792c6032b936ca61.exe

Overview

General Information

Sample name:	f3aef511705f37f9792c6032b936ca61.exe
Analysis ID:	1569764
MD5:	e4631d6e2fee44de27d84aff1ce7c7a5
SHA1:	d16bc9a9e7249e8f5b519cabbaafa0f1462bccdd
SHA256:	008478ff6c70392e5ecf933881df2c44f31fdf76ad88c407191233cb39de6528
Tags:	exenjratRATuser-abuse_ch
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops fake system file at system root drive

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Njrat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Creates autorun.inf (USB autostart)

Creates autostart registry keys with suspicious names

Drops PE files to the startup folder

Drops PE files with benign system names

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Protects its processes via BreakOnTermination flag

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses netsh to modify the Windows network and firewall settings

Uses taskkill to terminate AV processes

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara signature match

Classification

Process Tree

System is w10x64

f3aef511705f37f9792c6032b936ca61.exe (PID: 5840 cmdline: "C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe" MD5: E4631D6E2FEE44DE27D84AFF1CE7C7A5)

NjRAT.exe (PID: 3356 cmdline: "C:\Users\user\Desktop\NjRAT.exe" MD5: 5C02E4B0AD99D924AA9EED7D706BFE12)

svchost.exe (PID: 1536 cmdline: "C:\Users\user\AppData\Local\Temp\svchost.exe" MD5: 5C02E4B0AD99D924AA9EED7D706BFE12)

netsh.exe (PID: 5908 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6004 cmdline: taskkill /F /IM ProcessHacker.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 768 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

svchost.exe (PID: 6416 cmdline: "C:\Users\user\AppData\Local\Temp\svchost.exe" .. MD5: 5C02E4B0AD99D924AA9EED7D706BFE12)

svchost.exe (PID: 7136 cmdline: "C:\Users\user\AppData\Local\Temp\svchost.exe" .. MD5: 5C02E4B0AD99D924AA9EED7D706BFE12)

svchost.exe (PID: 2292 cmdline: "C:\Users\user\AppData\Local\Temp\svchost.exe" .. MD5: 5C02E4B0AD99D924AA9EED7D706BFE12)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "2.tcp.eu.ngrok.io", "Port": "16299", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "svchost.exe", "Install Dir": "TEMP"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\svchost.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\svchost.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\svchost.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7ee2:$a3: Download ERROR 0x81d4:$a5: netsh firewall delete allowedprogram "
C:\svchost.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7ee2:$a3: Download ERROR 0x81d4:$a5: netsh firewall delete allowedprogram "
C:\Users\user\Desktop\NjRAT.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\svchost.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80ca:$a1: netsh firewall add allowedprogram 0x82c4:$b1: [TAP] 0x826a:$b2: & exit 0x8236:$c1: md.exe /k ping 0 & del
C:\Users\user\AppData\Local\Temp\svchost.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81d4:$s1: netsh firewall delete allowedprogram 0x80ca:$s2: netsh firewall add allowedprogram 0x8234:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ebe:$s4: Execute ERROR 0x7f1e:$s4: Execute ERROR 0x7ee2:$s5: Download ERROR 0x827a:$s6: [kl]
C:\Users\user\Desktop\NjRAT.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7ee2:$a3: Download ERROR 0x81d4:$a5: netsh firewall delete allowedprogram "
C:\svchost.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80ca:$a1: netsh firewall add allowedprogram 0x82c4:$b1: [TAP] 0x826a:$b2: & exit 0x8236:$c1: md.exe /k ping 0 & del
C:\Users\user\Desktop\NjRAT.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80ca:$a1: netsh firewall add allowedprogram 0x82c4:$b1: [TAP] 0x826a:$b2: & exit 0x8236:$c1: md.exe /k ping 0 & del
C:\svchost.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81d4:$s1: netsh firewall delete allowedprogram 0x80ca:$s2: netsh firewall add allowedprogram 0x8234:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ebe:$s4: Execute ERROR 0x7f1e:$s4: Execute ERROR 0x7ee2:$s5: Download ERROR 0x827a:$s6: [kl]
C:\Users\user\Desktop\NjRAT.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81d4:$s1: netsh firewall delete allowedprogram 0x80ca:$s2: netsh firewall add allowedprogram 0x8234:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ebe:$s4: Execute ERROR 0x7f1e:$s4: Execute ERROR 0x7ee2:$s5: Download ERROR 0x827a:$s6: [kl]
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7ee2:$a3: Download ERROR 0x81d4:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80ca:$a1: netsh firewall add allowedprogram 0x82c4:$b1: [TAP] 0x826a:$b2: & exit 0x8236:$c1: md.exe /k ping 0 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81d4:$s1: netsh firewall delete allowedprogram 0x80ca:$s2: netsh firewall add allowedprogram 0x8234:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ebe:$s4: Execute ERROR 0x7f1e:$s4: Execute ERROR 0x7ee2:$s5: Download ERROR 0x827a:$s6: [kl]
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Stub.il	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 12 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x62c1:$a1: get_Registry 0x7ce2:$a3: Download ERROR 0x7fd4:$a5: netsh firewall delete allowedprogram "
00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7eca:$a1: netsh firewall add allowedprogram 0x80c4:$b1: [TAP] 0x806a:$b2: & exit 0x8036:$c1: md.exe /k ping 0 & del
00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x6d68d:$a1: get_Registry 0x86ee1:$a1: get_Registry 0xb1e67:$a1: get_Registry 0x2ecd7b:$a1: get_Registry 0x2ed885:$a1: get_Registry 0x2f9868:$a1: get_Registry 0x2f9f84:$a1: get_Registry 0x2fa6a6:$a1: get_Registry 0x2fade1:$a1: get_Registry 0x2fb51c:$a1: get_Registry 0x2fbc4c:$a1: get_Registry 0x2fc381:$a1: get_Registry 0x2fcab9:$a1: get_Registry 0x31c87e:$a1: get_Registry 0x31f8ac:$a1: get_Registry 0x3200ec:$a1: get_Registry 0x323b18:$a1: get_Registry 0x3266c3:$a1: get_Registry 0x326fa1:$a1: get_Registry 0x327849:$a1: get_Registry 0x328128:$a1: get_Registry
00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x88aea:$a1: netsh firewall add allowedprogram 0x88ce4:$b1: [TAP] 0x88c8a:$b2: & exit 0x88c56:$c1: md.exe /k ping 0 & del
00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: f3aef511705f37f9792c6032b936ca61.exe PID: 5840	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: NjRAT.exe PID: 3356	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: svchost.exe PID: 1536	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.NjRAT.exe.10000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
2.0.NjRAT.exe.10000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7ee2:$a3: Download ERROR 0x81d4:$a5: netsh firewall delete allowedprogram "
2.0.NjRAT.exe.10000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80ca:$a1: netsh firewall add allowedprogram 0x82c4:$b1: [TAP] 0x826a:$b2: & exit 0x8236:$c1: md.exe /k ping 0 & del
2.0.NjRAT.exe.10000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81d4:$s1: netsh firewall delete allowedprogram 0x80ca:$s2: netsh firewall add allowedprogram 0x8234:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ebe:$s4: Execute ERROR 0x7f1e:$s4: Execute ERROR 0x7ee2:$s5: Download ERROR 0x827a:$s6: [kl]
0.3.f3aef511705f37f9792c6032b936ca61.exe.6c6ca20.0.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.3.f3aef511705f37f9792c6032b936ca61.exe.6c5ce20.1.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x31447:$a1: get_Registry 0x26c35b:$a1: get_Registry 0x26ce65:$a1: get_Registry 0x278e48:$a1: get_Registry 0x279564:$a1: get_Registry 0x279c86:$a1: get_Registry 0x27a3c1:$a1: get_Registry 0x27aafc:$a1: get_Registry 0x27b22c:$a1: get_Registry 0x27b961:$a1: get_Registry 0x27c099:$a1: get_Registry 0x29be5e:$a1: get_Registry 0x29ee8c:$a1: get_Registry 0x29f6cc:$a1: get_Registry 0x2a30f8:$a1: get_Registry 0x2a5ca3:$a1: get_Registry 0x2a6581:$a1: get_Registry 0x2a6e29:$a1: get_Registry 0x2a7708:$a1: get_Registry 0x2af843:$a1: get_Registry
0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80ca:$a1: netsh firewall add allowedprogram 0x82c4:$b1: [TAP] 0x826a:$b2: & exit 0x8236:$c1: md.exe /k ping 0 & del
0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81d4:$s1: netsh firewall delete allowedprogram 0x80ca:$s2: netsh firewall add allowedprogram 0x8234:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ebe:$s4: Execute ERROR 0x7f1e:$s4: Execute ERROR 0x7ee2:$s5: Download ERROR 0x827a:$s6: [kl]
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\NjRAT.exe, ProcessId: 3356, TargetFilename: C:\Users\user\AppData\Local\Temp\svchost.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\user\AppData\Local\Temp\svchost.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\svchost.exe, ProcessId: 1536, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6d90d9a2ca0b357d5f629d5cdbe8d0d2

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\NjRAT.exe" , ParentImage: C:\Users\user\Desktop\NjRAT.exe, ParentProcessId: 3356, ParentProcessName: NjRAT.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , ProcessId: 1536, ProcessName: svchost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\svchost.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\svchost.exe, ProcessId: 1536, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6d90d9a2ca0b357d5f629d5cdbe8d0d2

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\svchost.exe, ProcessId: 1536, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\NjRAT.exe" , ParentImage: C:\Users\user\Desktop\NjRAT.exe, ParentProcessId: 3356, ParentProcessName: NjRAT.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , ProcessId: 1536, ProcessName: svchost.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\svchost.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\svchost.exe, ProcessId: 1536, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6d90d9a2ca0b357d5f629d5cdbe8d0d2

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\NjRAT.exe" , ParentImage: C:\Users\user\Desktop\NjRAT.exe, ParentProcessId: 3356, ParentProcessName: NjRAT.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , ProcessId: 1536, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Drops fake system file at system root drive

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\svchost.exe, ProcessId: 1536, TargetFilename: C:\svchost.exe

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:47:38.168327+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:43.073098+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:48.097368+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:53.075800+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:47:38.168327+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:43.073098+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:48.097368+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:53.075800+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:47:43.406131+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:29.997440+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:31.859286+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:37.843585+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:38.061987+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:39.251298+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:39.374864+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:39.563767+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:44.015364+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.135109+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.254928+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.343637+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.374742+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.958733+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:51.329348+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:51.773740+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:52.374092+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:53.947725+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:54.133502+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:54.253470+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:54.667514+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:55.748238+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:55.958955+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:56.616010+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:56.735824+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:57.338326+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:57.818525+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:58.552553+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:59.163581+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:59.783533+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:00.382947+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:00.535873+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:01.021710+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:01.143820+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:01.597448+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:01.880962+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:02.484241+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:03.088511+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:03.688001+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:04.321987+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:04.441787+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:04.561681+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:05.041504+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:05.401328+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:05.884227+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.004085+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.123871+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.244164+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.486800+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.607473+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:07.214042+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:07.395085+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:07.634952+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:07.774247+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:08.374875+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:08.975589+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:09.450656+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:09.869480+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:09.989301+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:10.229029+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:10.588731+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:10.948706+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:11.551709+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:12.032036+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:12.152025+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:12.777806+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:13.377275+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:13.977146+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:14.097059+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:14.336765+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:14.699209+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:15.299774+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:15.783873+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.385518+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.505973+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.745839+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.865755+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.985572+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:17.136735+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:17.379596+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:17.982962+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:18.103672+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:18.224405+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:18.841775+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:19.336897+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:19.966160+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:20.569434+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:20.932141+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:21.053035+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:21.641877+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:21.881725+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:22.241755+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:22.483256+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:22.966665+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:23.207726+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:23.551196+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:24.633916+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:25.031003+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:25.635585+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:26.235669+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:26.596512+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.203930+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.323711+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.443501+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.563538+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.683336+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.858958+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.978730+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:28.461423+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:29.061481+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:29.661431+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:29.901224+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:30.280113+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:30.913470+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:31.393688+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:32.015061+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:32.856928+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:33.937596+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:34.065589+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:34.185480+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:34.828220+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:35.911623+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:36.031728+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:36.617593+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:37.574116+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:37.814932+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:37.934742+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:38.175581+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:38.447737+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:38.811522+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:39.295686+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:39.415502+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:39.780965+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:39.900905+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:40.361752+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:40.601527+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:40.961161+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:41.084113+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:41.325598+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:41.928897+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:42.049613+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:42.529479+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:42.657647+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:43.138522+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:43.378377+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:43.860951+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:43.987986+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:44.593054+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:44.713206+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:48.576892+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:48.696847+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:48.816718+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:48.936521+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:49.194904+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:49.436887+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:50.048816+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:50.168727+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:50.656350+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:50.776325+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:51.349337+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:52.010672+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:53.097597+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:53.457603+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:54.114634+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:54.356134+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:54.476624+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:54.836527+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:55.076751+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:55.196635+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:55.797606+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:56.371079+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:56.816202+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:56.936509+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:57.177202+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:57.782297+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:58.899118+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.019072+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.617775+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.737810+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.858159+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.978032+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:00.098085+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:00.218005+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:00.459767+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:01.061616+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:01.541396+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:02.354167+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:02.954940+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:03.074842+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:03.677545+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:04.157499+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:04.397676+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:04.519831+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:04.640990+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:05.145619+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:05.385334+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:05.505189+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:05.625010+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:06.104256+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:06.224144+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:06.825619+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:06.945624+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.185359+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.305345+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.429615+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.838686+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.958504+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:08.214418+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:09.541614+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.141613+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.261418+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.381409+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.501320+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.674536+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.914333+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:11.034177+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:11.650150+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:12.252092+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:12.856472+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:12.976297+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:13.456344+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:13.576310+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:14.056250+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:14.693011+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:15.295817+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:16.016137+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:17.097457+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:17.697987+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:17.817907+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:18.321457+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:18.442473+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:18.877004+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:18.997040+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:19.117067+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:19.721583+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:19.841445+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.323903+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.443890+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.564432+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.804531+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.924385+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:21.612182+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:21.732377+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.022579+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.262318+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.625647+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.745459+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.986112+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:23.619822+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:23.739765+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.063428+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.187990+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.442802+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.563506+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.923351+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:25.043393+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:25.644780+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:26.245612+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:26.485587+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:26.605687+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:27.191374+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:27.552005+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:28.159727+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:28.520012+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:28.759701+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:29.119208+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:29.496924+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:30.099740+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:30.702425+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:31.304339+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:31.424307+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:31.928159+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.048325+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.168211+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.288059+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.449720+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.851564+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:33.578154+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:34.058977+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:34.178749+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:34.691716+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:35.366596+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:36.003318+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:36.603623+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:37.395158+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:37.880137+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:38.362331+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:39.461820+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:39.701741+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:40.301261+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:40.901365+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:41.604469+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:41.844335+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:41.968793+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:42.338253+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:42.578008+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:42.818281+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:43.085706+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:43.205492+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:43.325479+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:44.047591+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:44.648520+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:44.769700+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:45.249538+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:45.369617+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:45.730872+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:46.327804+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:46.447634+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.046897+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.286786+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.773746+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.893671+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:48.497895+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:48.617783+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:49.197316+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:50.156817+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:50.397793+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:53.315400+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:53.435904+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:53.556987+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:53.726570+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:54.089766+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:54.704801+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:55.188691+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:55.428336+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:55.791830+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:55.911771+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:56.525263+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:56.765375+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:57.247260+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:57.367150+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:57.749013+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:58.473908+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:58.713895+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:59.120884+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:59.758388+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:00.360947+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:00.969917+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:01.643730+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:01.763645+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:01.883430+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:02.362768+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:02.482698+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:02.968425+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:03.089007+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:03.569554+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.349231+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.469169+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.589109+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.713703+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.891110+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:05.134369+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:05.254978+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:05.858580+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:07.092399+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:08.459087+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:08.818820+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:09.300883+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:09.461100+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:09.890822+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:10.371112+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:10.491055+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:10.970343+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:11.090069+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.036413+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.156560+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.596139+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.716070+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.956226+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:13.683688+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:14.289704+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:14.409681+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:14.649508+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:14.832949+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.252317+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.436455+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.556319+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.676339+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:16.042149+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:16.162216+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:16.652636+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:17.256420+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:17.736918+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:17.976572+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:18.696540+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:19.176351+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:19.784644+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:19.904459+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:20.024997+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.106326+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.466243+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.587289+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.762196+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:22.124327+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:22.244243+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:22.846042+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:23.330598+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:23.450493+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:23.939428+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:24.060238+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:24.427457+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:24.549738+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:24.919796+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.041129+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.311361+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.432874+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.552756+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.793405+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.913260+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.273301+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.393274+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.617136+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.737044+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:27.339293+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:47:38.288383+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP

ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:47:17.233623+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:47:17.233623+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:47:17.233623+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:47.000670+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:48.681768+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:50.489867+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:52.853601+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:55.386821+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:57.818525+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:00.535873+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:04.801479+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:08.975589+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:12.391826+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:15.059179+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:18.103672+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:22.241755+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:26.115675+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:29.901224+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:33.216300+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:36.617593+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:40.961161+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:44.593054+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:56.037600+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:00.339702+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:03.557446+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.185359+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.914333+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:13.456344+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:16.257187+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:19.481697+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:23.353584+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:27.431704+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:30.099740+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:33.819328+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:37.755835+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:40.301261+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:43.807852+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.286786+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:50.637473+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:59.758388+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:03.329714+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:07.733829+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:11.330025+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.676339+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:18.696540+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.346383+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.152977+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.5	49978	3.127.138.57	16299	TCP

ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:47:38.288383+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.5	49711	3.126.37.18	16299	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\NjRAT.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\mic.dll	Avira: detection malicious, Label: HEUR/AGEN.1322924
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll	Avira: detection malicious, Label: HEUR/AGEN.1301128
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\WinMM.Net.dll	Avira: detection malicious, Label: TR/Agent.ymlbm
Source: C:\svchost.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\pw.dll	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\sc2.dll	Avira: detection malicious, Label: HEUR/AGEN.1300360
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe	Avira: detection malicious, Label: HEUR/AGEN.1305556
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll	Avira: detection malicious, Label: TR/AD.Bladabindi.qdbcy
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\plg.dll	Avira: detection malicious, Label: HEUR/AGEN.1300086

Found malware configuration

Source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp

Malware Configuration Extractor: Njrat {"Host": "2.tcp.eu.ngrok.io", "Port": "16299", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "svchost.exe", "Install Dir": "TEMP"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\Desktop\NjRAT.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll	ReversingLabs: Detection: 76%
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\mic.dll	ReversingLabs: Detection: 87%
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\plg.dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\pw.dll	ReversingLabs: Detection: 84%
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\sc2.dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\WinMM.Net.dll	ReversingLabs: Detection: 73%
Source: C:\svchost.exe	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Source: f3aef511705f37f9792c6032b936ca61.exe	ReversingLabs: Detection: 68%
Source: f3aef511705f37f9792c6032b936ca61.exe	Virustotal: Detection: 80%			Perma Link

Yara detected Njrat

Source: Yara match	File source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c6ca20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c5ce20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f3aef511705f37f9792c6032b936ca61.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NjRAT.exe PID: 3356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: C:\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Stub.il, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 85.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\NjRAT.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\mic.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\WinMM.Net.dll	Joe Sandbox ML: detected
Source: C:\svchost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\pw.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\sc2.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\plg.dll	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: f3aef511705f37f9792c6032b936ca61.exe

Joe Sandbox ML: detected

Source: f3aef511705f37f9792c6032b936ca61.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\NjRAT.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: f3aef511705f37f9792c6032b936ca61.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: f3aef511705f37f9792c6032b936ca61.exe
Source:	Binary string: C:\Users\Super\Documents\visual studio 2013\Projects\pw plugin\WindowsApplication12\obj\Release\pw.pdb source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr
Source:	Binary string: C:\Users\im523\Desktop\ll\obj\x86\Debug\ch.pdb source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, ch.dll.0.dr
Source:	Binary string: C:\Users\im523\Desktop\Sementara\NjRAT 5 fix7\obj\Debug\NjRat 0.7D Green Edition by im523.pdb source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr

Spreading

Creates autorun.inf (USB autostart)

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

File created: C:\autorun.inf

Jump to behavior

Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IL_02fe: ldstr "autorun.inf"
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IL_0390: ldstr "[autorun]"
Source: NjRAT.exe, 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: autorun.inf
Source: NjRAT.exe, 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: [autorun]
Source: NjRAT.exe, 00000002.00000002.2165635724.00000000025D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: NjRAT.exe, 00000002.00000002.2165635724.00000000025D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: svchost.exe, 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: autorun.inf.4.dr	Binary or memory string: [autorun]
Source: NjRAT.exe.0.dr	Binary or memory string: autorun.inf
Source: NjRAT.exe.0.dr	Binary or memory string: [autorun]
Source: svchost.exe.2.dr	Binary or memory string: autorun.inf
Source: svchost.exe.2.dr	Binary or memory string: [autorun]
Source: svchost.exe.4.dr	Binary or memory string: autorun.inf
Source: svchost.exe.4.dr	Binary or memory string: [autorun]
Source: 6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe.4.dr	Binary or memory string: autorun.inf
Source: 6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe.4.dr	Binary or memory string: [autorun]
Source: Stub.il.0.dr	Binary or memory string: IL_02fe: ldstr "autorun.inf"
Source: Stub.il.0.dr	Binary or memory string: IL_0390: ldstr "[autorun]"

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0001A7E7 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0001A7E7
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0002BB70 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0002BB70
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0003ADB8 FindFirstFileExA,	0_2_0003ADB8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49711 -> 3.126.37.18:16299
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49711 -> 3.126.37.18:16299
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.5:49711 -> 3.126.37.18:16299
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.5:49711 -> 3.126.37.18:16299
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49711 -> 3.126.37.18:16299
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49865 -> 3.127.138.57:16299
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49865 -> 3.127.138.57:16299
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49865 -> 3.127.138.57:16299
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.5:49865 -> 3.127.138.57:16299
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49977 -> 18.157.68.73:16299
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49977 -> 18.157.68.73:16299
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49977 -> 18.157.68.73:16299
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49978 -> 3.127.138.57:16299
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49978 -> 3.127.138.57:16299
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49978 -> 3.127.138.57:16299
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.5:49977 -> 18.157.68.73:16299
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.5:49978 -> 3.127.138.57:16299

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Network Connect: 3.127.138.57 16299			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Network Connect: 3.126.37.18 16299			Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.5:49711 -> 3.126.37.18:16299
Source: global traffic	TCP traffic: 192.168.2.5:49865 -> 3.127.138.57:16299
Source: global traffic	TCP traffic: 192.168.2.5:49977 -> 18.157.68.73:16299

Source: Joe Sandbox View	IP Address: 3.126.37.18 3.126.37.18
Source: Joe Sandbox View	IP Address: 3.127.138.57 3.127.138.57
Source: Joe Sandbox View	IP Address: 18.157.68.73 18.157.68.73

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr

String found in binary or memory: ERR%WindowsLive:name=*%http://hotmail.com9Software\ooVoo\Settings\UserUserQhttp://www.oovoo.com/?Encrypted PasswordPass equals www.hotmail.com (Hotmail)

Source: global traffic

DNS traffic detected: DNS query: 2.tcp.eu.ngrok.io

Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	String found in binary or memory: http://DynDns.com
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	String found in binary or memory: http://Paltalk.com/Software
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	String found in binary or memory: http://Yahoo.com
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	String found in binary or memory: http://dynupdate.no-ip.com/dns?username=
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	String found in binary or memory: http://hotmail.com9Software
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	String found in binary or memory: http://no-ip.com
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	String found in binary or memory: http://www.Hacker.com/
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	String found in binary or memory: http://www.SecurityXploded.com
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	String found in binary or memory: http://www.google.com
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	String found in binary or memory: http://www.no-ip.com/legal/tos
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	String found in binary or memory: http://www.noip.com
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	String found in binary or memory: http://www.noip.com/
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	String found in binary or memory: http://www.oovoo.com/?Encrypted
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, Stub.il.0.dr	String found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRAT.exe, 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, NjRAT.exe.0.dr, svchost.exe.2.dr, svchost.exe.4.dr, 6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe.4.dr	String found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: NjRAT.exe.0.dr, kl.cs

.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c6ca20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c5ce20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f3aef511705f37f9792c6032b936ca61.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NjRAT.exe PID: 3356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: C:\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Stub.il, type: DROPPED

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\svchost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\svchost.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\svchost.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Code function: 4_2_02BABEF2 NtSetInformationProcess,	4_2_02BABEF2
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Code function: 4_2_02BABED0 NtSetInformationProcess,	4_2_02BABED0
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Code function: 4_2_059401C2 NtQuerySystemInformation,	4_2_059401C2
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Code function: 4_2_05940187 NtQuerySystemInformation,	4_2_05940187

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_000171E6: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_000171E6

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00018709	0_2_00018709
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00026887	0_2_00026887
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0001C017	0_2_0001C017
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0003009A	0_2_0003009A
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0001E147	0_2_0001E147
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00013206	0_2_00013206
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00031218	0_2_00031218
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_000272FF	0_2_000272FF
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0003D35E	0_2_0003D35E
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00041464	0_2_00041464
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0001E57B	0_2_0001E57B
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00030596	0_2_00030596
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0001276D	0_2_0001276D
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_000309AE	0_2_000309AE
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00023A02	0_2_00023A02
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00034A0A	0_2_00034A0A
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0001EB7B	0_2_0001EB7B
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00034C39	0_2_00034C39
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0001FC43	0_2_0001FC43
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00023C7D	0_2_00023C7D
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00026CBC	0_2_00026CBC
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00030DE3	0_2_00030DE3
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0003CEB0	0_2_0003CEB0
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00025EB8	0_2_00025EB8
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00015EBC	0_2_00015EBC
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00023FAE	0_2_00023FAE
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0001EFEF	0_2_0001EFEF
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_00013FFE	0_2_00013FFE

Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe F0C85722B88D1E7A1941BA17551CD5C29AEF99FAD86D78A5631A0F5446B3F580
Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll 7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: String function: 0002E554 appears 35 times
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: String function: 0002E630 appears 54 times
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: String function: 0002EFB0 appears 31 times

Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNjRat 0.7D Green Edition by im523.exe4 vs f3aef511705f37f9792c6032b936ca61.exe
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamech.dll4 vs f3aef511705f37f9792c6032b936ca61.exe
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesHelper.exe< vs f3aef511705f37f9792c6032b936ca61.exe
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepw.dllL vs f3aef511705f37f9792c6032b936ca61.exe

Source: f3aef511705f37f9792c6032b936ca61.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\svchost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\svchost.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\svchost.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: pw.dll.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.spre.troj.adwa.spyw.evad.winEXE@15/20@4/3

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_00016EA8 GetLastError,FormatMessageW,

0_2_00016EA8

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Code function: 4_2_02BABBA2 AdjustTokenPrivileges,		4_2_02BABBA2
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Code function: 4_2_02BABB6B AdjustTokenPrivileges,		4_2_02BABB6B

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_0002A07C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_0002A07C

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_6414921

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6412:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1124:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\6d90d9a2ca0b357d5f629d5cdbe8d0d2

Source: C:\Users\user\Desktop\NjRAT.exe

File created: C:\Users\user\AppData\Local\Temp\svchost.exe

Jump to behavior

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Command line argument: sfxname	0_2_0002D891
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Command line argument: sfxstime	0_2_0002D891
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Command line argument: STARTDLG	0_2_0002D891

Source: f3aef511705f37f9792c6032b936ca61.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "ProcessHacker.exe")

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: f3aef511705f37f9792c6032b936ca61.exe	ReversingLabs: Detection: 68%
Source: f3aef511705f37f9792c6032b936ca61.exe	Virustotal: Detection: 80%

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

File read: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe "C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe"
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Process created: C:\Users\user\Desktop\NjRAT.exe "C:\Users\user\Desktop\NjRAT.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Users\user\Desktop\NjRAT.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe "C:\Users\user\AppData\Local\Temp\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM ProcessHacker.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe "C:\Users\user\AppData\Local\Temp\svchost.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe "C:\Users\user\AppData\Local\Temp\svchost.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe "C:\Users\user\AppData\Local\Temp\svchost.exe" ..
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Process created: C:\Users\user\Desktop\NjRAT.exe "C:\Users\user\Desktop\NjRAT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe "C:\Users\user\AppData\Local\Temp\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM ProcessHacker.exe	Jump to behavior

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: f3aef511705f37f9792c6032b936ca61.exe

Static file information: File size 2388170 > 1048576

Source: C:\Users\user\Desktop\NjRAT.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: f3aef511705f37f9792c6032b936ca61.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: f3aef511705f37f9792c6032b936ca61.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: f3aef511705f37f9792c6032b936ca61.exe
Source:	Binary string: C:\Users\Super\Documents\visual studio 2013\Projects\pw plugin\WindowsApplication12\obj\Release\pw.pdb source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr
Source:	Binary string: C:\Users\im523\Desktop\ll\obj\x86\Debug\ch.pdb source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, ch.dll.0.dr
Source:	Binary string: C:\Users\im523\Desktop\Sementara\NjRAT 5 fix7\obj\Debug\NjRat 0.7D Green Edition by im523.pdb source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr

Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: f3aef511705f37f9792c6032b936ca61.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: NjRAT.exe.0.dr, OK.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_6414921

Jump to behavior

Source: f3aef511705f37f9792c6032b936ca61.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0002E554 push eax; ret		0_2_0002E572
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0002EFF6 push ecx; ret		0_2_0002F009

Source: pw.dll.0.dr

Static PE information: section name: .text entropy: 7.825422229253219

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	File created: C:\svchost.exe			Jump to dropped file
Source: C:\Users\user\Desktop\NjRAT.exe	File created: C:\Users\user\AppData\Local\Temp\svchost.exe			Jump to dropped file

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	File created: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\sc2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	File created: C:\svchost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\NjRAT.exe	File created: C:\Users\user\AppData\Local\Temp\svchost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	File created: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\mic.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	File created: C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	File created: C:\Users\user\Desktop\NjRAT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	File created: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\pw.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	File created: C:\Users\user\Desktop\NjRat 0.7D Green Edition\WinMM.Net.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	File created: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\plg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	File created: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	File created: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll	Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6d90d9a2ca0b357d5f629d5cdbe8d0d2

Jump to behavior

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6d90d9a2ca0b357d5f629d5cdbe8d0d2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6d90d9a2ca0b357d5f629d5cdbe8d0d2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 6d90d9a2ca0b357d5f629d5cdbe8d0d2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 6d90d9a2ca0b357d5f629d5cdbe8d0d2	Jump to behavior

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: NjRAT.exe, 00000002.00000002.2165635724.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp, taskkill.exe, 00000007.00000002.2228274719.000000000041B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.2366176293.0000000003741000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2447632395.0000000003341000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2529674822.00000000036B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: taskkill.exe, 00000007.00000002.2228274719.000000000041B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C.EXECQUERY(SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "PROCESSHACKER.EXE"));
Source: taskkill.exe, 00000007.00000002.2228274719.000000000041B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ATASKKILL/F/IMPROCESSHACKER.EXE7B:
Source: taskkill.exe, 00000007.00000002.2228274719.000000000041B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "PROCESSHACKER.EXE")
Source: taskkill.exe, 00000007.00000002.2228451851.0000000002860000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ERROR: THE PROCESS "PROCESSHACKER.EXE" NOT FOUND.
Source: taskkill.exe, 00000007.00000002.2228274719.0000000000400000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL /F /IM PROCESSHACKER.EXEC
Source: taskkill.exe, 00000007.00000002.2228274719.000000000041B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PDLECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "PROCESSHACKER.EXE")2
Source: taskkill.exe, 00000007.00000002.2228274719.000000000041B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ATASKKILL/F/IMPROCESSHACKER.EXE
Source: taskkill.exe, 00000007.00000002.2228451851.0000000002860000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, PROCESSID, CSNAME, CAPTION, SESSIONID, THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "PROCESSHACKER.EXE")COMMONROG
Source: taskkill.exe, 00000007.00000002.2228174353.0000000000170000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\DESKTOP\C:\WINDOWS\SYSWOW64\TASKKILL.EXETASKKILL /F /IM PROCESSHACKER.EXEC:\USERS\user\APPDATA\LOCAL\TEMP\SVCHOST.EXEWINSTA0\DEFAULT0
Source: taskkill.exe, 00000007.00000002.2228274719.0000000000400000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL /F /IM PROCESSHACKER.EXE
Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRAT.exe, 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, NjRAT.exe.0.dr, svchost.exe.2.dr, svchost.exe.4.dr, 6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe.4.dr	Binary or memory string: #PROCESSHACKER.EXE
Source: taskkill.exe, 00000007.00000002.2228451851.0000000002860000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKKILL/F/IMPROCESSHACKER.EXE
Source: taskkill.exe, 00000007.00000002.2228451851.0000000002860000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: G CAPTION = "PROCESSHACKER.EXE"YY]
Source: taskkill.exe, 00000007.00000002.2228274719.000000000041B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THREADCOUNT, WORKINGSETSIZE, KERNELMODETIME, USERMODETIME, PARENTPROCESSID FROM WIN32_PROCESS WHERE ( CAPTION = "PROCESSHACKER.EXE")0USER
Source: svchost.exe, 00000004.00000002.4553855865.0000000000A00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\DESKTOP\C:\WINDOWS\SYSWOW64\TASKKILL.EXEETSTASKKILL /F /IM PROCESSHACKER.EXEUSC:\USERS\user\APPDATA\LOCAL\TEMP\SVCHOST.EXEHWINSTA0\DEFAULT:\U=::=::\ALLUSERSPROFILE=C:\PROGRAMDATAAPPDATA=C:\USERS\user\APPDATA\ROAMINGCOMMONPROGRAMFILES=C:\PROGRAM\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNRIVERS32SMBLYSTORAGEROOTS32AES CRYPTOGRAPHIC PROVIDERTERNAME=user-PCCOMSPEC=C:\WINDOWS\SYSTEM32\CMD.EXEDRIVERDATA=C:\WINDOWS\SYSTEM32\DRIVERS\DRIVERDATAFPS_BROWSER_APP_PROFILE_STRING=INTERNET EXPLORERFPS_BROWSER_USER_PROFILE_STRING=DEFAULTHOMEDRIVE=C:HOMEPATH=\USERS\userLOCALAPPDATA=C:\USERS\user\APPDATA\LOCALLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2ONEDRIVE=C:\USERS\user\ONEDRIVEOS=WINDOWS_NTPATH=C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH;C:\WINDOWS\SYSTEM32;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\;C:\WINDOWS\SYSTEM32\OPENSSH\;C:\USERS\user\APPDATA\LOCAL\MICROSOFT\WINDOWSAPPS;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=INTEL64 FAMILY 6 MODEL 143 STEPPING 8, GENUINE\REGISTRY\MACHINE\SOFTWARE\\RE\REGISTRY\MACHINE\R\REGISTRY\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN FILES (
Source: taskkill.exe, 00000007.00000002.2228451851.0000000002860000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CAPTION = "PROCESSHACKER.EXE"*
Source: taskkill.exe, 00000007.00000002.2228274719.0000000000400000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\DESKTOP\C:\WINDOWS\SYSWOW64\TASKKILL.EXETASKKILL /F /IM PROCESSHACKER.EXEC:\USERS\user\APPDATA\LOCAL\TEMP\SVCHOST.EXEWINSTA0\DEFAULT=::=::\ALLUSERSPROFILE=C:\PROGRAMDATAAPPDATA=C:\USERS\user\APPDATA\ROAMINGCOMMONPROGRAMFILES=C:\PROGRAM FILES (X86)\COMMON FILESCOMMONPROGRAMFILES(X86)=C:\PROGRAM FILES (X86)\COMMON FILESCOMMONPROGRAMW6432=C:\PROGRAM FILES\COMMON FILESCOMPUTERNAME=user-PCCOMSPEC=C:\WINDOWS\SYSTEM32\CMD.EXEDRIVERDATA=C:\WINDOWS\SYSTEM32\DRIVERS\DRIVERDATAFPS_BROWSER_APP_PROFILE_STRING=INTERNET EXPLORERFPS_BROWSER_USER_PROFILE_STRING=DEFAULTHOMEDRIVE=C:HOMEPATH=\USERS\userLOCALAPPDATA=C:\USERS\user\APPDATA\LOCALLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2ONEDRIVE=C:\USERS\user\ONEDRIVEOS=WINDOWS_NTPATH=C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH;C:\WINDOWS\SYSTEM32;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\;C:\WINDOWS\SYSTEM32\OPENSSH\;C:\USERS\user\APPDATA\LOCAL\MICROSOFT\WINDOWSAPPS;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=X86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=INTEL64 FAMILY 6 MODEL 143 STEPPING 8, GENUINEINTELPROCESSOR_LEVEL=6PROCESSOR_REVISION=8F08PROGRAMDATA=C:\PROGRAMDATAPROGRAMFILES=C:\PROGRAM FILES (X86)PROGRAMFILES(X86)=C:\PROGRAM FILES (X86)PROGRAMW6432=C:\PROGRAM FILESPSMODULEPATH=C:\PROGRAM FILES (X86)\WINDOWSPOWERSHELL\MODULES;C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\MODULES;C:\PROGRAM FILES (X86)\AUTOIT3\AUTOITXPUBLIC=C:\USERS\PUBLICSESSIONNAME=CONSOLESFXCMD="C:\USERS\user\DESKTOP\F3AEF511705F37F9792C6032B936CA61.EXE"SFXNAME=C:\USERS\user\DESKTOP\F3AEF511705F37F9792C6032B936CA61.EXESFXPAR=SFXSTIME=2024-12-06-03-47-19-469SYSTEMDRIVE=C:SYSTEMROOT=C:\WINDOWSTEMP=C:\USERS\user\APPDATA\LOCAL\TEMPTMP=C:\USERS\user\APPDATA\LOCAL\TEMPUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\USERS\userWINDIR=C:\WINDOWS+

Source: C:\Users\user\Desktop\NjRAT.exe	Memory allocated: 9D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Memory allocated: 25D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Memory allocated: 45D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 3280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 3280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 5280000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 15E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 3740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 5740000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 3340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 5340000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 36B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 36B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 56B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Code function: 4_2_02C010AE rdtsc

4_2_02C010AE

Source: C:\Users\user\Desktop\NjRAT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Window / User API: threadDelayed 3164	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Window / User API: threadDelayed 1679	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Window / User API: threadDelayed 3491	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Window / User API: foregroundWindowGot 428	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Window / User API: foregroundWindowGot 1273	Jump to behavior

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\sc2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\mic.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\pw.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NjRat 0.7D Green Edition\WinMM.Net.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\plg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll	Jump to dropped file
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll	Jump to dropped file

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-23286

Source: C:\Users\user\Desktop\NjRAT.exe TID: 6348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe TID: 6508	Thread sleep time: -1679000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe TID: 6508	Thread sleep time: -3491000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe TID: 4768	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe TID: 4140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe TID: 5492	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0001A7E7 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0001A7E7
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0002BB70 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0002BB70
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0003ADB8 FindFirstFileExA,	0_2_0003ADB8

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_0002E03A VirtualQuery,GetSystemInfo,

0_2_0002E03A

Source: C:\Users\user\Desktop\NjRAT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000002.2094832081.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}i
Source: netsh.exe, 00000005.00000002.2231879609.000000000338B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
Source: svchost.exe, 00000004.00000002.4554144205.0000000000C70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000004.00000002.4554144205.0000000000C70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

API call chain: ExitProcess graph end node

graph_0-23636

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Code function: 4_2_02C010AE rdtsc

4_2_02C010AE

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_0002F1B5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0002F1B5

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_0003780E mov eax, dword ptr fs:[00000030h]

0_2_0003780E

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_0003BAA0 GetProcessHeap,

0_2_0003BAA0

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0002F1B5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0002F1B5
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0002F303 SetUnhandledExceptionFilter,	0_2_0002F303
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0002F4CB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0002F4CB
Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Code function: 0_2_0003898F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0003898F

Source: C:\Users\user\Desktop\NjRAT.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Network Connect: 3.127.138.57 16299			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Network Connect: 3.126.37.18 16299			Jump to behavior

.NET source code references suspicious native API functions

Source: NjRAT.exe.0.dr, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: NjRAT.exe.0.dr, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: NjRAT.exe.0.dr, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: pw.dll.0.dr, Class1.cs	Reference to suspicious API methods: ReadProcessMemory(struct0_.intptr_0, num3 + 8, ref int_, 4, ref int_2)
Source: pw.dll.0.dr, Class1.cs	Reference to suspicious API methods: VirtualAllocEx(struct0_.intptr_0, num2, int_3, 12288, 64)
Source: pw.dll.0.dr, Class1.cs	Reference to suspicious API methods: WriteProcessMemory(struct0_.intptr_0, num4, byte_0, int_4, ref int_2)

Uses taskkill to terminate AV processes

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM ProcessHacker.exe

Jump to behavior

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe	Process created: C:\Users\user\Desktop\NjRAT.exe "C:\Users\user\Desktop\NjRAT.exe"			Jump to behavior
Source: C:\Users\user\Desktop\NjRAT.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe "C:\Users\user\AppData\Local\Temp\svchost.exe"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM ProcessHacker.exe

Jump to behavior

Source: svchost.exe, 00000004.00000002.4555101041.0000000003581000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.4555101041.0000000003788000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 00000004.00000002.4554144205.0000000000C70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Rh Program Manager
Source: svchost.exe, 00000004.00000002.4555101041.0000000003581000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.
Source: svchost.exe, 00000004.00000002.4555101041.00000000037AA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.4555101041.00000000035A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program manager
Source: svchost.exe, 00000004.00000002.4555101041.0000000003581000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.4555101041.0000000003788000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_0002F00B cpuid

0_2_0002F00B

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_0002A8CC

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_0002D891 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_0002D891

Source: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe

Code function: 0_2_0001AEE5 GetVersionExW,

0_2_0001AEE5

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\svchost.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c6ca20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c5ce20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f3aef511705f37f9792c6032b936ca61.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NjRAT.exe PID: 3356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: C:\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Stub.il, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: 2.0.NjRAT.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c6ca20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c5ce20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.f3aef511705f37f9792c6032b936ca61.exe.6c53a20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f3aef511705f37f9792c6032b936ca61.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NjRAT.exe PID: 3356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: C:\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\NjRAT.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Stub.il, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	311 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	221 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	221 Registry Run Keys / Startup Folder	13 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
f3aef511705f37f9792c6032b936ca61.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Perseus
f3aef511705f37f9792c6032b936ca61.exe	80%	Virustotal		Browse
f3aef511705f37f9792c6032b936ca61.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\NjRAT.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\svchost.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\mic.dll	100%	Avira	HEUR/AGEN.1322924
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll	100%	Avira	HEUR/AGEN.1301128
C:\Users\user\Desktop\NjRat 0.7D Green Edition\WinMM.Net.dll	100%	Avira	TR/Agent.ymlbm
C:\svchost.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\pw.dll	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\sc2.dll	100%	Avira	HEUR/AGEN.1300360
C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe	100%	Avira	HEUR/AGEN.1305556
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll	100%	Avira	TR/AD.Bladabindi.qdbcy
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\plg.dll	100%	Avira	HEUR/AGEN.1300086
C:\Users\user\Desktop\NjRAT.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\mic.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\NjRat 0.7D Green Edition\WinMM.Net.dll	100%	Joe Sandbox ML
C:\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\pw.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\sc2.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\plg.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\svchost.exe	100%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe	100%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Desktop\NjRAT.exe	100%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll	92%	ReversingLabs	Win32.Trojan.Zeus
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll	77%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\mic.dll	88%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\plg.dll	91%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\pw.dll	84%	ReversingLabs	Win32.Hacktool.Broduplo
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\sc2.dll	91%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Desktop\NjRat 0.7D Green Edition\WinMM.Net.dll	74%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\svchost.exe	100%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.Hacker.com/	0%	Avira URL Cloud	safe
http://www.oovoo.com/?Encrypted	0%	Avira URL Cloud	safe
http://hotmail.com9Software	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
2.tcp.eu.ngrok.io	3.126.37.18	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://dynupdate.no-ip.com/dns?username=	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	false		high
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRAT.exe, 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, NjRAT.exe.0.dr, svchost.exe.2.dr, svchost.exe.4.dr, 6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe.4.dr	false		high
http://www.Hacker.com/	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://DynDns.com	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	false		high
http://www.noip.com	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	false		high
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, Stub.il.0.dr	false		high
http://Paltalk.com/Software	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	false		high
http://www.google.com	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	false		high
http://www.no-ip.com/legal/tos	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, NjRat 0.7D Green Edition by im523.exe.0.dr	false		high
http://Yahoo.com	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	false		high
http://hotmail.com9Software	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.oovoo.com/?Encrypted	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://no-ip.com	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	false		high
http://www.noip.com/	f3aef511705f37f9792c6032b936ca61.exe, 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, pw.dll.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.126.37.18	2.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
3.127.138.57	unknown	United States	16509	AMAZON-02US	true
18.157.68.73	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569764
Start date and time:	2024-12-06 09:46:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	f3aef511705f37f9792c6032b936ca61.exe
Detection:	MAL
Classification:	mal100.spre.troj.adwa.spyw.evad.winEXE@15/20@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 325 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:48:06	API Interceptor	219281x Sleep call for process: svchost.exe modified
09:47:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6d90d9a2ca0b357d5f629d5cdbe8d0d2 "C:\Users\user\AppData\Local\Temp\svchost.exe" ..
09:47:42	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run 6d90d9a2ca0b357d5f629d5cdbe8d0d2 "C:\Users\user\AppData\Local\Temp\svchost.exe" ..
09:47:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6d90d9a2ca0b357d5f629d5cdbe8d0d2 "C:\Users\user\AppData\Local\Temp\svchost.exe" ..
09:47:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
3.126.37.18	W9UAjNR4L6.exe	Get hash	malicious	Njrat	Browse
	7zFM.exe	Get hash	malicious	ZTrat	Browse
	4xKDL5YCfQ.exe	Get hash	malicious	Njrat	Browse
	b8UsrDOVGV.exe	Get hash	malicious	Njrat	Browse
	tiodtk2cfy.exe	Get hash	malicious	Njrat	Browse
	pQBmVoyRnw.exe	Get hash	malicious	Njrat	Browse
	NezbdhNgwG.exe	Get hash	malicious	Njrat	Browse
	xdPdkPMD8u.exe	Get hash	malicious	Njrat	Browse
	VBUXm77rfL.exe	Get hash	malicious	Njrat	Browse
	gEuhLHV0.posh.ps1	Get hash	malicious	Metasploit	Browse
3.127.138.57	En3e396wX1.exe	Get hash	malicious	Njrat	Browse
	ea1Wv7aq.posh.ps1	Get hash	malicious	Metasploit	Browse
	R3ov8eFFFP.exe	Get hash	malicious	Njrat	Browse
	b8UsrDOVGV.exe	Get hash	malicious	Njrat	Browse
	2G8CgDVl3K.exe	Get hash	malicious	Njrat	Browse
	tiodtk2cfy.exe	Get hash	malicious	Njrat	Browse
	QUuUm3J8x3.exe	Get hash	malicious	Njrat	Browse
	RWqHoCWEPI.exe	Get hash	malicious	Njrat	Browse
	OUXkIxeP6k.exe	Get hash	malicious	Njrat	Browse
	eI43OwXSvq.exe	Get hash	malicious	Njrat	Browse
18.157.68.73	Ve0c8i5So2.exe	Get hash	malicious	Njrat	Browse
	b8UsrDOVGV.exe	Get hash	malicious	Njrat	Browse
	81Rz15POL6.exe	Get hash	malicious	Njrat	Browse
	649DB66A36E095B16832637A31D3CCC75040C5A6C23F6.exe	Get hash	malicious	Njrat	Browse
	RWqHoCWEPI.exe	Get hash	malicious	Njrat	Browse
	VBUXm77rfL.exe	Get hash	malicious	Njrat	Browse
	1UGdjTlX5v.exe	Get hash	malicious	Njrat	Browse
	kXghM8bJcm.exe	Get hash	malicious	Njrat	Browse
	eI43OwXSvq.exe	Get hash	malicious	Njrat	Browse
	p0zYXkMETE.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.tcp.eu.ngrok.io	W9UAjNR4L6.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	ULNZPn6D33.exe	Get hash	malicious	Sliver	Browse	18.197.239.5
	Injector.exe	Get hash	malicious	ZTrat	Browse	18.197.239.5
	7zFM.exe	Get hash	malicious	ZTrat	Browse	3.126.37.18
	Game Laucher.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	10.exe	Get hash	malicious	Unknown	Browse	18.192.93.86
	En3e396wX1.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	ZxocxU01PB.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	4xKDL5YCfQ.exe	Get hash	malicious	Njrat	Browse	18.156.13.209
	R3ov8eFFFP.exe	Get hash	malicious	Njrat	Browse	3.127.138.57

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://skillbridge.ca/onlinePaymentverify.html	Get hash	malicious	Unknown	Browse	108.158.75.100
	purchase order.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	main_mips.elf	Get hash	malicious	Mirai	Browse	13.218.109.96
	https://fujipharma.box.com/s/pezxwn32zbr37fbrrrqh18g3y8eulbk2	Get hash	malicious	Unknown	Browse	52.77.73.5
	main_arm7.elf	Get hash	malicious	Mirai	Browse	108.143.162.104
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	54.181.79.156
	main_sh4.elf	Get hash	malicious	Mirai	Browse	52.219.131.157
	https://do.not.click.on.this.link.instantrevert.net/XSEg2WDlKd2JCRDJOMWtwUGE5L0dpYzEyZUF0UjVQWmNQaWl2Q21KaDZSeUhuKzhLc243eHpPN1h4NjVNTnAzblZ6ZFZhaGwydDB1ZHJNUnQ5S25RRk0yTEtDbkhEZUlDZ29KY3lveXU2YW9kWkxheHEvTm1wWU5tWjUvT0lGZHkvR3k2MXBCbkYxdmJkZWl2NnNHa1dFcTFVd29uTklraVNkNHdISUFEbCszRE9tc3RETjdZSXdsaWl3PT0tLWJIaFJQTDlXUWhZQ0V6eWMtLWtnaFdmOHAzRW9zTE12VmNnY2lDS2c9PQ==?cid=2314349904	Get hash	malicious	KnowBe4	Browse	13.227.8.37
	https://online.coverages.best/informations.html?via=PTonRVU7RklJK0ZJTzAmQVk9NllEODZFRTsmNVY4NzFPPEJZQztWVCA=	Get hash	malicious	Unknown	Browse	13.209.60.147
	bin.sh.elf	Get hash	malicious	Mirai	Browse	65.11.249.192
AMAZON-02US	https://skillbridge.ca/onlinePaymentverify.html	Get hash	malicious	Unknown	Browse	108.158.75.100
	purchase order.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	main_mips.elf	Get hash	malicious	Mirai	Browse	13.218.109.96
	https://fujipharma.box.com/s/pezxwn32zbr37fbrrrqh18g3y8eulbk2	Get hash	malicious	Unknown	Browse	52.77.73.5
	main_arm7.elf	Get hash	malicious	Mirai	Browse	108.143.162.104
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	54.181.79.156
	main_sh4.elf	Get hash	malicious	Mirai	Browse	52.219.131.157
	https://do.not.click.on.this.link.instantrevert.net/XSEg2WDlKd2JCRDJOMWtwUGE5L0dpYzEyZUF0UjVQWmNQaWl2Q21KaDZSeUhuKzhLc243eHpPN1h4NjVNTnAzblZ6ZFZhaGwydDB1ZHJNUnQ5S25RRk0yTEtDbkhEZUlDZ29KY3lveXU2YW9kWkxheHEvTm1wWU5tWjUvT0lGZHkvR3k2MXBCbkYxdmJkZWl2NnNHa1dFcTFVd29uTklraVNkNHdISUFEbCszRE9tc3RETjdZSXdsaWl3PT0tLWJIaFJQTDlXUWhZQ0V6eWMtLWtnaFdmOHAzRW9zTE12VmNnY2lDS2c9PQ==?cid=2314349904	Get hash	malicious	KnowBe4	Browse	13.227.8.37
	https://online.coverages.best/informations.html?via=PTonRVU7RklJK0ZJTzAmQVk9NllEODZFRTsmNVY4NzFPPEJZQztWVCA=	Get hash	malicious	Unknown	Browse	13.209.60.147
	bin.sh.elf	Get hash	malicious	Mirai	Browse	65.11.249.192
AMAZON-02US	https://skillbridge.ca/onlinePaymentverify.html	Get hash	malicious	Unknown	Browse	108.158.75.100
	purchase order.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	main_mips.elf	Get hash	malicious	Mirai	Browse	13.218.109.96
	https://fujipharma.box.com/s/pezxwn32zbr37fbrrrqh18g3y8eulbk2	Get hash	malicious	Unknown	Browse	52.77.73.5
	main_arm7.elf	Get hash	malicious	Mirai	Browse	108.143.162.104
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	54.181.79.156
	main_sh4.elf	Get hash	malicious	Mirai	Browse	52.219.131.157
	https://do.not.click.on.this.link.instantrevert.net/XSEg2WDlKd2JCRDJOMWtwUGE5L0dpYzEyZUF0UjVQWmNQaWl2Q21KaDZSeUhuKzhLc243eHpPN1h4NjVNTnAzblZ6ZFZhaGwydDB1ZHJNUnQ5S25RRk0yTEtDbkhEZUlDZ29KY3lveXU2YW9kWkxheHEvTm1wWU5tWjUvT0lGZHkvR3k2MXBCbkYxdmJkZWl2NnNHa1dFcTFVd29uTklraVNkNHdISUFEbCszRE9tc3RETjdZSXdsaWl3PT0tLWJIaFJQTDlXUWhZQ0V6eWMtLWtnaFdmOHAzRW9zTE12VmNnY2lDS2c9PQ==?cid=2314349904	Get hash	malicious	KnowBe4	Browse	13.227.8.37
	https://online.coverages.best/informations.html?via=PTonRVU7RklJK0ZJTzAmQVk9NllEODZFRTsmNVY4NzFPPEJZQztWVCA=	Get hash	malicious	Unknown	Browse	13.209.60.147
	bin.sh.elf	Get hash	malicious	Mirai	Browse	65.11.249.192

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe	X2s67U04zU.exe	Get hash	malicious	DCRat	Browse
C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll	ZikuRAT VIP.7z	Get hash	malicious	Njrat	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\NjRAT.exe.log

Download File

Process:	C:\Users\user\Desktop\NjRAT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svchost.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Temp\svchost.exe

Download File

Process:	C:\Users\user\Desktop\NjRAT.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.57381833845709
Encrypted:	false
SSDEEP:	768:TpUDMmUbCv/cPByrUvSXrM+rMRa8Nuuut:T2DcbW05KUqI+gRJNd
MD5:	5C02E4B0AD99D924AA9EED7D706BFE12
SHA1:	E1CA2E74E7F873584E6B6D1D0F3D1D2DABC5713A
SHA-256:	0C41F773D5ABFFD1C52F008C3F144155CB7E331816A5C3AF1FC42683EAB51263
SHA-512:	AB2FD5CC9DA5F8FB2C8836A9063D8C15DB64847A6028F7AC0B330305D24905F8025BBE5CB02C7DE5BD0EE63B0173203D496292887AB90926BA4082AC066F5508
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\svchost.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\svchost.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Local\Temp\svchost.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\svchost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V~c................................. ........@.. ....................................@.................................\...O.......@............................................................................ ............... ..H............text........ ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.57381833845709
Encrypted:	false
SSDEEP:	768:TpUDMmUbCv/cPByrUvSXrM+rMRa8Nuuut:T2DcbW05KUqI+gRJNd
MD5:	5C02E4B0AD99D924AA9EED7D706BFE12
SHA1:	E1CA2E74E7F873584E6B6D1D0F3D1D2DABC5713A
SHA-256:	0C41F773D5ABFFD1C52F008C3F144155CB7E331816A5C3AF1FC42683EAB51263
SHA-512:	AB2FD5CC9DA5F8FB2C8836A9063D8C15DB64847A6028F7AC0B330305D24905F8025BBE5CB02C7DE5BD0EE63B0173203D496292887AB90926BA4082AC066F5508
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V~c................................. ........@.. ....................................@.................................\...O.......@............................................................................ ............... ..H............text........ ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Desktop\NjRAT.exe

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.57381833845709
Encrypted:	false
SSDEEP:	768:TpUDMmUbCv/cPByrUvSXrM+rMRa8Nuuut:T2DcbW05KUqI+gRJNd
MD5:	5C02E4B0AD99D924AA9EED7D706BFE12
SHA1:	E1CA2E74E7F873584E6B6D1D0F3D1D2DABC5713A
SHA-256:	0C41F773D5ABFFD1C52F008C3F144155CB7E331816A5C3AF1FC42683EAB51263
SHA-512:	AB2FD5CC9DA5F8FB2C8836A9063D8C15DB64847A6028F7AC0B330305D24905F8025BBE5CB02C7DE5BD0EE63B0173203D496292887AB90926BA4082AC066F5508
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\Desktop\NjRAT.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\Desktop\NjRAT.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\Desktop\NjRAT.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\Desktop\NjRAT.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V~c................................. ........@.. ....................................@.................................\...O.......@............................................................................ ............... ..H............text........ ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Desktop\NjRat 0.7D Green Edition\GeoIP.dat

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	data
Category:	dropped
Size (bytes):	1296658
Entropy (8bit):	5.9181827752117675
Encrypted:	false
SSDEEP:	24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
MD5:	797B96CC417D0CDE72E5C25D0898E95E
SHA1:	8C63D0CC8A3A09C1FE50C856B8E5170A63D62F13
SHA-256:	8A0675001B5BC63D8389FC7ED80B4A7B0F9538C744350F00162533519E106426
SHA-512:	9BB0C40C83551000577F8CF0B8A7C344BC105328A2C564DF70FABEC978AD267FA42E248C11FB78166855B0816D2EF3EC2C12FE52F8CC0B83E366E46301340882
Malicious:	false
Preview:	.............~..~.......H..I.........'..'.................../..0........"..#........i..j..............Z..[........T..U........J..K........G..0........=..0........5..g...........0.. .....'.....!..o.."..0..#..o..$..0..%.....&..0.....0..(..o..)..0..*..0..+..0..,..0..-..0..0...../.....0..0..1..0..2..0..3..0..4..0..0..-..6..o..7.....8..0..9..0..:..0..;..0..<..0..&..0..>..?..0.....@..w..A.....B..0..C..0..D..0..0..E..F..0..0..&..w..H..I..g.....o..L..M..S..0..N..O.....R..P.....Q..g..^..o..^.....&.....0.....V..0..w..X..W..o..P..0..Y.....o..0.....\..d..w.....]..^.._..`..0..c..0..w..a.....b........0..g..e..w..0..f..g..0..h..0.....w..k..l........m..n........o..p........J..q..l.....r..M..s..t..u..v........w..x........y..z........{..\|........}...........~....................8.......................l......................................8................................X...........................................................................................................l........................

C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1706496
Entropy (8bit):	5.621851082007528
Encrypted:	false
SSDEEP:	12288:ouicuiPszLSDeMFFFFFFFNPjiRfbljmYpNk1Yt6JwpwqVcTeec7neIjjpL:ouicui0zLSDRPjiRfzUcpcNgD
MD5:	1033C448810D3B507423546432E2F502
SHA1:	2BF9D04F68ED15B957378FB95DAA78C85D5B2B26
SHA-256:	F0C85722B88D1E7A1941BA17551CD5C29AEF99FAD86D78A5631A0F5446B3F580
SHA-512:	AEB964632DFAD41FC383A68ACE0E6BEB152A7075F21A32E449624A27DA5D2A5CCDA0665FBD90597D65D74B0790877BAF6F81336660B1DF4BF38B41CD0BC6CD44
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Joe Sandbox View:	Filename: X2s67U04zU.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x..V.....................V........... ........@.. ....................................@.....................................W........Q...................`....................................................... ............... ..H............text...$.... ...................... ..`.sdata..............................@....rsrc....Q.......R..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	5.8688535448754715
Encrypted:	false
SSDEEP:	1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
MD5:	A73EDB60B80A2DFA86735D821BEA7B19
SHA1:	F39A54D7BC25425578A2B800033E4508714A73ED
SHA-256:	7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98
SHA-512:	283E9206D0B56C1F8B0741375CCD0A184410CF89F5F42DFE91E7438C5FD0AC7FA4AFBB84B8B7EA448B3093397552FD3731B9BE74C67B846D946DA486DCF0DF68
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: ZikuRAT VIP.7z, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......R...........!..................... ... ....@.. .......................`............@.....................................O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........e...............................................................0..E........(......}.....r...p}.....r...p}......}.....s....}......d}......}........0...........{......(....s.........(....r...p(........o...........o..........o.....{....o.....o......o......o....&.o.......(.......%(.......}....(.................an..........ww......>....o....o.....0..........(.....Po........0..........(.....Po........0..i........o......-...}........3...}....*.%......s....s......o...

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.599068539501502
Encrypted:	false
SSDEEP:	384:nok/7+I98wxOatKr3xcNRPKtoMlqfpibcWY2EvHqNiaR6D3sO9:c6oh4RiHlqhi/EvDou
MD5:	73C8A5CD64FCF87186A6A9AC870DF509
SHA1:	7EA0BD1F15D7C8BC8B259B3A409B2CD3B0FE3EEC
SHA-256:	7722206DBA0CFB290F33093F9430CB770A160947001715AE11E6DBBFAEF1C0EE
SHA-512:	B5FAAF370D951BCCD34DA369E970D75C8F038BBFC99CF042C89A4CEB9CC077C1C8FC81318D79180C67373CCA8024D27AABA052D4CEE82A3AEDA8D59AD0AC817D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 77%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`..V...........!.....P...........o... ........@.. ....................................@..................................n..S.................................................................................... ............... ..H............text....O... ...P.................. ..`.sdata..c............T..............@....rsrc................V..............@..@.reloc...............^..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\mic.dll

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	5.9117962544447735
Encrypted:	false
SSDEEP:	1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
MD5:	D4C5DDC00F27162FC0947830E0E762B7
SHA1:	7769BE616D752E95D80E167F2EF4CC6B8C3C21FE
SHA-256:	B6FB6B66821E70A27A4750B0CD0393E4EE2603A47FEAC48D6A3D66D1C1CB56D5
SHA-512:	9555F800213F2F4A857B4558AA4D030EDF41485B8366812D5A6B9ADCC77FC21584E30D2DD9CE515846F3A809C85038958CB8174BF362CF6FED97CA99A826E379
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-.R...........!..................... ........@.. .......................@..................................................L............................ ......................................................,................ ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................H........u...i..........XO..\|&............................................(......}.....r...p}.....s....}.....r...p}.....(.......0...........F9K...s........s...........o.....o......jo.....o..................o....&.o......s.......s................o.....j.o.........o....&...(........jo.......................o....&..o.....o..........6(.....Po......6(.....Po.......0..........(.....Po......(.............0...........P(.....(.....o......*.......0..2..........o.....{......(..........r

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\plg.dll

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29184
Entropy (8bit):	5.664549935875628
Encrypted:	false
SSDEEP:	384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
MD5:	0CBC2D9703FEEAD9783439E551C2B673
SHA1:	4F8F4ADDD6F9E60598A7F4A191A89A52201394A8
SHA-256:	EA9ECF8723788FEEF6492BF938CDFAB1266A1558DFFE75E1F78A998320F96E39
SHA-512:	06F55B542000E23F5EEBA45EA5FF9FFADDDDD102935E039E4496AF5E5083F257129DAB2F346EEAE4EE864F54DB57D3C73CF6ED1D3568087411203769CF0DDD66
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X..R...........!.....l..........~.... ........@.. ....................................@.................................0...K.................................................................................... ............... ..H............text....j... ...l.................. ..`.rsrc................n..............@..@.reloc...............p..............@..B................`.......H........U..P4..........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP......(......(.....s.........s.........s.........s............0..........~....o......0..........~....o......0..........~....o......0..........~....o......0............(....(........0...........(....*..0...............(..

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\pw.dll

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	257024
Entropy (8bit):	7.718806258518157
Encrypted:	false
SSDEEP:	6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
MD5:	872401528FC94C90F3DE6658E776CC36
SHA1:	C58E22158774D16831350DE79EB4E1711379E8A6
SHA-256:	3A1CC072EFFD8C38406A6FDDF4D8F49C5366BB0E32071311D90DB669940987CE
SHA-512:	6DA881FB968BA9D9200777A9F19D69220468482F3EAAF687C433790D512DA520F5ADB23441FDC8F3FD10785918EB2864EA3EF32DDB80D2F6665550EA455F4A2F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......U...........!.........4........... ........@.. .......................`............@.................................p...K......../...................@....................................................... ............... ..H............text....... ...................... ..`.sdata..8...........................@....rsrc..../.......0..................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\sc2.dll

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.16289859666362
Encrypted:	false
SSDEEP:	192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
MD5:	19967E886EDCD2F22F8D4A58C8EA3773
SHA1:	BF6E0E908EAAD659FDD32572E9D73C5476CA26EC
SHA-256:	3E5141C75B7746C0EB2B332082A165DEACB943CEF26BD84668E6B79B47BDFD93
SHA-512:	D471DF3F0D69909E8EF9F947DA62C77C3FF1EB97AC1DD53A74AD09FB4D74EC26C3C22FACC18EC04F26DF3B85B0C70863119F5BAA090B110AB25383FCDB4E9D6E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... .R...........!................I... ...`....@.. ....................................@..................................I..W....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc..............................@..B.................I......H........2...............................................................r...p.......(......}.....s....}.....r...p}......}......}.....s....}.......0...........{......(....s........(....r...p(........(...........o..........o.....{....o.....o......o......o....&.o.......(.......%(.......}....(..............`m..........vv......:...(....o......0..........(.....Po........0..........(.....Po........0...........%......s....s......o....*...0..n.......s........j.........{.....{..

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Sound\Sound.wav

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	658988
Entropy (8bit):	7.7687372330318425
Encrypted:	false
SSDEEP:	12288:kqqW6lExbQPGUXw7zYmDahneArkGZKatb4TZdXEuH3S28UI:Mz65YQa44kKmLVHiXUI
MD5:	562FB3B4B1B1EAFD2CF107F2E92E0670
SHA1:	CEBF2A65C99E1B2C13D7212BF111BDF0FE5C13CE
SHA-256:	5FF592B183B2C990448F1DCD842A29CFE17A3EAA9956E0135C945C578676344A
SHA-512:	807CD580A04C84FB671C1DFA0FC2B90BBF2428E4727D7FA3956011623CAE5C7E093ACF55D5F0AD325116B729C96E845F06F3FC3007E8048238AACDEA7F21386A
Malicious:	false
Preview:	RIFF$...WAVEfmt ........D...........data................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Stub.il

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	assembler source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	408747
Entropy (8bit):	4.3806828177501735
Encrypted:	false
SSDEEP:	12288:YbidABkcrO7qU+1gtxPXEx8V0IC0FcUYpm+0DGG+ld+HkZCpC654tDarkic:s
MD5:	3575ABF7AB346EC4039138FAD1FAB4B7
SHA1:	C5C7B08CFCB707CAB339D966E36DE6C3C97BD7F5
SHA-256:	ED79411707D5A9925F1146E595983804E4EEAFE35E72EB51703908EFF13CC073
SHA-512:	2044D78E20A4D7B8ACBC0EBF61C38176314CCF02A0B009B161530B78658444FAED8304A628938514D98EFFE5EBDD81275E1328F65D98EC3F2E545F9C9DE56179
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\Desktop\NjRat 0.7D Green Edition\Stub.il, Author: Joe Security
Preview:	...// Microsoft (R) .NET Framework IL Disassembler. Version 2.0.50727.42..// Copyright (c) Microsoft Corporation. All rights reserved.........// Metadata version: v2.0.50727...module extern user32...module extern user32.dll...module extern winmm.dll...module extern avicap32.dll...module extern kernel32...module extern ntdll...module extern KERNEL32.DLL...assembly extern mscorlib..{.. .publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) // .z\V.4.... .ver 2:0:0:0..}...assembly extern Microsoft.VisualBasic..{.. .publickeytoken = (B0 3F 5F 7F 11 D5 0A 3A ) // .?_....:.. .ver 8:0:0:0..}...assembly extern System..{.. .publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) // .z\V.4.... .ver 2:0:0:0..}...assembly extern System.Windows.Forms..{.. .publickeytoken = (B7 7A 5C 56 19 34 E0 89 ) // .z\V.4.... .ver 2:0:0:0..}...assembly extern System.Drawing..{.. .publickeytoken = (B0 3F 5F 7F 11 D5 0A 3A )

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Stub.manifest

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	487
Entropy (8bit):	4.968013380130765
Encrypted:	false
SSDEEP:	6:TMVBd6OjzsbRu9Td8HW/5TiyEGWBRu9TO/STfUpRu9TNNciWkY2x8RTdN9TIHG:TMHdt43O5lEGaN/2UjMNciC2xA5NEG
MD5:	4D18AC38A92D15A64E2B80447B025B7E
SHA1:	5C34374C2DD5AFA92E0489F1D6F86DDE616ACA6C
SHA-256:	835A00D6E7C43DB49AE7B3FA12559F23C2920B7530F4D3F960FD285B42B1EFB5
SHA-512:	72BE79ACD72366B495E0F625A50C9BDF01047BCF5F9EE1E3BDBA10DAB7BD721B0126F429A91D8C80C2434E8BC751DEFDF4C05BDC09D26A871DF1BB2E22E923BF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">.. <requestedExecutionLevel level="asInvoker" uiAccess="false"/>.. </requestedPrivileges>.. </security>.. </trustInfo>..</assembly>..

C:\Users\user\Desktop\NjRat 0.7D Green Edition\WinMM.Net.dll

Download File

Process:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	5.942984156709154
Encrypted:	false
SSDEEP:	768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
MD5:	D4B80052C7B4093E10CE1F40CE74F707
SHA1:	2494A38F1C0D3A0AA9B31CF0650337CACC655697
SHA-256:	59E2AC1B79840274BDFCEF412A10058654E42F4285D732D1487E65E60FFBFB46
SHA-512:	3813B81F741AE3ADB07AE370E817597ED2803680841CCC7549BABB727910C7BFF4F8450670D0CA19A0D09E06F133A1AAEFECF5B5620E1B0BDB6BCD409982C450
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...TOZR...........!................~.... ........@.. ....................... ............@.................................(...S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................`.......H........e..\^...........@...%...........................................0..p........s....}.....s....}..... ....}.......}.....s....}.....(.....(....2.....r...pr...ps....z........s}...}......}.....0............(.......(........................b..{.....(....t....}....b..{.....(....t....}.....(....o......{....r..0.r...pr...ps....z..}......{......{.....0.r...pr...ps....z..}.....(`....0..$.......~....-.s......(....o..........~....*.0...........{....%.(.....{....,.r...ps.

C:\autorun.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost.exe
File Type:	Microsoft Windows Autorun file
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.320240000427043
Encrypted:	false
SSDEEP:	3:It1KV2LKMACovK0x:e1KzxvD
MD5:	5B0B50BADE67C5EC92D42E971287A5D9
SHA1:	90D5C99143E7A56AD6E5EE401015F8ECC093D95A
SHA-256:	04DDE2489D2D2E6846D42250D813AB90B5CA847D527F8F2C022E6C327DC6DB53
SHA-512:	C064DC3C4185A38D1CAEBD069ACB9FDBB85DFB650D6A241036E501A09BC89FD06E267BE9D400D20E6C14B4068473D1C6557962E8D82FDFD191DB7EABB6E66821
Malicious:	true
Preview:	[autorun]..open=C:\svchost.exe..shellexecute=C:\..

C:\svchost.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.57381833845709
Encrypted:	false
SSDEEP:	768:TpUDMmUbCv/cPByrUvSXrM+rMRa8Nuuut:T2DcbW05KUqI+gRJNd
MD5:	5C02E4B0AD99D924AA9EED7D706BFE12
SHA1:	E1CA2E74E7F873584E6B6D1D0F3D1D2DABC5713A
SHA-256:	0C41F773D5ABFFD1C52F008C3F144155CB7E331816A5C3AF1FC42683EAB51263
SHA-512:	AB2FD5CC9DA5F8FB2C8836A9063D8C15DB64847A6028F7AC0B330305D24905F8025BBE5CB02C7DE5BD0EE63B0173203D496292887AB90926BA4082AC066F5508
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\svchost.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\svchost.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\svchost.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\svchost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V~c................................. ........@.. ....................................@.................................\...O.......@............................................................................ ............... ..H............text........ ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.781884237983846
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	f3aef511705f37f9792c6032b936ca61.exe
File size:	2'388'170 bytes
MD5:	e4631d6e2fee44de27d84aff1ce7c7a5
SHA1:	d16bc9a9e7249e8f5b519cabbaafa0f1462bccdd
SHA256:	008478ff6c70392e5ecf933881df2c44f31fdf76ad88c407191233cb39de6528
SHA512:	fdba6e4c6ce13996f05bfa0680383c809b177aedbd300ce42e7f378fd8ad1a1b2cfbc6342b5f0f64d03142bc25f3cf538829cbd01c539ec4c1477121b8f6e8be
SSDEEP:	49152:x842+3u+OurHvP4yU222Yd/2bIKxwc6XfnVmAfIg39EJ:x8gTdrHvPfRn8ulx36PrNQ
TLSH:	AAB51201BB9595F2D5632976F928EF30DA6CEC501E20C69B63D04D1B7DB81C2E921BE3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...+...._......._..'...._f.'...._..'..

File Icon


Icon Hash:	10dad45854447230

Static PE Info

General

Entrypoint:	0x41eef0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x60C329FF [Fri Jun 11 09:16:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fcf1390e9ce472c7270447fc5c61a0c1

Entrypoint Preview

Instruction
call 00007FC674837799h
jmp 00007FC6748371BDh
cmp ecx, dword ptr [0043E668h]
jne 00007FC674837335h
ret
jmp 00007FC67483791Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC67482A137h
mov dword ptr [esi], 00435580h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00435588h
mov dword ptr [ecx], 00435580h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 00435568h
push eax
call 00007FC67483A4BDh
pop ecx
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FC67482A0CEh
push 0043B704h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FC674839C80h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FC6748372D4h
push 0043B91Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FC674839C63h
int3
jmp 00007FC67483BC33h
jmp dword ptr [00433260h]
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push 00422150h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3c830	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c864	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x63000	0x2a488	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0x227c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3aac0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35508	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3bdc4	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x313ba	0x31400	675b3d32e0449f24d266c11fd42c4e23	False	0.5840141180203046	data	6.709807872238317	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xa622	0xa800	d1ae5a0175dfb925fc91111d5aee7a6c	False	0.45317150297619047	data	5.222677614328155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x23728	0x1000	201530c9e56f172adf2473053298d48f	False	0.36767578125	data	3.7088186669877685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x62000	0x18c	0x200	b7f0feda7ab6671cb8b44734d1fc4180	False	0.447265625	data	3.3554341882340144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x63000	0x2a488	0x2a600	87b3bf4b958520f3b63cbea914fae3e1	False	0.1132121128318584	data	2.6898752697340647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e000	0x227c	0x2400	c4082250c29091b2a6f872d68c8d91ff	False	0.7757161458333334	data	6.564176621980741	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x63524	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x6406c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x65618	0x25b48	Device independent bitmap graphic, 187 x 400 x 32, image size 149600			0.049074074074074076
RT_DIALOG	0x8b160	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x8b3e8	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x8b524	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x8b610	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x8b740	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x8ba78	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x8bccc	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x8beb0	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x8c07c	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x8c234	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x8c37c	0x446	data	English	United States	0.340036563071298
RT_STRING	0x8c7c4	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x8c92c	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x8ca80	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x8cb8c	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x8cc48	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x8cd20	0x14	data			1.2
RT_MANIFEST	0x8cd34	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T09:47:17.233623+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:47:17.233623+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:47:17.233623+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:47:38.168327+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:47:38.168327+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:47:38.288383+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:47:38.288383+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:47:43.406131+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:29.997440+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:31.859286+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:37.843585+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:38.061987+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:39.251298+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:39.374864+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:39.563767+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49711	3.126.37.18	16299	TCP
2024-12-06T09:48:43.073098+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:43.073098+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.015364+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.135109+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.254928+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.343637+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.374742+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:44.958733+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:47.000670+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:48.681768+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:50.489867+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:51.329348+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:51.773740+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:52.374092+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:52.853601+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:53.947725+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:54.133502+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:54.253470+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:54.667514+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:55.386821+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:55.748238+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:55.958955+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:56.616010+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:56.735824+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:57.338326+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:57.818525+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:57.818525+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:58.552553+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:59.163581+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:48:59.783533+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:00.382947+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:00.535873+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:00.535873+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:01.021710+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:01.143820+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:01.597448+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:01.880962+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:02.484241+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:03.088511+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:03.688001+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:04.321987+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:04.441787+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:04.561681+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:04.801479+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:05.041504+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:05.401328+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:05.884227+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.004085+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.123871+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.244164+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.486800+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:06.607473+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:07.214042+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:07.395085+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:07.634952+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:07.774247+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:08.374875+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:08.975589+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:08.975589+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:09.450656+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:09.869480+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:09.989301+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:10.229029+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:10.588731+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:10.948706+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:11.551709+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:12.032036+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:12.152025+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:12.391826+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:12.777806+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:13.377275+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:13.977146+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:14.097059+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:14.336765+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:14.699209+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:15.059179+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:15.299774+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:15.783873+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.385518+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.505973+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.745839+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.865755+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:16.985572+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:17.136735+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:17.379596+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:17.982962+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:18.103672+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:18.103672+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:18.224405+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:18.841775+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:19.336897+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:19.966160+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:20.569434+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:20.932141+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:21.053035+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:21.641877+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:21.881725+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:22.241755+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:22.241755+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:22.483256+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:22.966665+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:23.207726+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:23.551196+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:24.633916+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:25.031003+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:25.635585+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:26.115675+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:26.235669+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:26.596512+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.203930+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.323711+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.443501+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.563538+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.683336+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.858958+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:27.978730+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:28.461423+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:29.061481+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:29.661431+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:29.901224+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:29.901224+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:30.280113+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:30.913470+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:31.393688+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:32.015061+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:32.856928+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:33.216300+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:33.937596+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:34.065589+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:34.185480+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:34.828220+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:35.911623+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:36.031728+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:36.617593+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:36.617593+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:37.574116+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:37.814932+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:37.934742+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:38.175581+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:38.447737+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:38.811522+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:39.295686+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:39.415502+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:39.780965+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:39.900905+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:40.361752+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:40.601527+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:40.961161+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:40.961161+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:41.084113+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:41.325598+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:41.928897+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:42.049613+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:42.529479+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:42.657647+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:43.138522+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:43.378377+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:43.860951+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:43.987986+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:44.593054+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:44.593054+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:44.713206+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49865	3.127.138.57	16299	TCP
2024-12-06T09:49:48.097368+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:48.097368+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:48.576892+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:48.696847+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:48.816718+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:48.936521+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:49.194904+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:49.436887+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:50.048816+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:50.168727+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:50.656350+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:50.776325+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:51.349337+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:52.010672+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:53.097597+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:53.457603+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:54.114634+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:54.356134+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:54.476624+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:54.836527+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:55.076751+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:55.196635+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:55.797606+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:56.037600+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:56.371079+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:56.816202+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:56.936509+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:57.177202+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:57.782297+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:58.899118+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.019072+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.617775+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.737810+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.858159+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:49:59.978032+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:00.098085+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:00.218005+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:00.339702+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:00.459767+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:01.061616+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:01.541396+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:02.354167+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:02.954940+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:03.074842+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:03.557446+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:03.677545+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:04.157499+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:04.397676+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:04.519831+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:04.640990+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:05.145619+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:05.385334+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:05.505189+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:05.625010+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:06.104256+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:06.224144+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:06.825619+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:06.945624+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.185359+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.185359+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.305345+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.429615+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.838686+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:07.958504+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:08.214418+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:09.541614+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.141613+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.261418+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.381409+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.501320+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.674536+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.914333+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:10.914333+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:11.034177+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:11.650150+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:12.252092+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:12.856472+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:12.976297+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:13.456344+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:13.456344+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:13.576310+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:14.056250+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:14.693011+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:15.295817+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:16.016137+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:16.257187+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:17.097457+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:17.697987+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:17.817907+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:18.321457+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:18.442473+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:18.877004+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:18.997040+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:19.117067+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:19.481697+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:19.721583+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:19.841445+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.323903+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.443890+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.564432+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.804531+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:20.924385+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:21.612182+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:21.732377+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.022579+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.262318+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.625647+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.745459+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:22.986112+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:23.353584+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:23.619822+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:23.739765+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.063428+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.187990+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.442802+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.563506+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:24.923351+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:25.043393+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:25.644780+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:26.245612+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:26.485587+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:26.605687+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:27.191374+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:27.431704+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:27.552005+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:28.159727+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:28.520012+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:28.759701+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:29.119208+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:29.496924+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:30.099740+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:30.099740+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:30.702425+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:31.304339+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:31.424307+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:31.928159+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.048325+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.168211+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.288059+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.449720+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:32.851564+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:33.578154+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:33.819328+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:34.058977+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:34.178749+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:34.691716+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:35.366596+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:36.003318+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:36.603623+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:37.395158+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:37.755835+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:37.880137+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:38.362331+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:39.461820+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:39.701741+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:40.301261+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:40.301261+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:40.901365+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:41.604469+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:41.844335+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:41.968793+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:42.338253+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:42.578008+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:42.818281+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:43.085706+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:43.205492+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:43.325479+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:43.807852+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:44.047591+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:44.648520+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:44.769700+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:45.249538+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:45.369617+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:45.730872+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:46.327804+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:46.447634+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.046897+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.286786+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.286786+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.773746+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:47.893671+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:48.497895+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:48.617783+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:49.197316+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:50.156817+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:50.397793+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:50.637473+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49977	18.157.68.73	16299	TCP
2024-12-06T09:50:53.075800+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:53.075800+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:53.315400+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:53.435904+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:53.556987+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:53.726570+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:54.089766+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:54.704801+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:55.188691+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:55.428336+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:55.791830+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:55.911771+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:56.525263+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:56.765375+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:57.247260+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:57.367150+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:57.749013+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:58.473908+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:58.713895+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:59.120884+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:59.758388+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:50:59.758388+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:00.360947+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:00.969917+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:01.643730+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:01.763645+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:01.883430+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:02.362768+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:02.482698+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:02.968425+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:03.089007+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:03.329714+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:03.569554+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.349231+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.469169+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.589109+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.713703+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:04.891110+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:05.134369+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:05.254978+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:05.858580+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:07.092399+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:07.733829+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:08.459087+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:08.818820+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:09.300883+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:09.461100+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:09.890822+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:10.371112+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:10.491055+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:10.970343+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:11.090069+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:11.330025+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.036413+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.156560+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.596139+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.716070+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:12.956226+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:13.683688+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:14.289704+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:14.409681+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:14.649508+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:14.832949+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.252317+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.436455+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.556319+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.676339+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:15.676339+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:16.042149+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:16.162216+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:16.652636+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:17.256420+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:17.736918+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:17.976572+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:18.696540+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:18.696540+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:19.176351+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:19.784644+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:19.904459+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:20.024997+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.106326+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.346383+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.466243+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.587289+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:21.762196+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:22.124327+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:22.244243+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:22.846042+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:23.330598+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:23.450493+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:23.939428+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:24.060238+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:24.427457+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:24.549738+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:24.919796+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.041129+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.311361+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.432874+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.552756+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.793405+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:25.913260+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.152977+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.273301+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.393274+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.617136+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:26.737044+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP
2024-12-06T09:51:27.339293+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49978	3.127.138.57	16299	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 09:47:37.914360046 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:47:38.034224987 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:47:38.034327030 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:47:38.168327093 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:47:38.288026094 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:47:38.288383007 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:47:38.408473969 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:47:43.406131029 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:47:43.526038885 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:29.997440100 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:30.117191076 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:31.859286070 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:31.979161978 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:37.843585014 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:37.963748932 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:38.061986923 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:38.181691885 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:39.251297951 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:39.370975018 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:39.374864101 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:39.494560003 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:39.563766956 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:39.683551073 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:39.683698893 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:39.803399086 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:39.803466082 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:39.923157930 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:39.923239946 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:40.043024063 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:40.043138981 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:40.162810087 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:40.163629055 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:40.283279896 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:40.283607006 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:40.403498888 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:40.406343937 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:40.526061058 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:40.526151896 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:40.645864010 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:40.645947933 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:40.715694904 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:40.716742992 CET	49711	16299	192.168.2.5	3.126.37.18
Dec 6, 2024 09:48:40.766618013 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:40.836415052 CET	16299	49711	3.126.37.18	192.168.2.5
Dec 6, 2024 09:48:42.950129986 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:43.069924116 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:43.070038080 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:43.073097944 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:43.192945957 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:43.193547010 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:43.313719034 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:43.314079046 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:43.433901072 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:43.434031963 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:43.553808928 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:43.557559967 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:43.858563900 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:43.893867016 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:43.895617008 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:43.978542089 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:43.979820967 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:44.015295982 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:44.015363932 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:44.099778891 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:44.100851059 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:44.135039091 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:44.135108948 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:44.221508026 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:44.223582029 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:44.254873991 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:44.254928112 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:44.343250036 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:44.343636990 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:44.374654055 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:44.374742031 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:44.463690996 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:44.494533062 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:44.958733082 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:45.078656912 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:45.078855991 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:45.198606014 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:45.198688030 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:45.318667889 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:45.318746090 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:45.438895941 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:45.441540956 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:45.561362028 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:45.561450005 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:45.681185961 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:45.681257010 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:45.801084995 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:45.801300049 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:45.921020031 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:45.921231031 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:46.040951014 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:46.041168928 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:46.160918951 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:46.161575079 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:46.281563044 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:46.281692028 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:46.401371956 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:46.401443005 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:46.521151066 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:46.521270037 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:46.640889883 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:46.641072035 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:46.760757923 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:46.760970116 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:46.880646944 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:46.880825043 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:47.000590086 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:47.000669956 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:47.120384932 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:47.120469093 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:47.240294933 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:47.241533995 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:47.361555099 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:47.361660957 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:47.481465101 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:47.481584072 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:47.601521015 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:47.601619959 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:47.721560001 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:47.721649885 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:47.841568947 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:47.841629028 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:47.961450100 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:47.961530924 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:48.081336975 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:48.081584930 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:48.201638937 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:48.201778889 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:48.321732998 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:48.321825027 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:48.441771030 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:48.441853046 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:48.561682940 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:48.561836004 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:48.681519032 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:48.681767941 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:48.801456928 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:48.801740885 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:48.921613932 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:48.921757936 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:49.043286085 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:49.043344021 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:49.163134098 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:49.163259029 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:49.283210039 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:49.285567045 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:49.405404091 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:49.405577898 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:49.525407076 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:49.525460005 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:49.645487070 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:49.645554066 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:49.765338898 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:49.765409946 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:49.885127068 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:49.885570049 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:50.006227016 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:50.009563923 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:50.129416943 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:50.129522085 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:50.249380112 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:50.249473095 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:50.369368076 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:50.369546890 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:50.489686012 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:50.489866972 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:50.609699965 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:50.609785080 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:50.729540110 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:50.729604959 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:50.849267006 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:50.849351883 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:50.969095945 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:50.969237089 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:51.089030981 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:51.089127064 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:51.208832979 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:51.208894968 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:51.329289913 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:51.329348087 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:51.449193001 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:51.773740053 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:51.893640041 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:51.893707991 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:52.013632059 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:52.013700008 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:52.133575916 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:52.133642912 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:52.254077911 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:52.254163027 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:52.373996019 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:52.374092102 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:52.493864059 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:52.493993998 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:52.613713980 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:52.613853931 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:52.733716011 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:52.733804941 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:52.853535891 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:52.853600979 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:52.973411083 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:52.973503113 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:53.093770981 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:53.093866110 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:53.213597059 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:53.215948105 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:53.335803032 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:53.337548971 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:53.457211018 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:53.457319021 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:53.577018976 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:53.577102900 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:53.696866989 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:53.697580099 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:53.817691088 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:53.819592953 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:53.946283102 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:53.947725058 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:54.067611933 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:54.133502007 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:54.253411055 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:54.253469944 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:54.373383045 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:54.667514086 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:54.787374973 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:54.787448883 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:54.907263041 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:54.907413960 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:55.027228117 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:55.027415037 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:55.147115946 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:55.147181034 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:55.266877890 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:55.266942024 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:55.386729002 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:55.386821032 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:55.506738901 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:55.507684946 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:55.627389908 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:55.627482891 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:55.748061895 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:55.748238087 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:55.891882896 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:55.958955050 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:56.131278992 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:56.131747961 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:56.251449108 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:56.251627922 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:56.371340036 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:56.371658087 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:56.492830992 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:56.495796919 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:56.615582943 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:56.616009951 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:56.735753059 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:56.735824108 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:56.855516911 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:56.855618000 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:56.975552082 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:56.975768089 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:57.096158981 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:57.097731113 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:57.217628002 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:57.217711926 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:57.338257074 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:57.338325977 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:57.458363056 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:57.458431959 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:57.578224897 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:57.578341961 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:57.698116064 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:57.698244095 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:57.818449020 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:57.818525076 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:57.947724104 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:57.947788000 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:58.067729950 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:58.067800999 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:58.188050985 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:58.188118935 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:58.307815075 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:58.311803102 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:58.431564093 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:58.431849003 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:58.552481890 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:58.552552938 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:58.672295094 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:58.672353029 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:58.792274952 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:58.795749903 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:58.915566921 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:58.919873953 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:59.040296078 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:59.043565989 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:59.163392067 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:59.163580894 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:59.283493042 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:59.283565044 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:59.403331041 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:59.403403044 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:59.523226023 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:59.523309946 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:59.643102884 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:59.643188953 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:59.763000011 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:59.783533096 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:48:59.903399944 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:48:59.903475046 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:00.023173094 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:00.023252964 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:00.143017054 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:00.143116951 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:00.262875080 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:00.263051033 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:00.382885933 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:00.382946968 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:00.502696991 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:00.535872936 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:00.655720949 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:00.655801058 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:00.775665045 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:00.779598951 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:00.899472952 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:00.899560928 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:01.019359112 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:01.021709919 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:01.141562939 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:01.143820047 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:01.263643980 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:01.597448111 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:01.717170954 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:01.717233896 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:01.836986065 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:01.880961895 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:02.001601934 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:02.001665115 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:02.121691942 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:02.121773958 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:02.241720915 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:02.241811991 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:02.362055063 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:02.363970041 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:02.484186888 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:02.484241009 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:02.604007959 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:02.607682943 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:02.727591991 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:02.727914095 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:02.847758055 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:02.848754883 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:02.968513966 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:02.968595982 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:03.088334084 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:03.088510990 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:03.208192110 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:03.208252907 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:03.327938080 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:03.328088045 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:03.447938919 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:03.448098898 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:03.567936897 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:03.568072081 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:03.687947989 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:03.688000917 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:03.807729959 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:04.321986914 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:04.441740036 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:04.441787004 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:04.561546087 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:04.561681032 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:04.681510925 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:04.681586027 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:04.801338911 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:04.801479101 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:04.921354055 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:04.921539068 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:05.041446924 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:05.041503906 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:05.161334038 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:05.161386967 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:05.281299114 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:05.281395912 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:05.401256084 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:05.401328087 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:05.521169901 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:05.521255970 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:05.641171932 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:05.641377926 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:05.763689041 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:05.763799906 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:05.883539915 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:05.884227037 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:06.003968000 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:06.004085064 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:06.123794079 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:06.123871088 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:06.243578911 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:06.244163990 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:06.363959074 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:06.486799955 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:06.606682062 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:06.607472897 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:06.727817059 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:07.214041948 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:07.395021915 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:07.395085096 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:07.514883995 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:07.514970064 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:07.634859085 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:07.634952068 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:07.754771948 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:07.774246931 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:07.893990993 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:07.894051075 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:08.013870955 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:08.013993025 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:08.133672953 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:08.133821964 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:08.253915071 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:08.255095959 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:08.374804020 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:08.374875069 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:08.494474888 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:08.494537115 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:08.614177942 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:08.614269972 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:08.734061003 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:08.735655069 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:08.855411053 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:08.855595112 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:08.975506067 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:08.975589037 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:09.095583916 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:09.095647097 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:09.215449095 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:09.215517998 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:09.335242987 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:09.450655937 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:09.572191954 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:09.869479895 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:09.989250898 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:09.989300966 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:10.109173059 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:10.109246016 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:10.228981972 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:10.229028940 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:10.348850012 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:10.348974943 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:10.468863010 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:10.468946934 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:10.588656902 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:10.588731050 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:10.708718061 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:10.708903074 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:10.828788996 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:10.828860998 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:10.948597908 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:10.948705912 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:11.068530083 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:11.068594933 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:11.188333035 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:11.188405991 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:11.308156013 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:11.309565067 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:11.430505037 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:11.431786060 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:11.551630974 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:11.551708937 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:11.671355963 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:11.671488047 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:11.791204929 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:11.791982889 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:11.911664009 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:11.911741972 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:12.031415939 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:12.032036066 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:12.151937962 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:12.152024984 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:12.271789074 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:12.271949053 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:12.391711950 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:12.391825914 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:12.512145042 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:12.512222052 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:12.631954908 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:12.632128000 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:12.751893997 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:12.777806044 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:12.897675037 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:12.897809982 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:13.017627001 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:13.017780066 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:13.137640953 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:13.137716055 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:13.257414103 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:13.257476091 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:13.377185106 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:13.377274990 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:13.497154951 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:13.497292995 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:13.617166996 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:13.617285013 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:13.737322092 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:13.737381935 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:13.857172966 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:13.857245922 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:13.977050066 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:13.977145910 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:14.097002029 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:14.097059011 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:14.216758013 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:14.216850042 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:14.336685896 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:14.336765051 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:14.457110882 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:14.457261086 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:14.579183102 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:14.579261065 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:14.699155092 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:14.699208975 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:14.819113970 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:14.819272041 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:14.939141989 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:14.939251900 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:15.059084892 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:15.059179068 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:15.179001093 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:15.179074049 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:15.298902988 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:15.299773932 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:15.419507980 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:15.423623085 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:15.543430090 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:15.543517113 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:15.663275003 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:15.663366079 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:15.783196926 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:15.783873081 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:15.903651953 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:15.903724909 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:16.023438931 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:16.023653984 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:16.145556927 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:16.145616055 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:16.265440941 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:16.265506983 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:16.385442972 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:16.385518074 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:16.505449057 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:16.505973101 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:16.625832081 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:16.625912905 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:16.745768070 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:16.745839119 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:16.865653038 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:16.865755081 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:16.985493898 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:16.985572100 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:17.105401039 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:17.136734962 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:17.256475925 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:17.257585049 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:17.377505064 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:17.379595995 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:17.499325037 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:17.499881983 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:17.619697094 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:17.619847059 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:17.739574909 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:17.739670992 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:17.860493898 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:17.863025904 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:17.982794046 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:17.982961893 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:18.103013992 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:18.103672028 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:18.224313974 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:18.224405050 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:18.344207048 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:18.841774940 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:18.961514950 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:18.961652040 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:19.081408024 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:19.081504107 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:19.201322079 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:19.201402903 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:19.321147919 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:19.336896896 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:19.456739902 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:19.457088947 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:19.576926947 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:19.577032089 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:19.696809053 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:19.696928024 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:19.816658020 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:19.816734076 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:19.936459064 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:19.966160059 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:20.086088896 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:20.086141109 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:20.205979109 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:20.206056118 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:20.325815916 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:20.327549934 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:20.447302103 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:20.449573040 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:20.569356918 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:20.569433928 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:20.689167976 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:20.689259052 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:20.809001923 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:20.812217951 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:20.932048082 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:20.932141066 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:21.051953077 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:21.053035021 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:21.172950983 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:21.641876936 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:21.761825085 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:21.761882067 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:21.881659031 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:21.881725073 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:22.001486063 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:22.001565933 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:22.121383905 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:22.121534109 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:22.241324902 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:22.241755009 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:22.361547947 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:22.361619949 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:22.481359959 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:22.483256102 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:22.602932930 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:22.603640079 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:22.723436117 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:22.724098921 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:22.844134092 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:22.846050978 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:22.965868950 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:22.966665030 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:23.086431026 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:23.087882996 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:23.207654953 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:23.207726002 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:23.327496052 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:23.327574015 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:23.551137924 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:23.551196098 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:23.790810108 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:24.633915901 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:24.753673077 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:24.753753901 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:24.874768972 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:24.874850035 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:24.994610071 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:25.031002998 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:25.150774002 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:25.151810884 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:25.271754026 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:25.275676012 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:25.395447969 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:25.395592928 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:25.515218973 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:25.515300989 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:25.635162115 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:25.635585070 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:25.755275965 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:25.755331993 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:25.875063896 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:25.875176907 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:25.994966030 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:25.995625019 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:26.115395069 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:26.115674973 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:26.235450029 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:26.235668898 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:26.355442047 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:26.355544090 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:26.475447893 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:26.475529909 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:26.596441031 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:26.596512079 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:26.716439962 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:27.203929901 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:27.323643923 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:27.323710918 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:27.443449974 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:27.443500996 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:27.563477993 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:27.563538074 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:27.683250904 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:27.683336020 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:27.803035021 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:27.858958006 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:27.978662968 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:27.978729963 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:28.098472118 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:28.098563910 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:28.218341112 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:28.218420982 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:28.338138103 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:28.340389013 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:28.460134029 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:28.461422920 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:28.581170082 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:28.581263065 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:28.701009035 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:28.701591969 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:28.821270943 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:28.821584940 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:28.941318989 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:28.941538095 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:29.061255932 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:29.061480999 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:29.181225061 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:29.181375027 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:29.301724911 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:29.301831961 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:29.421736956 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:29.421844006 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:29.541520119 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:29.541631937 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:29.661362886 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:29.661431074 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:29.781227112 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:29.781335115 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:29.901124001 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:29.901223898 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:30.020920992 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:30.021022081 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:30.140714884 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:30.140794992 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:30.260557890 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:30.280112982 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:30.399832964 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:30.399902105 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:30.519645929 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:30.519717932 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:30.639467001 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:30.639590979 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:30.759541988 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:30.759628057 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:30.879395962 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:30.913470030 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:31.033274889 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:31.033396959 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:31.153268099 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:31.153367996 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:31.273108959 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:31.273596048 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:31.393357038 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:31.393687963 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:31.513396978 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:32.015060902 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:32.134788036 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:32.137154102 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:32.256891012 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:32.256942034 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:32.376709938 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:32.376771927 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:32.496896029 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:32.496957064 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:32.617110968 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:32.617223024 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:32.736968994 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:32.737051010 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:32.856714010 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:32.856928110 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:32.976602077 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:32.976677895 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:33.096401930 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:33.096515894 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:33.216187954 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:33.216300011 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:33.335941076 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:33.336210966 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:33.456099987 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:33.457604885 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:33.577680111 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:33.577760935 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:33.697465897 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:33.697593927 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:33.817243099 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:33.817616940 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:33.937309980 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:33.937596083 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:34.057343006 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:34.065588951 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:34.185386896 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:34.185480118 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:34.305259943 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:34.828219891 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:34.947962999 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:34.948020935 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:35.067743063 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:35.067814112 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:35.187509060 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:35.187625885 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:35.307471037 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:35.308072090 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:35.427897930 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:35.428170919 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:35.547947884 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:35.548008919 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:35.667905092 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:35.669656038 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:35.790000916 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:35.791773081 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:35.911550999 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:35.911623001 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:36.031249046 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:36.031728029 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:36.151416063 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:36.151504993 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:36.271584988 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:36.271667957 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:36.494874954 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:36.495121002 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:36.614753962 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:36.617593050 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:36.737533092 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:36.741626978 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:36.861491919 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:36.861569881 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:36.981416941 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:37.574115992 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:37.693955898 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:37.694024086 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:37.814872026 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:37.814932108 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:37.934676886 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:37.934741974 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:38.054514885 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:38.054569960 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:38.175499916 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:38.175580978 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:38.295316935 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:38.447736979 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:38.567627907 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:38.571623087 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:38.691375017 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:38.691618919 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:38.811368942 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:38.811522007 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:38.932792902 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:38.935606003 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:39.055891037 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:39.055993080 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:39.175736904 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:39.175822020 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:39.295588970 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:39.295686007 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:39.415429115 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:39.415502071 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:39.535235882 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:39.535361052 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:39.655355930 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:39.655443907 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:39.775451899 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:39.780965090 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:39.900780916 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:39.900904894 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:40.020792007 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:40.361752033 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:40.481583118 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:40.481705904 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:40.601413965 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:40.601526976 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:40.721232891 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:40.721302986 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:40.841146946 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:40.841273069 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:40.961103916 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:40.961160898 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:41.080951929 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:41.084112883 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:41.203867912 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:41.203959942 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:41.323734999 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:41.325598001 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:41.445372105 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:41.445558071 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:41.565347910 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:41.565598011 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:41.685550928 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:41.686078072 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:41.805847883 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:41.805911064 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:41.925725937 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:41.928896904 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:42.048746109 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:42.049612999 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:42.169466972 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:42.169677973 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:42.289589882 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:42.289691925 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:42.409508944 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:42.409570932 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:42.529416084 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:42.529479027 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:42.649287939 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:42.657646894 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:42.777517080 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:43.138521910 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:43.258382082 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:43.258444071 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:43.378283024 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:43.378376961 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:43.498290062 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:43.498410940 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:43.620347977 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:43.620450974 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:43.740866899 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:43.740943909 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:43.860894918 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:43.860950947 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:43.980961084 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:43.987986088 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:44.108623028 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:44.108707905 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:44.229645014 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:44.229762077 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:44.349745035 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:44.349900961 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:44.473117113 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:44.473197937 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:44.592987061 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:44.593054056 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:44.713145018 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:44.713206053 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:44.832974911 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:44.833127022 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:44.953459978 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:44.953556061 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:45.073355913 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:45.073435068 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:45.194430113 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:45.718492985 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:45.718565941 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:47.734760046 CET	49865	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:49:47.854681015 CET	16299	49865	3.127.138.57	192.168.2.5
Dec 6, 2024 09:49:47.969784021 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:48.089574099 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:48.093692064 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:48.097368002 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:48.218131065 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:48.221657038 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:48.341515064 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:48.576891899 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:48.696789026 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:48.696846962 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:48.816660881 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:48.816718102 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:48.936455011 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:48.936521053 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:49.060348988 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:49.194904089 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:49.314907074 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:49.316446066 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:49.436261892 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:49.436887026 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:49.556631088 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:49.557615042 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:49.678044081 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:49.681665897 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:49.802829981 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:49.805608034 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:49.925785065 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:49.927752018 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:50.047621965 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:50.048815966 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:50.168618917 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:50.168726921 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:50.288497925 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:50.289649010 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:50.410128117 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:50.410284042 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:50.530395985 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:50.530477047 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:50.650412083 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:50.656349897 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:50.776261091 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:50.776324987 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:50.896277905 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:51.349337101 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:51.469249010 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:51.469397068 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:51.589924097 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:51.590095043 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:51.710839987 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:51.710918903 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:51.830765963 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:51.830843925 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:51.950664997 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:52.010672092 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:52.130698919 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:52.130832911 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:52.250564098 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:52.250684977 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:52.370490074 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:52.370685101 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:52.490483046 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:52.493609905 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:52.613456964 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:52.613622904 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:52.733463049 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:52.733635902 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:52.853528023 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:52.853634119 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:52.973563910 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:52.976488113 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:53.096604109 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:53.097596884 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:53.217413902 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:53.217638016 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:53.337474108 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:53.337548018 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:53.457473040 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:53.457602978 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:53.577578068 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:54.114634037 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:54.234687090 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:54.234792948 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:54.356056929 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:54.356133938 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:54.476557970 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:54.476624012 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:54.596457005 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:54.596538067 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:54.716429949 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:54.716600895 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:54.836452007 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:54.836527109 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:54.956414938 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:54.956578016 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:55.076667070 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:55.076750994 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:55.196563959 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:55.196635008 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:55.316412926 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:55.317630053 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:55.437329054 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:55.437441111 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:55.557307959 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:55.557393074 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:55.677263021 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:55.677611113 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:55.797311068 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:55.797605991 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:55.917371035 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:55.917668104 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:56.037427902 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:56.037600040 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:56.183125019 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:56.183202982 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:56.302968979 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:56.371078968 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:56.491108894 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:56.816201925 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:56.936186075 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:56.936508894 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:57.056952000 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:57.057024956 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:57.177088022 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:57.177201986 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:57.296911001 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:57.297146082 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:57.417036057 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:57.417664051 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:57.537554026 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:57.537744999 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:57.659246922 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:57.661524057 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:57.782207966 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:57.782296896 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:57.902056932 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:57.905632019 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:58.025501013 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:58.025669098 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:58.145512104 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:58.145642996 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:58.265428066 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:58.265631914 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:58.385696888 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:58.385839939 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:58.505902052 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:58.506005049 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:58.625816107 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:58.625945091 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:58.745724916 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:58.745805025 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:58.866535902 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:58.899117947 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:59.018992901 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:59.019072056 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:59.139600992 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:59.617774963 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:59.737751961 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:59.737809896 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:59.858095884 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:59.858159065 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:49:59.977968931 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:49:59.978032112 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:00.097965956 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:00.098084927 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:00.217931986 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:00.218004942 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:00.337939978 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:00.339701891 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:00.459475994 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:00.459767103 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:00.579572916 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:00.579710960 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:00.699672937 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:00.701679945 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:00.821542025 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:00.821624041 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:00.941494942 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:00.941574097 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:01.061459064 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:01.061615944 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:01.181457996 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:01.181535959 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:01.301418066 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:01.301673889 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:01.421376944 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:01.421478987 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:01.541327953 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:01.541395903 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:01.661269903 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:01.661412001 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:01.781320095 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:02.354166985 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:02.473937988 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:02.473997116 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:02.593854904 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:02.593938112 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:02.713723898 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:02.713835955 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:02.834991932 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:02.835102081 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:02.954870939 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:02.954940081 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:03.074784040 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:03.074841976 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:03.194674969 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:03.194824934 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:03.314584970 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:03.317667961 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:03.437406063 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:03.437695026 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:03.557362080 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:03.557446003 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:03.677202940 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:03.677545071 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:03.797274113 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:03.797328949 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:03.917155027 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:03.917680025 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:04.037493944 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:04.037623882 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:04.157433987 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:04.157499075 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:04.277239084 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:04.277810097 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:04.397615910 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:04.397675991 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:04.517658949 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:04.519830942 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:04.640846968 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:04.640990019 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:04.760802984 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:05.145618916 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:05.265377998 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:05.265456915 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:05.385272026 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:05.385334015 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:05.505100965 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:05.505188942 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:05.624953985 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:05.625010014 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:05.744606972 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:05.744668007 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:05.864383936 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:05.864476919 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:05.984152079 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:05.984231949 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:06.104171038 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:06.104255915 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:06.224035025 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:06.224143982 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:06.344046116 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:06.345628977 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:06.465491056 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:06.465589046 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:06.585464001 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:06.585659981 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:06.705498934 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:06.705605984 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:06.825372934 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:06.825618982 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:06.945441961 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:06.945624113 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:07.065372944 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:07.065458059 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:07.185290098 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:07.185359001 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:07.305283070 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:07.305345058 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:07.425622940 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:07.429615021 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:07.549571037 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:07.838685989 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:07.958441973 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:07.958503962 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:08.078402996 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:08.081685066 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:08.201713085 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:08.214417934 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:08.334353924 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:08.334415913 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:08.454159021 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:08.457731009 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:08.577470064 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:08.577548981 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:08.697315931 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:08.697722912 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:08.817429066 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:08.817537069 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:08.937196016 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:08.937618017 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:09.057467937 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:09.057658911 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:09.177352905 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:09.177614927 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:09.298357964 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:09.300921917 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:09.420666933 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:09.420779943 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:09.540525913 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:09.541614056 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:09.661417007 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:09.661650896 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:09.781459093 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:09.781652927 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:09.901428938 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:09.901519060 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:10.021306038 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:10.021368980 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:10.141158104 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:10.141613007 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:10.261363029 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:10.261418104 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:10.381347895 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:10.381408930 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:10.501235962 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:10.501319885 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:10.621274948 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:10.674535990 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:10.794394016 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:10.794461012 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:10.914279938 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:10.914333105 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:11.034125090 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:11.034177065 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:11.153965950 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:11.154097080 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:11.274013042 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:11.274137974 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:11.394548893 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:11.394656897 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:11.514404058 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:11.514501095 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:11.634630919 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:11.650150061 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:11.770199060 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:11.770302057 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:11.890357018 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:11.890450954 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:12.010525942 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:12.010658979 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:12.131218910 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:12.131293058 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:12.252031088 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:12.252091885 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:12.374322891 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:12.374438047 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:12.496572018 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:12.496690035 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:12.616540909 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:12.616622925 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:12.736490965 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:12.736572027 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:12.856420040 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:12.856472015 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:12.976239920 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:12.976296902 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:13.096509933 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:13.096632957 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:13.216510057 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:13.216603041 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:13.336365938 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:13.336446047 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:13.456267118 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:13.456343889 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:13.576241970 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:13.576309919 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:13.696058035 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:13.696176052 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:13.815948963 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:13.816066027 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:13.935947895 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:13.936018944 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:14.056181908 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:14.056250095 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:14.176546097 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:14.176603079 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:14.296335936 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:14.296442032 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:14.416218042 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:14.419733047 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:14.541228056 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:14.541378021 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:14.661288977 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:14.693011045 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:14.812881947 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:14.813627958 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:14.933518887 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:14.933612108 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:15.053442001 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:15.053678036 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:15.173639059 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:15.173706055 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:15.293615103 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:15.295816898 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:15.415946960 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:15.416063070 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:15.535887003 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:15.535948038 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:15.655797005 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:15.655890942 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:15.775855064 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:15.776025057 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:15.895958900 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:15.896023989 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:16.016062021 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:16.016136885 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:16.136375904 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:16.136464119 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:16.257071972 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:16.257186890 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:16.377307892 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:16.377420902 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:16.497536898 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:16.497606993 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:16.617444992 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:16.617559910 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:16.737258911 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:16.737329960 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:16.857146978 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:16.857264042 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:16.977169991 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:16.977336884 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:17.097385883 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:17.097456932 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:17.217253923 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:17.217324018 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:17.337832928 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:17.337893963 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:17.457736015 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:17.457840919 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:17.577575922 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:17.577706099 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:17.697909117 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:17.697987080 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:17.817784071 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:17.817907095 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:17.937822104 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:17.937892914 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:18.057722092 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:18.057811975 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:18.177702904 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:18.177774906 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:18.299067020 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:18.321456909 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:18.442395926 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:18.442472935 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:18.562743902 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:18.877003908 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:18.996973991 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:18.997040033 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:19.117006063 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:19.117067099 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:19.236949921 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:19.237090111 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:19.357510090 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:19.357861996 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:19.477715015 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:19.481697083 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:19.601458073 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:19.601553917 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:19.721287012 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:19.721582890 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:19.841372013 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:19.841444969 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:19.961237907 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:19.961704016 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:20.081450939 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:20.081607103 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:20.201509953 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:20.203649998 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:20.323525906 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:20.323903084 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:20.443810940 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:20.443890095 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:20.564344883 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:20.564431906 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:20.684559107 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:20.684648037 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:20.804451942 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:20.804531097 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:20.924316883 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:20.924385071 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:21.044497013 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:21.612181902 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:21.732326031 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:21.732377052 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:21.852142096 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:22.022578955 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:22.142393112 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:22.142502069 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:22.262249947 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:22.262317896 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:22.382173061 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:22.385727882 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:22.505436897 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:22.505665064 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:22.625472069 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:22.625647068 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:22.745343924 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:22.745459080 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:22.865103960 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:22.865663052 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:22.986031055 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:22.986112118 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:23.105824947 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:23.109679937 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:23.230885983 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:23.233668089 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:23.353379011 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:23.353584051 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:23.473449945 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:23.473524094 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:23.593882084 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:23.619822025 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:23.739701986 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:23.739764929 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:23.859601974 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:24.063427925 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:24.183257103 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:24.187989950 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:24.307872057 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:24.442801952 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:24.563364983 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:24.563505888 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:24.683331013 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:24.683422089 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:24.803160906 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:24.803265095 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:24.923299074 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:24.923351049 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:25.043292999 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:25.043392897 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:25.163496017 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:25.163618088 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:25.283641100 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:25.283735991 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:25.403523922 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:25.403816938 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:25.523730993 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:25.524867058 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:25.644721985 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:25.644779921 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:25.764759064 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:25.764866114 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:25.884674072 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:25.885685921 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:26.005485058 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:26.005666018 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:26.125442028 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:26.125644922 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:26.245527983 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:26.245611906 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:26.365428925 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:26.365530014 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:26.485527039 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:26.485586882 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:26.605460882 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:26.605686903 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:26.725423098 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:27.191374063 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:27.311081886 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:27.311141014 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:27.431090117 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:27.431704044 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:27.551424980 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:27.552005053 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:27.671753883 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:27.676186085 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:27.795875072 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:27.795938969 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:27.915863991 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:27.919940948 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:28.039747953 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:28.039839029 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:28.159648895 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:28.159727097 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:28.279511929 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:28.280267000 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:28.399972916 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:28.400053024 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:28.519829988 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:28.520011902 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:28.639847040 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:28.639975071 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:28.759627104 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:28.759701014 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:28.879355907 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:28.879501104 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:28.999286890 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:28.999351025 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:29.119049072 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:29.119208097 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:29.242278099 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:29.242425919 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:29.362982035 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:29.363061905 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:29.482891083 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:29.496923923 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:29.616928101 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:29.617023945 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:29.736871958 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:29.737087011 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:29.857125998 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:29.857367992 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:29.977317095 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:29.977399111 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:30.099678993 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:30.099740028 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:30.219562054 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:30.219633102 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:30.339549065 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:30.339679956 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:30.459481955 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:30.460166931 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:30.580003023 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:30.580089092 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:30.700234890 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:30.702425003 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:30.822283030 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:30.822362900 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:30.942116022 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:30.942322016 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:31.062138081 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:31.062237024 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:31.182024956 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:31.182600975 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:31.302423954 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:31.304338932 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:31.424176931 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:31.424307108 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:31.544229984 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:31.928158998 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:32.048178911 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:32.048325062 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:32.168155909 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:32.168210983 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:32.287982941 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:32.288058996 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:32.449057102 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:32.449719906 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:32.606812000 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:32.606920004 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:32.726655006 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:32.726733923 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:32.846482038 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:32.851563931 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:32.971332073 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:32.973685980 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:33.093677998 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:33.097675085 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:33.217464924 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:33.217660904 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:33.338406086 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:33.338474989 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:33.458127975 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:33.458210945 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:33.578020096 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:33.578154087 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:33.697937965 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:33.698072910 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:33.819215059 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:33.819328070 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:33.939028978 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:33.939089060 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:34.058919907 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:34.058976889 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:34.178673029 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:34.178749084 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:34.298729897 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:34.691715956 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:34.811497927 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:34.811619043 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:34.931308985 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:34.931512117 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:35.051269054 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:35.051335096 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:35.171089888 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:35.171154022 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:35.290810108 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:35.366595984 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:35.486426115 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:35.486505032 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:35.606283903 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:35.609683990 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:35.729326010 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:35.729702950 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:35.849493980 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:35.849682093 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:35.969352961 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:36.003318071 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:36.123233080 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:36.123306990 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:36.243012905 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:36.243803024 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:36.363523960 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:36.363671064 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:36.483480930 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:36.483573914 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:36.603537083 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:36.603622913 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:36.723392010 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:36.723534107 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:36.843487024 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:37.395158052 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:37.514874935 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:37.514936924 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:37.634705067 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:37.634821892 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:37.755759001 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:37.755835056 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:37.875586033 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:37.880136967 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:38.002034903 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:38.002141953 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:38.122138977 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:38.122359037 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:38.242275953 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:38.242453098 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:38.362226963 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:38.362330914 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:38.482219934 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:38.483406067 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:38.603230953 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:38.603324890 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:38.723155975 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:38.723786116 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:38.843573093 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:38.843820095 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:38.963656902 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:38.963766098 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:39.083718061 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:39.083827972 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:39.219007015 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:39.219223976 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:39.338999033 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:39.341658115 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:39.461657047 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:39.461819887 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:39.581715107 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:39.581787109 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:39.701651096 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:39.701740980 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:39.821471930 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:39.821567059 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:39.941442966 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:39.941526890 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:40.061405897 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:40.061534882 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:40.181318998 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:40.181397915 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:40.301192045 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:40.301260948 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:40.421241999 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:40.421356916 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:40.541218996 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:40.541306973 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:40.661154985 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:40.661303997 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:40.781217098 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:40.781294107 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:40.901281118 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:40.901365042 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:41.021298885 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:41.021440029 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:41.141338110 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:41.141426086 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:41.261284113 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:41.261522055 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:41.381371021 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:41.381433010 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:41.501319885 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:41.604469061 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:41.724355936 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:41.724441051 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:41.844252110 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:41.844335079 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:41.968661070 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:41.968792915 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:42.088745117 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:42.088850021 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:42.208789110 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:42.208858967 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:42.328711033 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:42.338253021 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:42.458112001 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:42.458203077 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:42.577934980 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:42.578007936 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:42.698134899 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:42.698200941 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:42.818190098 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:42.818280935 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:42.938236952 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:43.085705996 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:43.205408096 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:43.205492020 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:43.325360060 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:43.325479031 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:43.445214033 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:43.447829008 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:43.567519903 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:43.567819118 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:43.687597990 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:43.687844992 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:43.807768106 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:43.807852030 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:43.927603960 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:43.927778006 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:44.047519922 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:44.047590971 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:44.167547941 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:44.167695999 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:44.287681103 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:44.289012909 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:44.408797026 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:44.408910990 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:44.528626919 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:44.528712034 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:44.648443937 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:44.648519993 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:44.769617081 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:44.769700050 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:44.889820099 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:44.889897108 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:45.009620905 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:45.009726048 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:45.129554987 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:45.129625082 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:45.249453068 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:45.249537945 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:45.369472027 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:45.369616985 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:45.489383936 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:45.489464045 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:45.609287024 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:45.609738111 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:45.730803967 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:45.730871916 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:45.850573063 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:46.327804089 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:46.447583914 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:46.447633982 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:46.567275047 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:46.567392111 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:46.687047005 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:46.687108040 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:46.806885004 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:46.807039022 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:46.926868916 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:46.926933050 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:47.046717882 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:47.046896935 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:47.166763067 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:47.166836977 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:47.286700964 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:47.286786079 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:47.406758070 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:47.409781933 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:47.529808998 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:47.533730030 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:47.653542995 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:47.653628111 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:47.773675919 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:47.773746014 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:47.893528938 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:47.893671036 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:48.013425112 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:48.013676882 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:48.133539915 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:48.133718967 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:48.253597021 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:48.257719994 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:48.377566099 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:48.377670050 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:48.497672081 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:48.497895002 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:48.617724895 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:48.617783070 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:48.737525940 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:49.197315931 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:49.317141056 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:49.317225933 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:49.437077045 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:49.437135935 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:49.556952000 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:49.557069063 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:49.676908016 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:49.677042961 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:49.796961069 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:49.797069073 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:49.916946888 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:49.917041063 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:50.036869049 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:50.036935091 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:50.156706095 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:50.156816959 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:50.277807951 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:50.278007030 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:50.397712946 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:50.397793055 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:50.517563105 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:50.517678976 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:50.637398958 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:50.637473106 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:50.715233088 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:50.715306997 CET	49977	16299	192.168.2.5	18.157.68.73
Dec 6, 2024 09:50:50.757204056 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:50.835117102 CET	16299	49977	18.157.68.73	192.168.2.5
Dec 6, 2024 09:50:52.952507019 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:53.072571039 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:53.072674990 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:53.075799942 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:53.195523977 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:53.195636988 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:53.315332890 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:53.315399885 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:53.435173988 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:53.435904026 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:53.556168079 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:53.556987047 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:53.676660061 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:53.726569891 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:53.846240997 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:53.846304893 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:53.966104984 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:53.967747927 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:54.087518930 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:54.089766026 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:54.209518909 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:54.704801083 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:54.825726032 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:54.825779915 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:54.947532892 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:54.947670937 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:55.067470074 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:55.067691088 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:55.188446045 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:55.188690901 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:55.308425903 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:55.308516026 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:55.428241968 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:55.428335905 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:55.548053026 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:55.551693916 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:55.671369076 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:55.671786070 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:55.791614056 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:55.791830063 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:55.911706924 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:55.911771059 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:56.031703949 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:56.031820059 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:56.152124882 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:56.152445078 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:56.273103952 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:56.275749922 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:56.395632029 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:56.395730972 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:56.515829086 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:56.525263071 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:56.645253897 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:56.645315886 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:56.765305996 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:56.765374899 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:56.885242939 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:56.885380983 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:57.006143093 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:57.006227016 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:57.125989914 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:57.126101971 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:57.247150898 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:57.247260094 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:57.367098093 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:57.367150068 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:57.487004042 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:57.489684105 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:57.609580040 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:57.609684944 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:57.729619980 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:57.749012947 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:57.868962049 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:57.869033098 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:57.989115953 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:57.989201069 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:58.109292030 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:58.109693050 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:58.229450941 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:58.233676910 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:58.353455067 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:58.353543043 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:58.473829031 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:58.473907948 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:58.593794107 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:58.593869925 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:58.713788033 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:58.713895082 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:58.833765984 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:58.833981991 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:58.953871012 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:58.953958035 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:59.073729992 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:59.120883942 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:59.241904974 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:59.241974115 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:59.361737967 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:59.361874104 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:59.481775999 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:59.481987953 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:59.601857901 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:59.601939917 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:59.721951962 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:59.758388042 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:59.878345966 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:59.878427029 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:50:59.998244047 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:50:59.998527050 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:00.118266106 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:00.118452072 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:00.238359928 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:00.238423109 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:00.358244896 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:00.360946894 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:00.480762005 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:00.480834961 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:00.600786924 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:00.600960970 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:00.720837116 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:00.720952988 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:00.841234922 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:00.841331959 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:00.969789028 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:00.969917059 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:01.089812040 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:01.643729925 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:01.763583899 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:01.763644934 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:01.883364916 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:01.883430004 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:02.003130913 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:02.003225088 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:02.123009920 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:02.123151064 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:02.242894888 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:02.242968082 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:02.362685919 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:02.362767935 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:02.482625008 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:02.482697964 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:02.602615118 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:02.605731010 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:02.725572109 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:02.725737095 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:02.845567942 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:02.845747948 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:02.966336012 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:02.968425035 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:03.088324070 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:03.089006901 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:03.208760977 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:03.208842039 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:03.328578949 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:03.329714060 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:03.449568033 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:03.449739933 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:03.569485903 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:03.569554090 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:03.689399958 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:04.349231005 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:04.469084978 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:04.469168901 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:04.589025974 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:04.589108944 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:04.710321903 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:04.713702917 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:04.833518028 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:04.891109943 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:05.011468887 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:05.013763905 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:05.133663893 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:05.134368896 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:05.254379988 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:05.254977942 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:05.374722958 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:05.377681017 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:05.497558117 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:05.497699022 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:05.617877007 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:05.618041039 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:05.737920046 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:05.738018036 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:05.858480930 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:05.858580112 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:05.978442907 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:05.978518963 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:06.098201990 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:06.098351955 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:06.218101978 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:06.218256950 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:06.337946892 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:06.338037968 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:06.457940102 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:07.092398882 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:07.212127924 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:07.212191105 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:07.332097054 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:07.332174063 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:07.492264032 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:07.492331028 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:07.612117052 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:07.613738060 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:07.733766079 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:07.733829021 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:07.853555918 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:07.853705883 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:07.973469019 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:07.973565102 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:08.093535900 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:08.095263958 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:08.215027094 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:08.215735912 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:08.335520029 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:08.337688923 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:08.457485914 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:08.459086895 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:08.578838110 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:08.579015970 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:08.698761940 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:08.698821068 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:08.818690062 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:08.818820000 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:08.938647032 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:08.938782930 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:09.058660984 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:09.058729887 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:09.179116964 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:09.300883055 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:09.421400070 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:09.461100101 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:09.580944061 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:09.890821934 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:10.010814905 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:10.010942936 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:10.130865097 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:10.131122112 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:10.250967979 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:10.251056910 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:10.371049881 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:10.371112108 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:10.490978003 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:10.491055012 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:10.610841036 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:10.610958099 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:10.730685949 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:10.730776072 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:10.850481987 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:10.850591898 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:10.970267057 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:10.970343113 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:11.089987993 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:11.090069056 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:11.209876060 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:11.209955931 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:11.329801083 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:11.330024958 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:11.449878931 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:11.450050116 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:11.569808006 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:11.569894075 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:11.689748049 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:11.689860106 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:11.809732914 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:11.809792042 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:11.929656982 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:12.036412954 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:12.156419992 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:12.156559944 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:12.276479959 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:12.596138954 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:12.716008902 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:12.716069937 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:12.836096048 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:12.836250067 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:12.956146002 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:12.956226110 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:13.076209068 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:13.076353073 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:13.196290016 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:13.196374893 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:13.316303968 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:13.316380024 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:13.436240911 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:13.440809965 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:13.560792923 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:13.561702967 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:13.681649923 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:13.683687925 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:13.803577900 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:13.805743933 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:13.925643921 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:13.925712109 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:14.045530081 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:14.047713041 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:14.167577028 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:14.169723034 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:14.289572001 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:14.289704084 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:14.409535885 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:14.409681082 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:14.529524088 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:14.529603004 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:14.649439096 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:14.649507999 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:14.769265890 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:14.832948923 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:14.952811003 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:15.252316952 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:15.372208118 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:15.436455011 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:15.556251049 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:15.556318998 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:15.676275969 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:15.676338911 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:15.796174049 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:16.042149067 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:16.162141085 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:16.162215948 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:16.281960011 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:16.282140017 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:16.402055025 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:16.402206898 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:16.521986008 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:16.524686098 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:16.644450903 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:16.652636051 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:16.772648096 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:16.772733927 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:16.892518997 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:16.895842075 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:17.015662909 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:17.016040087 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:17.135952950 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:17.136475086 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:17.256329060 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:17.256419897 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:17.376163006 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:17.376255989 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:17.496104002 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:17.496198893 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:17.616796017 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:17.616940022 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:17.736793995 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:17.736917973 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:17.856687069 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:17.856749058 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:17.976490021 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:17.976572037 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:18.096681118 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:18.096755028 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:18.336345911 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:18.336492062 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:18.456408024 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:18.456563950 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:18.576385021 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:18.576471090 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:18.696471930 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:18.696540117 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:18.816392899 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:18.816539049 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:18.936321020 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:18.936479092 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:19.056399107 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:19.056487083 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:19.176278114 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:19.176351070 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:19.297750950 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:19.297816038 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:19.417758942 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:19.417896986 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:19.537687063 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:19.541786909 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:19.661631107 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:19.663558960 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:19.783421040 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:19.784643888 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:19.904397964 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:19.904459000 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:20.024286032 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:20.024996996 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:20.144829988 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:20.145757914 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:20.265582085 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:20.265700102 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:20.385454893 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:20.385698080 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:20.505486965 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:20.505562067 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:20.625312090 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:20.625400066 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:20.745414019 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:20.745520115 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:20.865514994 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:20.865744114 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:20.985589981 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:20.985673904 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:21.106234074 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:21.106326103 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:21.226316929 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:21.226387024 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:21.346293926 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:21.346383095 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:21.466169119 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:21.466243029 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:21.586281061 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:21.587289095 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:21.707057953 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:21.762196064 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:21.882714987 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:21.882817030 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:22.002731085 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:22.002821922 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:22.122800112 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:22.124326944 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:22.244157076 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:22.244242907 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:22.364140034 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:22.365724087 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:22.485743046 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:22.485874891 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:22.605807066 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:22.605885983 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:22.725651979 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:22.725820065 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:22.845953941 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:22.846041918 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:22.970184088 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:22.970350027 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:23.090130091 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:23.090415001 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:23.210324049 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:23.210427046 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:23.330517054 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:23.330598116 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:23.450428009 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:23.450493097 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:23.570173025 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:23.939428091 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:24.059240103 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:24.060237885 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:24.180183887 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:24.427457094 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:24.547271967 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:24.549737930 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:24.669553995 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:24.919795990 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:25.039683104 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:25.041129112 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:25.161022902 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:25.311361074 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:25.431245089 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:25.432873964 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:25.552615881 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:25.552756071 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:25.672493935 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:25.672574043 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:25.793339968 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:25.793405056 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:25.913203955 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:25.913259983 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:26.033034086 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:26.033174992 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:26.152911901 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:26.152976990 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:26.273237944 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:26.273300886 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:26.393167973 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:26.393274069 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:26.513082027 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:26.617136002 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:26.736979008 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:26.737044096 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:26.856939077 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:26.857098103 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:26.976857901 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:26.977025986 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:27.098998070 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:27.099163055 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:27.219186068 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:27.219259024 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:27.339241028 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:27.339293003 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:27.460037947 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:27.460131884 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:27.580382109 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:27.580476999 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:27.700351000 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:27.700459957 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:27.820682049 CET	16299	49978	3.127.138.57	192.168.2.5
Dec 6, 2024 09:51:27.820775986 CET	49978	16299	192.168.2.5	3.127.138.57
Dec 6, 2024 09:51:27.940722942 CET	16299	49978	3.127.138.57	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 09:47:37.414025068 CET	59163	53	192.168.2.5	1.1.1.1
Dec 6, 2024 09:47:37.911210060 CET	53	59163	1.1.1.1	192.168.2.5
Dec 6, 2024 09:48:42.720762968 CET	60727	53	192.168.2.5	1.1.1.1
Dec 6, 2024 09:48:42.949074030 CET	53	60727	1.1.1.1	192.168.2.5
Dec 6, 2024 09:49:47.736398935 CET	56313	53	192.168.2.5	1.1.1.1
Dec 6, 2024 09:49:47.968624115 CET	53	56313	1.1.1.1	192.168.2.5
Dec 6, 2024 09:50:52.719913006 CET	64977	53	192.168.2.5	1.1.1.1
Dec 6, 2024 09:50:52.948474884 CET	53	64977	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 09:47:37.414025068 CET	192.168.2.5	1.1.1.1	0x27cf	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:48:42.720762968 CET	192.168.2.5	1.1.1.1	0x1950	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:49:47.736398935 CET	192.168.2.5	1.1.1.1	0xd481	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:50:52.719913006 CET	192.168.2.5	1.1.1.1	0x32	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 09:47:37.911210060 CET	1.1.1.1	192.168.2.5	0x27cf	No error (0)	2.tcp.eu.ngrok.io	3.126.37.18	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:48:42.949074030 CET	1.1.1.1	192.168.2.5	0x1950	No error (0)	2.tcp.eu.ngrok.io	3.127.138.57	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:49:47.968624115 CET	1.1.1.1	192.168.2.5	0xd481	No error (0)	2.tcp.eu.ngrok.io	18.157.68.73	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:50:52.948474884 CET	1.1.1.1	192.168.2.5	0x32	No error (0)	2.tcp.eu.ngrok.io	3.127.138.57	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:47:19
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe"
Imagebase:	0x10000
File size:	2'388'170 bytes
MD5 hash:	E4631D6E2FEE44DE27D84AFF1CE7C7A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000003.2084844156.0000000006BD3000.00000004.00000020.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:47:20
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\NjRAT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NjRAT.exe"
Imagebase:	0x10000
File size:	37'888 bytes
MD5 hash:	5C02E4B0AD99D924AA9EED7D706BFE12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000002.00000000.2090189709.0000000000012000.00000002.00000001.01000000.00000009.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\Desktop\NjRAT.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\Desktop\NjRAT.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\Desktop\NjRAT.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\Desktop\NjRAT.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:47:20
Start date:	06/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff7a2c50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:47:27
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\svchost.exe"
Imagebase:	0x5f0000
File size:	37'888 bytes
MD5 hash:	5C02E4B0AD99D924AA9EED7D706BFE12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000004.00000002.4555101041.0000000003281000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\svchost.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\svchost.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Local\Temp\svchost.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\svchost.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:47:34
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:47:34
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:47:34
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM ProcessHacker.exe
Imagebase:	0x690000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:47:34
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:47:42
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\svchost.exe" ..
Imagebase:	0xa70000
File size:	37'888 bytes
MD5 hash:	5C02E4B0AD99D924AA9EED7D706BFE12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:47:50
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\svchost.exe" ..
Imagebase:	0x660000
File size:	37'888 bytes
MD5 hash:	5C02E4B0AD99D924AA9EED7D706BFE12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:47:59
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\svchost.exe" ..
Imagebase:	0xa20000
File size:	37'888 bytes
MD5 hash:	5C02E4B0AD99D924AA9EED7D706BFE12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.9%
Total number of Nodes:	1560
Total number of Limit Nodes:	35

Executed Functions

Function 0002D891 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000203AA: GetModuleHandleW.KERNEL32(kernel32), ref: 000203BF
Part of subcall function 000203AA: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 000203D1
Part of subcall function 000203AA: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00020402

Part of subcall function 0002A004: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0002A00C

Part of subcall function 0002A5C6: OleInitialize.OLE32(00000000), ref: 0002A5DF
Part of subcall function 0002A5C6: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0002A616
Part of subcall function 0002A5C6: SHGetMalloc.SHELL32(00058430), ref: 0002A620

Part of subcall function 000216CB: GetCPInfo.KERNEL32(00000000,?), ref: 000216DC
Part of subcall function 000216CB: IsDBCSLeadByte.KERNEL32(00000000), ref: 000216F0

GetCommandLineW.KERNEL32 ref: 0002D8D9
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0002D900
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0002D911
UnmapViewOfFile.KERNEL32(00000000), ref: 0002D94B

Part of subcall function 0002D544: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0002D55A
Part of subcall function 0002D544: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0002D596

CloseHandle.KERNEL32(00000000), ref: 0002D954
GetModuleFileNameW.KERNEL32(00000000,0006DC90,00000800), ref: 0002D96F
SetEnvironmentVariableW.KERNEL32(sfxname,0006DC90), ref: 0002D97B
GetLocalTime.KERNEL32(?), ref: 0002D986
_swprintf.LIBCMT ref: 0002D9C5
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0002D9D7
GetModuleHandleW.KERNEL32(00000000), ref: 0002D9DE
LoadIconW.USER32(00000000,00000064), ref: 0002D9F5
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B170,00000000), ref: 0002DA46
Sleep.KERNEL32(?), ref: 0002DA74
DeleteObject.GDI32 ref: 0002DAAD
DeleteObject.GDI32(?), ref: 0002DABD
CloseHandle.KERNEL32 ref: 0002DB00

Strings

winrarsfxmappingfile.tmp, xrefs: 0002D8F4
sfxstime, xrefs: 0002D9D2
C:\Users\user\Desktop, xrefs: 0002D8A6
sfxname, xrefs: 0002D976
STARTDLG, xrefs: 0002DA3B
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0002D9B6

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 788466649-2656992072
Opcode ID: b62f522c1396d6cb0a2ed59933666d8191a65f38f5c1478308c7ff2b5a390f34
Instruction ID: 9b04ab7e8042802a07fd2c30529d799e05d59e9cba6af99db603e0c1a72cbecf
Opcode Fuzzy Hash: b62f522c1396d6cb0a2ed59933666d8191a65f38f5c1478308c7ff2b5a390f34
Instruction Fuzzy Hash: 1D61D3B5904360AFE321AB74FC49F6B77ECAB45705F04042AF945A61A2DFBC8D44CB62

Function 0002A07C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(0002B0DD,PNG,?,?,?,0002B0DD,00000066), ref: 0002A08E
SizeofResource.KERNEL32(00000000,00000000,?,?,?,0002B0DD,00000066), ref: 0002A0A6
LoadResource.KERNEL32(00000000,?,?,?,0002B0DD,00000066), ref: 0002A0B9
LockResource.KERNEL32(00000000,?,?,?,0002B0DD,00000066), ref: 0002A0C4
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0002B0DD,00000066), ref: 0002A0E2
GlobalLock.KERNEL32(00000000), ref: 0002A0F3
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 0002A117
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0002A15C
GlobalUnlock.KERNEL32(00000000), ref: 0002A17B
GlobalFree.KERNEL32(00000000), ref: 0002A182

Strings

PNG, xrefs: 0002A07F

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: c3ca661d882f2d1337e59b840a19896f031f20fd578155262eefbe5bd1ad94e8
Instruction ID: e033feec4f54d788574243153e6f4e36b14a0ad108fcca8fa1e5245f1de8832e
Opcode Fuzzy Hash: c3ca661d882f2d1337e59b840a19896f031f20fd578155262eefbe5bd1ad94e8
Instruction Fuzzy Hash: DB31C4B5200726AFE7119F21ED49E2BBBACFF86761F100528F905D2260EF35DC10CA65

Function 0001A7E7 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0001A6E2,000000FF,?,?), ref: 0001A81B
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0001A6E2,000000FF,?,?), ref: 0001A851
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0001A6E2,000000FF,?,?), ref: 0001A85D
FindNextFileW.KERNEL32(?,?,?,?,?,?,0001A6E2,000000FF,?,?), ref: 0001A885
GetLastError.KERNEL32(?,?,?,?,0001A6E2,000000FF,?,?), ref: 0001A891

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 4234bf41d09034959c421dc704661fb9f001979369d43dcb45238e705838b1a1
Instruction ID: 9217c108ff2107750152df7fb74bcfed0b787c00512ffe0aea25d4a9459f3fac
Opcode Fuzzy Hash: 4234bf41d09034959c421dc704661fb9f001979369d43dcb45238e705838b1a1
Instruction Fuzzy Hash: 7841A676605281AFC364EF74C884ADAF7E8BF49340F000A2AF599D3201D774A995CB92

Function 0003780E Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,000377E4,?,0004BAD8,0000000C,0003793B,?,00000002,00000000), ref: 0003782F
TerminateProcess.KERNEL32(00000000,?,000377E4,?,0004BAD8,0000000C,0003793B,?,00000002,00000000), ref: 00037836
ExitProcess.KERNEL32 ref: 00037848

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2a1b54f889933ed4c66d1df9a060da32a355aef2b5f49b69b3ea85bbf72c4b02
Instruction ID: be3714bf3ccb795d57d343f2b8794c22f514d20d9de5d23e91a0cbffee815741
Opcode Fuzzy Hash: 2a1b54f889933ed4c66d1df9a060da32a355aef2b5f49b69b3ea85bbf72c4b02
Instruction Fuzzy Hash: A5E04FB9140104ABDF126F54DE0CA887FAEEF06741F004020F9084A133CB39DE42CA84

Function 00018709 Relevance: 3.9, APIs: 2, Instructions: 948COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0001870E
_memcmp.LIBVCRUNTIME ref: 00018B96

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: dd7b54356c73a4df21a3844ad18a3992e648bdeb58232e6ae56eae6fd6c7bb77
Instruction ID: 5da0f0fa3c0b40bb680b93cecdbe4eb1bc6a44bde7f4d104d3832cdad906b73c
Opcode Fuzzy Hash: dd7b54356c73a4df21a3844ad18a3992e648bdeb58232e6ae56eae6fd6c7bb77
Instruction Fuzzy Hash: 6C82F930904285AEDF65DB60C895BFEB7F9AF05300F0881BAE9599B183DB315BC5CB61

Function 00026887 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3c5fcad5c3ca5a7061284cbbb2fc9a863743897c87c0e39b80888418f6e0e438
Instruction ID: 7ee8bf88994eac70e4cc03937a54e49adb9e2deb42abc5059e07d0a95cb1d8bf
Opcode Fuzzy Hash: 3c5fcad5c3ca5a7061284cbbb2fc9a863743897c87c0e39b80888418f6e0e438
Instruction Fuzzy Hash: 0FD126B1A043518FCB14CF28E8817ABBBE4FF85308F04456DE8859B242D735E958CBDA

Function 0002B170 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 725COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0002B175

Part of subcall function 0001130B: GetDlgItem.USER32(00000000,00003021), ref: 0001134F
Part of subcall function 0001130B: SetWindowTextW.USER32(00000000,000435B4), ref: 00011365

Strings

winrarsfxmappingfile.tmp, xrefs: 0002B54D
__tmp_rar_sfx_access_check_%u, xrefs: 0002B45C
<, xrefs: 0002B52B
C:\Users\user\Desktop, xrefs: 0002B570
STARTDLG, xrefs: 0002B194
@, xrefs: 0002B538
"%s"%s, xrefs: 0002B6B4
-el -s2 "-d%s" "-sp%s", xrefs: 0002B512
LICENSEDLG, xrefs: 0002BA02

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-3472986185
Opcode ID: 203f61adfea2c85b9205134fd51ad0d846fba0183908ccff3c2517790ebc1a6c
Instruction ID: 422aedff7590a221ff5c89964f199e50e5e5f462732891a818ee1934991ce44b
Opcode Fuzzy Hash: 203f61adfea2c85b9205134fd51ad0d846fba0183908ccff3c2517790ebc1a6c
Instruction Fuzzy Hash: 2742C370944364AEFB21ABA0EC4AFFF7BBCAB05701F404154FA45B6192CBBC5984CB61

Function 000203AA Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 000203BF
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 000203D1
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00020402
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 000206AF
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000206CB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 000206DD
ReadFile.KERNEL32(00000000,?,00007FFE,00043BA4,00000000), ref: 000206FC
CloseHandle.KERNEL32(00000000), ref: 00020754
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0002076A
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 000207C2
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 000207EB
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 00020825

Part of subcall function 00020360: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0002037B
Part of subcall function 00020360: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0001EE61,Crypt32.dll,00000000,0001EEE5,?,?,0001EEC7,?,?,?), ref: 0002039D

_swprintf.LIBCMT ref: 00020899
_swprintf.LIBCMT ref: 000208E5

Part of subcall function 00013F8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00013FA2

AllocConsole.KERNEL32 ref: 000208ED
GetCurrentProcessId.KERNEL32 ref: 000208F7
AttachConsole.KERNEL32(00000000), ref: 000208FE
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00020924
WriteConsoleW.KERNEL32(00000000), ref: 0002092B
Sleep.KERNEL32(00002710), ref: 00020936
FreeConsole.KERNEL32 ref: 0002093C
ExitProcess.KERNEL32 ref: 00020944

Strings

Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 000208D3
kernel32, xrefs: 000203B8
SetDllDirectoryW, xrefs: 000203CB
DXGIDebug.dll, xrefs: 00020444, 000207AE
uxtheme.dll, xrefs: 00020866
SetDefaultDllDirectories, xrefs: 000203FC
dwmapi.dll, xrefs: 0002046F, 0002085C

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: bc6d3af890177a17dcafca00afcd76bcf1daa307ff5f8fa91075e9da7175863f
Instruction ID: 384861d3ad31e1e57778218c54ac204c1f0f2884a64632592433d982e18b034a
Opcode Fuzzy Hash: bc6d3af890177a17dcafca00afcd76bcf1daa307ff5f8fa91075e9da7175863f
Instruction Fuzzy Hash: 61D171F1508394ABD330DF50E849BDFBBE8FB85704F50192CF68996151CBB89648CB6A

Function 0001D601 Relevance: 21.6, APIs: 3, Strings: 9, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0001D606
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,0001D5E8,?), ref: 0001D642
__fprintf_l.LIBCMT ref: 0001DB33

Part of subcall function 00021692: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0001B842,00000000,?,?,?,0001047C), ref: 000216AE

Strings

*messages***, xrefs: 0001D75A
$%s:, xrefs: 0001DB16
,, xrefs: 0001DB6E
*messages***, xrefs: 0001D793
R, xrefs: 0001D7A5
RTL, xrefs: 0001DAF8
a, xrefs: 0001D7AF
@%s:, xrefs: 0001DB1D, 0001DB29
, xrefs: 0001D93A

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 1867786338-980926923
Opcode ID: 129298566ef5d657ac7d3c40810d07fffff2ac3f005bac0d023854dadca161a3
Instruction ID: 5f883725c4a2a92790a5a659ec03d1e342910991e7dba149d53dcd26aa0cbd6c
Opcode Fuzzy Hash: 129298566ef5d657ac7d3c40810d07fffff2ac3f005bac0d023854dadca161a3
Instruction Fuzzy Hash: 1B12C3B1900319AADF25DFA4DC95BEEB7B5FF14300F10456AF505A7192EB709A80CB64

Function 0002CE1E Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0002AF04: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0002AF15
Part of subcall function 0002AF04: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0002AF26
Part of subcall function 0002AF04: IsDialogMessageW.USER32(0001047C,?), ref: 0002AF3A
Part of subcall function 0002AF04: TranslateMessage.USER32(?), ref: 0002AF48
Part of subcall function 0002AF04: DispatchMessageW.USER32(?), ref: 0002AF52

GetDlgItem.USER32(00000068,0006ECB0), ref: 0002CE32
ShowWindow.USER32(00000000,00000005,?,?,?,0002A8C2,00000001,?,?,0002B15B,00044F88,0006ECB0,0006ECB0,00001000,00000000,00000000), ref: 0002CE5A
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0002CE65
SendMessageW.USER32(00000000,000000C2,00000000,000435B4), ref: 0002CE73
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0002CE89
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0002CEA3
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0002CEE7
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0002CEF5
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0002CF04
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0002CF2B
SendMessageW.USER32(00000000,000000C2,00000000,0004431C), ref: 0002CF3A

Strings

\, xrefs: 0002CE93

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 6677bd826da328c55c83e8adf17351ff11cd6227dd6244a3be2141dd05bdc0b1
Instruction ID: 599fd3a281ee58bf4e36d4c90d08d4df2ade56e2b0a1c30569fc75a1539118cd
Opcode Fuzzy Hash: 6677bd826da328c55c83e8adf17351ff11cd6227dd6244a3be2141dd05bdc0b1
Instruction Fuzzy Hash: 0231F471145740BFF3119F20EC49FAF7FACFBA2705F400518FA41A61A1CB6C59448BA6

Function 0002D0DF Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0002D211
ShowWindow.USER32(?,00000000), ref: 0002D250
GetExitCodeProcess.KERNEL32(?,?), ref: 0002D28C
CloseHandle.KERNELBASE(?), ref: 0002D2B2
ShowWindow.USER32(?,00000001), ref: 0002D341

Part of subcall function 00021AC4: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0001B250,?,?,?,0001B1FE,?,-00000002,?,00000000,?), ref: 00021ADA

Strings

.exe, xrefs: 0002D2BC
.inf, xrefs: 0002D1CD
, xrefs: 0002D15F

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 267c7cee14330b5a2752b581b88dfe34306e26a1d17323165375bec3841ef004
Instruction ID: b39f56268d4ca021a9837597e90a0d3b5aa61beb092674e3613af20b2e60ecf5
Opcode Fuzzy Hash: 267c7cee14330b5a2752b581b88dfe34306e26a1d17323165375bec3841ef004
Instruction Fuzzy Hash: 9B61A2705043E0ABE771DF14E904AABBBF9AF91304F04481BE5C497152D7B9CD89CB92

Function 0003A368 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0003526B,0003526B,?,?,?,0003A5B9,00000001,00000001,8FE85006), ref: 0003A3C2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0003A5B9,00000001,00000001,8FE85006,?,?,?), ref: 0003A448
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0003A542
__freea.LIBCMT ref: 0003A54F

Part of subcall function 00038838: RtlAllocateHeap.NTDLL(00000000,?,?,?,00033CF6,?,0000015D,?,?,?,?,000351D2,000000FF,00000000,?,?), ref: 0003886A

__freea.LIBCMT ref: 0003A558
__freea.LIBCMT ref: 0003A57D

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 8e004413f7a64ad8040a8504fdd549291550d80482e59053dfb303d0920ffd04
Instruction ID: 406354df4dda31c7c64fcff37a8f85a9db18520007e04e57bfa2f6f01f4c6ba0
Opcode Fuzzy Hash: 8e004413f7a64ad8040a8504fdd549291550d80482e59053dfb303d0920ffd04
Instruction Fuzzy Hash: A051DD72B00616AFEF268F64CC45EAF7BADEB46750F154628FC45D6181EB34DC80C662

Function 0002A558 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0002A56F
SHAutoComplete.SHLWAPI(?,00000010), ref: 0002A5A6

Part of subcall function 00021AC4: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0001B250,?,?,?,0001B1FE,?,-00000002,?,00000000,?), ref: 00021ADA

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0002A596

Strings

EDIT, xrefs: 0002A57A, 0002A585, 0002A592
@Ut, xrefs: 0002A5A6

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @Ut$EDIT
API String ID: 4243998846-2065656831
Opcode ID: c4f31249c3ce517d180879aa817d4eee3e06035a94b361c71fd7e4b50fbd300c
Instruction ID: f67fa1818bc6a54b36915d1023b57b0bfad9755debb754f0ce19c9859d1d16b9
Opcode Fuzzy Hash: c4f31249c3ce517d180879aa817d4eee3e06035a94b361c71fd7e4b50fbd300c
Instruction Fuzzy Hash: EDF08932B4173867E7305665AC05FDB76AC9B46B10F050155BD08B6181D7689A41C5F6

Function 0002A5C6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00020360: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0002037B
Part of subcall function 00020360: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0001EE61,Crypt32.dll,00000000,0001EEE5,?,?,0001EEC7,?,?,?), ref: 0002039D

OleInitialize.OLE32(00000000), ref: 0002A5DF
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0002A616
SHGetMalloc.SHELL32(00058430), ref: 0002A620

Strings

riched20.dll, xrefs: 0002A5CE
3so, xrefs: 0002A5F7

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3so
API String ID: 3498096277-1543193245
Opcode ID: 392bb22d5331bbed1ba3cfab83bdf7939647ed8304fe59bbf85de3384d4800dd
Instruction ID: 2316e96915dce6673d153459ac2d2004ddcaa76f168582e3a0156f00e37803cc
Opcode Fuzzy Hash: 392bb22d5331bbed1ba3cfab83bdf7939647ed8304fe59bbf85de3384d4800dd
Instruction Fuzzy Hash: 3DF0FFB1D0021DABDB10AF99D8499EFFBFCEF54715F00415AE914E2201DBB856458BA1

Function 00019B50 Relevance: 7.6, APIs: 5, Instructions: 117
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,0001797C,?,00000005,?,00000011), ref: 00019BEC
GetLastError.KERNEL32(?,?,0001797C,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00019BF9
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,0001797C,?,00000005,?), ref: 00019C2E
GetLastError.KERNEL32(?,?,0001797C,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00019C36
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,0001797C,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00019C7B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 7d004797deab1519b540e3539f1af22df3e06f9120eb2a37624df2e56c79e669
Instruction ID: 5d14a28c4de0e28c4157df1538530e9e63028cf2239785d680cdc5bee2af4d82
Opcode Fuzzy Hash: 7d004797deab1519b540e3539f1af22df3e06f9120eb2a37624df2e56c79e669
Instruction Fuzzy Hash: 494163309487426BE7308F24DD5ABDABBE0BB05324F200719F9E5821D1D3B8A8C8CBD5

Function 00039339 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00038C7F,0003891B,?,000392E3,00000001,00000364,?,00033B5F,?,?,00050F50), ref: 0003933E
_free.LIBCMT ref: 00039373
_free.LIBCMT ref: 0003939A
SetLastError.KERNEL32(00000000,?,00050F50), ref: 000393A7
SetLastError.KERNEL32(00000000,?,00050F50), ref: 000393B0

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 6844ee1f9e3e4ce5a5484f756d7b8a73616d00727942b19b846d5d1d0a341e83
Instruction ID: 32afd6fa0ba71c92f8ba2bd199c6457e2ff8ed0469d3ba26ef465a3cc9c86f6a
Opcode Fuzzy Hash: 6844ee1f9e3e4ce5a5484f756d7b8a73616d00727942b19b846d5d1d0a341e83
Instruction Fuzzy Hash: 7B01F9F66457003A93233775BD85B5B26AD9BC33B0F310125F645A21D3DEB98A015129

Function 0002AF04 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0002AF15
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0002AF26
IsDialogMessageW.USER32(0001047C,?), ref: 0002AF3A
TranslateMessage.USER32(?), ref: 0002AF48
DispatchMessageW.USER32(?), ref: 0002AF52

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 9059489ffb6b265aed647b7798e1e3ffab66886350d56680912cabd82be744e9
Instruction ID: feaeb60e64daada3e2acb4bd311b6a42041960dd03b4cbceb9437d2ea4c57992
Opcode Fuzzy Hash: 9059489ffb6b265aed647b7798e1e3ffab66886350d56680912cabd82be744e9
Instruction Fuzzy Hash: C2F01DB1E01229AB9B209BE2AC4CDEB7FBCEF062517408415B909E2101EA2CD445CBF1

Function 0002D544 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0002D55A
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0002D596

Strings

sfxcmd, xrefs: 0002D555
sfxpar, xrefs: 0002D591

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 85902b43ee386358a47f6021198de15d535328cce2db802dcd07c9eb72a01407
Instruction ID: e0b3f0e46e725289d9e66f34e5faf02e31984981cf0d4ee316b0a4ad306c2e75
Opcode Fuzzy Hash: 85902b43ee386358a47f6021198de15d535328cce2db802dcd07c9eb72a01407
Instruction Fuzzy Hash: CBF0A7B2800638B7D7205F949C09BFA77D8AF15B41B000166FD4496153D6B18D80DAE4

Function 0001A49E Relevance: 6.1, APIs: 4, Instructions: 127
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,0001823A,?,?,?), ref: 0001A544
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000000,?,0001823A,?), ref: 0001A588
SetFileTime.KERNELBASE(?,00000800,?,00000000,?,?,00000000,?,0001823A,?,?,?,?,?,?,?), ref: 0001A609
CloseHandle.KERNEL32(?,?,?,00000000,?,0001823A,?,?,?,?,?,?,?,?,?,?), ref: 0001A610

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6bc8ea782f88d94d5584a2695c7ed4b2d6be3537b65a09a176b078589c22f4cd
Instruction ID: a4c9c036cd63014b764f6e499086bbb76e7de517de011e764451b8fcbae1bcdd
Opcode Fuzzy Hash: 6bc8ea782f88d94d5584a2695c7ed4b2d6be3537b65a09a176b078589c22f4cd
Instruction Fuzzy Hash: 0E41FD30249381AAE731DE24DC55FEFBBE8AF86700F08091DF5D593181D6A89A88DB53

Function 000199EE Relevance: 6.1, APIs: 4, Instructions: 57fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 000199FE
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00019A16
GetLastError.KERNEL32 ref: 00019A48
GetLastError.KERNEL32 ref: 00019A67

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: e77e144640631bd3a6ea072d196feaec0c48f4c1dfe9a42e4021d6c25ecd034f
Instruction ID: 344b971547119be380113922b7f255e63af212ee4794b21a91d6496381da9999
Opcode Fuzzy Hash: e77e144640631bd3a6ea072d196feaec0c48f4c1dfe9a42e4021d6c25ecd034f
Instruction Fuzzy Hash: 37117035500104ABDB649B90D925AF93BE8FF01761F908229F86A85190D7769E889FD2

Function 0003A804 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00033B5F,00000000,00000000,?,0003A7AB,00033B5F,00000000,00000000,00000000,?,0003A9A8,00000006,FlsSetValue), ref: 0003A836
GetLastError.KERNEL32(?,0003A7AB,00033B5F,00000000,00000000,00000000,?,0003A9A8,00000006,FlsSetValue,00047348,00047350,00000000,00000364,?,00039387), ref: 0003A842
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0003A7AB,00033B5F,00000000,00000000,00000000,?,0003A9A8,00000006,FlsSetValue,00047348,00047350,00000000), ref: 0003A850

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 0d27a3064fe7cbed66b25e4aa33efc6da0cbe40ad13bbdc7e23cdf1b0453d02e
Instruction ID: 20485acc72e01c99d19f2c9ba306723568fe19d179b43b7f9240ef546cf5a81d
Opcode Fuzzy Hash: 0d27a3064fe7cbed66b25e4aa33efc6da0cbe40ad13bbdc7e23cdf1b0453d02e
Instruction Fuzzy Hash: 1C01FC767012229BD7324B79AC44A56BB9CAF077A1F200624FD46D7190DB25D90286D5

Function 00020B64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_00010CA0,?,00000000,00000000), ref: 00020B88
SetThreadPriority.KERNEL32(?,00000000), ref: 00020BCF

Part of subcall function 00016E68: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00016E86

Strings

CreateThread failed, xrefs: 00020B94

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: e7feb99b36bec210162005a267008a365480b37f13b26286d6e57611b9673c47
Instruction ID: 586adb2a3c27e725ddba2ab084a5e3cb720415d5b072e09abb91d399a6b2d595
Opcode Fuzzy Hash: e7feb99b36bec210162005a267008a365480b37f13b26286d6e57611b9673c47
Instruction Fuzzy Hash: 7801F9B63443156FE7355F54FD86FA773E8EB44716F20063DFA46A6182CBE1A8408724

Function 0001A0CF Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,0001CE98,00000001,?,?,?,00000000,0002510E,?,?,?), ref: 0001A0EC
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,0002510E,?,?,?,?,?,00024BB3,?), ref: 0001A12E
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,0001CE98,00000001,?,?), ref: 0001A158

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 0325ec508860a0e244b81f3aa7ff4bea3cb61244c00e629191fcef1225f73bb7
Instruction ID: c7b0850ffd7d0437769cc8802e46b281ef006961d24a17c67e69ee891311cf3b
Opcode Fuzzy Hash: 0325ec508860a0e244b81f3aa7ff4bea3cb61244c00e629191fcef1225f73bb7
Instruction Fuzzy Hash: 9631E371309305AFDB218F24DD48BAABBE8EB56710F044519F9459B181CB75DD88CBB3

Function 0001A3FA Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0001A2B3,?,00000001,00000000,?,?), ref: 0001A421
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0001A2B3,?,00000001,00000000,?,?), ref: 0001A454
GetLastError.KERNEL32(?,?,?,?,0001A2B3,?,00000001,00000000,?,?), ref: 0001A471

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 204d55339a8eb1844f60e6673cb30a86c449f26bd3801207f732a307d1ea4ab2
Instruction ID: 76d7c2e652856891bbd2b7ed7bbe1efcd33ea431bcc2f6bbcc7dcbfa609c610f
Opcode Fuzzy Hash: 204d55339a8eb1844f60e6673cb30a86c449f26bd3801207f732a307d1ea4ab2
Instruction Fuzzy Hash: 0201B17530226467EBB1AAA4AC0EBEE739CAF47740F088441F941D6092C7A8C9C186A7

Function 0003B303 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0003B328

Strings

, xrefs: 0003B36D

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 421bc5b07e6783d45910f3b5332b23947e2b2c17254df7ce28d23282f5a6a196
Instruction ID: 62fcb8cedeb185f1696b72a59fe9eacdfd5fc7cc9faef8335ecd2eb7ada243c7
Opcode Fuzzy Hash: 421bc5b07e6783d45910f3b5332b23947e2b2c17254df7ce28d23282f5a6a196
Instruction Fuzzy Hash: C941F9B050439C9EDB238E24CC85BFABBEDEB55308F1404EDE69A86143D735AA45DF24

Function 0003AA3C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,8FE85006,00000001,?,000000FF), ref: 0003AAAD

Strings

LCMapStringEx, xrefs: 0003AA4D, 0003AA57

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 9f3d114f440b321da6ccc7b6af1c6a044a0880668f07db7dc098e4b538a4941d
Instruction ID: 3edc3cdca6a426c075f94e30c6ed5ccbf6f2d47cea10bb4f9368e8a64671fec7
Opcode Fuzzy Hash: 9f3d114f440b321da6ccc7b6af1c6a044a0880668f07db7dc098e4b538a4941d
Instruction Fuzzy Hash: 4C01257664421DBBCF029FA0DE02DEE7F6AEF09760F018114FE0829161C7768A31EB95

Function 0003A9DA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0003A03F), ref: 0003AA25

Strings

InitializeCriticalSectionEx, xrefs: 0003A9F5

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 9001119ec943123e53773ff4230c0d35073fe57a0d353013dcb54834f11f8fbd
Instruction ID: 3f24ec1e21acc73d682befda8ec82c666edec1adaef9fd27956dbd3f4779fe00
Opcode Fuzzy Hash: 9001119ec943123e53773ff4230c0d35073fe57a0d353013dcb54834f11f8fbd
Instruction Fuzzy Hash: 42F0597574421CBBCF116F20CD05C9E7FA4EF06720F008024FD091A221CB314E10E785

Function 0003A87F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0003A8BE

Strings

FlsAlloc, xrefs: 0003A89A

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 283ed90f16dce2e1d469df9ed9df6d7301f5cf40546bce1f622dda5af7959afd
Instruction ID: ace84b20c211103e61aee69be722ab1c4b0278dc4d85a6e4efbf5895e9e8d4cf
Opcode Fuzzy Hash: 283ed90f16dce2e1d469df9ed9df6d7301f5cf40546bce1f622dda5af7959afd
Instruction Fuzzy Hash: 5BE0ABB4B85228ABE7117F64DD02DAEBB98DF17B21F010024FC091B251CE740F0196DE

Function 00033567 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0003357C

Strings

FlsAlloc, xrefs: 0003356B, 00033575

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: b86876e5aa862879b6c71fb4cd0f0bc7e22313a6449c4a1c2686359b3bc25350
Instruction ID: 6e04975ffde4e37d05e81a392d9c1c44caaabdfe7b7ffc9c407d531bc4320934
Opcode Fuzzy Hash: b86876e5aa862879b6c71fb4cd0f0bc7e22313a6449c4a1c2686359b3bc25350
Instruction Fuzzy Hash: E0D05BA1782B746BD51132956D42ADD7A488701FB3F460171FF0C5F2439655561041DD

Function 0002E4C1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002E4D3

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Strings

3so, xrefs: 0002E4C1, 0002E4CD

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3so
API String ID: 1269201914-3563916355
Opcode ID: c5ba04ec99eb79833d02fed2908dab1f832308a478b6be94db7cce9be9e882cd
Instruction ID: 980d077e0bfbd90dff1aae763d3b0b3c030c5cf6b04eb86c2807cfbf3ae7d303
Opcode Fuzzy Hash: c5ba04ec99eb79833d02fed2908dab1f832308a478b6be94db7cce9be9e882cd
Instruction Fuzzy Hash: 5AB012C12DB061FC3308A155FE12C7A011CC7C0B50330DC2FB705D804395445C060036

Function 0003B660 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0003B22B: GetOEMCP.KERNEL32(00000000,?,?,0003B4B4,?), ref: 0003B256

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0003B4F9,?,00000000), ref: 0003B6D4
GetCPInfo.KERNEL32(00000000,0003B4F9,?,?,?,0003B4F9,?,00000000), ref: 0003B6E7

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: ed752caf900bc48b6689a6a454c2ee7429e2f81d8a1ddc505eb6f68736e62b95
Instruction ID: b1099d9b334f8c493e1fb00527f6f895626fdddee1405e64542fe88332793d19
Opcode Fuzzy Hash: ed752caf900bc48b6689a6a454c2ee7429e2f81d8a1ddc505eb6f68736e62b95
Instruction Fuzzy Hash: E35146749082559FDB22DF35C8856FBBBECEF81308F14406ED68A8B252D739D545CB90

Function 00022E9E Relevance: 3.1, APIs: 2, Instructions: 112COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00023000
__CxxThrowException@8.LIBVCRUNTIME ref: 00023018

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 093377766ae1bcbd2c91f0e8cd189e9661e90355b9ef5c5a5b64d01d2774de6c
Instruction ID: 19ac0476aa6a1bc486bd17c52af5bcca9f3fd96e94a1be20c12a95146ad593f3
Opcode Fuzzy Hash: 093377766ae1bcbd2c91f0e8cd189e9661e90355b9ef5c5a5b64d01d2774de6c
Instruction Fuzzy Hash: D24115B0A08351BBD768EBB4E984BDAF7E4BF54304F04053EE65853142DB74A858C3A5

Function 000113A7 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000113A7

Part of subcall function 00015FD7: __EH_prolog.LIBCMT ref: 00015FDC

Part of subcall function 0001CA2B: __EH_prolog.LIBCMT ref: 0001CA30
Part of subcall function 0001CA2B: new.LIBCMT ref: 0001CA73
Part of subcall function 0001CA2B: new.LIBCMT ref: 0001CA97

new.LIBCMT ref: 00011420

Part of subcall function 0001B26D: __EH_prolog.LIBCMT ref: 0001B272

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 98d3d1ae8516a254999d8d254e662872a4ce1f9f1cbd7516dc152163a019d0bb
Instruction ID: 78d8cac20b225117b5965b606550af3b65724e7a91dbb2063c27edaea0854cfd
Opcode Fuzzy Hash: 98d3d1ae8516a254999d8d254e662872a4ce1f9f1cbd7516dc152163a019d0bb
Instruction Fuzzy Hash: 404136B0905B50DEE724CF798485AE6FBE5FF18300F504A6ED6EE83282DB326594CB11

Function 000113A2 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000113A7

Part of subcall function 00015FD7: __EH_prolog.LIBCMT ref: 00015FDC

Part of subcall function 0001CA2B: __EH_prolog.LIBCMT ref: 0001CA30
Part of subcall function 0001CA2B: new.LIBCMT ref: 0001CA73
Part of subcall function 0001CA2B: new.LIBCMT ref: 0001CA97

new.LIBCMT ref: 00011420

Part of subcall function 0001B26D: __EH_prolog.LIBCMT ref: 0001B272

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c63db06de51266e280c5c97df7bbe18b6c58fbb7d38383d9548184467aacff03
Instruction ID: d4935f2267cd23250aa768e54d324059b08d7666f2a5d4a077baf2ffd236a199
Opcode Fuzzy Hash: c63db06de51266e280c5c97df7bbe18b6c58fbb7d38383d9548184467aacff03
Instruction Fuzzy Hash: 7C4147B0905B409EE724DF798485AE7FBE5FF18300F504A6ED6EE83282DB326594CB11

Function 0003B497 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 000392B5: GetLastError.KERNEL32(?,00050F50,000340E4,00050F50,?,?,00033B5F,?,?,00050F50), ref: 000392B9
Part of subcall function 000392B5: _free.LIBCMT ref: 000392EC
Part of subcall function 000392B5: SetLastError.KERNEL32(00000000,?,00050F50), ref: 0003932D
Part of subcall function 000392B5: _abort.LIBCMT ref: 00039333

Part of subcall function 0003B5BE: _abort.LIBCMT ref: 0003B5F0
Part of subcall function 0003B5BE: _free.LIBCMT ref: 0003B624

Part of subcall function 0003B22B: GetOEMCP.KERNEL32(00000000,?,?,0003B4B4,?), ref: 0003B256

_free.LIBCMT ref: 0003B50F
_free.LIBCMT ref: 0003B545

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: d6343e99f6713e942e7cea1a17be80bc0c644b38c5c2ddf601d064c15e338615
Instruction ID: d68dd93a791b5595a6e924adba572d3a725e2ab4ac49d80edc392d305101bbf6
Opcode Fuzzy Hash: d6343e99f6713e942e7cea1a17be80bc0c644b38c5c2ddf601d064c15e338615
Instruction Fuzzy Hash: 15310831D04608AFDB12EF68D441BADB7F9EF41328F244099F6049B292DF359E40CB50

Function 000198BE Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,0001A07C,?,?,00017936), ref: 00019946
CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,0001A07C,?,?,00017936), ref: 0001997B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f263822cf7e4d1de9b5c696e50aa8207c139444f32cca0c5ee662b0e249cf513
Instruction ID: 820fb15342bd91ab9883a4e03e46fefb657189847560c2bfced79f4675fe1829
Opcode Fuzzy Hash: f263822cf7e4d1de9b5c696e50aa8207c139444f32cca0c5ee662b0e249cf513
Instruction Fuzzy Hash: 3F2107B1404748AEE7308F14CC55BEBB7E8EF4A764F004A2DF5E5821D1C774AC899B61

Function 00019F02 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,000175F1,?,?,?,?), ref: 00019F1C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00019FCC

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: c9ccbe4cb4feb63a9e32f412c50535baab1e76d60d1af9627cc91bbd4c0dbfb5
Instruction ID: 796868a644a9b343b9fa4035163a0aae400b6e852063eaa8308d591df671ab47
Opcode Fuzzy Hash: c9ccbe4cb4feb63a9e32f412c50535baab1e76d60d1af9627cc91bbd4c0dbfb5
Instruction Fuzzy Hash: 8F21F331258346ABC714CF24C861AEBBBE8AF96304F04092CB4D1C7141C729EA8ECB61

Function 0003A768 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0003A7C8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0003A7D5

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 2c08dd550e21d6a07550de89bb03297d7c68d80ee5e6f2c19318f4ac0ab90b5e
Instruction ID: a6d3214496da2d90a267a5ed04e51be3701071cb9c02b7f5193df6f1889c160d
Opcode Fuzzy Hash: 2c08dd550e21d6a07550de89bb03297d7c68d80ee5e6f2c19318f4ac0ab90b5e
Instruction Fuzzy Hash: 8011E33BB141209FAB27DF28DCC089A73E9AB87370F164220FC55AB244DA34DC4187D2

Function 00019CF9 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00019CD5,?,?,00000000,?,?,00018F2A,?), ref: 00019D60
GetLastError.KERNEL32 ref: 00019D6D

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 63728a2568498a404167a907a6f8299728a01823f478991872bda9c7057bcf8c
Instruction ID: ce135123c2363f5a81105bc382b873d8a227b134a727ed9d7fab2bccd3e88aea
Opcode Fuzzy Hash: 63728a2568498a404167a907a6f8299728a01823f478991872bda9c7057bcf8c
Instruction Fuzzy Hash: C001D6763042019B8B1CCF65BDB49FEB399AF85721B14462DF92787291CB34DC859B21

Function 00019FE0 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 0001A016
GetLastError.KERNEL32 ref: 0001A022

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: bd62450f288b073e6e7552eb5456bea741dab53d843e96bd3be62138ffaee73c
Instruction ID: 0058b38d165b20c43c3cc552fbf36ec8936756f6723112cf92f0ae809bee3206
Opcode Fuzzy Hash: bd62450f288b073e6e7552eb5456bea741dab53d843e96bd3be62138ffaee73c
Instruction Fuzzy Hash: D001D8717052005FEB359E29DC447EBB7D9AB8E355F14893DB146C3680DA79DC8C8B12

Function 00038926 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00038947

Part of subcall function 00038838: RtlAllocateHeap.NTDLL(00000000,?,?,?,00033CF6,?,0000015D,?,?,?,?,000351D2,000000FF,00000000,?,?), ref: 0003886A

RtlReAllocateHeap.NTDLL(00000000,?,?,?,?,00050F50,0001D11F,?,?,?,?,?,?), ref: 00038983

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: 92c32b27e10708ea5025a89fa6d747158f253fc0e0c52a818314187eef0edbee
Instruction ID: ed89bf920daa581980a4f42c43f67e6f9b9058208abfa949ce38007e8617a649
Opcode Fuzzy Hash: 92c32b27e10708ea5025a89fa6d747158f253fc0e0c52a818314187eef0edbee
Instruction Fuzzy Hash: 24F0C835101305BBDB6326269C00BBF379C9F82770F2CC197F914A6191DF34D8004762

Function 00020BE3 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00020BF0
GetProcessAffinityMask.KERNEL32(00000000), ref: 00020BF7

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5af5cc940854447f990ff14b28bbe5affb4048fc8bad985cab7efdafdbe93db6
Instruction ID: 01dc80bc3c1c9e549d76f031ffce0c23cfa161e1688164f8750fec4f0d9a5700
Opcode Fuzzy Hash: 5af5cc940854447f990ff14b28bbe5affb4048fc8bad985cab7efdafdbe93db6
Instruction Fuzzy Hash: 00E092F6A0122AA7DF1887A4BC059EBB3EEDB052007305379E907D3602F934DE4246A4

Function 0001A637 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0001A46D,?,?,?,0001A2B3,?,00000001,00000000,?,?), ref: 0001A64B
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0001A46D,?,?,?,0001A2B3,?,00000001,00000000,?,?), ref: 0001A67C

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 632f00285cece8550216b0dfbc587a2928dcf1d6c348d63e8bb1f2de971b1b40
Instruction ID: bea40542b2f8ad61caa0b5a0487b95a563b16b4f1deb685abd760f0a309c786d
Opcode Fuzzy Hash: 632f00285cece8550216b0dfbc587a2928dcf1d6c348d63e8bb1f2de971b1b40
Instruction Fuzzy Hash: 1AF0A0312512597BEF119F60DC00BE937ACAB05781F088151BC8886161DB368EE8AE54

Function 0002D830 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0002D85E
SetDlgItemTextW.USER32(00000065,?), ref: 0002D875

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 57f553d505c7bdbd0b2fd5f2823fac0714484e55290a81b1b5fad5f04c71223c
Instruction ID: ad2283a69aed692dbf72499cf96703954c9b419f91773199e3bdbe4dbfc509f8
Opcode Fuzzy Hash: 57f553d505c7bdbd0b2fd5f2823fac0714484e55290a81b1b5fad5f04c71223c
Instruction Fuzzy Hash: D8F0EC7190435C6BE711BBA0EC06FEF3B5CA704746F0404A5BB01670A3DD7969604761

Function 0001A320 Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,000199EC,?,?,00019825,?,?,?,?,00041F81,000000FF), ref: 0001A331
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,000199EC,?,?,00019825,?,?,?,?,00041F81,000000FF), ref: 0001A35F

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: e68a5e8e14c3bb85b08a70a39f3f3cf5799b261272a631aaad9eb40e4ad15ce9
Instruction ID: 83df7184d0d0d00cdeaa8f44eb7b0baddc2c7c12e58ddc3e4de7f4060e3dc307
Opcode Fuzzy Hash: e68a5e8e14c3bb85b08a70a39f3f3cf5799b261272a631aaad9eb40e4ad15ce9
Instruction Fuzzy Hash: AEE02235A812187BEB109F60DC04FEA33ACBB09782F4800A1BC88C2051DB218ED8AA54

Function 0002A62E Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00041F81,000000FF), ref: 0002A662
CoUninitialize.COMBASE(?,?,?,?,00041F81,000000FF), ref: 0002A667

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 8b064cdb413878361d25444023bc0e5fc1b58807d8b9f5de191546f6016d1066
Instruction ID: 2221f500fb5a3502f3e8d3c61b9a53d771af40c6c8db71b10df19a05af5b0e64
Opcode Fuzzy Hash: 8b064cdb413878361d25444023bc0e5fc1b58807d8b9f5de191546f6016d1066
Instruction Fuzzy Hash: 12F06572558654DFC710DB4CDD05B55FBA8FB49B20F00436AF41993760CB786801CB94

Function 0001A387 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0001A37C,?,00017776,?,?,?,?), ref: 0001A398
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0001A37C,?,00017776,?,?,?,?), ref: 0001A3C4

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 81b8c2aa5dfd1a6d0620136db663838c3e9a000a35c27cbc01002da82019b867
Instruction ID: e61bd8f6a667452c9d2c140b5d0075d9cb22ef46b2fbc5d94dee0a1db59c620a
Opcode Fuzzy Hash: 81b8c2aa5dfd1a6d0620136db663838c3e9a000a35c27cbc01002da82019b867
Instruction Fuzzy Hash: 2AE09B355001286BDB50EB64DC04BE9779C9B097E1F0042A2FD54E3195D7709E848ED5

Function 00020360 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0002037B
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0001EE61,Crypt32.dll,00000000,0001EEE5,?,?,0001EEC7,?,?,?), ref: 0002039D

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 7de36e1ed2a306c0f3fba0b502f7c4a8a982380e5637178bb4ac64075281c2ee
Instruction ID: bbc2e122240b01311d98a77bff4a401af8743f68f61338a5077fea740266d4e0
Opcode Fuzzy Hash: 7de36e1ed2a306c0f3fba0b502f7c4a8a982380e5637178bb4ac64075281c2ee
Instruction Fuzzy Hash: C9E0127691126C6BDB11AA94EC48FD677ACEF19382F0400A5B948D2105DB749A848BA4

Function 00029D6F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00029D90
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00029D97

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 5b581c621ce7631a60f54e9d2184e2903b8e88c2ae1da27871016360cf13428c
Instruction ID: 6423ea6fce440c52c8361e30e99b0b9d61b6514b6d8cb4fc0ca8a6a85a6a0e9c
Opcode Fuzzy Hash: 5b581c621ce7631a60f54e9d2184e2903b8e88c2ae1da27871016360cf13428c
Instruction Fuzzy Hash: 37E01275905268EFDB60EF98D501BDDB7F8EB08711F10845BE84993701D7B06E04EB91

Function 000323FC Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00033567: try_get_function.LIBVCRUNTIME ref: 0003357C

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0003241A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00032425

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: adb50edd760c188d66b62ca0b8036a9e740be9cf324dbbc08bd43fd295209997
Instruction ID: c87f36bbe33b3e51a7e92fb1b34a2d211673cd681f293e0d802510ec1686dcde
Opcode Fuzzy Hash: adb50edd760c188d66b62ca0b8036a9e740be9cf324dbbc08bd43fd295209997
Instruction Fuzzy Hash: EED02234904740A82C5B37797C038CC23CC2B52BB8FB14A96F720CF1C3FE1880816025

Function 0002DF2E Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadLock.DELAYIMP ref: 0002DF3A
DloadProtectSection.DELAYIMP ref: 0002DF56

Part of subcall function 0002E12F: DloadObtainSection.DELAYIMP ref: 0002E13F

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: 97be39c2cf98ed424aad8e4ffc306976eb8d8a799b10d212b74e0aef62aefe15
Instruction ID: 59c9a4f95f6403300afb64ab4f0cb2b26ebfeadbb472d6ce91205b7c76407477
Opcode Fuzzy Hash: 97be39c2cf98ed424aad8e4ffc306976eb8d8a799b10d212b74e0aef62aefe15
Instruction Fuzzy Hash: EFD0C9749442748AE292A724FE4679822A0B705344FA00722BA1AE61A2CBBC4890C649

Function 000112E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 000112FB
ShowWindow.USER32(00000000), ref: 00011302

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 5f92c946e1f046913ebdd581b418e7892d0d014ac5afb267cde280bd50422064
Instruction ID: 90cfbb2347ba57b25ed803bd191fbd368d2c3411ba3aac0cc040625ecd95b0bf
Opcode Fuzzy Hash: 5f92c946e1f046913ebdd581b418e7892d0d014ac5afb267cde280bd50422064
Instruction Fuzzy Hash: DAC01232858200BEDB010BB0DC09C2FBBA8ABA5212F00C918B2A9D0060CA3CC050DB11

Function 000119C6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000119CB

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3bf998307937cc68227f8c69832a12e93a89a966d0ac6f7e690c170d66679f0f
Instruction ID: e377a246e93ee630c1c427dccd43faf4dc4234c083dc6e17f7b5718f771e1fbc
Opcode Fuzzy Hash: 3bf998307937cc68227f8c69832a12e93a89a966d0ac6f7e690c170d66679f0f
Instruction Fuzzy Hash: 88C1C774A042549FEF59CF68C494BED7BE5EF0A300F0840B9ED469F286CB759984CBA1

Function 00013AC2 Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00013AC7

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2c11522dcea083afb42c2d4c2dd92eadf4fb03b32420afcf103d5b454f794a24
Instruction ID: af24a816e228eab809c2638639c04729622ecd59a1e6fbef538d5d11f1672e17
Opcode Fuzzy Hash: 2c11522dcea083afb42c2d4c2dd92eadf4fb03b32420afcf103d5b454f794a24
Instruction Fuzzy Hash: E471C471504F849EDB25DB70DC81AEBF7E8AF15301F44496EE6AB47142EB326A88CF11

Function 0001850D Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00018512

Part of subcall function 000113A2: __EH_prolog.LIBCMT ref: 000113A7
Part of subcall function 000113A2: new.LIBCMT ref: 00011420

Part of subcall function 000119C6: __EH_prolog.LIBCMT ref: 000119CB

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0945b0d329f23568a1aa9ee008155ac8ad1b3a74e02943544c9c6d856013675a
Instruction ID: ad64d97b1081761f4b38d09a17c91eb8d6e7cc92bef9fd9f42db69f2715e64e5
Opcode Fuzzy Hash: 0945b0d329f23568a1aa9ee008155ac8ad1b3a74e02943544c9c6d856013675a
Instruction Fuzzy Hash: 37419F719406A49ADB24EB60CC55BEAB3B8AF10304F4440EAE58EA3093DF756BC8DF50

Function 000230C9 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000230CE

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7bee4ddaf22b741a6a7ad21ce853eabc457d18a7d383b053f9d4eb413917b5a6
Instruction ID: c13e7a33eba119e5e7a6b2c23db5ee44ce15f3b0ea65b13a4f1f18004d4f1485
Opcode Fuzzy Hash: 7bee4ddaf22b741a6a7ad21ce853eabc457d18a7d383b053f9d4eb413917b5a6
Instruction Fuzzy Hash: 6121F8B1E402316FDB149F75EC416ABB6A8FF15754F04023AE905EB682D7749E10C6A8

Function 00011E20 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00011E25

Part of subcall function 00013AC2: __EH_prolog.LIBCMT ref: 00013AC7

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0a9d52dc23975345105fd46873601441d45fe0644ccbee0be9747d78e283dec8
Instruction ID: d78e5a29b0c8275631b1c525927c62321d600a0912ad93ff38b58e291c12c248
Opcode Fuzzy Hash: 0a9d52dc23975345105fd46873601441d45fe0644ccbee0be9747d78e283dec8
Instruction Fuzzy Hash: E4215A71A042189FCF19DF98D9519EEFBF6BF58300F10006DE949A7252DB325E50CBA0

Function 0002AA53 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0002AA58

Part of subcall function 000113A2: __EH_prolog.LIBCMT ref: 000113A7
Part of subcall function 000113A2: new.LIBCMT ref: 00011420

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 11afb7b8ab01e2c4e879baff3ee2383f9220765f80587d603f10d4e885340b26
Instruction ID: 58870b053785016a676a7c2ab6cd3f902427eb959527794fe528afe36ac6aac5
Opcode Fuzzy Hash: 11afb7b8ab01e2c4e879baff3ee2383f9220765f80587d603f10d4e885340b26
Instruction Fuzzy Hash: EC218C71D042A9AFCF15DF94D9915EEB7F4AF19304F4004AEE809A3203DB356E45DBA1

Function 00019477 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0001947C

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 676a75b6ab41cbf1c89dd58a0177a9950af162a88aa033c2f84251728da1e63c
Instruction ID: 2d29204b1f80d448d01957a219ebb9b04f7486c7d302e3e6f0aaff875547e35a
Opcode Fuzzy Hash: 676a75b6ab41cbf1c89dd58a0177a9950af162a88aa033c2f84251728da1e63c
Instruction Fuzzy Hash: F111A577A015289BCF11AF98CC51DDEB776FF48750F004155F919A7222CA34CD9187E0

Function 000388C9 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,000392E3,00000001,00000364,?,00033B5F,?,?,00050F50), ref: 0003890A

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: adcb956e77d7fa16d149ad90a6ea504e09d24e80d8c60882ca54e2907e509124
Instruction ID: fb318965495fc5def7e58750854bc9af730b02becd38be5617035f01f845face
Opcode Fuzzy Hash: adcb956e77d7fa16d149ad90a6ea504e09d24e80d8c60882ca54e2907e509124
Instruction Fuzzy Hash: 0AF0E031A0532567DB731B259C05B6A378C9F417A0F1CC193B804E6191CF30DD004BE1

Function 00038838 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00033CF6,?,0000015D,?,?,?,?,000351D2,000000FF,00000000,?,?), ref: 0003886A

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 648eac622bfa7476768a2619dd3d01067673498293d69fff7356161f3d685d63
Instruction ID: 0ba35e05cec30a44cdd2bdca9068474a189fcaf8f3f2839683480b87436c47c4
Opcode Fuzzy Hash: 648eac622bfa7476768a2619dd3d01067673498293d69fff7356161f3d685d63
Instruction Fuzzy Hash: 97E065356013119BE7732B665C05B9B7A9C9B413A0FA5C1A0BD58A6092DF64DC0047E1

Function 00015B57 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00015B5C

Part of subcall function 0001B26D: __EH_prolog.LIBCMT ref: 0001B272

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 35d96266a3d6b87c05e90dda0d0ca64669bc1df95a96cd72b2ed2539357e4b30
Instruction ID: 1ea10b39d577cc7a5805777d4708629f6abc215fa60b9f7639414bc62df43e20
Opcode Fuzzy Hash: 35d96266a3d6b87c05e90dda0d0ca64669bc1df95a96cd72b2ed2539357e4b30
Instruction Fuzzy Hash: 50018C30A157A4EAE715E7A8E8153EFF7F89F15304F00818EB85A53283DBB41B08C762

Function 0001A6B9 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0001A6E8

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 43cb6d7983e74293f88f99aa3b73561ea9f1a03f350d585a137112d88c7b7321
Instruction ID: 54fa31aa6ebb8101d3bccadbe9ea3b373e9485fbceef2eafb3de8d568584ce63
Opcode Fuzzy Hash: 43cb6d7983e74293f88f99aa3b73561ea9f1a03f350d585a137112d88c7b7321
Instruction Fuzzy Hash: 15F05E3510E780AACA626BB848457CABBE06F17371F088A49F1F9521D2C3B554D99722

Function 00020957 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 0002098C

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 7527a6d88633618405f89a0fe21b578d10426d86b27419f8c345d15e0d92756d
Instruction ID: 7f48c4f313f0f3efa3e80188f1f7d33597a3ae0a04bf182dc1493206d88a9f01
Opcode Fuzzy Hash: 7527a6d88633618405f89a0fe21b578d10426d86b27419f8c345d15e0d92756d
Instruction Fuzzy Hash: AFD012656112602DFA213324FC49BFE168A4FD6321F0C0175B40E56293CA4D08C69BA1

Function 00029FDB Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00029FE1

Part of subcall function 00029D6F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00029D90

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 1be1482ac2147708aedbcb5cadff49528507359555a760097fab3dd187c3424e
Instruction ID: 567a473ffdcbc849c818e805a96078daa7335e353d1c6ea85112e6eadfd6f2b2
Opcode Fuzzy Hash: 1be1482ac2147708aedbcb5cadff49528507359555a760097fab3dd187c3424e
Instruction Fuzzy Hash: BDD0A73021421D7ADFD07A64EC029BE7A9CDB00300F004075BC08C5182FE71CE106251

Function 00019B29 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00019A27), ref: 00019B35

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d21a3378762cd65062cc35ad50ad7cb0b4d717850d78858471dc86bd7a7d4863
Instruction ID: 05266ab0cb8b5f470d2e13e2826f98af3675042e07e49466e3ebdd7423963f4c
Opcode Fuzzy Hash: d21a3378762cd65062cc35ad50ad7cb0b4d717850d78858471dc86bd7a7d4863
Instruction Fuzzy Hash: 91D01270015140958FA18A346F990D5A6929B43366B38CBA4D026C50A2C722C983F501

Function 0002D6D7 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0002D6FC

Part of subcall function 0002AF04: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0002AF15
Part of subcall function 0002AF04: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0002AF26
Part of subcall function 0002AF04: IsDialogMessageW.USER32(0001047C,?), ref: 0002AF3A
Part of subcall function 0002AF04: TranslateMessage.USER32(?), ref: 0002AF48
Part of subcall function 0002AF04: DispatchMessageW.USER32(?), ref: 0002AF52

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: eb7bf2407bc04b6ce44c8c8e081523c502414739800931fcf187f9d46054efed
Instruction ID: bb3f651caebf565997f8bc0b7d70c32cdbf1f63a68df6a421479b71310a425e7
Opcode Fuzzy Hash: eb7bf2407bc04b6ce44c8c8e081523c502414739800931fcf187f9d46054efed
Instruction Fuzzy Hash: E7D09E71144301ABE7012B51DE06F5A7AA2BB88B05F404554B644740B28A6AAD60DF26

Function 0002DB4E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 506cf7e6e03773dd7fb19d6e798a9c0c8f182efe0ab112ba127145d98b39dab1
Instruction ID: 308ddbc553dbd98fc5bca7373a30ecb7749fcfaf3d9b961dcbda860f4981db01
Opcode Fuzzy Hash: 506cf7e6e03773dd7fb19d6e798a9c0c8f182efe0ab112ba127145d98b39dab1
Instruction Fuzzy Hash: D6B012C9AD8161FC32042144FC4AC3F021CC7D0B11370C42BBB01D40C1E9445C098035

Function 0002DB69 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 43acfc938fe8ea8dfea3d5384b4c6cef3d2e729c8294eed8127c965fb6f231b9
Instruction ID: c44c1d7f54fb32e39ec047e2968fdea395e28ba9e2214acec6805afd8777766d
Opcode Fuzzy Hash: 43acfc938fe8ea8dfea3d5384b4c6cef3d2e729c8294eed8127c965fb6f231b9
Instruction Fuzzy Hash: 4AB012C9A98261EC32186148FD42C3F011CC7C0B10370843BB605C50C1E9445C064035

Function 0002DB73 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 605a696473a1252850652f49fc8c856bc043d888f1cab8fbc3f4ac39076b0c9f
Instruction ID: 9b513fc551764d45db6bf89e0e7fbdf3161c9af1f1a412e84d5e533ffbb60b7a
Opcode Fuzzy Hash: 605a696473a1252850652f49fc8c856bc043d888f1cab8fbc3f4ac39076b0c9f
Instruction Fuzzy Hash: 90B012C9A98161EC32046148FC42C3F021CE7C0B10370842BB605C50C1E9445C054135

Function 0002DB7D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d0550142ec703cca1d5b1447ea7c208e1b037663e431a82d580d032d57610fda
Instruction ID: 76835d4a472d0b1840fc186045c0adc616fd527b230615cfdd67af8def053f36
Opcode Fuzzy Hash: d0550142ec703cca1d5b1447ea7c208e1b037663e431a82d580d032d57610fda
Instruction Fuzzy Hash: EFB012C5A98061EC32046149FC02C3A011CC7C0B10370C46BBA05C51C1E5445C0A8035

Function 0002DB87 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 66ee2694762527f4e7845143b30cfc5ac14b262a816871b86ee457466b9f8bbd
Instruction ID: 423936fc92eb3c7fd92d654ce71362b93046ec85d16a5f2c930abccb8855b250
Opcode Fuzzy Hash: 66ee2694762527f4e7845143b30cfc5ac14b262a816871b86ee457466b9f8bbd
Instruction Fuzzy Hash: 14B012C5A981A1EC32446149FC02C3A011CC7C0B10371C56BB605C51C1E5445C8A4035

Function 0002DB9B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bbdde65482dddd6c35c80a3ae512b095f5ed6e08a1b55c8b0a14f49a10627897
Instruction ID: 88788249ba812a8b0d1c8e896fab62b54ac9dc993beebe8600c24438649f5177
Opcode Fuzzy Hash: bbdde65482dddd6c35c80a3ae512b095f5ed6e08a1b55c8b0a14f49a10627897
Instruction Fuzzy Hash: 20B012C5A98061EC32046189FC02C3A021CD7C4B10370C86BB605C51C1F5445C0A4035

Function 0002DBA5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cc239c6101dc74f3aed47c151aa4ca6722549614c7daea18c6a9c77333357afe
Instruction ID: a74819bbaca9a39df5be7970dcc8fe70a501a02339c0a08411aee896a61073ca
Opcode Fuzzy Hash: cc239c6101dc74f3aed47c151aa4ca6722549614c7daea18c6a9c77333357afe
Instruction Fuzzy Hash: 2DB012D5A980A1EC32047148FC02C3A011CC7C0B10370C42BBA09C50C1E5445C058035

Function 0002DBAF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f2252746c441e62afd872ab7808f4580b0192d297e61760d78728a0fca01d412
Instruction ID: a9cf71f753e2f9aaa02148b7d4bd8794e116d86bcf7a5dbb8a0fdb1580114131
Opcode Fuzzy Hash: f2252746c441e62afd872ab7808f4580b0192d297e61760d78728a0fca01d412
Instruction Fuzzy Hash: 66B012D5A981A1EC32447148FC02C3A011CC7C0B10371852BB609C50C1E5445C454035

Function 0002DBB9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a00fba9b9e3015a8c95b214f626964c7854aa3ba1770e55805fa6d59c912610a
Instruction ID: a9f7b4e48d51960f24e49e155c721e8b97771971e9ffc81e6ae8d8aad2ac34e0
Opcode Fuzzy Hash: a00fba9b9e3015a8c95b214f626964c7854aa3ba1770e55805fa6d59c912610a
Instruction Fuzzy Hash: CDB012D5A980A1EC32087148FD02C3A011CC7C0B10370843BB609C50C1E5445D064035

Function 0002DBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2bf7cfe9ca2e41ffa404254c05849d1e331a0863313a579d22d10c53420064ba
Instruction ID: e90b49f552dddfcc1e580177089f90ceb2b49725e3ce2f9e97eb6490d12feaf3
Opcode Fuzzy Hash: 2bf7cfe9ca2e41ffa404254c05849d1e331a0863313a579d22d10c53420064ba
Instruction Fuzzy Hash: 32B012D5A980A1EC32087149FC02C3A021CD7C0B10370842BB609C50C1E5445C054035

Function 0002DBCD Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6a04b1277034a294028b77ec74af1bec3c350c9f158309ee5bfe97f33826a0e7
Instruction ID: 52d0f60e951c6f92a7cd8e3577d9ef62204e0c72d93adbf84c926e9bcdd2e646
Opcode Fuzzy Hash: 6a04b1277034a294028b77ec74af1bec3c350c9f158309ee5bfe97f33826a0e7
Instruction Fuzzy Hash: F5B012C5A99061EC3204A148FC02C3A011DC7C0B10370C42BBA05C50C2E5445C058035

Function 0002DBE1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 284604f18c609c64adc33298075f446cdb1104f967643af2432052db0d26cd10
Instruction ID: 0349d06da096eee31be2e38c986e6d5e32e5e0382acc113d662a6d52e88b738c
Opcode Fuzzy Hash: 284604f18c609c64adc33298075f446cdb1104f967643af2432052db0d26cd10
Instruction Fuzzy Hash: 29B012C5A9A061EC3208A148FD02C3A011DC7C0B10370843BB605C50C2E5445C064035

Function 0002DBEB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4009c76e43db22fb4e8b16668995b650398e16a946c658ac35ec352ece67b8c5
Instruction ID: 3ff7c847a7eed5d5b94921ea797678dd90c46ed677056e6b97f3bab8e3c8ce03
Opcode Fuzzy Hash: 4009c76e43db22fb4e8b16668995b650398e16a946c658ac35ec352ece67b8c5
Instruction Fuzzy Hash: B4B012C5AA9061EC3204A148FC02C3A025DDBC0B10370842BB605C50C2E5445C054035

Function 0002DBFF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f5d4685a0568fd4f3124bdbeed0a4451ed3e29a217fab8c17f014c4e40088aa5
Instruction ID: 2a69139bf5bb085476f79033f528d95560efaebde4e08135b0400478844bbd70
Opcode Fuzzy Hash: f5d4685a0568fd4f3124bdbeed0a4451ed3e29a217fab8c17f014c4e40088aa5
Instruction Fuzzy Hash: 19B012C5B98161EC32456148FC02C3A019CD7C0B10371852BB605C50C1E5445C454035

Function 0002DC31 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ab827d9ff5fbb370c934dabbdce3099eecaf530f7cb01d7ffffbfdfb92b918a1
Instruction ID: 1db5dbe03edd213aa36465cfcbf6e11d327267666f7b1fe07e98221edda6176e
Opcode Fuzzy Hash: ab827d9ff5fbb370c934dabbdce3099eecaf530f7cb01d7ffffbfdfb92b918a1
Instruction Fuzzy Hash: B5B012C5A98061EC32186148FD03C3A011CC7C0F10370843BB705C50C1F5445C064035

Function 0002DD96 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DD79

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fcd044c65f820321baae23f07ebb6fcb718fe20588e67bce78badcb1d5102f4e
Instruction ID: 04ab4decf58aee75e09ba5390ff610ef757238180a51e373144e857be3925a7c
Opcode Fuzzy Hash: fcd044c65f820321baae23f07ebb6fcb718fe20588e67bce78badcb1d5102f4e
Instruction Fuzzy Hash: CCB012D5698861EC32047149FC02C3E010CC3C0B10330D56BBA05C8042E44C9C050035

Function 0002DDA0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DD79

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7787576c6f47a6ae4e4994859fd42acccbe37c88528e95b5751d5108824aa450
Instruction ID: 90e3d1bef2df93684beaf293eddeae255dde1be1b6d02a270594031122e378d7
Opcode Fuzzy Hash: 7787576c6f47a6ae4e4994859fd42acccbe37c88528e95b5751d5108824aa450
Instruction Fuzzy Hash: 1FB012C5698821AC3204614AFC02D3E010CD3C4B10330D96BB605C8042F4489C0A0435

Function 0002DDC8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DD79

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b59b05d003b26912ae57cd148286ccce7f2d55f12997c4bee94ef939bab44b38
Instruction ID: 0cf0a2d86cc1a60560d465542757ba0e78c7ebb506b239920d7b34a3f2407551
Opcode Fuzzy Hash: b59b05d003b26912ae57cd148286ccce7f2d55f12997c4bee94ef939bab44b38
Instruction Fuzzy Hash: BCB012C56D8921AC32046149FC42D3E010CE3C0B10330956BB505C8042E4489C050135

Function 0002DE8A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DE9C

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 83b9cc2c4ec159979f44f81badab31cb3f4504b184208ba9e8a8fdc554df6347
Instruction ID: 459475ee89f1f6c1c57f5a6bc92fc16953fada41fd339b8e0fbdde0c103054fe
Opcode Fuzzy Hash: 83b9cc2c4ec159979f44f81badab31cb3f4504b184208ba9e8a8fdc554df6347
Instruction Fuzzy Hash: 3CB012C1399222BC33042145BC07CBB011CC7C0B14330852BB605D8042D9485C490039

Function 0002DEA5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DE9C

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b7fd1812328fa49337c2a11a3eadfff5a19a75c905c317cc4336c11ef7bc0116
Instruction ID: 4a42f9bbbfaf53a50b5347aaafe35d51dc1cad1fc246fad730a1321bcbfc79c0
Opcode Fuzzy Hash: b7fd1812328fa49337c2a11a3eadfff5a19a75c905c317cc4336c11ef7bc0116
Instruction Fuzzy Hash: 27B012C1399021AC32046159BC07DBA011CD7C0B10330843BB606C8043D9446C490039

Function 0002DEAF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DE9C

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: be80ec3083610257b45a0cdd27b7cd822d0a3c7f842ac0e2a62b529dbf13a440
Instruction ID: 215e6fb64903640028f5f40bd904521126f9112d7bf6b2c4e5293576356df23d
Opcode Fuzzy Hash: be80ec3083610257b45a0cdd27b7cd822d0a3c7f842ac0e2a62b529dbf13a440
Instruction Fuzzy Hash: EDB012C1399122EC32086149BC07CBB012CC7C0B10330C42BBA05C9042D9445C090039

Function 0002DEC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DE9C

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1983398aee8dd4c29f52592384c7b5415be1610fa3c320cc3d3db3df6cfd87dd
Instruction ID: b51e8c55b94627f00eb57f82cb759badcf3869d0969715516b74a755c175ec67
Opcode Fuzzy Hash: 1983398aee8dd4c29f52592384c7b5415be1610fa3c320cc3d3db3df6cfd87dd
Instruction Fuzzy Hash: 21B012C1399062AC32086149BD07CBB011CC7C0B10330C42BB705C8042D9445C060039

Function 0002DEEB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DEFD

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 05f96c6351824709124369455dcbba6c84223606f1418817e445974da1d8e37f
Instruction ID: bb42e20b39c0b090db17ae3a4ea0af56927858c8908c404b016233c096d9b3d8
Opcode Fuzzy Hash: 05f96c6351824709124369455dcbba6c84223606f1418817e445974da1d8e37f
Instruction Fuzzy Hash: A5B012C1698122BC32183245FC06C7B022CC3F0B20370C52BBB01D8441A9446C050039

Function 0002DF1A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DEFD

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0f54396b1418d09a226553c33c7dd923853eca0c094ba7ae24ac1ab179e472b8
Instruction ID: de9c58fef29a83b59ffdea6e840b097afbd24bd1a22a3a99aea66a334662374b
Opcode Fuzzy Hash: 0f54396b1418d09a226553c33c7dd923853eca0c094ba7ae24ac1ab179e472b8
Instruction Fuzzy Hash: 0CB012C1698122BD32187249FC42C7A035CD3F0B20370842BF705C8441D5446C050035

Function 0002DF24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DEFD

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6cd3d17d0858aeb90bd67a9c2bc724c9c8383708345bf860beef63b618d5e97c
Instruction ID: 27f7370cec2a9a12cf1aa9bd35ebba1027799a2d54810e2aa1fecb9ba2ee3d5a
Opcode Fuzzy Hash: 6cd3d17d0858aeb90bd67a9c2bc724c9c8383708345bf860beef63b618d5e97c
Instruction Fuzzy Hash: 5DB012C1698121AC321C7249FD02C7A023CC3F0B103B0863BB705C8541D5446C060039

Function 0002DB96 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3ff3151c3f5b3f94f1a48d5ef9a1cce3d5ae52713633e2de01157cb5e9ec17e3
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: 3ff3151c3f5b3f94f1a48d5ef9a1cce3d5ae52713633e2de01157cb5e9ec17e3
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DBDC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 551f6b31e3683bbfcff44e7967bb1790d86f20cd41e17678da7544e2d911e513
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: 551f6b31e3683bbfcff44e7967bb1790d86f20cd41e17678da7544e2d911e513
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DBFA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9ded52bca199abeb5dbc1475f7a06a4e564d8a9a5259be9701d70dc9d6a83286
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: 9ded52bca199abeb5dbc1475f7a06a4e564d8a9a5259be9701d70dc9d6a83286
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DC0E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 580e3d26483a2d6ddd863e211282bcc267b595de5cdc2b80acdee98ac7717d59
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: 580e3d26483a2d6ddd863e211282bcc267b595de5cdc2b80acdee98ac7717d59
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DC18 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: da9d21bc99d731a380c643a9bba9e64988cb17a6cea7be041b56aa2b1576670f
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: da9d21bc99d731a380c643a9bba9e64988cb17a6cea7be041b56aa2b1576670f
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DC22 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8fd47fd1f6fae80ed136bce25785911b29cd9dc7ecaaa39e671204717f37656e
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: 8fd47fd1f6fae80ed136bce25785911b29cd9dc7ecaaa39e671204717f37656e
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DC2C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6263a4e0a7338464cdf25f1e517c7165711d745bff2cf4391de78c8956584b27
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: 6263a4e0a7338464cdf25f1e517c7165711d745bff2cf4391de78c8956584b27
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DC40 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 500adbc21f6864cc47f8606819d83e66c507fdb0899761ecef2a305c25af45c6
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: 500adbc21f6864cc47f8606819d83e66c507fdb0899761ecef2a305c25af45c6
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DC4A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b62518c9c7d1e148fac88d8320b356236778c9b0b4865c26ee87c12d7940ccda
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: b62518c9c7d1e148fac88d8320b356236778c9b0b4865c26ee87c12d7940ccda
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DC54 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DB60

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 73832c8021a880b157232ba2a8f8fa0fe29ba38f59724f15cd700b703578d331
Instruction ID: 2ad476d104a7b4001af00a8a8e1c6aa0abd754f1d3f5656d4362ea087804137c
Opcode Fuzzy Hash: 73832c8021a880b157232ba2a8f8fa0fe29ba38f59724f15cd700b703578d331
Instruction Fuzzy Hash: 2BA012C5598062FC31042140BC02C3A011CC6C0B10330481AB502840C1A5401C054030

Function 0002DD6C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DD79

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e1a044038d4ac2e86079f54952647c95b7b239e515f6181ef5790123277b21e3
Instruction ID: c0a99d31fc390c2c1111a1ac5329c10cd2adba34e7a58d5f3ce24dfcbbb5e343
Opcode Fuzzy Hash: e1a044038d4ac2e86079f54952647c95b7b239e515f6181ef5790123277b21e3
Instruction Fuzzy Hash: E5A002D55959617C35146195BD56C7E511CC6C0B11330555BB50198045A5445C451435

Function 0002DD87 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DD79

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e39bd76e6cc47c5815c8de32d6d88a2c1a09ed39e4a639882e07226fe92cbcbd
Instruction ID: ec581f6fc25dd6c99bb469aa5ce1506b3736e9aa34200e727de1ada88a61aa96
Opcode Fuzzy Hash: e39bd76e6cc47c5815c8de32d6d88a2c1a09ed39e4a639882e07226fe92cbcbd
Instruction Fuzzy Hash: 14A002D5599962BC31146155BD46C7E511CC6C4B51330595BB5029804565445C451435

Function 0002DD91 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DD79

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 88494d67e7e5fb4c46b9c7350071c1d56642ba810428b8d7385dd4191d4e117e
Instruction ID: ec581f6fc25dd6c99bb469aa5ce1506b3736e9aa34200e727de1ada88a61aa96
Opcode Fuzzy Hash: 88494d67e7e5fb4c46b9c7350071c1d56642ba810428b8d7385dd4191d4e117e
Instruction Fuzzy Hash: 14A002D5599962BC31146155BD46C7E511CC6C4B51330595BB5029804565445C451435

Function 0002DDAF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DD79

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1ae9832b31d55e0f43b45514f02d0c734d819903cb5a17773d91b6402f658946
Instruction ID: ec581f6fc25dd6c99bb469aa5ce1506b3736e9aa34200e727de1ada88a61aa96
Opcode Fuzzy Hash: 1ae9832b31d55e0f43b45514f02d0c734d819903cb5a17773d91b6402f658946
Instruction Fuzzy Hash: 14A002D5599962BC31146155BD46C7E511CC6C4B51330595BB5029804565445C451435

Function 0002DDB9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DD79

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c10409d31bd8b96b2fd829531b3a0ac1a0dc595e0a6fad84a26ca43f6285a646
Instruction ID: ec581f6fc25dd6c99bb469aa5ce1506b3736e9aa34200e727de1ada88a61aa96
Opcode Fuzzy Hash: c10409d31bd8b96b2fd829531b3a0ac1a0dc595e0a6fad84a26ca43f6285a646
Instruction Fuzzy Hash: 14A002D5599962BC31146155BD46C7E511CC6C4B51330595BB5029804565445C451435

Function 0002DDC3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DD79

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ad5317140652b954b99cc0847395a3d1225eef441c29d2e6acf787cf562f3122
Instruction ID: ec581f6fc25dd6c99bb469aa5ce1506b3736e9aa34200e727de1ada88a61aa96
Opcode Fuzzy Hash: ad5317140652b954b99cc0847395a3d1225eef441c29d2e6acf787cf562f3122
Instruction Fuzzy Hash: 14A002D5599962BC31146155BD46C7E511CC6C4B51330595BB5029804565445C451435

Function 0002DEBE Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DE9C

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f37305d6397e5b190d4aaf55bbd5ebbc70f1a0a25f49b3ba80e498b593ba5ff0
Instruction ID: ffdd4919e05f7b054688f0443855e9415cc1d4d6f4d4cc0ee03c9ac154a5c099
Opcode Fuzzy Hash: f37305d6397e5b190d4aaf55bbd5ebbc70f1a0a25f49b3ba80e498b593ba5ff0
Instruction Fuzzy Hash: C0A002D5299162BC351461557D57CBA111CC6D4B55331591AB6029804159505C451035

Function 0002DED2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DE9C

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4bac26012ea5c9277da82fd2067ed6f9e2610988ebd18c7403d9a0653c664eed
Instruction ID: ffdd4919e05f7b054688f0443855e9415cc1d4d6f4d4cc0ee03c9ac154a5c099
Opcode Fuzzy Hash: 4bac26012ea5c9277da82fd2067ed6f9e2610988ebd18c7403d9a0653c664eed
Instruction Fuzzy Hash: C0A002D5299162BC351461557D57CBA111CC6D4B55331591AB6029804159505C451035

Function 0002DEDC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DE9C

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d3b7aff073464b7500115abf3b301a11906e02367c0ed89b8544bba4a59a7d79
Instruction ID: ffdd4919e05f7b054688f0443855e9415cc1d4d6f4d4cc0ee03c9ac154a5c099
Opcode Fuzzy Hash: d3b7aff073464b7500115abf3b301a11906e02367c0ed89b8544bba4a59a7d79
Instruction Fuzzy Hash: C0A002D5299162BC351461557D57CBA111CC6D4B55331591AB6029804159505C451035

Function 0002DEE6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DE9C

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9e7a45d0e6ef48f0c5eaee7829da9c96298a33f66842992471277bfac98bb399
Instruction ID: ffdd4919e05f7b054688f0443855e9415cc1d4d6f4d4cc0ee03c9ac154a5c099
Opcode Fuzzy Hash: 9e7a45d0e6ef48f0c5eaee7829da9c96298a33f66842992471277bfac98bb399
Instruction Fuzzy Hash: C0A002D5299162BC351461557D57CBA111CC6D4B55331591AB6029804159505C451035

Function 0002DF0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DEFD

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bb129cac1079903fc0a9224977ac7e9ff88bc5fb15bb050c0dfd30b1c080b30e
Instruction ID: 6ce1314390d3fdaa74269e65ddea2ec56e20d5496ee063e0742befa6907bce08
Opcode Fuzzy Hash: bb129cac1079903fc0a9224977ac7e9ff88bc5fb15bb050c0dfd30b1c080b30e
Instruction Fuzzy Hash: 83A002D5599162BC75187255BD46C7A121CC6E4B51371591AB6029845155406C451035

Function 0002DF15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0002DEFD

Part of subcall function 0002E221: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0002E29E
Part of subcall function 0002E221: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0002E2AF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bfede1492ccfb2ea3929e18a12cca4422a9f80171217bb9fff29a85280f0fd38
Instruction ID: 6ce1314390d3fdaa74269e65ddea2ec56e20d5496ee063e0742befa6907bce08
Opcode Fuzzy Hash: bfede1492ccfb2ea3929e18a12cca4422a9f80171217bb9fff29a85280f0fd38
Instruction Fuzzy Hash: 83A002D5599162BC75187255BD46C7A121CC6E4B51371591AB6029845155406C451035

Function 0001A05F Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00019295,?,?,-00001964), ref: 0001A062

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 1ace6e2cd14aa056be99a3435b4a20615964b5a294f4c306e406d9bdad710e79
Instruction ID: d5d18c774b63ae61d67e68544556706641cde1da009ea0eb882e8a202079ad7e
Opcode Fuzzy Hash: 1ace6e2cd14aa056be99a3435b4a20615964b5a294f4c306e406d9bdad710e79
Instruction Fuzzy Hash: 9CB011B80A000AAA8E002F30CE288283A20EB2230A300A2A0A002CA0A0CB22C002AA00

Function 00019870 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,0001982C,?,?,?,?,00041F81,000000FF), ref: 0001988B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: cdf79ad3ae51f81ea54a364f6d1dea37a3872eff0dff3b058d1a3cadbd0e2690
Instruction ID: 0202607b4dcc995f163764f13bfa9108705bb4eb22032d2fba18c1b8a96e3fbf
Opcode Fuzzy Hash: cdf79ad3ae51f81ea54a364f6d1dea37a3872eff0dff3b058d1a3cadbd0e2690
Instruction Fuzzy Hash: FBF089705857145EEF308A24C9687E2B7D45B13739F045B1DD0F7434E0D76565CD8B40

Non-executed Functions

Function 0002BB70 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0001130B: GetDlgItem.USER32(00000000,00003021), ref: 0001134F
Part of subcall function 0001130B: SetWindowTextW.USER32(00000000,000435B4), ref: 00011365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0002BC01
EndDialog.USER32(?,00000006), ref: 0002BC14
GetDlgItem.USER32(?,0000006C), ref: 0002BC30
SetFocus.USER32(00000000), ref: 0002BC37
SetDlgItemTextW.USER32(?,00000065,?), ref: 0002BC71
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0002BCA8
FindFirstFileW.KERNEL32(?,?), ref: 0002BCBE
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0002BCDC
FileTimeToSystemTime.KERNEL32(?,?), ref: 0002BCEC
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0002BD08
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0002BD24
_swprintf.LIBCMT ref: 0002BD54

Part of subcall function 00013F8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00013FA2

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0002BD67
FindClose.KERNEL32(00000000), ref: 0002BD6E
_swprintf.LIBCMT ref: 0002BDC7
SetDlgItemTextW.USER32(?,00000068,?), ref: 0002BDDA
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0002BDF7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0002BE17
FileTimeToSystemTime.KERNEL32(?,?), ref: 0002BE27
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0002BE41
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0002BE59
_swprintf.LIBCMT ref: 0002BE85
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0002BE98
_swprintf.LIBCMT ref: 0002BEEC
SetDlgItemTextW.USER32(?,00000069,?), ref: 0002BEFF

Part of subcall function 0002A8CC: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0002A8F2
Part of subcall function 0002A8CC: GetNumberFormatW.KERNEL32(00000400,00000000,?,0004E600,?,?), ref: 0002A941

Strings

%s %s, xrefs: 0002BDB9, 0002BEDE
REPLACEFILEDLG, xrefs: 0002BB97
%s %s %s, xrefs: 0002BD42, 0002BE77

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: bd82038301557078f0fa888854f390d4d746bd45349f8cea5c0ddac719e3bca0
Instruction ID: dda3fc006621a5a900ebb7338d7430b0901cdc75332ba33f97f05eb811766605
Opcode Fuzzy Hash: bd82038301557078f0fa888854f390d4d746bd45349f8cea5c0ddac719e3bca0
Instruction Fuzzy Hash: A291A4B2548348BFE2219BA0DD49FFB77ECEB89704F040829F749D6082DB7596458B72

Function 000171E6 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 326fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000171EB

Part of subcall function 00017CC4: GetCurrentProcess.KERNEL32(00000020,?), ref: 00017CD3
Part of subcall function 00017CC4: GetLastError.KERNEL32 ref: 00017D19
Part of subcall function 00017CC4: CloseHandle.KERNEL32(?), ref: 00017D28

Part of subcall function 0001A320: DeleteFileW.KERNELBASE(?,?,?,000199EC,?,?,00019825,?,?,?,?,00041F81,000000FF), ref: 0001A331
Part of subcall function 0001A320: DeleteFileW.KERNEL32(?,?,?,00000800,?,?,000199EC,?,?,00019825,?,?,?,?,00041F81,000000FF), ref: 0001A35F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 0001737E
CloseHandle.KERNEL32(00000000), ref: 0001739A
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 000174C9

Strings

SeRestorePrivilege, xrefs: 00017203
\??\, xrefs: 00017267
UNC\, xrefs: 0001728C
SeCreateSymbolicLinkPrivilege, xrefs: 0001720D

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: File$CloseCreateDeleteHandle$CurrentErrorH_prologLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2517273693-3508440684
Opcode ID: ddf85be2e71d4a9fa0f991da26c3b1ca57ac800de5a754964a1aa7e0de96f131
Instruction ID: 28be8146587836f510053b16f02ed1b4526ac77b5bebbaa8ec86c8b5509c0eff
Opcode Fuzzy Hash: ddf85be2e71d4a9fa0f991da26c3b1ca57ac800de5a754964a1aa7e0de96f131
Instruction Fuzzy Hash: 9FC10471904604ABEF21EB74DC81EEEB7B8EF44304F004569F95AE7243D774AA84CB61

Function 00013206 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0001320F
_memcmp.LIBVCRUNTIME ref: 000132FC

Strings

CMT, xrefs: 00013915
h%u, xrefs: 000135B2
hc%u, xrefs: 00013600

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: 901bb4782e6cb2766531fbe7ee709e447493b0aa383f3ca0c83c54e6bfed39d5
Instruction ID: b1da4f3e8862f2bd3e47e8cfbf4628e55d57d27f59d4efd1dec30fdd7b8721fe
Opcode Fuzzy Hash: 901bb4782e6cb2766531fbe7ee709e447493b0aa383f3ca0c83c54e6bfed39d5
Instruction Fuzzy Hash: 103291715143849FEF18DF64C885AEA37E5AF55304F44447EFD8A8B283DB70AA88CB61

Function 0003D35E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0003D4A4

Strings

1#SNAN, xrefs: 0003E6A3
1#QNAN, xrefs: 0003E6AA
1#IND, xrefs: 0003E69C
1#INF, xrefs: 0003E6B1

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 2d9daa618a138f3d0aff907f8e2f2ad160b287d65b44b24cd42e2b56c030cebe
Instruction ID: d6003b4505dda06e2ade5c5d314a6cdcc5da1fc23092283771bc3b91b61687a0
Opcode Fuzzy Hash: 2d9daa618a138f3d0aff907f8e2f2ad160b287d65b44b24cd42e2b56c030cebe
Instruction Fuzzy Hash: FBC23B71E086288FDB66CE28DD407EAB7F9EB45304F1542EAD44DE7281E774AE818F40

Function 0001276D Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 794COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00012776
_strlen.LIBCMT ref: 00012D04

Part of subcall function 00021692: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0001B842,00000000,?,?,?,0001047C), ref: 000216AE

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00012E65

Strings

CMT, xrefs: 00012E98

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 5e306f059851e164fef947c3232a360b4913cd9450e92e5cff334181ccc26b88
Instruction ID: 3641e58c4649af3d3e3eabc0061e769b87a3a4604b0bf838a051ab7bf71d1139
Opcode Fuzzy Hash: 5e306f059851e164fef947c3232a360b4913cd9450e92e5cff334181ccc26b88
Instruction Fuzzy Hash: 8462F4719042448FDF29DF78C885AEA3BE1AF54304F09457EED9A8B283DB7099D5CB50

Function 0003898F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00038A87
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00038A91
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 00038A9E

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 582235e15ab21b42c2be5a93047beba66ca23c30db767cb16491fd2168659438
Instruction ID: fa477f12a320d8b234e2e80c0b40e12c742eb931ffa041fcc0dae9cee373a9a2
Opcode Fuzzy Hash: 582235e15ab21b42c2be5a93047beba66ca23c30db767cb16491fd2168659438
Instruction Fuzzy Hash: 1531B37590122D9BDB61DF64D9897DCBBB8BF08310F5081EAE80CA7261EB349B858F45

Function 0003ADB8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0003AF4B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 759ce7731a7ac902f2cfeaf7ea2cecb54a26d5b188d7062116f380a4567ecc7a
Instruction ID: a34c6abb1561ad859f2f4b0eb8b3f14104593c0ca421658bf025049f1a9276ef
Opcode Fuzzy Hash: 759ce7731a7ac902f2cfeaf7ea2cecb54a26d5b188d7062116f380a4567ecc7a
Instruction Fuzzy Hash: AC3128B1A002496FCB269F78CC84DFB7BBDDF86314F1401A8F459C7251E6309D458B61

Function 0003CEB0 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c71cb9696925a17b0f1ed029d90042ab8403ec90c4966a08425d5b2b74d4a4
Instruction ID: eca7826bac441c4f0fcbfbb7c4b3e4e86ddc3533bcba16661cff0d6f6a7775ac
Opcode Fuzzy Hash: e4c71cb9696925a17b0f1ed029d90042ab8403ec90c4966a08425d5b2b74d4a4
Instruction Fuzzy Hash: CD022B71E002199BDF15CFA9D8806AEFBF5FF88314F25826AD919E7241D731AE41CB80

Function 0002A8CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0002A8F2
GetNumberFormatW.KERNEL32(00000400,00000000,?,0004E600,?,?), ref: 0002A941

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 59a9130c0da75f333038d7142e441b2dde90175609e476058a7bed4591795b21
Instruction ID: 8a8dd87a3793672a420de0972db7120360c5b834834a018971f4150803d2815a
Opcode Fuzzy Hash: 59a9130c0da75f333038d7142e441b2dde90175609e476058a7bed4591795b21
Instruction Fuzzy Hash: 46015E7A100398BBEB108F64EC45F9BB7BCEF19720F005422FA0497161D3749A158BA9

Function 00016EA8 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00017016,00000000,00000400), ref: 00016EA8
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00016EC9

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 991dbc8528f3a0c7c9c8395511042b3be4ee3415459c2fe8f5c638e39496c28e
Instruction ID: 9c05f62cffbf050f566bc6044fab8003f77fca8a02d947e9447b486e7b2757d3
Opcode Fuzzy Hash: 991dbc8528f3a0c7c9c8395511042b3be4ee3415459c2fe8f5c638e39496c28e
Instruction Fuzzy Hash: DAD0A7783C43017EFE200B70EC05F7A3BE06706B42F10D7047342D80D0C57180249618

Function 00041464 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0004145F,?,?,00000008,?,?,000410FF,00000000), ref: 00041691

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e2992be0efbc831edc64672549e2d5be4a8c195f533d07af82f1999883a89197
Instruction ID: 7fb12d0ed156e2f3429f2c2e984326ca578fbd356f95fcb9fe46988c18de0d48
Opcode Fuzzy Hash: e2992be0efbc831edc64672549e2d5be4a8c195f533d07af82f1999883a89197
Instruction Fuzzy Hash: 6CB15FB5610608DFD755CF28C48ABA57BF0FF45364F298668E89ACF2A1C335E981CB44

Function 00013FFE Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

gj, xrefs: 00014041

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 76da12711b98701d9019d12b562aa71a8901b2bab4d42bb9d0e97fbae46e3d24
Instruction ID: f576e378357f01b4aea7ec9d1b6d805917e3cbcfbc8cef2448f1574ea6c7a412
Opcode Fuzzy Hash: 76da12711b98701d9019d12b562aa71a8901b2bab4d42bb9d0e97fbae46e3d24
Instruction Fuzzy Hash: 05F1D2B1A083418FD348CF29D880A5AFBE1BFCC208F15992EF598D7711E634E9558F56

Function 0001AEE5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0001AF0A

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 071fb1271169854c4514cec61e1232a0ffea7202bbe4e3776c770a1016e6820b
Instruction ID: 12fe32bbd4de034ec6d9c755de478be5ab9c7f0664d90ac1e0e814b9f1ac5c96
Opcode Fuzzy Hash: 071fb1271169854c4514cec61e1232a0ffea7202bbe4e3776c770a1016e6820b
Instruction Fuzzy Hash: 22F06DF4A0030C8BDB28CB58ED456EA73A1F74A311F2002A9DA1943354D378AD81CF55

Function 0002F303 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F310,0002ED75), ref: 0002F308

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e3b178ea22c9bb292d666ace5cafab607425646f2851f2bfaf46532a0d882164
Instruction ID: c935b6ad48722b21f943258a47a9f8fa7a5eb84d4601f2a4404285b67f884264
Opcode Fuzzy Hash: e3b178ea22c9bb292d666ace5cafab607425646f2851f2bfaf46532a0d882164
Instruction Fuzzy Hash:

Function 0003BAA0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0003BAA0

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4cca32fe855ba35ed4a6f25527658a5df79aba21b12ae28567a335641b81ef22
Instruction ID: 0b32d83095629ed29bbf14e85c4b57e9f3401cb7bf9b1b92af032032170b01c2
Opcode Fuzzy Hash: 4cca32fe855ba35ed4a6f25527658a5df79aba21b12ae28567a335641b81ef22
Instruction Fuzzy Hash: 05A001F8A112018BA7408F7AAA193493AA9BB466917099269A509D61B0EA2C85A49F05

Function 00025EB8 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fe8b68d85eb5d17935bfec2f030431fd039ced6a7f16b8f26ca7e07dbe69ab
Instruction ID: 8491219e4f33d836b94480262dac2b4724b5477b2753a324764d72e29f38fef6
Opcode Fuzzy Hash: 47fe8b68d85eb5d17935bfec2f030431fd039ced6a7f16b8f26ca7e07dbe69ab
Instruction Fuzzy Hash: C3624731604B958FCB29CF38E8906F9BBE1AF55304F08896ED8EB8B342D631E945C714

Function 000272FF Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1934457230b8a5889079426b7d709a5a451781bce21afd7ed3a4cdc0267fc13d
Instruction ID: dd621915a3c899025f1516b27250dcece3693823fe69d93be978f7e50a8968e0
Opcode Fuzzy Hash: 1934457230b8a5889079426b7d709a5a451781bce21afd7ed3a4cdc0267fc13d
Instruction Fuzzy Hash: BD6224706087969FC729CF28D8806B9FBE1BF55304F14866ED9AE87742D730EA55CB80

Function 0001EFEF Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f5bd359781b5b3123466a5dc6871deb785564998a4d1fc58e8050fbd07c65a
Instruction ID: 4dc8c2ecaed24e0ed5f604b8f7960272a81ef5cbcac95c63bb8abf3ca50b95bb
Opcode Fuzzy Hash: 08f5bd359781b5b3123466a5dc6871deb785564998a4d1fc58e8050fbd07c65a
Instruction Fuzzy Hash: 3F523B726047018FC718CF19C891A6AF7E1FFCC304F498A2DE98597255D734EA59CB86

Function 00026CBC Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3dd3ff4408fdf19bb955616eecb27f7934ae5e9513e661c58e8089dc0526ed6
Instruction ID: 6f6ad0ab6a9aca321087fab54c9128829d4e8e41f1c55d0432bd1c16ba7571a5
Opcode Fuzzy Hash: c3dd3ff4408fdf19bb955616eecb27f7934ae5e9513e661c58e8089dc0526ed6
Instruction Fuzzy Hash: FA12F4B16047168BCB28CF28E9D07B9B3E1FF54308F10492EE59BC7A81D775A8A4CB45

Function 0001C017 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d077c6873a9c74c4dbc00ca0b35b3c3f4b088f93bdf930808bec61d931da8e
Instruction ID: 1710876e3ae7fb50547ac6feefdb85bc118df0183769ef4fca46d94df899a115
Opcode Fuzzy Hash: 32d077c6873a9c74c4dbc00ca0b35b3c3f4b088f93bdf930808bec61d931da8e
Instruction Fuzzy Hash: E7F1BA71A483018FD764CF28C4849AEBBE2EFC9714F548A2EF4D597252D730E985CB52

Function 00030DE3 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 77cd3a3b386e8bed31a6b1180f8e9a34d6f70c49afded03eb6bab3fae4d50d83
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: AAC192322060930AEFAE4639C53457FBAE95BD27B1B1A076ED4F6CB0C5FE20C564D620

Function 00031218 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 404119c568637d09ebb33722c633b617f14b1b822431bb325292820c6513edb9
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: F4C174322061934BEBAE463A853457FBAE55BD27B171A076ED4F7CB0C5FE10C524D620

Function 000309AE Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: ce8feb11a7bfcfa9aea484a0d1fd6af05abeee74cd07c4673a08fdfd4e9abd6f
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: CDC19F322161930BEFAE4639853453FFAE95BE27B171A076ED4F6CB1C5FE20C5249620

Function 00030596 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 910f5317bdaaa5e2fe25656c311ec87cad9cb9d8ce8456bc2607d542ba38cd31
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: B7C1723220A1530AEFAE4639C53453FBAE95BE27B171A076ED4F6CB1C9FE20D524D610

Function 0001E57B Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c733347e432c5370c4f4b21c7d2972b5ef9b204b0fd0527f52f259d5cde18743
Instruction ID: 196b48e847992f00cfb0691a43c160e1cba842168ee19f4c6708a10a97da7e2d
Opcode Fuzzy Hash: c733347e432c5370c4f4b21c7d2972b5ef9b204b0fd0527f52f259d5cde18743
Instruction Fuzzy Hash: 31E117745183848FD304CF29D8905ABBBF0BB8A301F89496EF9D597352C236E919DF62

Function 00023C7D Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3de862736fa759ab1a4f332156b41f12bf147e2cfccb8d80ac070fbe34d2d0
Instruction ID: 1c72eae2f605fb98d8713ee50b88c77f41673f69d54096b28b576cc11b96953d
Opcode Fuzzy Hash: 2c3de862736fa759ab1a4f332156b41f12bf147e2cfccb8d80ac070fbe34d2d0
Instruction Fuzzy Hash: 569157B02043559BDB24EF64F895BFEB7D5AB51300F10092DE997872C3EB789688C752

Function 00034C39 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd80cbe972f84f10c5728996baee0bad5a8ee5275275e37d730f5ec6e10aaefe
Instruction ID: c7fb68f7e4521b61098453c2f5ae1f9d9f1f8b711e473a16b454c07dca18e61c
Opcode Fuzzy Hash: cd80cbe972f84f10c5728996baee0bad5a8ee5275275e37d730f5ec6e10aaefe
Instruction Fuzzy Hash: C3616571610B09A7DEFB9A288892BFE23DCEF41700F14091AE883DF2A2D715BD42C355

Function 00023FAE Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7143b401136632ee41cc728dc3e906afaa0c283aea16f65d0c64829696432638
Instruction ID: 7b4df9ad72cd87ac984ffedd5760fab405a183d1caadbb15a48cff06f84b6af9
Opcode Fuzzy Hash: 7143b401136632ee41cc728dc3e906afaa0c283aea16f65d0c64829696432638
Instruction Fuzzy Hash: E37179717043A59BDB34DF28E8C1BED77D0ABA1304F00092DEA868B683DA7489C9C752

Function 00034A0A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: 134d41f0c3c16260af7c90533eaa01d3c0cd50d4aac3770020a1deef253ea95e
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 69518861680F4497DBBB896889967FFB7CD9B12300F180549E982CF293C719FE45835B

Function 0001E147 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7696b65dccb8ed960e7a82359ae72344445c19be522e06d79cdccfac804f7975
Instruction ID: 22fec0c4e5bdf08937be6707a25d9d6e665ecc980002150228f905ada08b8f8e
Opcode Fuzzy Hash: 7696b65dccb8ed960e7a82359ae72344445c19be522e06d79cdccfac804f7975
Instruction Fuzzy Hash: 128182912597E49EE7564F7C7CA42FA3FA55733202B5C00BAC8C987263D13A4A98D721

Function 0001EB7B Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73551f061fbeb237f9014dff11d003de8ea5e13542a180f5d2115c1830f23470
Instruction ID: 86b88d979d8b020a1bc10303ed5965fa1b381c6c6cb3820d090d373c9638cb1e
Opcode Fuzzy Hash: 73551f061fbeb237f9014dff11d003de8ea5e13542a180f5d2115c1830f23470
Instruction Fuzzy Hash: 4D519D7150C3D14EC712CF29D5944EFBFE1AF9A318F5948AEE8D54A213C230968ACB92

Function 0001FC43 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9283e6247ddc9768b49c9927b64c578dc6b69cecf71d930ef571c3427fa84bef
Instruction ID: a6a00897ad89c38520f2e866814ae2dae56d8d0b0d6400b0dfce51ef5f61e669
Opcode Fuzzy Hash: 9283e6247ddc9768b49c9927b64c578dc6b69cecf71d930ef571c3427fa84bef
Instruction Fuzzy Hash: FE5136B1A083068BC748CF19D48059AF7E1FF88314F058A2EE899A3741DB34E959CBD6

Function 00023A02 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52abad45f79ce36a7b19b15fd8adf95ea09ff33d00a420e695b3def5234c655d
Instruction ID: 44470effdff214bd8e0ef80e512f2b2648cb21b166af2c5d9e33ec99a2c52c46
Opcode Fuzzy Hash: 52abad45f79ce36a7b19b15fd8adf95ea09ff33d00a420e695b3def5234c655d
Instruction Fuzzy Hash: 2231F2B26047559FCB14DF28C8516AEBBD0FB96300F10492DE4C5C7742D739EA89CB92

Function 00015EBC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7984eaeb5f872894f55277456badf67e2d6eccc95b61acfb6359050129d02c0d
Instruction ID: 8f90ed233738c8993d3ac2dd0939c543f15bfd1310a9ed0009f6cd2e2bea04ca
Opcode Fuzzy Hash: 7984eaeb5f872894f55277456badf67e2d6eccc95b61acfb6359050129d02c0d
Instruction Fuzzy Hash: 55210775A202618FCB88CF2EDD9047A7791E78A312746813BEA42CB2D0C538F965C7A0

Function 0002C085 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0002C08A

Part of subcall function 0002ACC6: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0002AD8E

SetWindowTextW.USER32(?,?), ref: 0002C3B7
_wcsrchr.LIBVCRUNTIME ref: 0002C541
GetDlgItem.USER32(?,00000066), ref: 0002C57C
SetWindowTextW.USER32(00000000,?), ref: 0002C58C
SendMessageW.USER32(00000000,00000143,00000000,0005A472), ref: 0002C59A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0002C5C5

Strings

<br>, xrefs: 0002C31A
Software\Microsoft\Windows\CurrentVersion, xrefs: 0002C460
%s.%d.tmp, xrefs: 0002C286
ProgramFilesDir, xrefs: 0002C48B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: 01d83a1ad9707d7b69a686b6fafd2faa1e1db2690d74ecbd4afe96c1a4b6693d
Instruction ID: 0266d797a19996f9204e0fc24d640ce1889bcff805f4ca73f9d5acc67a5fb436
Opcode Fuzzy Hash: 01d83a1ad9707d7b69a686b6fafd2faa1e1db2690d74ecbd4afe96c1a4b6693d
Instruction Fuzzy Hash: 16E19476D00628AAEB25DBA0EC85DEF77BCAF15311F4000A6F909E7051EB749FC48B51

Function 0001DD73 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0001DD99

Part of subcall function 00013F8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00013FA2

Part of subcall function 000218AE: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00050EE8,?,0001D4C2,00000000,?,00000050,00050EE8), ref: 000218CB

_strlen.LIBCMT ref: 0001DDBA
SetDlgItemTextW.USER32(?,0004E154,?), ref: 0001DE1A
GetWindowRect.USER32(?,?), ref: 0001DE54
GetClientRect.USER32(?,?), ref: 0001DE60
GetWindowLongW.USER32(?,000000F0), ref: 0001DF00
GetWindowRect.USER32(?,?), ref: 0001DF2D
SetWindowTextW.USER32(?,?), ref: 0001DF70
GetSystemMetrics.USER32(00000008), ref: 0001DF78
GetWindow.USER32(?,00000005), ref: 0001DF83
GetWindowRect.USER32(00000000,?), ref: 0001DFB0
GetWindow.USER32(00000000,00000002), ref: 0001E022

Strings

CAPTION, xrefs: 0001DF52
d, xrefs: 0001DE80
$%s:, xrefs: 0001DD8D

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 9f823f99bceb3d96d1cc98150a1c2a80cb1c7b7ba6da8dcddde25177a8bef4ac
Instruction ID: 004da627160d35e06d3e99c2b7d19298bc3e391a468303a2949154a6566c49d3
Opcode Fuzzy Hash: 9f823f99bceb3d96d1cc98150a1c2a80cb1c7b7ba6da8dcddde25177a8bef4ac
Instruction Fuzzy Hash: 1381B271508341AFD714DF68CD84AAFBBE9FBC8704F04092DFA88E7251D674E9458B52

Function 0003C592 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0003C5D6

Part of subcall function 0003C171: _free.LIBCMT ref: 0003C18E
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C1A0
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C1B2
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C1C4
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C1D6
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C1E8
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C1FA
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C20C
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C21E
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C230
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C242
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C254
Part of subcall function 0003C171: _free.LIBCMT ref: 0003C266

_free.LIBCMT ref: 0003C5CB

Part of subcall function 000387FE: RtlFreeHeap.NTDLL(00000000,00000000,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?), ref: 00038814
Part of subcall function 000387FE: GetLastError.KERNEL32(?,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?,?), ref: 00038826

_free.LIBCMT ref: 0003C5ED
_free.LIBCMT ref: 0003C602
_free.LIBCMT ref: 0003C60D
_free.LIBCMT ref: 0003C62F
_free.LIBCMT ref: 0003C642
_free.LIBCMT ref: 0003C650
_free.LIBCMT ref: 0003C65B
_free.LIBCMT ref: 0003C693
_free.LIBCMT ref: 0003C69A
_free.LIBCMT ref: 0003C6B7
_free.LIBCMT ref: 0003C6CF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: a225bf2f8812807e983504bdfcaf642f0775d0d1682640617bb6576566ae231f
Instruction ID: 2bdd5c0573d8d0526fba23d5b935f25c97a0d743e9203cae2280b80034f1867e
Opcode Fuzzy Hash: a225bf2f8812807e983504bdfcaf642f0775d0d1682640617bb6576566ae231f
Instruction Fuzzy Hash: AF316F72604705AFEF62AA39D946F9673EEBF00310F249469F548EB152DF31EC808B24

Function 0002CFEE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0002D011
GetClassNameW.USER32(00000000,?,00000800), ref: 0002D03D

Part of subcall function 00021AC4: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0001B250,?,?,?,0001B1FE,?,-00000002,?,00000000,?), ref: 00021ADA

GetWindowLongW.USER32(00000000,000000F0), ref: 0002D059
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0002D070
GetObjectW.GDI32(00000000,00000018,?), ref: 0002D084
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0002D0AD
DeleteObject.GDI32(00000000), ref: 0002D0B4
GetWindow.USER32(00000000,00000002), ref: 0002D0BD

Strings

STATIC, xrefs: 0002D043

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 44e72943b1382ab76ffc78cd7eb050ea9773815df21f86f86046367c58b041a4
Instruction ID: d50bcec638fbcf6bedd5b4da8c6693c7e75c986641a5ef5936c7a5657589bd7c
Opcode Fuzzy Hash: 44e72943b1382ab76ffc78cd7eb050ea9773815df21f86f86046367c58b041a4
Instruction Fuzzy Hash: 9511E1329453307BF2706BB0EC89FEF769DFB64710F404422FA45B50A3CA688D8686B5

Function 000391C1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000391D5

Part of subcall function 000387FE: RtlFreeHeap.NTDLL(00000000,00000000,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?), ref: 00038814
Part of subcall function 000387FE: GetLastError.KERNEL32(?,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?,?), ref: 00038826

_free.LIBCMT ref: 000391E1
_free.LIBCMT ref: 000391EC
_free.LIBCMT ref: 000391F7
_free.LIBCMT ref: 00039202
_free.LIBCMT ref: 0003920D
_free.LIBCMT ref: 00039218
_free.LIBCMT ref: 00039223
_free.LIBCMT ref: 0003922E
_free.LIBCMT ref: 0003923C

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98e66a147431afabe1c5ca08c9bdfb0b3ef68972fa83c6fba02d160b194d4340
Instruction ID: b707b341ada025afdd1e9ae6d84cfbbe3fc1523fa07c44e31143fc578d749e7e
Opcode Fuzzy Hash: 98e66a147431afabe1c5ca08c9bdfb0b3ef68972fa83c6fba02d160b194d4340
Instruction Fuzzy Hash: 9C11777A514248AFCF16EF59C942CD93BAAFF04350F6181A5BA084F137DA31DE509B84

Function 000120E7 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

x%u, xrefs: 000125FF
xc%u, xrefs: 0001265C
;%u, xrefs: 0001241C

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: 4a0a98bef46b02f2533228d7a21d157f11e9b58aa296ca018910f072982aae39
Instruction ID: 62f79414e9839b51a495b149c9e86fb139f1bbce6263eb45a7851dc5fbf03771
Opcode Fuzzy Hash: 4a0a98bef46b02f2533228d7a21d157f11e9b58aa296ca018910f072982aae39
Instruction Fuzzy Hash: 81F1FA71A083809BEB15EB6888D5FFE77D96F90300F080579F9858B283DA64D9D4C762

Function 0002AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0001130B: GetDlgItem.USER32(00000000,00003021), ref: 0001134F
Part of subcall function 0001130B: SetWindowTextW.USER32(00000000,000435B4), ref: 00011365

EndDialog.USER32(?,00000001), ref: 0002AFB0
SendMessageW.USER32(?,00000080,00000001,?), ref: 0002AFD7
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0002AFF0
SetWindowTextW.USER32(?,?), ref: 0002B001
GetDlgItem.USER32(?,00000065), ref: 0002B00A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0002B01E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0002B034

Strings

LICENSEDLG, xrefs: 0002AF74

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 87126c6082418bc4a06769e757623b07cf5e9666901dc017fdac60c799fdb62a
Instruction ID: 81eb13592fa128b5ab6e73427ef3470985462d849c362889b3ca2d92fff83ed9
Opcode Fuzzy Hash: 87126c6082418bc4a06769e757623b07cf5e9666901dc017fdac60c799fdb62a
Instruction Fuzzy Hash: 96218572644210BBF2615B61ED89F7B7BADFB4A751F000024F609A50A1DF5D68419772

Function 000195E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000195E5
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00019608
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00019627

Part of subcall function 00021AC4: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0001B250,?,?,?,0001B1FE,?,-00000002,?,00000000,?), ref: 00021ADA

_swprintf.LIBCMT ref: 000196C3

Part of subcall function 00013F8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00013FA2

MoveFileW.KERNEL32(?,?), ref: 00019732
MoveFileW.KERNEL32(?,?), ref: 00019772

Strings

rtmp%d, xrefs: 000196AC

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: 93ef564fba12ab20aa5ba0d4ae5f2da1192b48660623ef95b0ca362be8b71118
Instruction ID: 99ab3bf9ca2ec77a102497b06ee029014b31511493fc16df193b2f08e6661a48
Opcode Fuzzy Hash: 93ef564fba12ab20aa5ba0d4ae5f2da1192b48660623ef95b0ca362be8b71118
Instruction Fuzzy Hash: BF4131759112686ADF20EFA0DC95EDE73BCAF51380F1444E5B549E3082DB349BC9CBA4

Function 000290A2 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00029178
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00029199
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 000291C0

Strings

<html>, xrefs: 000290E7, 00029120
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 000290F2
</html>, xrefs: 0002914A
utf-8"></head>, xrefs: 000290FD

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: 0adaa78250a33a190c781a6109c7546ecd5ec234e311f5bd73d91070a085fe11
Instruction ID: ee43450ac99e92f55ff6b5fdcf790b15eacc1057effe9c563e09b2fd982545a4
Opcode Fuzzy Hash: 0adaa78250a33a190c781a6109c7546ecd5ec234e311f5bd73d91070a085fe11
Instruction Fuzzy Hash: 76317D755043267BD725BB60AC46FEF7B9CEF82320F104019F904561C3EF649A0883A5

Function 00020D5A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00020D6D

Part of subcall function 0001AEE5: GetVersionExW.KERNEL32(?), ref: 0001AF0A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00020D90
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00020DA2
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00020DB3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00020DC3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00020DD3
FileTimeToSystemTime.KERNEL32(?,?), ref: 00020E0D
__aullrem.LIBCMT ref: 00020E9B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 79257488a80b0f03c0d9c3132d39c2173f5fc236076421da4ae3ded753042c0f
Instruction ID: cc34ec7acd35d6238b5762786aa4944522e10f6ca2831d508e1f9945c6e67946
Opcode Fuzzy Hash: 79257488a80b0f03c0d9c3132d39c2173f5fc236076421da4ae3ded753042c0f
Instruction Fuzzy Hash: 914157B64083159FC714DF64D8809ABFBF8FB88714F004E2EF59282650E738E588CB62

Function 0003F0FD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0003F872,00000000,00000000,00000000,00000000,00000000,00034D0F), ref: 0003F13F
__fassign.LIBCMT ref: 0003F1BA
__fassign.LIBCMT ref: 0003F1D5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0003F1FB
WriteFile.KERNEL32(?,00000000,00000000,0003F872,00000000,?,?,?,?,?,?,?,?,?,0003F872,00000000), ref: 0003F21A
WriteFile.KERNEL32(?,00000000,00000001,0003F872,00000000,?,?,?,?,?,?,?,?,?,0003F872,00000000), ref: 0003F253

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 1cecdf2afab1d90459f8dd30f6b217905c7f11eb18534d4cdc2f76556e989850
Instruction ID: 6f07e8ee47a97c6759ab37af0b1bb7bdd0243a34bb67fee986d20a057caaeb7a
Opcode Fuzzy Hash: 1cecdf2afab1d90459f8dd30f6b217905c7f11eb18534d4cdc2f76556e989850
Instruction Fuzzy Hash: FD51C1B4E0024ADFDB11CFA8D885AEFBBF8EF09300F14412AE955E7291D774A951CB60

Function 00029878 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00029891
GetWindowRect.USER32(?,00000000), ref: 000298E7
ShowWindow.USER32(?,00000005,00000000), ref: 0002997E
SetWindowTextW.USER32(?,00000000), ref: 00029986
ShowWindow.USER32(00000000,00000005), ref: 0002999C

Strings

RarHtmlClassName, xrefs: 00029948

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: a642f7089feecbfa3fc831436bb9d715104b0b5e72c9b8a076da195841a2c4c6
Instruction ID: fd4fb550fffe4c58f76a79eebab85ebb0d761d4c492994328f3f83c0a950fee1
Opcode Fuzzy Hash: a642f7089feecbfa3fc831436bb9d715104b0b5e72c9b8a076da195841a2c4c6
Instruction Fuzzy Hash: 5341B031404224AFEB219F65EC4CB5B7BA8FF49710F04456DFA09A9166CB38D990CB61

Function 0003C314 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0003C2D8: _free.LIBCMT ref: 0003C301

_free.LIBCMT ref: 0003C362

Part of subcall function 000387FE: RtlFreeHeap.NTDLL(00000000,00000000,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?), ref: 00038814
Part of subcall function 000387FE: GetLastError.KERNEL32(?,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?,?), ref: 00038826

_free.LIBCMT ref: 0003C36D
_free.LIBCMT ref: 0003C378
_free.LIBCMT ref: 0003C3CC
_free.LIBCMT ref: 0003C3D7
_free.LIBCMT ref: 0003C3E2
_free.LIBCMT ref: 0003C3ED

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b4869a11d69ac16d31ffc0356dc65cdab29eeda7956d265d3493ae357e3f0567
Instruction ID: 68c628f61ff70f6a52d0da707c03678b13e25a52572c01950236a04ac7fb3ed1
Opcode Fuzzy Hash: b4869a11d69ac16d31ffc0356dc65cdab29eeda7956d265d3493ae357e3f0567
Instruction Fuzzy Hash: CB111F72584B08BAE922BBB1CC4BFCB779DAF14700F404D15B6AAFA063DE65B5054790

Function 0003236A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00032361,0002FDB2), ref: 00032378
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00032386
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0003239F
SetLastError.KERNEL32(00000000,?,00032361,0002FDB2), ref: 000323F1

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 538097cd8884ba0209240f1202bc7fecdc46acaa5ab9e5d91f8c58facf96d370
Instruction ID: f060b8e60bf5545bb0a45b4301fa72ec4d4e927881514b059b39f30839be0377
Opcode Fuzzy Hash: 538097cd8884ba0209240f1202bc7fecdc46acaa5ab9e5d91f8c58facf96d370
Instruction Fuzzy Hash: 9B01D8765093116FB6662B74BDC559A269CFB12374F210629F110451E2EF194D015158

Function 0002DF61 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

ReleaseSRWLockExclusive, xrefs: 0002DFA0
AcquireSRWLockExclusive, xrefs: 0002DF90
KERNEL32.DLL, xrefs: 0002DF7B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 27aeddb271ce8f65d03e5f0950a53f4decb82c9d4f38e2a192d826304d52ac1d
Instruction ID: 985f72870fa5c9fb069723233cf8c1a76ef7ec489b705dc86359a38e145eab32
Opcode Fuzzy Hash: 27aeddb271ce8f65d03e5f0950a53f4decb82c9d4f38e2a192d826304d52ac1d
Instruction Fuzzy Hash: 1A01F9B57422329BAFE15F747E9069763D45B42317310527BF507EB140D618CC8592AC

Function 00020F8E Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00020FDD

Part of subcall function 0001AEE5: GetVersionExW.KERNEL32(?), ref: 0001AF0A

LocalFileTimeToFileTime.KERNEL32(?,00020F88), ref: 00021001
FileTimeToSystemTime.KERNEL32(?,?), ref: 00021017
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00021026
SystemTimeToFileTime.KERNEL32(?,00020F88), ref: 00021034
SystemTimeToFileTime.KERNEL32(?,?), ref: 00021042

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: a2f8584bd767bbce6345d3dce31564039dcd317c215cd40997024a224a5e4e48
Instruction ID: f8409100df388a7bf1693b2a819cf68c4ad0ef5260a32814b4a2503b2693fc32
Opcode Fuzzy Hash: a2f8584bd767bbce6345d3dce31564039dcd317c215cd40997024a224a5e4e48
Instruction Fuzzy Hash: CD311A7A90024AEBCB10DFE4D9859EFFBBCFF58300B04451AE915E3210E7349A85CB69

Function 00029400 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00029424
_memcmp.LIBVCRUNTIME ref: 0002943B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 6ad755461b5f66880c4c49805c0627fce15da44b0e294637d634c16e4af92be8
Instruction ID: 81acf99b635498cde1f851f2a805b5781000bf28752ad182d42c8398c6f7dc17
Opcode Fuzzy Hash: 6ad755461b5f66880c4c49805c0627fce15da44b0e294637d634c16e4af92be8
Instruction Fuzzy Hash: 5E2195B160022EABD719AE10DD41F7F77ADAB51B85F108125FC089F113F770DD468691

Function 000392B5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00050F50,000340E4,00050F50,?,?,00033B5F,?,?,00050F50), ref: 000392B9
_free.LIBCMT ref: 000392EC
_free.LIBCMT ref: 00039314
SetLastError.KERNEL32(00000000,?,00050F50), ref: 00039321
SetLastError.KERNEL32(00000000,?,00050F50), ref: 0003932D
_abort.LIBCMT ref: 00039333

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 400a75818c6ca9545cc0f34b6925702beb4227fe19aa59bfa1233d9e49794362
Instruction ID: 8a3f75505c7d240ecf8a52714914776a402bd2335e4dc22c7a02874c7f90c08a
Opcode Fuzzy Hash: 400a75818c6ca9545cc0f34b6925702beb4227fe19aa59bfa1233d9e49794362
Instruction Fuzzy Hash: 5BF028BA504A0036D7133339BD0ABAF2AAE9BC3760F350554F655A31D3EEA8C9024128

Function 0002D5A3 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0002D5AF
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0002D5C9
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0002D5DA
TranslateMessage.USER32(?), ref: 0002D5E4
DispatchMessageW.USER32(?), ref: 0002D5EE
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0002D5F9

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: d444c8586c8412bf539fae330b4160a01ad0e270e0fc78a8a04ab237525b7799
Instruction ID: b1e7ee9f03200259c0e37c5f3c0f5c00ae1afe0898fabd184a1ea90c83885836
Opcode Fuzzy Hash: d444c8586c8412bf539fae330b4160a01ad0e270e0fc78a8a04ab237525b7799
Instruction Fuzzy Hash: ECF03C72E01229ABDB206BA1EC4DEDBBF6DFF52351B008512F60AE2011D6389941C7F0

Function 0002C7C3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0002C7D9
_swprintf.LIBCMT ref: 0002C80D

Part of subcall function 00013F8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00013FA2

SetDlgItemTextW.USER32(?,00000066,0005946A), ref: 0002C82D
EndDialog.USER32(?,00000001), ref: 0002C941

Strings

%s%s%u, xrefs: 0002C802

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf
String ID: %s%s%u
API String ID: 3182297613-1360425832
Opcode ID: 4a78a775255a8fbfe85bfbcba0a79115eac2e7063a729a031c03f10565b6a782
Instruction ID: b70636c43ef6db4c8eb8acaa70204e17127d43776bea3b2befcfc34dbd0a6dda
Opcode Fuzzy Hash: 4a78a775255a8fbfe85bfbcba0a79115eac2e7063a729a031c03f10565b6a782
Instruction Fuzzy Hash: 4A418771D00628AAEB25DBA0EC85EDE77BCEF05301F1040A6E509E6151EB759BC4CF51

Function 0002B07D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0002B08D
GetObjectW.GDI32(00000000,00000018,?), ref: 0002B0B2
DeleteObject.GDI32(00000000), ref: 0002B0E4
DeleteObject.GDI32(00000000), ref: 0002B107

Part of subcall function 0002A07C: FindResourceW.KERNEL32(0002B0DD,PNG,?,?,?,0002B0DD,00000066), ref: 0002A08E
Part of subcall function 0002A07C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,0002B0DD,00000066), ref: 0002A0A6
Part of subcall function 0002A07C: LoadResource.KERNEL32(00000000,?,?,?,0002B0DD,00000066), ref: 0002A0B9
Part of subcall function 0002A07C: LockResource.KERNEL32(00000000,?,?,?,0002B0DD,00000066), ref: 0002A0C4

Strings

], xrefs: 0002B0BA

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID: ]
API String ID: 142272564-3352871620
Opcode ID: 04732cfb9c25e5496208429a6cc78524c20e918314e64dfb29fe7caca591a53c
Instruction ID: 09c179443d3e49a9da831423712f20312cb1bbf750053a4d01b7a9dad1114435
Opcode Fuzzy Hash: 04732cfb9c25e5496208429a6cc78524c20e918314e64dfb29fe7caca591a53c
Instruction Fuzzy Hash: 6001D632940325A7E7623764BC45BBFBBAAEF82751F040015FD14B7292DF368C1586B1

Function 0002CF50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0001130B: GetDlgItem.USER32(00000000,00003021), ref: 0001134F
Part of subcall function 0001130B: SetWindowTextW.USER32(00000000,000435B4), ref: 00011365

EndDialog.USER32(?,00000001), ref: 0002CF9B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0002CFB1
SetDlgItemTextW.USER32(?,00000066,?), ref: 0002CFC5
SetDlgItemTextW.USER32(?,00000068), ref: 0002CFD4

Strings

RENAMEDLG, xrefs: 0002CF68

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 2a1db7ff946706611397dc57f321dfc4d13216810221327bcc40682fb58d6f19
Instruction ID: 02f31de87bc834f0158c7dfc98f3b2696c3e22e06749ed6312b61a6c0f16c45a
Opcode Fuzzy Hash: 2a1db7ff946706611397dc57f321dfc4d13216810221327bcc40682fb58d6f19
Instruction Fuzzy Hash: 6D0128326C43207EF6A04F68AE08FAF779EFB59702F000431F306A60D0C6B958058775

Function 00037893 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00037844,?,?,000377E4,?,0004BAD8,0000000C,0003793B,?,00000002), ref: 000378B3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000378C6
FreeLibrary.KERNEL32(00000000,?,?,?,00037844,?,?,000377E4,?,0004BAD8,0000000C,0003793B,?,00000002,00000000), ref: 000378E9

Strings

CorExitProcess, xrefs: 000378BE
mscoree.dll, xrefs: 000378AC

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c35caceacdef8e25510406e4b43460c9cdcb969ff5049d92840b84bde2436e05
Instruction ID: 03e80d2a810226376bbb75c0703b4268c39b3feeabd1bcf4750745ed55403539
Opcode Fuzzy Hash: c35caceacdef8e25510406e4b43460c9cdcb969ff5049d92840b84bde2436e05
Instruction Fuzzy Hash: 74F0C2B4A44218FBDB25AFA4DD09B9DBFB8EF04752F000178F809A6160DF348E44DB98

Function 0001EE4E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00020360: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0002037B
Part of subcall function 00020360: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0001EE61,Crypt32.dll,00000000,0001EEE5,?,?,0001EEC7,?,?,?), ref: 0002039D

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0001EE6D
GetProcAddress.KERNEL32(000581C0,CryptUnprotectMemory), ref: 0001EE7D

Strings

Crypt32.dll, xrefs: 0001EE57
CryptUnprotectMemory, xrefs: 0001EE73
CryptProtectMemory, xrefs: 0001EE67

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 1368a94f39834f9a20d6b8783b6227dd2cab863f28fc6e0e1627f856e15806d0
Instruction ID: 26a5ea3bdd2fec5d05299aa15018d2037e3851a3e9c598b0afbaa37a261ca95e
Opcode Fuzzy Hash: 1368a94f39834f9a20d6b8783b6227dd2cab863f28fc6e0e1627f856e15806d0
Instruction Fuzzy Hash: 8BE04FF4800751AED7709F34E809B46BAE46F15700F00A92DE586D7241D6B5D9848B54

Function 000380C8 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0003813A
_free.LIBCMT ref: 0003815A

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e0c006d6af1085d8671633f16afc0eb5a2a9ffab947f2cb3f888b831b0dc6afe
Instruction ID: d3875d24cf3f1dd3b930d1e85de2a260ee5d7392550ffccf206b79afdf93cac9
Opcode Fuzzy Hash: e0c006d6af1085d8671633f16afc0eb5a2a9ffab947f2cb3f888b831b0dc6afe
Instruction Fuzzy Hash: A441B276A003009FDB26DF78C881A9AB3E9EF89314F1585A9F515EB251DB31ED01CB80

Function 0003B9A0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0003B9A9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0003B9CC

Part of subcall function 00038838: RtlAllocateHeap.NTDLL(00000000,?,?,?,00033CF6,?,0000015D,?,?,?,?,000351D2,000000FF,00000000,?,?), ref: 0003886A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0003B9F2
_free.LIBCMT ref: 0003BA05
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0003BA14

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 057c7dada146de9bb7c0c02322182e37b50b30b93f410bcd4e3bc19ae931636f
Instruction ID: cf6d20e5876358a70ff4ad8681e75669b762f11151e294a7493d6d2311437e28
Opcode Fuzzy Hash: 057c7dada146de9bb7c0c02322182e37b50b30b93f410bcd4e3bc19ae931636f
Instruction Fuzzy Hash: 8501B1B6A01B507F27226A7A6C8DCBB7AADDBC6BA4B140129FA04D2101EF648D0181B1

Function 00020A36 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00020D11: ResetEvent.KERNEL32(?), ref: 00020D23
Part of subcall function 00020D11: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00020D37

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00020A6A
CloseHandle.KERNEL32(?,?), ref: 00020A84
DeleteCriticalSection.KERNEL32(?), ref: 00020A9D
CloseHandle.KERNEL32(?), ref: 00020AA9
CloseHandle.KERNEL32(?), ref: 00020AB5

Part of subcall function 00020B29: WaitForSingleObject.KERNEL32(?,000000FF,00020C48,?,?,00020CBF,?,?,?,?,?,00020CA9), ref: 00020B2F
Part of subcall function 00020B29: GetLastError.KERNEL32(?,?,00020CBF,?,?,?,?,?,00020CA9), ref: 00020B3B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 6932cb42b3bcb6227cccc10f1ee663ed967f4486becd40d8d8d5a6af52938f89
Instruction ID: 2bc2be4c2c2b4341346f3921305beb2f2290542c719b2edfeee0d5b108586775
Opcode Fuzzy Hash: 6932cb42b3bcb6227cccc10f1ee663ed967f4486becd40d8d8d5a6af52938f89
Instruction Fuzzy Hash: D501B5B5500704EFCB329B69ED84FC6FBE9FB49710F004629F15A42161CB766A44CB94

Function 0003C26F Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0003C287

Part of subcall function 000387FE: RtlFreeHeap.NTDLL(00000000,00000000,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?), ref: 00038814
Part of subcall function 000387FE: GetLastError.KERNEL32(?,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?,?), ref: 00038826

_free.LIBCMT ref: 0003C299
_free.LIBCMT ref: 0003C2AB
_free.LIBCMT ref: 0003C2BD
_free.LIBCMT ref: 0003C2CF

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6e3b3f150375f9d459450b7717767449538c38cc82bc5742a759ad4401962c84
Instruction ID: 458feee1d9317d45f4b7fb3c1dc2995a7c1ebfb7c2decadbb60eac85bd7f7e04
Opcode Fuzzy Hash: 6e3b3f150375f9d459450b7717767449538c38cc82bc5742a759ad4401962c84
Instruction Fuzzy Hash: B4F0FF73914340BBAA62EBA9EAC5C5A73DEBB01720F644845F119EB511CF34FC804768

Function 00038350 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0003836E

Part of subcall function 000387FE: RtlFreeHeap.NTDLL(00000000,00000000,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?), ref: 00038814
Part of subcall function 000387FE: GetLastError.KERNEL32(?,?,0003C306,?,00000000,?,00000000,?,0003C32D,?,00000007,?,?,0003C72A,?,?), ref: 00038826

_free.LIBCMT ref: 00038380
_free.LIBCMT ref: 00038393
_free.LIBCMT ref: 000383A4
_free.LIBCMT ref: 000383B5

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5d93d48e9f293cc4d741074a52b0bf281ea3b7d76fe74b02cc1511be0daa1323
Instruction ID: 3fee506979cff2becb4fb86c631f5e166122dd15a540e59b0ac9e576c2888d40
Opcode Fuzzy Hash: 5d93d48e9f293cc4d741074a52b0bf281ea3b7d76fe74b02cc1511be0daa1323
Instruction Fuzzy Hash: EFF06DB5D253109BAF426B1AFC424C43A6AB705B107288186F108AB2B2CF3D44928B89

Function 00021107 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 198COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 000212C5
_swprintf.LIBCMT ref: 00021374

Strings

%ls, xrefs: 0002114A, 00021160
%s: %s, xrefs: 000212D4

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 5cd8aa473f6730d73af7355695b74cad277ebad6771d774ba2ef107fe89f8068
Instruction ID: 1bfca8a617fae399269f08f8e316b459685fb50fc35b7efded6c9afbe03cfa12
Opcode Fuzzy Hash: 5cd8aa473f6730d73af7355695b74cad277ebad6771d774ba2ef107fe89f8068
Instruction Fuzzy Hash: 93511A7138C324FAE7326ED4FD02FFE769AAB25B00F204506F786A84D2C6B156706706

Function 0003798E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe,00000104), ref: 000379CE
_free.LIBCMT ref: 00037A99
_free.LIBCMT ref: 00037AA3

Strings

C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe, xrefs: 000379C5, 000379CC, 000379FB, 00037A33

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\f3aef511705f37f9792c6032b936ca61.exe
API String ID: 2506810119-3606139780
Opcode ID: 0a0d6d4a5a19623227c30d3375d7b5ce92794f917fb2715599c62ab3103a6da3
Instruction ID: 069cbbf60b733e1f476329e2e8f9350d70219a91a372a6c8ed13240284bba7ca
Opcode Fuzzy Hash: 0a0d6d4a5a19623227c30d3375d7b5ce92794f917fb2715599c62ab3103a6da3
Instruction Fuzzy Hash: 693180B1A08608EFDB32DF99DC85ADEBBFCEB85310F1441A6F508A7251D6748E80CB51

Function 00017638 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0001763D

Part of subcall function 00013AC2: __EH_prolog.LIBCMT ref: 00013AC7

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000,00000000), ref: 00017704

Part of subcall function 00017CC4: GetCurrentProcess.KERNEL32(00000020,?), ref: 00017CD3
Part of subcall function 00017CC4: GetLastError.KERNEL32 ref: 00017D19
Part of subcall function 00017CC4: CloseHandle.KERNEL32(?), ref: 00017D28

Strings

SeRestorePrivilege, xrefs: 00017697
SeSecurityPrivilege, xrefs: 00017682

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: c70186f9a756a588f9d7932856ece0e92c5eaf87a5572a1b78dbd0f26d3242a9
Instruction ID: 5f81869483e66f10a2665328d2d400d9dcf8b8f15a8571b1248980181ffa2b0f
Opcode Fuzzy Hash: c70186f9a756a588f9d7932856ece0e92c5eaf87a5572a1b78dbd0f26d3242a9
Instruction Fuzzy Hash: 3C31F871A48344AEEF20EB64EC45BEE7BB9EF54314F044059F84DA7183C7744A84C7A1

Function 0002A6C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0001130B: GetDlgItem.USER32(00000000,00003021), ref: 0001134F
Part of subcall function 0001130B: SetWindowTextW.USER32(00000000,000435B4), ref: 00011365

EndDialog.USER32(?,00000001), ref: 0002A748
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0002A75D
SetDlgItemTextW.USER32(?,00000066,?), ref: 0002A772

Strings

ASKNEXTVOL, xrefs: 0002A6D8

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: d3d8e802a1d8c8108adfeede0f946f872dc08d9b8eb4f796ddf13a9fac72d03e
Instruction ID: 9624d4d655f5f63be9c34f507f43e22e9f4c93fc40ce2a89e35efae1fc91b986
Opcode Fuzzy Hash: d3d8e802a1d8c8108adfeede0f946f872dc08d9b8eb4f796ddf13a9fac72d03e
Instruction Fuzzy Hash: D711B972708220EFE6229F54ED45FAA77F9FB4B740F100114F304EB1B1CB699885972A

Function 0001D483 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0001D4EE
_strncpy.LIBCMT ref: 0001D538

Strings

@%s, xrefs: 0001D4D8
$%s, xrefs: 0001D4E3

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 0e880f3da7b95bee4fb0ec5e1503e4374c0f527fdadf59f150d39a9392afca33
Instruction ID: faecfe40f1df7c3c0c1325de122a098e5c6d30e13ff297df254fa8c694c5e86a
Opcode Fuzzy Hash: 0e880f3da7b95bee4fb0ec5e1503e4374c0f527fdadf59f150d39a9392afca33
Instruction Fuzzy Hash: CC215E72540248ABEF31EEA4CD46FDE3BE8AF04300F044422FA14961A2E375EA958B61

Function 0002AC20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0001130B: GetDlgItem.USER32(00000000,00003021), ref: 0001134F
Part of subcall function 0001130B: SetWindowTextW.USER32(00000000,000435B4), ref: 00011365

EndDialog.USER32(?,00000001), ref: 0002AC6E
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0002AC86
SetDlgItemTextW.USER32(?,00000067,?), ref: 0002ACB4

Strings

GETPASSWORD1, xrefs: 0002AC39

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 046eba6e4b23b51760ac46c83f1e7024c8855d69cc374926d9b8669ccda4d7c4
Instruction ID: f6a6001a9ce59231c7437629d4516b0e3c0753945519b2170ad7fed8ac3c2f44
Opcode Fuzzy Hash: 046eba6e4b23b51760ac46c83f1e7024c8855d69cc374926d9b8669ccda4d7c4
Instruction Fuzzy Hash: 9B112B72A40128B7DB219E64EC49FFF3B7CEB5A700F100424FB45B2581CA659D8586B2

Function 00020995 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0001ADB5,00000008,?,00000000,?,0001CD8C,?,00000000), ref: 000209CE
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0001ADB5,00000008,?,00000000,?,0001CD8C,?,00000000), ref: 000209D8
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0001ADB5,00000008,?,00000000,?,0001CD8C,?,00000000), ref: 000209E8

Strings

Thread pool initialization failed., xrefs: 00020A00

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: e68575030eda6990e04a27eb7a5dcd7c8685a9a6c62c066fc52c7e2648d746df
Instruction ID: 4b1b9c0015be194d1b37849cb185c47247a3d395705ed7906505ca507a45c3cd
Opcode Fuzzy Hash: e68575030eda6990e04a27eb7a5dcd7c8685a9a6c62c066fc52c7e2648d746df
Instruction Fuzzy Hash: A511C2F1600708AFE3305F65DC84AA7FBECEB65714F10492EF1DA82202D6B12980CB64

Function 0002D648 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 0002D69B
REPLACEFILEDLG, xrefs: 0002D686, 0002D6BA

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 9adca0f2abe347d1c8d07f704e04f3db1be125383e46d861a737c7442812538a
Instruction ID: 42c7debb93c4baac0fd0a96a66bf2630fb39b7a778eda3cc376977b7bdc6f102
Opcode Fuzzy Hash: 9adca0f2abe347d1c8d07f704e04f3db1be125383e46d861a737c7442812538a
Instruction Fuzzy Hash: 8C019EB2A00319AFEB514F54FD08E5B7BEAE705395B144423FD09E2230DAB98C50EFA0

Function 000394EE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00039579
__alldvrm.LIBCMT ref: 0003977A
__alldvrm.LIBCMT ref: 0003979C

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: e530949d133c0fe719df7704e4bd8e68177ea7de6064a97516e7fd75facf1640
Instruction ID: d2b64b1cf87692c8191c64e9c1d80d07fa1f062f72f1c9c7acdde11f0c88ac91
Opcode Fuzzy Hash: e530949d133c0fe719df7704e4bd8e68177ea7de6064a97516e7fd75facf1640
Instruction Fuzzy Hash: 2FA16872A147869FEB23CF18C8927FEBBE9EF15310F14416DE5959B282C6B88D41C750

Function 0003C3F8 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8FE85006,00034236,00000000,00000000,0003526B,?,0003526B,?,00000001,00034236,8FE85006,00000001,0003526B,0003526B), ref: 0003C445
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0003C4CE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0003C4E0
__freea.LIBCMT ref: 0003C4E9

Part of subcall function 00038838: RtlAllocateHeap.NTDLL(00000000,?,?,?,00033CF6,?,0000015D,?,?,?,?,000351D2,000000FF,00000000,?,?), ref: 0003886A

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: ae08408804ff8e1d425dbfb716dbe719c449f7f8ae1380c850928fb58d44c7d1
Instruction ID: b3bac7cf21a96a36a6eccf92df91a9131a60d97e86a107d6777aac6cadce57e4
Opcode Fuzzy Hash: ae08408804ff8e1d425dbfb716dbe719c449f7f8ae1380c850928fb58d44c7d1
Instruction Fuzzy Hash: 6B31CD72A0021AABEF269F74DC51DFE7BA9EB01710F154168FC04EA251EB35CD50CBA0

Function 000327A3 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 000327BA

Part of subcall function 00032DF2: ___AdjustPointer.LIBCMT ref: 00032E3C

_UnwindNestedFrames.LIBCMT ref: 000327D1
___FrameUnwindToState.LIBVCRUNTIME ref: 000327E3
CallCatchBlock.LIBVCRUNTIME ref: 00032807

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction ID: ace475c464f1af51dd6fdea5bde900532cb2e5ba7a908ff91fcb3601932ae6e4
Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction Fuzzy Hash: 1201E532000109BBDF13AF65DD41EEA7BBAFF58754F158124F91866122C736E8A1EBA0

Function 0002A01B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0002A01E
GetDeviceCaps.GDI32(00000000,00000058), ref: 0002A02D
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0002A03B
ReleaseDC.USER32(00000000,00000000), ref: 0002A049

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 568e58cb1ecb8d513816870c43a5d5ff2e1329374d91f372948b2421be57d429
Instruction ID: 533fc774e6339eabb221240d11f61661d16361c9ab7654e131a3811a452a9cbd
Opcode Fuzzy Hash: 568e58cb1ecb8d513816870c43a5d5ff2e1329374d91f372948b2421be57d429
Instruction Fuzzy Hash: 40E0EC31D85721A7E3601BA17C0DB8B3B54FB09B13F054005FA0AB6191EA7C4485CFF1

Function 000322B6 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 000322B6
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 000322BB
___vcrt_initialize_locks.LIBVCRUNTIME ref: 000322C0

Part of subcall function 000333BE: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 000333CF

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 000322D5

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 5bd959aa501a7ab12ea48519a29bdec622f540cb30e6334150180b8a95b84f40
Instruction ID: 7a05500db7946741beca08ae3ead97293f6910f1e2d9b82b096671cf85b24350
Opcode Fuzzy Hash: 5bd959aa501a7ab12ea48519a29bdec622f540cb30e6334150180b8a95b84f40
Instruction Fuzzy Hash: 7DC04C74409251781C773AB536872EE434C5F56BC5F8064C1E852175079D05074A2833

Function 0002A1BD Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 0002A051: GetDC.USER32(00000000), ref: 0002A055
Part of subcall function 0002A051: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0002A060
Part of subcall function 0002A051: ReleaseDC.USER32(00000000,00000000), ref: 0002A06B

GetObjectW.GDI32(?,00000018,?), ref: 0002A1ED

Part of subcall function 0002A476: GetDC.USER32(00000000), ref: 0002A47F
Part of subcall function 0002A476: GetObjectW.GDI32(?,00000018,?), ref: 0002A4AE
Part of subcall function 0002A476: ReleaseDC.USER32(00000000,?), ref: 0002A546

Strings

(, xrefs: 0002A325

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 413c4df9bba053ac273dab2c028ccc8da93a8a5241a6b639b48cbdcccd672edb
Instruction ID: 2fabdc25a52c0b9ce826484a81a9a9108ff8a2ed309470922c8aac8df8e9cb6f
Opcode Fuzzy Hash: 413c4df9bba053ac273dab2c028ccc8da93a8a5241a6b639b48cbdcccd672edb
Instruction Fuzzy Hash: B6910175608354AFD710DF28D948A2BBBE8FFCA700F00481DF98AD7261DA75A905CB62

Function 0003AC28 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0003AD94

Part of subcall function 00038B69: IsProcessorFeaturePresent.KERNEL32(00000017,00038B58,0000002C,0004BC40,0003BD76,00000000,00000000,00039338,?,?,00038B65,00000000,00000000,00000000,00000000,00000000), ref: 00038B6B
Part of subcall function 00038B69: GetCurrentProcess.KERNEL32(C0000417,0004BC40,0000002C,00038896,00000016,00039338), ref: 00038B8D
Part of subcall function 00038B69: TerminateProcess.KERNEL32(00000000), ref: 00038B94

Strings

., xrefs: 0003AF4B
*?, xrefs: 0003AC6B

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: b6f4886fb241bc6412e8874b3df55810ed09b0cad714297808d292c8a57c0ef0
Instruction ID: 16d94b3e43d573885ed3fab2825e5e3a50e4049379174603d95796ec5247a370
Opcode Fuzzy Hash: b6f4886fb241bc6412e8874b3df55810ed09b0cad714297808d292c8a57c0ef0
Instruction Fuzzy Hash: A3519F71E00209AFDF16DFA8C881AEDB7F9FF59310F248169E895E7341EA359E018B51

Function 000177FA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 000177FF
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0001799B

Part of subcall function 0001A637: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0001A46D,?,?,?,0001A2B3,?,00000001,00000000,?,?), ref: 0001A64B
Part of subcall function 0001A637: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0001A46D,?,?,?,0001A2B3,?,00000001,00000000,?,?), ref: 0001A67C

Strings

:, xrefs: 00017870

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 0fd9aef93026f1775eec5ce72ca5546f98d4ba8077c9eea360f392e10821a4f9
Instruction ID: 6cf0ad56edbdd4c9cf4b2980bfb5d27d67105038b0df85a3754b40f5411445b3
Opcode Fuzzy Hash: 0fd9aef93026f1775eec5ce72ca5546f98d4ba8077c9eea360f392e10821a4f9
Instruction Fuzzy Hash: 72415F71905268AAEB21EB50DD55EEEB3BDEF45300F0041DAB649A3083DB745FC9CB61

Function 0001B85C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

UNC, xrefs: 0001B8F8
\\?\, xrefs: 0001B8AE, 0001B8EA, 0001B94B, 0001B99E

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 05ede41cb5590300bb5074af2048467f2312cc76b7912fe6a51a35f88bacf446
Instruction ID: 3b14a1c83c23c2283a929bbc32ada848d39a3b71beed98bc74d394b9943001af
Opcode Fuzzy Hash: 05ede41cb5590300bb5074af2048467f2312cc76b7912fe6a51a35f88bacf446
Instruction Fuzzy Hash: 8641A231500319BACF21AF61DC42EEF77ADAF55390F10446AF95497142EB70DED2C6A0

Function 000291F6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00029204

Strings

about:blank, xrefs: 000292C2
Shell.Explorer, xrefs: 0002922F

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: a47756828187e5a1c02d685f6d547b3fea4a65c46f1ba4c8a0f45bbe66e6f8da
Instruction ID: 1cbbb205d46c5149bb63970861aa3216629d328bef0f2306d7bd2e1d4a38c621
Opcode Fuzzy Hash: a47756828187e5a1c02d685f6d547b3fea4a65c46f1ba4c8a0f45bbe66e6f8da
Instruction Fuzzy Hash: 4E216275214324EFDB089F64E895A6A77A8FF88720F15846DF9099F287DB70EC00CB64

Function 0001EECD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0001EE4E: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0001EE6D
Part of subcall function 0001EE4E: GetProcAddress.KERNEL32(000581C0,CryptUnprotectMemory), ref: 0001EE7D

GetCurrentProcessId.KERNEL32(?,?,?,0001EEC7), ref: 0001EF5F

Strings

CryptUnprotectMemory failed, xrefs: 0001EF57
CryptProtectMemory failed, xrefs: 0001EF16

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 769f3cdace20091b00ca3c316ae7f8e8ddf8d7c3d8a7854a383c08a3a8d4acb0
Instruction ID: 1b5c9c677abb3f9a26407385aab0861ad6161ef67cffe05ce011baccfb7a2a8c
Opcode Fuzzy Hash: 769f3cdace20091b00ca3c316ae7f8e8ddf8d7c3d8a7854a383c08a3a8d4acb0
Instruction Fuzzy Hash: FA113B71A09668ABEB215F20DC02AEF3799EF04720B04812DFC056B292CB795E8287D4

Function 0001130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0001DD73: _swprintf.LIBCMT ref: 0001DD99
Part of subcall function 0001DD73: _strlen.LIBCMT ref: 0001DDBA
Part of subcall function 0001DD73: SetDlgItemTextW.USER32(?,0004E154,?), ref: 0001DE1A
Part of subcall function 0001DD73: GetWindowRect.USER32(?,?), ref: 0001DE54
Part of subcall function 0001DD73: GetClientRect.USER32(?,?), ref: 0001DE60

GetDlgItem.USER32(00000000,00003021), ref: 0001134F
SetWindowTextW.USER32(00000000,000435B4), ref: 00011365

Strings

0, xrefs: 0001130E

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: d30f7d3d1d738314a2d5540645651a96654fc8ed5167275ec4f3f919095ebb2f
Instruction ID: 473f6fad26b4d6b94f08e4ecf537de8287edf9339807b1a1bb55df02638d7408
Opcode Fuzzy Hash: d30f7d3d1d738314a2d5540645651a96654fc8ed5167275ec4f3f919095ebb2f
Instruction Fuzzy Hash: 98F0AFB050034CA6DF690FA1CC09BEE3BD8BB20345F088014FE59549E1CB78CAD6EA50

Function 00020B29 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00020C48,?,?,00020CBF,?,?,?,?,?,00020CA9), ref: 00020B2F
GetLastError.KERNEL32(?,?,00020CBF,?,?,?,?,?,00020CA9), ref: 00020B3B

Part of subcall function 00016E68: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00016E86

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00020B44

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 0c9d0ecfda153b94bcc28d67cc86518776c5f69cc65e47b9cf097a09e8ed200b
Instruction ID: a385dad8372c49c4672f9ac10339372d27831369f1629c1c63f62f71199fe136
Opcode Fuzzy Hash: 0c9d0ecfda153b94bcc28d67cc86518776c5f69cc65e47b9cf097a09e8ed200b
Instruction Fuzzy Hash: 00D05EB690813076DA112724ED0AEEF79599B62730F240B24F639651E6CB660A8182E9

Function 0001DD29 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0001D5EF,?), ref: 0001DD2E
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0001D5EF,?), ref: 0001DD3C

Strings

RTL, xrefs: 0001DD36

Memory Dump Source

Source File: 00000000.00000002.2093236579.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2093217964.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093268763.0000000000043000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.000000000004E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000054000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093293585.0000000000071000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000072000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.0000000000079000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2093383787.000000000009B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_f3aef511705f37f9792c6032b936ca61.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 277648eee7bd7508106ddb320708546088f1ce9f3748363c03af40b0963d5bbc
Instruction ID: c01c0b3c877c04df7bcccb3aea8d3a82b1fa8bd9c38ab5fa389d0ae3b6944a77
Opcode Fuzzy Hash: 277648eee7bd7508106ddb320708546088f1ce9f3748363c03af40b0963d5bbc
Instruction Fuzzy Hash: BFC08CB138535076FB3427307E2DB832E88AB12B12F19255DF641DE1D0DAF9C981C7A4

Analysis Process: NjRAT.exePID: 3356, Parent PID: 5840COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	37
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 047E0938 Relevance: 1.7, Strings: 1, Instructions: 495
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@hk, xrefs: 047E0B23

Memory Dump Source

Source File: 00000002.00000002.2165922378.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_NjRAT.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: 926bdb8481a7dfd28dca412b7866f65d92246bf286b91c727069c666d1f5b705
Instruction ID: 002993a29518e069c80c46d6a1601698390c93ca56c0fdb07ae67caac9c9668f
Opcode Fuzzy Hash: 926bdb8481a7dfd28dca412b7866f65d92246bf286b91c727069c666d1f5b705
Instruction Fuzzy Hash: 6102D1347012108FCB28EB78E455A6D77F2AF88308F148979D406CB3A9DF399C56DB90

Function 0090A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0090A6B9

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: d6cf03a4f62bd4d98f378f92f76242469100e615eca8ef7f82a3066bcf0374bb
Instruction ID: 378004b435b06a445474b59a95def806f413c260b4ca51f9d9a7847c19eda54b
Opcode Fuzzy Hash: d6cf03a4f62bd4d98f378f92f76242469100e615eca8ef7f82a3066bcf0374bb
Instruction Fuzzy Hash: 9C3181715093846FE711CB25DC85B96BFF8EF06314F0884AAE944CF293D365A909CBA2

Function 0090A361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,3E02B584,00000000,00000000,00000000,00000000), ref: 0090A40C

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 511ff394769ff1db4bb43560f806c22b230e7969b53ee7257ce1e2957e41a462
Instruction ID: 7600de0712b2753eb3f84a4f86c9bd969d64c0a94d6960bcf67ad549c07ff406
Opcode Fuzzy Hash: 511ff394769ff1db4bb43560f806c22b230e7969b53ee7257ce1e2957e41a462
Instruction Fuzzy Hash: CF318175505744AFD721CF11DC84F92BBFCEF05310F08859AE9458B292D364E909CB62

Function 0090A462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,3E02B584,00000000,00000000,00000000,00000000), ref: 0090A4F8

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b9e45d6956575f5d20db182dbd0ac31c51dc99acd4c72f6f6d4f102bd9f2b60f
Instruction ID: 89966ae26df65ef1c8e72b5ba579780ea058c4516fb94127ece521480e785eda
Opcode Fuzzy Hash: b9e45d6956575f5d20db182dbd0ac31c51dc99acd4c72f6f6d4f102bd9f2b60f
Instruction Fuzzy Hash: DD2190765043846FD7228F11DC44FA7BFBCEF46310F08859AE985CB692D264E948CBB2

Function 0090A646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0090A6B9

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: a103f82ea328e6a06746ffb69fdf104847fcbdebf64af6a8ccb76c39d826ee41
Instruction ID: d7260a28ef711a518c9b6eab8e0f61a523552f47ce5c28cb3f39460c6851e44c
Opcode Fuzzy Hash: a103f82ea328e6a06746ffb69fdf104847fcbdebf64af6a8ccb76c39d826ee41
Instruction Fuzzy Hash: C62180716002049FE710DB25DD85FA6FBE8EF04314F08886AED458B782D775E809CAA2

Function 0090AA07 Relevance: 1.6, APIs: 1, Instructions: 72
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 0090AA86

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: e50e589815eace576b2d968d1f529882cc84d2f388b649bc19cb782dca9d6b57
Instruction ID: ed07f329429160417c034102279b7081688d6eddb02f041e17c72706432bdf9c
Opcode Fuzzy Hash: e50e589815eace576b2d968d1f529882cc84d2f388b649bc19cb782dca9d6b57
Instruction Fuzzy Hash: B0217FB26093809FD711CB25DD45B52BFF8EF06314F0984EAE885DF2A3D224E908CB61

Function 0090A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,3E02B584,00000000,00000000,00000000,00000000), ref: 0090A40C

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5553131b5c694eecfd52dbd653b728f83d0320fbd0eb37baa2ff2eb469b847df
Instruction ID: 3d5ed7670f10f56bec2fd990bc9137392593345f14d93905b73d29494f5f8b05
Opcode Fuzzy Hash: 5553131b5c694eecfd52dbd653b728f83d0320fbd0eb37baa2ff2eb469b847df
Instruction Fuzzy Hash: F9215C76600704AFE720CE15DC84FA6B7ECEF04714F08856AED458B6A1D7B4E949CAB2

Function 0090A486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,3E02B584,00000000,00000000,00000000,00000000), ref: 0090A4F8

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5ed20653b468e5df3a6c025ceac8628fb313eb6f64d2eff70f2e5b91e9f64861
Instruction ID: 17c441f1723435b5e7fa6e46efe54e4a0ee619fbc47bc2573c8a31c931e0cbcd
Opcode Fuzzy Hash: 5ed20653b468e5df3a6c025ceac8628fb313eb6f64d2eff70f2e5b91e9f64861
Instruction Fuzzy Hash: A2118176600704AFE7218E11DC45FAABBECEF04714F04856AED458A691D375E948CAB2

Function 0090A2D2 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 0090A330

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c694ec4c0fe8c25a043869c71a909888a3b89b60ab034ea0765045c4c2981e82
Instruction ID: dcfc0c528351f2d86d1a47ed0539c8cfcce801190729e6b6fb0fa514385bb784
Opcode Fuzzy Hash: c694ec4c0fe8c25a043869c71a909888a3b89b60ab034ea0765045c4c2981e82
Instruction Fuzzy Hash: 7621297140E3C49FD7138B259C54A52BFB4AF07224F0D80DBDD848F2A3C269A808DB62

Function 0090AC24 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0090AC80

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 0b10ca92b844ed95cee48d4f6ded769cdc7abf7f4b52e293d2bee06ef128911a
Instruction ID: 8cf3d4066484820d286f25ce2cc74191f6b627d696b61008c0b9c421c66a9681
Opcode Fuzzy Hash: 0b10ca92b844ed95cee48d4f6ded769cdc7abf7f4b52e293d2bee06ef128911a
Instruction Fuzzy Hash: E91163715093849FD711CB25DC94B52BFA8DF06210F0984EAED85CF292D275E848CBA2

Function 0090A8A4 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 0090A903

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f41ae04675083075d2cd1b1d0cbf268d63286d48fbfede5500c1cc00f12649d3
Instruction ID: ec2f3340fd4a7d2f0700c0a350ff23f64e38f1b56efeb33755df8ffa44b855d3
Opcode Fuzzy Hash: f41ae04675083075d2cd1b1d0cbf268d63286d48fbfede5500c1cc00f12649d3
Instruction Fuzzy Hash: 351163725093849FD711CF25DC45B56BFE8EF06320F0984AAED45CF252D274E844CB62

Function 0090AA3E Relevance: 1.6, APIs: 1, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 0090AA86

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 7ec1ba3937f628279de1fbfd799d808324c722de2c7cf5ee63246012af7048e5
Instruction ID: b8c1533fba7e8ebcbdb01fd29f7db0e43d332e0d1c55ee49c0ab7cc55135ed91
Opcode Fuzzy Hash: 7ec1ba3937f628279de1fbfd799d808324c722de2c7cf5ee63246012af7048e5
Instruction Fuzzy Hash: 5B1130727003449FDB50CF25D945B56BBE8EB14720F0884AADD49CB691D279E944CAA2

Function 0090A8C6 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 0090A903

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 32a1aaa77f4d4a506ea79c49cb1ee0688657470aa024eeffec24d1184322cb5e
Instruction ID: d3a95c4eb5438eb699b56604af6b834c28d733f1f1a2251b9d2cd7547f6074c9
Opcode Fuzzy Hash: 32a1aaa77f4d4a506ea79c49cb1ee0688657470aa024eeffec24d1184322cb5e
Instruction Fuzzy Hash: 720140726043459FDB10CF25D885B66FBE8EF04324F08C4AADD45CB791D279E944CAA2

Function 0090AC46 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0090AC80

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 2a4f1593b63ddfd84092a02fb65471e6abb75f74503557460d5a224ecd4c84bd
Instruction ID: c8dd87d0de3be30a5e73fa660758995b427c4620ea9c06c01ea214f25eee3ed8
Opcode Fuzzy Hash: 2a4f1593b63ddfd84092a02fb65471e6abb75f74503557460d5a224ecd4c84bd
Instruction Fuzzy Hash: CF0140716042448FEB10CF25D985B56BBE8EF05724F08C4AADD49CF792D379E844CEA2

Function 0090A2FE Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 0090A330

Memory Dump Source

Source File: 00000002.00000002.2165259709.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_90a000_NjRAT.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cabf59e8c551d35cf30f20ce4126e86ca4d7a8d0b0c83997a0af234740ca72d4
Instruction ID: 300d267c5f625ea1cb028e20cd7ceac46bc30c5e6928d999c068f165644e2713
Opcode Fuzzy Hash: cabf59e8c551d35cf30f20ce4126e86ca4d7a8d0b0c83997a0af234740ca72d4
Instruction Fuzzy Hash: ACF0AF35904344CFDB108F19D884B65FBE4EF04324F08C0AADD494F792D279A848DEA2

Function 047E0310 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2165922378.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_NjRAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ee576c419f89dcbc4b8383b0aead6adf2f2e63c6f083e47159f1fbab1d1f6f
Instruction ID: 03d50c407fc058aa4e1519640bfdf84e6b7d9fdb3c9bfe8177ee6e6488250ac4
Opcode Fuzzy Hash: e0ee576c419f89dcbc4b8383b0aead6adf2f2e63c6f083e47159f1fbab1d1f6f
Instruction Fuzzy Hash: F76156307042158FC724EB7A9810ABD33E7ABC9344B448929E405DB3E5DF79DD4AD7A1

Function 047E0007 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2165922378.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_NjRAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efead245b031d80af8587674b90e5bf7a530f5241475af5f044f4e5c091f6504
Instruction ID: 848d8561f79d33ad7ac3e93918361559d83652446f85e17e8c9784f283f402aa
Opcode Fuzzy Hash: efead245b031d80af8587674b90e5bf7a530f5241475af5f044f4e5c091f6504
Instruction Fuzzy Hash: BC71933021B3868FC722EB34E8548857BB2AF46208755C99AD044CF67BDB38591FDB62

Function 047E03BD Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2165922378.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_NjRAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54b7119a4bba303b1d7787c8210b19b1a2d0ec9548e13905b30947e546777a9
Instruction ID: 0c7479d65bb21faaf25b594a637d5e876a370bf60ce19d4f50388198e353ee46
Opcode Fuzzy Hash: d54b7119a4bba303b1d7787c8210b19b1a2d0ec9548e13905b30947e546777a9
Instruction Fuzzy Hash: 074128307042158FCB58B7BA94146BD32D79FCA3887448829E406DF3E5DF7D8E4A97A2

Function 047E0878 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2165922378.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_NjRAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bafbd06801065b54af3b52322f06ee58954c63c0207a96a4c84449a2dd280f2d
Instruction ID: 1bf9a0d96afb2878b2c5d2fa2d9304cddea62ac8eef5bc5172366b3f3c1098d8
Opcode Fuzzy Hash: bafbd06801065b54af3b52322f06ee58954c63c0207a96a4c84449a2dd280f2d
Instruction Fuzzy Hash: 29119430B09386CFD711BB74D858498BBF1EF8530CB4489ADE4858B3A6DB755849DB83

Function 009E05E0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2165459854.00000000009E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9e0000_NjRAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acc9ca31a77fad880df8aa6bda41af073a65ac54f6e7d8058312b6674f23c6e
Instruction ID: a76e978ae8737c3bf4e8f76d3160387692ea5de33717b0f5cd383e0919025e76
Opcode Fuzzy Hash: 5acc9ca31a77fad880df8aa6bda41af073a65ac54f6e7d8058312b6674f23c6e
Instruction Fuzzy Hash: F201DB765093846FD7118F15AC41862FFB8EF46220708C4EFEC498B612D235A909CB72

Function 009E0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2165459854.00000000009E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 009E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9e0000_NjRAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8f48ba1bed87d39a72c899e186899c90729275833d424bad961594394b0c58
Instruction ID: 14a47e10877bd196277e516d5c716b346f36e1e4c717f0feae634154cbc6c20d
Opcode Fuzzy Hash: 5c8f48ba1bed87d39a72c899e186899c90729275833d424bad961594394b0c58
Instruction Fuzzy Hash: 37E092B66006044BD650CF0AFC41452F7D8EB84630B08C07FDC0D8BB01D235B508CEA5

Function 009023F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2165242544.0000000000902000.00000040.00000800.00020000.00000000.sdmp, Offset: 00902000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_902000_NjRAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b0fbdc10ce88935a9e50ea48cb66cde1bb61b5373bf7c244a0a7c8a26cf1be
Instruction ID: 3cb243a11d485b315c2d5ab706f195255e6f228c010c4a96358ae278d1aa3635
Opcode Fuzzy Hash: 24b0fbdc10ce88935a9e50ea48cb66cde1bb61b5373bf7c244a0a7c8a26cf1be
Instruction Fuzzy Hash: 2AD05E792096C14FD3169B1CC5A8F9637DCAB51718F4A44F9AC008B7B3C768D981D600

Function 009023BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2165242544.0000000000902000.00000040.00000800.00020000.00000000.sdmp, Offset: 00902000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_902000_NjRAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b6f06979941b41de74e1c0cc34fb0c4e2d7905dc6b92c5caa7bd54ee0d4915
Instruction ID: c445d1347886f18acedeb794059d4888c7a6551cf8ee53594c42bb6e01f549a9
Opcode Fuzzy Hash: b2b6f06979941b41de74e1c0cc34fb0c4e2d7905dc6b92c5caa7bd54ee0d4915
Instruction Fuzzy Hash: 65D05E342002818FCB25DB0CD6D8F5937D8AF40B14F0644E8AC108B7A2C7B8D8C0CA00

Analysis Process: svchost.exePID: 1536, Parent PID: 3356COMMON

Execution Graph

Execution Coverage:	20.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.7%
Total number of Nodes:	182
Total number of Limit Nodes:	9

Executed Functions

Function 02BABB6B Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 02BABBEB

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 2cd1513f29f70ea765315dda7ddde12aa39ab217e90a15dede93c0404c35c8b5
Instruction ID: 015a4c6bf1e68409d15c1cc1a2c600f2146e57647a43ec5bc6cf653427f84081
Opcode Fuzzy Hash: 2cd1513f29f70ea765315dda7ddde12aa39ab217e90a15dede93c0404c35c8b5
Instruction Fuzzy Hash: 7921D1765097809FDB128F25DC50B52BFF4EF16314F0884DAE9858B563D335A808CB62

Function 05940187 Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 059401FD

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 8c121c7857626062ee8749544c8f33148a4d3d3ec589cbb0a7bf1e52575ed244
Instruction ID: 81abd57c956961252a3783abdb5a2cfa8bfa32b7d442646f61dca8b3fe7ce53e
Opcode Fuzzy Hash: 8c121c7857626062ee8749544c8f33148a4d3d3ec589cbb0a7bf1e52575ed244
Instruction Fuzzy Hash: 4321AE724097C0AFDB238B20EC45A52FFB4EF06214F0984DBE9844B5A3D265A90DDB62

Function 02BABBA2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 02BABBEB

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 0f4b17a7a7d7c1cedb1cc767403df75341546ea787ac11cc336ea5872fc3a567
Instruction ID: 0e29a503c89b0fe0daaa7eec0e26cb71685eb86ccebab0d93e8798a42b1fe2c1
Opcode Fuzzy Hash: 0f4b17a7a7d7c1cedb1cc767403df75341546ea787ac11cc336ea5872fc3a567
Instruction Fuzzy Hash: 4D11C2725043049FDB20CF15D884B62FBE4EF14324F08C8AAED558B662D335E418CF61

Function 02BABED0 Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 02BABF2D

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 6325e861fb8ce586e8cebb9dd81e6f3a2956ff2ce40b8e9d223ba19e4df27c97
Instruction ID: 9f1e88c089c2f19a72447facb82fa5e6da36af98ba7ba41c0f21e09e4a0acf29
Opcode Fuzzy Hash: 6325e861fb8ce586e8cebb9dd81e6f3a2956ff2ce40b8e9d223ba19e4df27c97
Instruction Fuzzy Hash: 2111A072409780AFCB228F11DC44F52FFB4EF06224F09C4DAED884B662C275A818DB62

Function 02BABEF2 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 02BABF2D

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 77a9198f3ab460499d51aff3986e20b091f052e0a7a94fc5ade7268a6c45f5dc
Instruction ID: 873b5f364e86440c6e2f956c787d704a266cfaf887b0fe1f19f21a470119a21f
Opcode Fuzzy Hash: 77a9198f3ab460499d51aff3986e20b091f052e0a7a94fc5ade7268a6c45f5dc
Instruction Fuzzy Hash: C201AD324046049FDB208F05D884B65FBE0EF18324F0CC59AED594B662C37AE858DF62

Function 059401C2 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 059401FD

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 45b59687c3c5d0e9808ec1f5038d08cbf5d5b44aa1e0b809c01d8adeea1523b2
Instruction ID: d3a3fcacf7526deee443c775abf8568ebf231ac6f5fcd991341fb7d4923238f1
Opcode Fuzzy Hash: 45b59687c3c5d0e9808ec1f5038d08cbf5d5b44aa1e0b809c01d8adeea1523b2
Instruction Fuzzy Hash: 33018F364006049FDB20CF45E948F61FBE4FF08224F08C49ADE490A652C376A858CF62

Function 054A0310 Relevance: 3.9, Strings: 3, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=[fi^, xrefs: 054A0477, 054A047C
[fi^, xrefs: 054A0545, 054A054A
-[fi^, xrefs: 054A04DA, 054A04DF

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: [fi^$-[fi^$=[fi^
API String ID: 0-2239522807
Opcode ID: d1d87b1c08670dc7f2b46d6879012c9ff634c78c372214aaae46e8b0fd90ffd8
Instruction ID: c5eeac3b35f66332ebeeb5bcdb5fa2d716ddd6b0d065a828d64c53e706e1dcca
Opcode Fuzzy Hash: d1d87b1c08670dc7f2b46d6879012c9ff634c78c372214aaae46e8b0fd90ffd8
Instruction Fuzzy Hash: 81510230B042018BC719EB7CA4196BE77D7AF85284B5448AED806DB3C1DFBDCC4687A2

Function 054A03BD Relevance: 3.9, Strings: 3, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=[fi^, xrefs: 054A0477, 054A047C
[fi^, xrefs: 054A0545, 054A054A
-[fi^, xrefs: 054A04DA, 054A04DF

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: [fi^$-[fi^$=[fi^
API String ID: 0-2239522807
Opcode ID: 82d1ba90e61eaef3a67994469bf431e4b1e7fc4461e125e50ff0360a6d2278cd
Instruction ID: a9a3e628ab9ada6076711c7b3fe5470b5b8b715e08b49dcdbb4346d29e14352f
Opcode Fuzzy Hash: 82d1ba90e61eaef3a67994469bf431e4b1e7fc4461e125e50ff0360a6d2278cd
Instruction Fuzzy Hash: 89410931B041158BC759E77D94252BE32D79FC5288B4848AED806DB3D1DFBD8D0A87A2

Function 054A1929 Relevance: 2.8, Strings: 2, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@hk, xrefs: 054A1BC0
:@hk, xrefs: 054A1BAF

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk$:@hk
API String ID: 0-48768170
Opcode ID: d85820a5cfe38c41e1f3edc3d527964599a5f5060e161533ea1739ef32302fdb
Instruction ID: f58dee4bafc533bedbdb8fde8b24319e4e2e561bac93df61a09e0c66cbe21a46
Opcode Fuzzy Hash: d85820a5cfe38c41e1f3edc3d527964599a5f5060e161533ea1739ef32302fdb
Instruction Fuzzy Hash: ADC17C707051548BEB05EB78E8187BE37ABEB99208F10446ED806977C1CF7D9C26DB61

Function 054A1999 Relevance: 2.8, Strings: 2, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@hk, xrefs: 054A1BC0
:@hk, xrefs: 054A1BAF

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk$:@hk
API String ID: 0-48768170
Opcode ID: d2c5139a4a227d4e7dbc5a20ba7ff3e07b9bae6d816fda6d90bf5cde0841765c
Instruction ID: f8e96c1691e104ea0ee4c63d6c8c2e9bb545b4cbca57808db57a6993a7662744
Opcode Fuzzy Hash: d2c5139a4a227d4e7dbc5a20ba7ff3e07b9bae6d816fda6d90bf5cde0841765c
Instruction Fuzzy Hash: 00A181707051548BDB05EB78E8187BE36ABEB99308F10446ED84A977C1CF7D8C26D761

Function 054A19B7 Relevance: 2.8, Strings: 2, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@hk, xrefs: 054A1BC0
:@hk, xrefs: 054A1BAF

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk$:@hk
API String ID: 0-48768170
Opcode ID: 82bc581c37b864795b49f72f57040b8f2afa796ff82e785a5cca99ba23c2cbc9
Instruction ID: af6358376d871e5bea453edc2c7b66968434a2ac83c99b21d7cae1941d80f5fd
Opcode Fuzzy Hash: 82bc581c37b864795b49f72f57040b8f2afa796ff82e785a5cca99ba23c2cbc9
Instruction Fuzzy Hash: DAA181707042548BEB05EB78E9187BE32ABAB99308F10446ED84A977C1CF7D8C26D761

Function 054A19CA Relevance: 2.8, Strings: 2, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@hk, xrefs: 054A1BC0
:@hk, xrefs: 054A1BAF

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk$:@hk
API String ID: 0-48768170
Opcode ID: 818059d61772c2ab412be5e6789b60f955aab73902798bd331b3bc1ba1f723e5
Instruction ID: 6d494c630adef447140d8af2a3dda7e37f24e369aacdf17cb1496092b3b1dfe3
Opcode Fuzzy Hash: 818059d61772c2ab412be5e6789b60f955aab73902798bd331b3bc1ba1f723e5
Instruction Fuzzy Hash: 24A181707052548BEB05EB78E8187BE36ABAB99308F10446ED84A977C1CF7D8C26D761

Function 054A0938 Relevance: 1.7, Strings: 1, Instructions: 494
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@hk, xrefs: 054A0B23

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: 53cd65f6fb2d40e89429c3558916f8d1f40f30f0080db17f3ae515a2d2ab553f
Instruction ID: a1703503fb0b46b700544feb5f65124bd91357a76ea604a5771ef59790e4825e
Opcode Fuzzy Hash: 53cd65f6fb2d40e89429c3558916f8d1f40f30f0080db17f3ae515a2d2ab553f
Instruction Fuzzy Hash: 75029E347012108FCB19EB7CE459AAE77E2EF99208F1444ADD806DB3A5DF799C42CB91

Function 05942DF2 Relevance: 1.6, APIs: 1, Instructions: 99
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 05942EB9

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: dd11f331a03a7e919b3b552762f459d9b300b8eb297b5b00b8bd6a02621f82e7
Instruction ID: bbafd78492728de0880439df73edd4a9b336895ffd3ce2e2e2113611409f0f74
Opcode Fuzzy Hash: dd11f331a03a7e919b3b552762f459d9b300b8eb297b5b00b8bd6a02621f82e7
Instruction Fuzzy Hash: C1317076504344AFEB21CB65DC44FA7BBFCFF05214F08899AF9859B662D324E908CB61

Function 05940F73 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 0594103A

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 05cc75c55ad119ed89926bc0bcf77a7b55aa044aa94f9f546e5d7f9d6e0b36a2
Instruction ID: 3715a56f2bb414b92046c71cc23b6b3dca1c59a75db3fde0632f7fc40cf83bc4
Opcode Fuzzy Hash: 05cc75c55ad119ed89926bc0bcf77a7b55aa044aa94f9f546e5d7f9d6e0b36a2
Instruction Fuzzy Hash: 4D316B7510E3C06FD3139B258C65A61BFB4EF47610B0E85DBD8C48F6A3D2296909DBB2

Function 05941BA0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 05941C67

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: d265c5feff59b977bd0b7ea0adfe4caf43b801cf35fd512292e3fda4872494a7
Instruction ID: cb62e44114b33e4706f88b1515a0f99195920d9d593d023aad73db3c500af85e
Opcode Fuzzy Hash: d265c5feff59b977bd0b7ea0adfe4caf43b801cf35fd512292e3fda4872494a7
Instruction Fuzzy Hash: 5C31C2B2504344AFEB21CB51DC84FA6FBACEF04314F04899AFA489B291D374A948CB71

Function 05941E2E Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 05941EEE

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: a4568705860b3f7bd3687a677fa968e6148736883b2bef9757accbac04c02e08
Instruction ID: 94642822a8a47aaaaeca892f9cde59aae56f773d407bd29aac1d50fdea8e108a
Opcode Fuzzy Hash: a4568705860b3f7bd3687a677fa968e6148736883b2bef9757accbac04c02e08
Instruction Fuzzy Hash: B2318F7150D3C06FD3038B358C61AA2BFB8AF47210F0D84CBD8C48F6A3D225A959C7A2

Function 02BAAB1E Relevance: 1.6, APIs: 1, Instructions: 91
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 02BAABD1

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: cf56707a53b01e9ede37a117270d61bc058ab62a54877714d6aa6be2b70e64bd
Instruction ID: 7fca030e91ce7599457f896d7718434189b0ad92e3e7b7b59d38808e220d0ee7
Opcode Fuzzy Hash: cf56707a53b01e9ede37a117270d61bc058ab62a54877714d6aa6be2b70e64bd
Instruction Fuzzy Hash: 0731A4725083846FE7228B51DC84FA7BFBCEF06214F0885DAE9859B653D324A908CB71

Function 02BAA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(?,?), ref: 02BAA6B9

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 9e1963a585da576dae7ba94bc69dddb03ebd9cf10ad5aec102f8775dc681e5df
Instruction ID: 175be7c09b9a2d6aa672a5c06951ba00a439295cf0ff97723d485fa40f8f4a1e
Opcode Fuzzy Hash: 9e1963a585da576dae7ba94bc69dddb03ebd9cf10ad5aec102f8775dc681e5df
Instruction Fuzzy Hash: 413193B15093846FE711CB25DC95B96BFF8EF06214F08849AE944CF292D375E909CB71

Function 0594148C Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 05941523

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: bdb7cda35c98f9d5ab40480e4e37240c601c15771c7a402eee8d9e4ef0cde115
Instruction ID: b7bc45e79157ab8e869239a2014569a3e675e8fc493ff3091432123977746e94
Opcode Fuzzy Hash: bdb7cda35c98f9d5ab40480e4e37240c601c15771c7a402eee8d9e4ef0cde115
Instruction Fuzzy Hash: AB3193725043846FEB21CF65DC45FA7BFECEF05210F0884AAE945DB652D364E908CB61

Function 02BAAE79 Relevance: 1.6, APIs: 1, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 02BAAF1D

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d19146bb9604f68503560a94db6b3c8e93a2a5d0eab30f75a62ea9340b76e307
Instruction ID: a91e3f62491aa39c98c1932a3146ca9bffe763bc017d0d7f8f7f2a85e8e686e5
Opcode Fuzzy Hash: d19146bb9604f68503560a94db6b3c8e93a2a5d0eab30f75a62ea9340b76e307
Instruction Fuzzy Hash: 52318FB1509344AFE721CF65DC84F56BBF8EF05614F0888AEE9858B652D375E408CB71

Function 02BABDD8 Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BABE6C

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 4b4a0770b0ba9ff3085bca2762778aa4c37618cbaf0211a235b21136822ead07
Instruction ID: 42ca2f4551b6cafc36d684e786a1dc0a6f4db897cd1df2e89318b1fcfeb55bea
Opcode Fuzzy Hash: 4b4a0770b0ba9ff3085bca2762778aa4c37618cbaf0211a235b21136822ead07
Instruction Fuzzy Hash: CA21D6725093845FE7128F25DC45B96BFB8EF46324F0884DBE944CF193D364A909CB61

Function 05942E1E Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 05942EB9

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6d6c761b3fff5bb2045564ee96a7069de96130eb1ab48c0043d720b2775e7a96
Instruction ID: 099a33d583246b49137dd26c4cd9953a27164a98fbabd36d6eadf9c9d76813e9
Opcode Fuzzy Hash: 6d6c761b3fff5bb2045564ee96a7069de96130eb1ab48c0043d720b2775e7a96
Instruction Fuzzy Hash: 27216B76600208AEEB21DB15DC44FABBBECFF08614F04896AF9459B651E734E9088E61

Function 02BAA361 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BAA40C

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8401faf9e842ce0c9ba049da0016f6c85f603a5a471929ed6e6db0bc45cb8ca4
Instruction ID: 536db08b42fb4b06da0c247c478c94da133eb0926c76f3869090485d248bd598
Opcode Fuzzy Hash: 8401faf9e842ce0c9ba049da0016f6c85f603a5a471929ed6e6db0bc45cb8ca4
Instruction Fuzzy Hash: C3316D75509784AFE722CF11DC84F92BBF8EF06614F0885DAE9858B692D324E909CB71

Function 05941A98 Relevance: 1.6, APIs: 1, Instructions: 85timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 05941B35

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: dda606e3f62944c97c6015df5eabc4c526ec33d8abcacd7439ce78a6dd87346e
Instruction ID: 5d9b0c888a9a5d09d021e8912a8356ad2de38406295bf30c0fb068e75fdfd927
Opcode Fuzzy Hash: dda606e3f62944c97c6015df5eabc4c526ec33d8abcacd7439ce78a6dd87346e
Instruction Fuzzy Hash: BA2128725053446FD722CF11DC45FA6BFBCEF06324F0885AAE9448B162D334A908CB71

Function 05943160 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 059431F7

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 99c869fbc2f0a212d03150148d36f8ce46dda81942cf779df4e72bd2b2709627
Instruction ID: 593f2fcb70052403ddc2bd6f2e416cab231807019f66e31e153c064cf739efaf
Opcode Fuzzy Hash: 99c869fbc2f0a212d03150148d36f8ce46dda81942cf779df4e72bd2b2709627
Instruction Fuzzy Hash: 9C21A5725093846FD712CB21DC55F96BFA8AF46224F0884EAE9448F193D225A949CB62

Function 05941BC2 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 05941C67

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 39fb4602c0a7b0775b44b1cde575b19a0128a76a1e36aab0a34f030e7a5d72c2
Instruction ID: 8c53a430857818b40d0c92f7ea410643d2f7c56d1657a3f5820217e208ba2643
Opcode Fuzzy Hash: 39fb4602c0a7b0775b44b1cde575b19a0128a76a1e36aab0a34f030e7a5d72c2
Instruction Fuzzy Hash: 4A21B572500204AEEB20DF51DD84FA6F7ACEF04714F04895AFE499A681D775A948CF71

Function 05943091 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 05943120

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 8e1c93798065aa8a5098648db8a2e5eefd9d31d5a1696e6c01dd34dbe2131a2a
Instruction ID: 6260bdb48e3c5f773a27e1df171d5584f1da376d8d3090b218da44f3c80f5588
Opcode Fuzzy Hash: 8e1c93798065aa8a5098648db8a2e5eefd9d31d5a1696e6c01dd34dbe2131a2a
Instruction Fuzzy Hash: 0F218D711093849FDB12CF24DC44F62BFF8EF0A214F0888DAE884CB662D364E849CB61

Function 02BAAF74 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BAB009

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 929c6b0e908c75cc0d8ee5e532eebb53118a2e6f1e0f43c54a9177d2a93c1ad0
Instruction ID: 76f49f01dff6430402d371478d04ac211193bbe3c07248c3a4c523f698148f3a
Opcode Fuzzy Hash: 929c6b0e908c75cc0d8ee5e532eebb53118a2e6f1e0f43c54a9177d2a93c1ad0
Instruction Fuzzy Hash: 282128B25097806FE7128B15DC85BA2BFACEF06324F0985D6ED408B293D364A909C775

Function 02BAA462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BAA4F8

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 9fc3026c1908d64a0b4a6825a145052fcb729856212c455d00f7f194379b69cc
Instruction ID: b2e2381a72ab633140009ab391961b287f5b77f86106f1323026d72e491934cc
Opcode Fuzzy Hash: 9fc3026c1908d64a0b4a6825a145052fcb729856212c455d00f7f194379b69cc
Instruction Fuzzy Hash: 00218EB25083846FD7228F11DC54FA7BFB8EF46224F08859AED859B652D364E808CB71

Function 054A27B8 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

:@hk, xrefs: 054A2C21

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: 1ad4dea1020fe67e66a8e309664117ed26ab031139ff17823d8d5dd96200f677
Instruction ID: b6b47d9b11120db4533f547e653eeb87c76e0ba6cd5049ee90e3c6ce38dc7e02
Opcode Fuzzy Hash: 1ad4dea1020fe67e66a8e309664117ed26ab031139ff17823d8d5dd96200f677
Instruction Fuzzy Hash: 3DD13B35B05214DFCB09DFB8F4589AE77B2EB99204B20846DE802973A5DF799C12DB90

Function 05941642 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 059416D6

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: c88f23fb6d3d7221c679f646566368bd48cf107934740ecb7c90323d2421c6bd
Instruction ID: 3333b944fa58c600d2c521050625e3845a904950ea0bcf4e454675a4f13ab51a
Opcode Fuzzy Hash: c88f23fb6d3d7221c679f646566368bd48cf107934740ecb7c90323d2421c6bd
Instruction Fuzzy Hash: D121B171505344AFE722CF15CC44F96FFF8EF09224F08859EE9848B652D375A508CBA1

Function 05941066 Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 059410F2

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: bba62b0a9e5c2f2d00b1dfc4087b147fa64674e079de26e1fb9fbf13856c3325
Instruction ID: 961a5bceef4b0b390e8554b0019f1f95ed1fc46a4feac08a18f509def4b28e54
Opcode Fuzzy Hash: bba62b0a9e5c2f2d00b1dfc4087b147fa64674e079de26e1fb9fbf13856c3325
Instruction Fuzzy Hash: 0F21A271505344AFE721CF51DC44F96FFB8EF05310F04889EE9858B652D375A408CB61

Function 02BAAE9E Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 02BAAF1D

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4a5369f620bd63566804d40983cb2176aeed6fd974b854fad7a39641475056b0
Instruction ID: 913380f54dc6688a0809cb213a564fb2053c9395dcf466157d0a495de5c38fb2
Opcode Fuzzy Hash: 4a5369f620bd63566804d40983cb2176aeed6fd974b854fad7a39641475056b0
Instruction Fuzzy Hash: 3921A1B2604204AFEB20CF25CD44F66FBE8EF08614F0488AAED45CB651D376E408CB71

Function 02BAB304 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BAB389

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 83884611715e47dd869ad58f56160dfb210188d39bd003e2e226fddaf91313de
Instruction ID: 7a5f295c58470debefc2be3132e3d23271246afaa516659f072b3172c005f844
Opcode Fuzzy Hash: 83884611715e47dd869ad58f56160dfb210188d39bd003e2e226fddaf91313de
Instruction Fuzzy Hash: 1921C5725053446FEB228F51DC44FA7BFE8EF46314F0488AAFD459B552C325A408CBB1

Function 0594139A Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 05941438

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a3c396dab9ff4c3afc628a5ddd0f991874418a8997a31c6bb8a5d9e4356d7026
Instruction ID: b81d39b0f6261ba568ba0cbd64e2ba9692712add7b9765c53328feb831f166ec
Opcode Fuzzy Hash: a3c396dab9ff4c3afc628a5ddd0f991874418a8997a31c6bb8a5d9e4356d7026
Instruction Fuzzy Hash: C9219C72608384AFE722CB51DC44FA6BFFCAF45314F08859AE9459B692D324E908CB61

Function 059414B2 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 05941523

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: a719f2ee2a292b9ba3a4ab7e26f22d18812d3fc3be78ad1236f8455e9b322953
Instruction ID: fd3734556ce6ca21717e88e355a3b1448ba6f59c5753d63c8230b664f6bca118
Opcode Fuzzy Hash: a719f2ee2a292b9ba3a4ab7e26f22d18812d3fc3be78ad1236f8455e9b322953
Instruction Fuzzy Hash: 39219272A00244AFEB20DF25DC45FAAFBACEF04214F04886AED45DB651D774E948CE71

Function 059400B8 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 0594013E

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: b56437347fd5fb514d6ad1bf3d6d42793045ec8ce664459702241c0f3c0394da
Instruction ID: 365f6fb1100e573873ee5ccd7a5d8de2f2268225291f13dac654effbe57590ef
Opcode Fuzzy Hash: b56437347fd5fb514d6ad1bf3d6d42793045ec8ce664459702241c0f3c0394da
Instruction Fuzzy Hash: A4216D7150D3C49FD7128B65DC55A92BFB8AF07210F0D84DBD985CF1A3D2249918CB62

Function 02BAAB52 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 02BAABD1

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6a9b4c2e0c8fa92baa7229b7ef94688d1851046282cb2c2a80d0d7c124ec8161
Instruction ID: dda89ebb708e62a3038ae1adca34a6f0798454a5c51bc1420ec2b61b8d5299c8
Opcode Fuzzy Hash: 6a9b4c2e0c8fa92baa7229b7ef94688d1851046282cb2c2a80d0d7c124ec8161
Instruction Fuzzy Hash: DB219F72604204AFE7209F11DC84FABFBBCEF08214F0485AAED459B652D734E948CAB1

Function 0594325F Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 059432DB

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 00adbce1ee245b2bb291b26f5e451c731c32b0f9254e504efca1997ef7f0ba88
Instruction ID: 1976d14e03211ff93e09dba6b572995caf54766d9bf15a5a913d236fb3414961
Opcode Fuzzy Hash: 00adbce1ee245b2bb291b26f5e451c731c32b0f9254e504efca1997ef7f0ba88
Instruction Fuzzy Hash: C121D4715093846FD721CF25DC44FA7BFACEF05224F0888AAED45CB252D374A808CB61

Function 02BAA646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 02BAA6B9

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6eacb3a5a7dd4ddc888c3cb5c7845ade20874392b1bf61f20e97477c4fffc82c
Instruction ID: ad026fb919a4bfef2e05f8f9b071193260ee29bc61e570a5900bb82e01a68988
Opcode Fuzzy Hash: 6eacb3a5a7dd4ddc888c3cb5c7845ade20874392b1bf61f20e97477c4fffc82c
Instruction Fuzzy Hash: 9B219271604204AFE710DF29DD85BA6FBF8EF04224F0488AAED458B741D775E809CA71

Function 059418D9 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 0594195C

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: ab7b1aca41726609ce31b3c9d84ba1884338aac96f056751ff4fa338ab01d3d4
Instruction ID: 6038a65f96d574ff0812e550049da8928f3af84b99bf3f09eec7bc99f1e614aa
Opcode Fuzzy Hash: ab7b1aca41726609ce31b3c9d84ba1884338aac96f056751ff4fa338ab01d3d4
Instruction Fuzzy Hash: 4721A7715093846FD712CB11DC44F96FFB8EF46224F0885DBE9449F252D368A548CB62

Function 02BAB9F3 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 02BABA6A

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 82ee9ccdc22b470f398ddedd04c3b50b1ae47d89f0f73580b7f3f901812a9652
Instruction ID: fb1995c6134a97b4484651d313f059873252dd0aa607e1008a1a376368b28d55
Opcode Fuzzy Hash: 82ee9ccdc22b470f398ddedd04c3b50b1ae47d89f0f73580b7f3f901812a9652
Instruction Fuzzy Hash: 8C216F726093805FDB218F25DC54B52BFE8EF46214F0884DAED95DB252D675E408CB61

Function 02BAA392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BAA40C

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 048c8212fa7693c5eb538e929fa93eb5fb008e73185bbb6eb82cbeba0c238284
Instruction ID: b46a8bbeafa6a5dad5f8ca78b6d139411f37473b45e692bfff7f07d703c69a83
Opcode Fuzzy Hash: 048c8212fa7693c5eb538e929fa93eb5fb008e73185bbb6eb82cbeba0c238284
Instruction Fuzzy Hash: 9B218C76604604AFEB20CE15DC84FA6F7FCEF04624F08C5AAED458B691D764E849CA71

Function 05942FCB Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 05943047

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 19713bee60a15b23533adc306ca8850d29dee54ce8ff09558c8e3565c89bbc0a
Instruction ID: 7567845fc8b70cd669b16c88731c5a7170938d399a090c25f71fe578f074b891
Opcode Fuzzy Hash: 19713bee60a15b23533adc306ca8850d29dee54ce8ff09558c8e3565c89bbc0a
Instruction Fuzzy Hash: ED21C3715093846FDB22CF11DC44FA6BFB8EF45324F0889AAED459B652C374A508CBA2

Function 02BAAC19 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAAC97

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bf41d99180aa812849194712e14b0e17ad3983a1901617d445371e12fe71d1f0
Instruction ID: 700375cc7ddc66e3184fd1a0d296ef0a210991608eeee457fbb4207376fcef7e
Opcode Fuzzy Hash: bf41d99180aa812849194712e14b0e17ad3983a1901617d445371e12fe71d1f0
Instruction Fuzzy Hash: F521A4725093C45FEB12CF25DC95B92BFF8EF06324F0984EAE8858B263D2749449CB61

Function 05941086 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 059410F2

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: fdbb3efd709a783ea059a297065288ad75fd4df6a385c6f50d2989f4d5d938eb
Instruction ID: f01467b40f6d7bda091c324b770bb3b60991941f4632ca1dacb3d7c4b3b8c97f
Opcode Fuzzy Hash: fdbb3efd709a783ea059a297065288ad75fd4df6a385c6f50d2989f4d5d938eb
Instruction Fuzzy Hash: B121D171500204AFEB21CF52DD45FA6FBE8EF08324F04886EED458A651D376A848CB71

Function 05941D72 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 05941DEE

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 74dd71d9b1b638b7a7515d96951974ef044e778fc322def333a62de87480d4e2
Instruction ID: fba8eb33854a239900561da67827884fd0d29c37f048e6cf4dfb091048b11828
Opcode Fuzzy Hash: 74dd71d9b1b638b7a7515d96951974ef044e778fc322def333a62de87480d4e2
Instruction Fuzzy Hash: 97219F76508784AFDB228F51DC44F62BFF8EF06310F0888DAED858B562D335A818DB61

Function 05941662 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 059416D6

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 34b045cc4a8ad5da4fee15013bd3f14f48c77c3bd2081fb2c51d672223ab4ff3
Instruction ID: b5c0b479accf1264469317ce254a8b8dc04ddc02d004f26ce39084c2afd02d4e
Opcode Fuzzy Hash: 34b045cc4a8ad5da4fee15013bd3f14f48c77c3bd2081fb2c51d672223ab4ff3
Instruction Fuzzy Hash: 4521AE72500204AFE721CF56DC85FA6FBE8EF08224F088969ED458B651D375E848CBA1

Function 0594210A Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 05942193

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e8de0e16d1563697ce427ea8514608aedefca34b842d4b94c8a656651acbace3
Instruction ID: 911158d21d7efb86d5ec803a115468be14df98fbbf81404bfd4366870fc64642
Opcode Fuzzy Hash: e8de0e16d1563697ce427ea8514608aedefca34b842d4b94c8a656651acbace3
Instruction Fuzzy Hash: B411E1755053446FEB21CB11DC85FA6FFBCEF05320F08849AFD449B292C3A8A948CB62

Function 02BAA486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BAA4F8

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f3f8c0ecfa95689dde2b6ad2031235889d2ab9d231cbf415c7c916b4905b5466
Instruction ID: 15768528d2f4e71104e213fd792587209ffd89372e7f38106e74a1930ee60fd1
Opcode Fuzzy Hash: f3f8c0ecfa95689dde2b6ad2031235889d2ab9d231cbf415c7c916b4905b5466
Instruction Fuzzy Hash: E011D372604604AFEB208E11DC44FA7FBFCEF04614F08859AED459A652D775E448CA75

Function 059413C6 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 05941438

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ef93c7e82fb57f612cba77db1d03e6234c8750d3744197de4204fca9d676ff1a
Instruction ID: 96f25945b594f991e705b3ef508e8d3ace1c6b03389eac829e3798ececd219f1
Opcode Fuzzy Hash: ef93c7e82fb57f612cba77db1d03e6234c8750d3744197de4204fca9d676ff1a
Instruction Fuzzy Hash: A011AF72600204AFE720CE51DC44FA6BBECEF04714F08856AED459AA51D374E948DAB1

Function 02BAADB4 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAAE1E

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: a3166293f9a57e3b828897fb068dc0165f8d7b2b635340c2838a0ffd9f0bfd34
Instruction ID: e7fff2d485dfb6e0ee2a12f175a316c3ff07f952812299e40b3380594e98a1bc
Opcode Fuzzy Hash: a3166293f9a57e3b828897fb068dc0165f8d7b2b635340c2838a0ffd9f0bfd34
Instruction Fuzzy Hash: FB115E725093809FD711CF25DC95B52BFE8EF05610F0984AAE985DB652D324E804CB61

Function 05941AD6 Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 05941B35

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: d6a6848840540e3e334687fffa660a42a15138c01420dfade45885eadd13b2bc
Instruction ID: 5441daa97a0cdd47e0c738059f89458805b2f2b91b615ec174ffa251dd6e79ac
Opcode Fuzzy Hash: d6a6848840540e3e334687fffa660a42a15138c01420dfade45885eadd13b2bc
Instruction Fuzzy Hash: 0C11D072600204AFEB21CF51DC45FAABBACEF44324F04886AED058B651D375E848DBA1

Function 0594319E Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 059431F7

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 882ffcfb60cd1c318615151184ab0ee808cd0804425256f608411c1e07b8929f
Instruction ID: 1a624e39ba21e83fc7d9537efc1e90d6f6a2a9b9982cbe6128b0a9c9ccb93320
Opcode Fuzzy Hash: 882ffcfb60cd1c318615151184ab0ee808cd0804425256f608411c1e07b8929f
Instruction Fuzzy Hash: 9B11C472600204AFEB20CF65DC45FAABBACEF04324F04886AED058B641D375E848CBB5

Function 05943282 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 059432DB

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 882ffcfb60cd1c318615151184ab0ee808cd0804425256f608411c1e07b8929f
Instruction ID: d48e6e2963c93a818f080829d0ffe26af05fc0974fcc1696dd94408eb8277d1c
Opcode Fuzzy Hash: 882ffcfb60cd1c318615151184ab0ee808cd0804425256f608411c1e07b8929f
Instruction Fuzzy Hash: EC119472600204AFEB11CF65DC45FAABBACEF04324F04886AED059B651D775E848CEB5

Function 02BABE16 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BABE6C

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: ba6ec8c495647659d3babfa992b6bef80692e6e60556fbc57fec3230d959dd74
Instruction ID: 1916a5f48491d6d57edf017b667f8402f2e1e599a4c8c3c03f0a6e1d1dd1a401
Opcode Fuzzy Hash: ba6ec8c495647659d3babfa992b6bef80692e6e60556fbc57fec3230d959dd74
Instruction Fuzzy Hash: EE11A771604204AFEB11DF15DC85BA6FB98DF44224F0488AAED05CB651D775A548CAA1

Function 02BAB32A Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BAB389

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b3488bd5f192c6518eec1f08b99571f2dfbfdf4154148676edb80b0e6463d092
Instruction ID: 7cc03fad3f9dda40ae0781e8aa8e5559e2aecee438146f9cbc1fff57bd65c1ea
Opcode Fuzzy Hash: b3488bd5f192c6518eec1f08b99571f2dfbfdf4154148676edb80b0e6463d092
Instruction Fuzzy Hash: AA11E372504204AFEB21CF51DC44FAAFBE8EF04328F04C8AAED458B651C375A408CBB2

Function 05942FEE Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 05943047

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: f391b825ac89c452830bd1eebcbcf7f72baded59709995fc1b6dbe6fa7b61690
Instruction ID: 29a2b001c40e9265b875fcbdde5b73f1e8dcc3e945d69e912e242ce8fa7d1636
Opcode Fuzzy Hash: f391b825ac89c452830bd1eebcbcf7f72baded59709995fc1b6dbe6fa7b61690
Instruction Fuzzy Hash: 6411E771500204AFEB20CF11DC44FA6FBA8EF04324F04896AED058B641C375A848CEB1

Function 05941906 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 0594195C

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 303a0ed036225a9edb73119108aee9ce84e0d92878b9e6541259f676a8f9dcc0
Instruction ID: 2f1cb6c689f80dea5c0651070eaba3da6dd8dadcf41ab1189859363e6556efc2
Opcode Fuzzy Hash: 303a0ed036225a9edb73119108aee9ce84e0d92878b9e6541259f676a8f9dcc0
Instruction Fuzzy Hash: 4D11C671500204AFEB10CF11DC84FAABBE8EF04324F0488A6ED049B741D375A848CAB5

Function 05942055 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

CoGetObjectContext.COMBASE(?,?), ref: 059420C7

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: d7aba9c3e22ca6bef4d77acbdac05eaa25bf865a635c0e1ee17abca9e2fc63fe
Instruction ID: 3263b43c2a8ce64dddee9d86b700e2aad71f1da9022be56d8316b0342bfa4a9f
Opcode Fuzzy Hash: d7aba9c3e22ca6bef4d77acbdac05eaa25bf865a635c0e1ee17abca9e2fc63fe
Instruction Fuzzy Hash: D7117F754093849FDB128F15CD45A61BFB4EF06320F0984DAED454F262D369A849DB62

Function 02BAA2D2 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAA330

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a12cfbd7d6335fbf618306e47fe5be7dcff52322576b9a4f6e511d105eaba0a7
Instruction ID: 80026125300a1e49742a628e825a8bad591fcd48c16bf01cf492713abd68114b
Opcode Fuzzy Hash: a12cfbd7d6335fbf618306e47fe5be7dcff52322576b9a4f6e511d105eaba0a7
Instruction Fuzzy Hash: 8C118F7140D3C06FDB128B15DC54B62BFB4DF47224F0984DBED848B263C2656918DB72

Function 0594212A Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 05942193

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 67d87723e2c9faa4b47148e3e28799e3a3da04433a4f8dde3b495629f29aacc3
Instruction ID: 8504db962f115d5b5daa4997c1916b31160f9cca33af050bebd4a1ded62ff17b
Opcode Fuzzy Hash: 67d87723e2c9faa4b47148e3e28799e3a3da04433a4f8dde3b495629f29aacc3
Instruction Fuzzy Hash: 4611E975500204AEEB20DB11DD81FB6F7A8EF04724F048495FE445A681D7B9A948CE71

Function 05940450 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 059404B6

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 372379a201b622b27632f2599a0e6a6f665ccb988ae4a0accce9c83886872086
Instruction ID: f58f4b2b60743cf52d893714b0b0d3995c00b8541a035c6ef8a8c01e738fb825
Opcode Fuzzy Hash: 372379a201b622b27632f2599a0e6a6f665ccb988ae4a0accce9c83886872086
Instruction Fuzzy Hash: 4E117F32508780AFCB218F51DC44A56FFF4EF0A220F09889EEE858B562D375A418DB61

Function 059430CA Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 05943120

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 804c9e4db53c1b9cfb88f97ba00739eb6bb12c84123e9b4e5fad3840d865c2cb
Instruction ID: c2bd1d8fe159385827d4ba65129919541daa2bfe7a8c207a23dafc8d57ea9ddf
Opcode Fuzzy Hash: 804c9e4db53c1b9cfb88f97ba00739eb6bb12c84123e9b4e5fad3840d865c2cb
Instruction Fuzzy Hash: C6114F756042449FDB20CF25D984FA2FBE8EF08714F0888AADD49CB651D375E888CF61

Function 02BAA078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 02BAA0D5

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: c0c39ef0b050506351d6cdb360cf47ef23a1fdbd7b76721a405016156ad13828
Instruction ID: 944ccc4c487d9cfc8335ae6ef000532a09a25bcbc3dccd2687808e3a3c8e00a4
Opcode Fuzzy Hash: c0c39ef0b050506351d6cdb360cf47ef23a1fdbd7b76721a405016156ad13828
Instruction Fuzzy Hash: C8119172509780AFDB22CF15DC44B52FFB4EF46224F0888DEED859B562C375A818DB62

Function 02BABA22 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 02BABA6A

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: bced4ee67cea2dd2bcbd149dbf756d286be7123b0f881c0d8baa4fd591bc13bd
Instruction ID: 11662a34a726a0ab79423de036162b37798ec2b637a3c3f9a547442e23bbad76
Opcode Fuzzy Hash: bced4ee67cea2dd2bcbd149dbf756d286be7123b0f881c0d8baa4fd591bc13bd
Instruction Fuzzy Hash: 1C11A5B26042048FEB10CF25DC95B56FBE8EF14224F08C4AADC1ACB751D775E404CA71

Function 02BAADD6 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAAE1E

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: bced4ee67cea2dd2bcbd149dbf756d286be7123b0f881c0d8baa4fd591bc13bd
Instruction ID: a440437e87ecefa44bf6a97bd75ff3a9fc6eb40d03523fecf82b8c76fc9d0db5
Opcode Fuzzy Hash: bced4ee67cea2dd2bcbd149dbf756d286be7123b0f881c0d8baa4fd591bc13bd
Instruction Fuzzy Hash: 9911C4B26042049FDB10CF29D885B56FBE8EF04624F18C8AADD49DB741D335E844CB71

Function 02BAAFB6 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,35C9D1D0,00000000,00000000,00000000,00000000), ref: 02BAB009

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d9128078fa184ac4b9f4e09eea6ad8aa3778349f43b0b3f9f1f2ec1460e805f5
Instruction ID: 7f00e1920f8707bac587d319914a6ba24fe9acfd74a6bbe0437aaf9ba67b404e
Opcode Fuzzy Hash: d9128078fa184ac4b9f4e09eea6ad8aa3778349f43b0b3f9f1f2ec1460e805f5
Instruction Fuzzy Hash: 9B01D672504204AFE720CB01DC85FA6FBA8EF14628F04C0A6ED048B741D379E548CAB5

Function 02BAB1A8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAB1FC

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 5643a09d4702c19e6c01db85f928f410ec307553246ec638e9cfc5be809ad26a
Instruction ID: e7dcaeba7d2ce06803970985a043184b4be4045be5254c6424d8748163c6fbb9
Opcode Fuzzy Hash: 5643a09d4702c19e6c01db85f928f410ec307553246ec638e9cfc5be809ad26a
Instruction Fuzzy Hash: 9B11A5765093809FDB128F15DC54B56FFB4DF06224F0884DBED858B662D275A908CB62

Function 02BAA9E4 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 02BAAA3B

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: d504a26610e36f51b1930472ac8269053f56a9863bf3f67f0cbc57ed9c201be6
Instruction ID: 8dbdbd8fb2ee43ef5bfbe7f7d2193fe616653f241f142142ff86e59878bdd46f
Opcode Fuzzy Hash: d504a26610e36f51b1930472ac8269053f56a9863bf3f67f0cbc57ed9c201be6
Instruction Fuzzy Hash: D31191724093849FDB118F15DD84B52BFF4EF06220F0984DAED458B262D275A808CB61

Function 05941DA2 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 05941DEE

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: dacc804655263b9fa706944bde25d091060b5a706ce1222fea29773df0ad335c
Instruction ID: 4b20726a662e0e6844eb4e54cbc571ec6a102230e9f7cc37c64a0f7bc6d5d6ed
Opcode Fuzzy Hash: dacc804655263b9fa706944bde25d091060b5a706ce1222fea29773df0ad335c
Instruction Fuzzy Hash: E4115A765006049FDB20CF55D844F62FBE5EF08320F08C8AAED498B662D336E858EF61

Function 059400FE Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 0594013E

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: df6343b99bc16ff5322282988f0fcebde8fc2c3666ab078e8838db6dc0446ea2
Instruction ID: b8471688459a95c48e67f49853fd301e31b91f095dcd6a337605cf941a767116
Opcode Fuzzy Hash: df6343b99bc16ff5322282988f0fcebde8fc2c3666ab078e8838db6dc0446ea2
Instruction Fuzzy Hash: 8A115E726042049FDB50CF65D989B66FBE8EF08324F0884AADE498F651D375E848CF61

Function 02BAAC5A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAAC97

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ebef69e58ae2b6fa58586e2ebaadaa2f9f205a49e0a293bc34f8abf7d9e28d74
Instruction ID: f89223f92ffcafb96254a11934a58e32f8a133ea64a4feb374733c5e1ce7a5a5
Opcode Fuzzy Hash: ebef69e58ae2b6fa58586e2ebaadaa2f9f205a49e0a293bc34f8abf7d9e28d74
Instruction Fuzzy Hash: C90180726042449FEB50CF25DC85756FBE4EF04224F08C4AADD45CB752E375E444CA62

Function 05941E9E Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 05941EEE

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: ef3451eb362d77648033d0d3b486210e3cb1faf7be5a49f4c066c0f808d9b5b8
Instruction ID: 24fcae815a7aa64ceaa309edc5a7886d9e0b7ae421c7a1d29ca7514e19a96e54
Opcode Fuzzy Hash: ef3451eb362d77648033d0d3b486210e3cb1faf7be5a49f4c066c0f808d9b5b8
Instruction Fuzzy Hash: 7601B171A00204ABD350DF16CC85B66FBE8EB88B20F14855AEC089B741D731F915CBE2

Function 05940472 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 059404B6

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ef671ead7dfe912f3d4e5a2986f018eaa315ce07bff925c4da448707d77f12fc
Instruction ID: 2233cbfba505223abc3b730c35366a268cfa4af1b40d5b6c84fb98e4d50875ee
Opcode Fuzzy Hash: ef671ead7dfe912f3d4e5a2986f018eaa315ce07bff925c4da448707d77f12fc
Instruction Fuzzy Hash: 81016D325006049FDB21CF55D944F66FFE5EF08324F08C8AAEE494AA52D376E818DF62

Function 05940FEA Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 0594103A

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8b1e62aa0d77a33d40353a180a87c65fcd09e0164479b03e182c514d173915d1
Instruction ID: bbfc17b0b1c710c32491a70e1dfaa03d80721a6e43db26d62414cdad032ea37c
Opcode Fuzzy Hash: 8b1e62aa0d77a33d40353a180a87c65fcd09e0164479b03e182c514d173915d1
Instruction Fuzzy Hash: 8F01A271500204ABD250DF16CC86F66FBE8FB88A20F14815AEC089BB41D771F915CBE6

Function 02BAA09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 02BAA0D5

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 4b682661949582d64538f53538555f9286fb60633c2b8daf7e6c0c03e7daeefa
Instruction ID: 109b3f0da9fe0e05fb7abac09f9a6c4129ad203286dd49e230311ec7e4f1a32c
Opcode Fuzzy Hash: 4b682661949582d64538f53538555f9286fb60633c2b8daf7e6c0c03e7daeefa
Instruction Fuzzy Hash: 05019E325046449FDB20CF55D845B55FBF0EF08324F08C8AADD498B652D376E448CB72

Function 054A2757 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

:@hk, xrefs: 054A2C21

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: 402382e1c6d0f99c7975d10904158ad6f949d153b355761082fdca3e96955cea
Instruction ID: 2c23185a284b00b252a50b77dcfaa2cb50f9afac9af783d6d5dda8df235f2573
Opcode Fuzzy Hash: 402382e1c6d0f99c7975d10904158ad6f949d153b355761082fdca3e96955cea
Instruction Fuzzy Hash: B4B15D34B05214DFCB09DFB8F4546AE77B2EB99204B20846EE805973A5DF799C12CB90

Function 02BAAA06 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 02BAAA3B

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: 4203e7544ad73e7407eca8f89f3b53c36e99ac94d593b2616c608825196c6065
Instruction ID: 35f9cee8dd411d63e7062fca499d3e784053ce288dfbc4bda2d1cbc6cdce9e01
Opcode Fuzzy Hash: 4203e7544ad73e7407eca8f89f3b53c36e99ac94d593b2616c608825196c6065
Instruction Fuzzy Hash: C8018F725046449FDB10CF15D984B66FBE4EF04724F08C8EADD4A8B652D379A448CEB2

Function 02BAB1CA Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAB1FC

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 296671c78f22ed0c43bc5037542b7b9e1525879d32935bd552cce22cc9141a89
Instruction ID: 535b9b653fd632f91c8dcb68d43b41418131d926b769fad16195e73a42b82cf7
Opcode Fuzzy Hash: 296671c78f22ed0c43bc5037542b7b9e1525879d32935bd552cce22cc9141a89
Instruction Fuzzy Hash: F701AD355042048FDB108F15E884B66FBA4EF04224F08C0EADD458BB52D379E848CE62

Function 05942092 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CoGetObjectContext.COMBASE(?,?), ref: 059420C7

Memory Dump Source

Source File: 00000004.00000002.4557897335.0000000005940000.00000040.00000800.00020000.00000000.sdmp, Offset: 05940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5940000_svchost.jbxd

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 2c1daf18f6db6bc088ec250516db41bc67071464832256d00e11b318980820ff
Instruction ID: fb62dd37cbc5293c10a5d1fc52d2669d274d0dd20b357befbed0e328ebd2a80a
Opcode Fuzzy Hash: 2c1daf18f6db6bc088ec250516db41bc67071464832256d00e11b318980820ff
Instruction Fuzzy Hash: DDF06D755006449FDB108F05D884B61FBE4FF08224F08C49AED454B652D37AA888CEA2

Function 02BAA2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAA330

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 02ca0e4630c8d7209a84c15a8e00aa5d273dee3f551f0f5399434da9340d07b0
Instruction ID: aaf2b86de83c9e70a7d740ae5e448286100c6af397c6633326a7e3e9739124a7
Opcode Fuzzy Hash: 02ca0e4630c8d7209a84c15a8e00aa5d273dee3f551f0f5399434da9340d07b0
Instruction Fuzzy Hash: B4F0AF35908644CFDB108F09D884B65FBE0EF04324F08C0DADD494B752D379A848CEB2

Function 054A28BD Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

:@hk, xrefs: 054A2C21

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: c89bf841e35e98ac093a043fb6bd72c14cce0ce0ddbbafa3b891e9f592e04f4b
Instruction ID: f1f7d9d17399822875e5ad6cad88ad1a1f7188bf931c31735e61edf7296b940d
Opcode Fuzzy Hash: c89bf841e35e98ac093a043fb6bd72c14cce0ce0ddbbafa3b891e9f592e04f4b
Instruction Fuzzy Hash: A8912938B01214DFCB09DFB8F4556AD77A2EB59208B20846AE806973A5DF799C12DF50

Function 054A290D Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

:@hk, xrefs: 054A2C21

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: e2decdccd67ead7a2fc029448c68923bb0fc42466464ca117c5a210d27c39611
Instruction ID: 03fe43582a45fd17a3d414fa0e378bd79490ae8c42a0cf9a5828657d246e06d5
Opcode Fuzzy Hash: e2decdccd67ead7a2fc029448c68923bb0fc42466464ca117c5a210d27c39611
Instruction Fuzzy Hash: A8811A38B01214DFCB09DFB8F4556AD73A2FB99208B20846AE845973A5DF799C12DF90

Function 054A294F Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

:@hk, xrefs: 054A2C21

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: d8e923dfc252648af1fd8a7e54124e92c4dbca3a700e15312f26bdde5c7e9c2d
Instruction ID: 8eb5ae7634b0a77c641c140f40f9777c7ee333255b13751a4275d4ea8362ccca
Opcode Fuzzy Hash: d8e923dfc252648af1fd8a7e54124e92c4dbca3a700e15312f26bdde5c7e9c2d
Instruction Fuzzy Hash: 1F811C38B01214DFCB09DFB8F4556AD73A2FB99208B20846EE845973A5DF799C12DF90

Function 054A0B03 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

:@hk, xrefs: 054A0B23

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: 9dcc9ff9296f250ff490962ad8a2114dc1146c4c8a48da000b11a6d710ea86e9
Instruction ID: 298b15cf86465dd1f4c34c30c0aae2cc22e2df3421dcb009996639d101f4128b
Opcode Fuzzy Hash: 9dcc9ff9296f250ff490962ad8a2114dc1146c4c8a48da000b11a6d710ea86e9
Instruction Fuzzy Hash: 1571AC35701210CFCB19DB78E45867D37A3EB99208B2444AEE80A8B3D5DF7E9C52CB61

Function 054A29C3 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

:@hk, xrefs: 054A2C21

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: 81e912c991460b0a44cddf4008ab28c78b231d9ec688bf259e95904c9d499f31
Instruction ID: 5f15986ec6debf5c1fe75790783782e6cc2b5a6c76695505e61af34e3d261532
Opcode Fuzzy Hash: 81e912c991460b0a44cddf4008ab28c78b231d9ec688bf259e95904c9d499f31
Instruction Fuzzy Hash: 39713D38B01214DFCB19DFB8F45866D73A2FB99208B20846EE845973A5DF799C12DF90

Function 054A2AA5 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

:@hk, xrefs: 054A2C21

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: d30db7276ffe5f14fdb43304aa7933946b9951637591cb199c3c8af5dd7a1206
Instruction ID: dba0caefdb7dffd0ec47e9ca723b1b73a5e1665dc79a5c9361473f279df530e9
Opcode Fuzzy Hash: d30db7276ffe5f14fdb43304aa7933946b9951637591cb199c3c8af5dd7a1206
Instruction Fuzzy Hash: 4C519438B05214DFCB18DFB8E44966E73A7FF98214F20846AD805973A5CF789C12DB90

Function 054A2BC0 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

:@hk, xrefs: 054A2C21

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: :@hk
API String ID: 0-3104576358
Opcode ID: 8a85134143ecca7e74dbd9f08930a9f71c9e0b1994485d4aab85c3a46d440aba
Instruction ID: 99c10e7c3111e161d533364f194f05f869aaaf4fe7433239231443a56f83d5ce
Opcode Fuzzy Hash: 8a85134143ecca7e74dbd9f08930a9f71c9e0b1994485d4aab85c3a46d440aba
Instruction Fuzzy Hash: F231A138B012188FCB09EBB8E4046BD73A7FF99208F20846ED80597795CF798C12DB91

Function 02BABC38 Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BABCA4

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 955ecfb9c8c322141333ba5da0714f75821409f3368f727d06c70345fe4fb085
Instruction ID: d393be8266fef4de68e633976c669823d9fc3be8d87d4fe8a7794af9b001f44b
Opcode Fuzzy Hash: 955ecfb9c8c322141333ba5da0714f75821409f3368f727d06c70345fe4fb085
Instruction Fuzzy Hash: 9221817250D3C45FDB128B25DC54B92BFB4AF07324F0984DAEC858F663D265A908DB62

Function 02BAA710 Relevance: 1.3, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAA780

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 24c2549bcda345104f8f542b84f7e0c4c4e0acebc09176ed3d8d150d71ff6f1e
Instruction ID: fa32cad8a6a844de3fe494b91059c5b84d3d43412e675640e9e6f2448916c60f
Opcode Fuzzy Hash: 24c2549bcda345104f8f542b84f7e0c4c4e0acebc09176ed3d8d150d71ff6f1e
Instruction Fuzzy Hash: 5A21D5B15083849FD711CF15DC95752BFB8EF02324F0984DAED458B653D334A909CB61

Function 02BAAA81 Relevance: 1.3, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAAAE0

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8e47916d6b3c9e4c620b77abf4a80416555882d034aa40c142a124e083e668f9
Instruction ID: 8e871ded21b2a5557d305ad10b5d2ba2d2ddb179823043f5cc05b6c02c58430e
Opcode Fuzzy Hash: 8e47916d6b3c9e4c620b77abf4a80416555882d034aa40c142a124e083e668f9
Instruction Fuzzy Hash: 66115E715493C05FDB128B25DC54792BFB4EF06220F0988DBED848F153C265A948CB62

Function 054A0509 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

[fi^, xrefs: 054A0545, 054A054A

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID: [fi^
API String ID: 0-3750854875
Opcode ID: d45c9815d371ae80286c4d605657b92a4ad02294401bc7d6d23fb46f1c7e576d
Instruction ID: 4e576e13e2ac434a31127e87071659dc734f4c80b70bac220db44de7111ef613
Opcode Fuzzy Hash: d45c9815d371ae80286c4d605657b92a4ad02294401bc7d6d23fb46f1c7e576d
Instruction Fuzzy Hash: B201B121F041108B4B5AE7BD44252BE75D75FD418470948AAC40ADB381DF788C068BF7

Function 02BABC72 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BABCA4

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a1c0e3add5f20fe4c38382189c220f524b16cc18201e059bd88e2104c5dfad1f
Instruction ID: 27a4e254ac79d1a044d484b1fcaeef518a97102e7733e6fc7bdfa1d93221637c
Opcode Fuzzy Hash: a1c0e3add5f20fe4c38382189c220f524b16cc18201e059bd88e2104c5dfad1f
Instruction Fuzzy Hash: 7501DF766082048FDB10CF25E884B96FBE4EF14228F08C4AADC098B752D775E848CA62

Function 02BAA74E Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAA780

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 944cedc438af05d49cde4c63abd2eba0fc4f0f49785f9094db22706909529862
Instruction ID: 5444cec74f528a29541088dfd76e8b4ae22d3830a333f0f7b483633c12385e83
Opcode Fuzzy Hash: 944cedc438af05d49cde4c63abd2eba0fc4f0f49785f9094db22706909529862
Instruction Fuzzy Hash: 2B017C756042448FDB508F25D9957A6FBB4DF04224F08C4AADD498B652D379E848CAA2

Function 02BAAAAE Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,35C9D1D0,00000000,?,?,?,?,?,?,?,?,6C223C58), ref: 02BAAAE0

Memory Dump Source

Source File: 00000004.00000002.4554713291.0000000002BAA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BAA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2baa000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8e19de8865803adfb52f82e1955b360edddf95b4f548f7d071a974b277dedb9d
Instruction ID: 124dd2ed6b1cea93d3d6fd2649761528945cdad3e3239e9ebd23a03f21f7f14d
Opcode Fuzzy Hash: 8e19de8865803adfb52f82e1955b360edddf95b4f548f7d071a974b277dedb9d
Instruction Fuzzy Hash: F1016D719092449FDB10CF15D984BA6FBE4EF04324F08C8EADD498F652D379A848CEB2

Function 054A1F3F Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa4c3ab2d9d6f3864ea1cb28ac6ecbb3b9bf1a36d4d1649b4c2ed49537b8b35
Instruction ID: 54e1b1a6bc4a85ba1ed9de74db17f08e295d8f9c3cf46b774ed125e70a397d3d
Opcode Fuzzy Hash: 4fa4c3ab2d9d6f3864ea1cb28ac6ecbb3b9bf1a36d4d1649b4c2ed49537b8b35
Instruction Fuzzy Hash: C512D436A092118FDB68EB38D4547FE72A3BF95204F15446AC806A7390DF78DC86DBA1

Function 054A1460 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 401d7fc4c2ad65a58c352853352a6d8244cd26c5bf266ed5403f3d840548a420
Instruction ID: 060d8e7a783663bf1bd5cdca982030a6b1eb9e51ba0c3f6c9a6036486bce5581
Opcode Fuzzy Hash: 401d7fc4c2ad65a58c352853352a6d8244cd26c5bf266ed5403f3d840548a420
Instruction Fuzzy Hash: 25A10232B052008BC755DB38E8487EE36E3BBA4254F5856AAE812DB3D1DF79DC06CB51

Function 054A05C5 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248b4975e5fbde61d2b81133af8bfac3a9c4384b45be9487825ee59d85ea836e
Instruction ID: 253b4f2269f697b5125e5f26ac1e1c9c5998a0e4409230c003f46224c300bb7f
Opcode Fuzzy Hash: 248b4975e5fbde61d2b81133af8bfac3a9c4384b45be9487825ee59d85ea836e
Instruction Fuzzy Hash: B0619939B01300CFCB15DB79F4486AE77A2FB98248B1544ADD8069B392DF7ADC42CB61

Function 054A0015 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ca8cc4d1c43f8819556002622592d3a6abc13605e16b2054d5e7e69b06f151
Instruction ID: 9577eec8564ddf9847cf5ea39e793399768251306f27f6f6a9666cf22bac06db
Opcode Fuzzy Hash: b8ca8cc4d1c43f8819556002622592d3a6abc13605e16b2054d5e7e69b06f151
Instruction Fuzzy Hash: 9F619F3061A385CFC306DB3CF45C59D3BB2EFA1248759859EC4448B6A7DB6C5C1ACBA2

Function 054A0BA8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc2ae22a085545b585f07321ec6065ef469ef0186e004691eafefcac101ebe1
Instruction ID: 4b196e5a131a9339e4b377210ede476f8c3215080b4369248a0135570aa19a16
Opcode Fuzzy Hash: 3cc2ae22a085545b585f07321ec6065ef469ef0186e004691eafefcac101ebe1
Instruction Fuzzy Hash: A0518D39701210CFCB19DB78F45866D37A2EB99208B1544ADE80A9B3D5DF7AEC52CB60

Function 054A1450 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c248692b04c12a7c22def44a5b83c38cd3a688f912370697f6f3bb023ffcd8
Instruction ID: ff137ae500851f176c0a34857f643b2dc0997406fa6680cf1e66c41ffb48b094
Opcode Fuzzy Hash: 78c248692b04c12a7c22def44a5b83c38cd3a688f912370697f6f3bb023ffcd8
Instruction Fuzzy Hash: DB51C032A05201DBD755CB3AE8447FA36E7FB98350F5842AAD802DB2D1DF78D906CB21

Function 054A0634 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e89e4884db58490e206aa450ceeba3444c4fe74563c9a83f6a356c104c01c5d
Instruction ID: 1f0575a8a65064615904a052ba5b75a2e47516e66e3ad0cb040726f1d813beae
Opcode Fuzzy Hash: 3e89e4884db58490e206aa450ceeba3444c4fe74563c9a83f6a356c104c01c5d
Instruction Fuzzy Hash: FF511739702200CFCB19DF78F45866E73A2FB9824871544ADD8069B395DF7AEC52CBA0

Function 054A1830 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911a9868bd377af4fe2831dc9bf3f3ac79e52b3cf28a41c2087ede32447460cf
Instruction ID: fe1079691d8d9193479d16d622b024caeb2281123a0609b6e03edd1b0744da3a
Opcode Fuzzy Hash: 911a9868bd377af4fe2831dc9bf3f3ac79e52b3cf28a41c2087ede32447460cf
Instruction Fuzzy Hash: EF41CD32B05211CBDB16CB3AA8447FD36E3BB94354F5855AAD402DB2D1DF78D906CB21

Function 054A0C22 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23dc36aa0ef8d00b84b2aa5eb094550817cfb63c6101a90c4904fea1b58c0737
Instruction ID: 364dcd7d52530f3f6005ada5142033144f7fdb25d61f49368651611728863669
Opcode Fuzzy Hash: 23dc36aa0ef8d00b84b2aa5eb094550817cfb63c6101a90c4904fea1b58c0737
Instruction Fuzzy Hash: 4841AF39701210CFCB19DB78F45966D37A2EB98208B1544ADE80A9B3D5DF7AEC52CB60

Function 054A1238 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975b18ceda74bbbdabce3fadfa14e248bb3c8d089583fddea8014507e38e97a8
Instruction ID: 1f8af1567c684cf1f3c820d471c80491227aefa9b1b29359a336131b5795535e
Opcode Fuzzy Hash: 975b18ceda74bbbdabce3fadfa14e248bb3c8d089583fddea8014507e38e97a8
Instruction Fuzzy Hash: 7F41A232B002118FDB44DF78D8885AE77E6EF84214B5884BAD805DB79ADF39CD45CBA1

Function 054A3070 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67802597cf4e7a05d9e80bdc051dd2dac8390e378d5ef14d5bb24f46a0a0103
Instruction ID: 08dcc5547222717ec73679e576a184ee900e9d0afe7a32e1ded762d885ac0b48
Opcode Fuzzy Hash: b67802597cf4e7a05d9e80bdc051dd2dac8390e378d5ef14d5bb24f46a0a0103
Instruction Fuzzy Hash: 9231BF71B002059FDB14CF79D844BEEBBF6AF88214F24856AE405EB390EF749C058B90

Function 054A1229 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36631ac33b5be1d2d3998cf3c4b16cb78ca360e6895e9562340cf1a4113076f3
Instruction ID: 8e3aa5b9435246aefc5d2f0179c6f25de7b37a7409493a7ebaea732e3688289c
Opcode Fuzzy Hash: 36631ac33b5be1d2d3998cf3c4b16cb78ca360e6895e9562340cf1a4113076f3
Instruction Fuzzy Hash: C3319232B012118FDB44DF78C8885AE77E2BF88204F5884A9D805DB79ADF79DD45CBA0

Function 054A0C8D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018a8ed9497b6fcc812a5f5e0a6a4ddd307e3227cc41566523eb155b8438136c
Instruction ID: 3e9cb9b1b5ce0b46dfec85da371ef91a921678c78720d0fe7f946f9d5eae3bad
Opcode Fuzzy Hash: 018a8ed9497b6fcc812a5f5e0a6a4ddd307e3227cc41566523eb155b8438136c
Instruction Fuzzy Hash: AB319F39B012108FDB15DB78E4597AD37A2EB98208F1484ADE40ADB3D5DF79EC52CB60

Function 054A2698 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ea0188cfcc36b4d2f0813582a2a5cec9504ad1d3a8b2adbb6cef35de224da5
Instruction ID: fca8bd363b062e8c8356520007fd635504a0a79798cfe2952d7c847828731658
Opcode Fuzzy Hash: 75ea0188cfcc36b4d2f0813582a2a5cec9504ad1d3a8b2adbb6cef35de224da5
Instruction Fuzzy Hash: 1B11E739F042149BCB55EA75D801BFEB7F7BF88300F14857AD501AB280EA749D008BA0

Function 02C01371 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554990185.0000000002C01000.00000040.00000020.00020000.00000000.sdmp, Offset: 02C01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c01000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003d4a67e74f61a5267a93cf249c49998e43c6b09d6e555fdcbe2ced51fad319
Instruction ID: 61948693d71ac43e2d5dc4fef98aed1c3eb98eefb5305ab11017f0db1556ef92
Opcode Fuzzy Hash: 003d4a67e74f61a5267a93cf249c49998e43c6b09d6e555fdcbe2ced51fad319
Instruction Fuzzy Hash: 4D211B3114D3C08FCB178B60D994B55BFB5AB87218F1985DED4888B5A3C26A8916CB52

Function 054A0E55 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f851299d19ed66887a512b74a6d7dd309653df338aa8a682a7e049f9b184e6d2
Instruction ID: 901039502fe3f94ace36ee1e2ff42d60026f215ef80c745a22df7b8c3fc16833
Opcode Fuzzy Hash: f851299d19ed66887a512b74a6d7dd309653df338aa8a682a7e049f9b184e6d2
Instruction Fuzzy Hash: 0D215B35B110148FCB04DBBCE4589AD73F3FF98218B1081A9E80AAB365CF759C46CBA1

Function 054A0D40 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5eac5c2f23b4bdd9769ed8c47cb76b35e9b242801a21a71a07ad0a7901ab338
Instruction ID: 33122d6db303a9f455a3cb8500e7fdf0b7446b525a97ccafbbf719969ff077c1
Opcode Fuzzy Hash: f5eac5c2f23b4bdd9769ed8c47cb76b35e9b242801a21a71a07ad0a7901ab338
Instruction Fuzzy Hash: D811DC35B012108FCB14DF79E4486AD77E2EF94218B6584AEE019DB3C2EF79D852CB20

Function 054A0773 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69427dec031b2532d08322ccab40afb4070b14b4893abed55b7f570beed791ca
Instruction ID: 9cd285925bed0c7063dccc0f255c11cea57743b4e4cf7d82243bcd81c00d2fe6
Opcode Fuzzy Hash: 69427dec031b2532d08322ccab40afb4070b14b4893abed55b7f570beed791ca
Instruction Fuzzy Hash: 6E213835702300CFCB09DB78F45856D33A2FB9924871544ADD906973A1DF7EAC52CB91

Function 05D526C0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557991789.0000000005D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d50000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3bda86e143e74f7c2e5b7ee459df717c7923541976737f77a7001041b65c24
Instruction ID: 79336c8ffef3e1482bc0113e22af004904d917515ba145c1c8285815dfda0ff5
Opcode Fuzzy Hash: ad3bda86e143e74f7c2e5b7ee459df717c7923541976737f77a7001041b65c24
Instruction Fuzzy Hash: 6C11B7B5908341AFD340CF19D881A5BFBE4FB88664F04896EF998D7311D235E9188FA2

Function 02C0139C Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554990185.0000000002C01000.00000040.00000020.00020000.00000000.sdmp, Offset: 02C01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c01000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762da46029d19b7b0fef0db1243fa06564232f0f49718f8b172257b0cc0094a6
Instruction ID: 8f68bbc6865fbe19776e538606383732881ecfe468d102174e19a0860343a32b
Opcode Fuzzy Hash: 762da46029d19b7b0fef0db1243fa06564232f0f49718f8b172257b0cc0094a6
Instruction Fuzzy Hash: 5B11A2312042849FD715CB51D980F26FBA5EBC9718F28C9ACE94D4BB92C7BBD843CA51

Function 054A2EE1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f7275c6fd272865d138ea8685a3fbb4b70f54241f90867e8fb6d889443339be
Instruction ID: e50a27ba28c459e43bf187467cc01428fa23d0b295334fca1185fc2bf91d7bcf
Opcode Fuzzy Hash: 7f7275c6fd272865d138ea8685a3fbb4b70f54241f90867e8fb6d889443339be
Instruction Fuzzy Hash: 1A110877F082044AEF00DA79C984AFF77A7EF84314F0A4076E905A7388DBB18945A661

Function 054A2F88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25e97cc5d79db7ed2f8973c23e373e08a3715b6324291e0153ff7129729218a
Instruction ID: 473fb6f0d5d19eb354f08c15e1e8ac8af437699f47447e7c9edf57127b85c9eb
Opcode Fuzzy Hash: c25e97cc5d79db7ed2f8973c23e373e08a3715b6324291e0153ff7129729218a
Instruction Fuzzy Hash: 7001E133E041189A8F01EAB498489EE77E5EF54254B4505AAE800FB205EB69EE0587B1

Function 054A2DD0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0324ce3474700ea43a6d78edb5f738796cc65672bf37b526abd1122b7cdba7
Instruction ID: f9ba21e05997518c2cf72a2e4f61bf9455841c0832a9ed8443a3b553503f0018
Opcode Fuzzy Hash: eb0324ce3474700ea43a6d78edb5f738796cc65672bf37b526abd1122b7cdba7
Instruction Fuzzy Hash: 27111272D1110CAFCB05DFE9E8858DEBBF9EF88210F148166E505F7210EB70A905CBA0

Function 02BBB858 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554782254.0000000002BBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bba000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c90d54a18cfba0e8f1f4f82d8196b5243b6a82578abaf305a2c9e88ad03afe
Instruction ID: b785228f46e44402f94d09cdf0a7fd4b79731c3c60561205285ba740731fe639
Opcode Fuzzy Hash: 44c90d54a18cfba0e8f1f4f82d8196b5243b6a82578abaf305a2c9e88ad03afe
Instruction Fuzzy Hash: 4C11E8B5908305AFD350CF09D840E5BFBE8EB88660F04891EFD5897311D235E9088FA2

Function 05D52564 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557991789.0000000005D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d50000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f393338bb64600f9c468943d25ea8fd9e372c01d71de68e8b938f54528f0636
Instruction ID: 114ab198aa70e607b57f4f990da85d0f562a80fe6bc450d88d20ea77d04a617d
Opcode Fuzzy Hash: 8f393338bb64600f9c468943d25ea8fd9e372c01d71de68e8b938f54528f0636
Instruction Fuzzy Hash: 3E11E8B5908305AFD750CF09D880E5BFBE8EB88660F04891EFD5997311D235E9088FA2

Function 054A13A9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc89193072900f75bdb6a161b98ab4816f50ae62b21a70d40db06478c2ea955
Instruction ID: 30cbc3236884ee79bcbfb00d7715c9770b706ba35965001908f046cf15a074d7
Opcode Fuzzy Hash: 8dc89193072900f75bdb6a161b98ab4816f50ae62b21a70d40db06478c2ea955
Instruction Fuzzy Hash: FC116D31F01218CF8B54DFBCA8455AE77F6EB8925472444BEC80AE7350EB358D12CB90

Function 054A13B8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbc5705eb4687524d424b48e185fd27a9868fdb3e5831e38f5451782b10acab
Instruction ID: eefe294b30ac3e90167beb3e464f6a3a725dabf29331dead9add184a3d7e791c
Opcode Fuzzy Hash: 3fbc5705eb4687524d424b48e185fd27a9868fdb3e5831e38f5451782b10acab
Instruction Fuzzy Hash: C2014C71F01218CF8B54EBBDA8455AEB7F6EB89254B20447EC809E7350EB369D12CB90

Function 02C01047 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554990185.0000000002C01000.00000040.00000020.00020000.00000000.sdmp, Offset: 02C01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c01000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a639ca129c22fb2a73dcb9385576bb39a0247fd88edb06f35e7c0d9fb4032d44
Instruction ID: 934af7e080bdb9e469c5e7a57c615e34a7f1b5e3c6a19e60a0b79670dfc5cdec
Opcode Fuzzy Hash: a639ca129c22fb2a73dcb9385576bb39a0247fd88edb06f35e7c0d9fb4032d44
Instruction Fuzzy Hash: 3D018BB65093845FD7118F169C40862FFF8DF4663070984DFED498BA52D2696808CB71

Function 054A0D98 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c388219f6e98fcd004a53a957d2292ca260067dacf2eed97dc7d82610ed8dc
Instruction ID: ab4d561e410baf3908ed3c4add1712868a34161a53f069db97bd230d87b10b59
Opcode Fuzzy Hash: 65c388219f6e98fcd004a53a957d2292ca260067dacf2eed97dc7d82610ed8dc
Instruction Fuzzy Hash: 19015A31E01204CFCB14DF79E0485ACB7B2FF48219B65846EE415AB382EB76D991CF60

Function 054A088A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a84822f052d84042ecaa3ade8329b856acb99568105a8bad09d31f18d0793f
Instruction ID: b8b567cb34591fbca2dc09350c286d27773e2d3093a03721362472a452e3e22a
Opcode Fuzzy Hash: b3a84822f052d84042ecaa3ade8329b856acb99568105a8bad09d31f18d0793f
Instruction Fuzzy Hash: 4F0192716042068BCB11AB34D4585AD77E5EF80308F408D5DE84587794EBB99C598F42

Function 054A1EAF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff912608bb0cb79b7004cfc8e549695c19828c9e52b5aab732d8f7565cba1b7c
Instruction ID: 47efdce80c0fbd12bc2a76b4ec63b1e17a312904aac9f2bf26015ce8051eb14a
Opcode Fuzzy Hash: ff912608bb0cb79b7004cfc8e549695c19828c9e52b5aab732d8f7565cba1b7c
Instruction Fuzzy Hash: 10F030B2E012499EDF50DBB999816EFBFF5EB48214F50447BD209E7240E7358A05CBA2

Function 02C01458 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554990185.0000000002C01000.00000040.00000020.00020000.00000000.sdmp, Offset: 02C01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c01000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b16fdc0296a997f28148fe2f73c86c88888e1c28f51257b56842edee350ddb0
Instruction ID: e0d57e0720d80a8752fb1a45e12b208ee5ec7fd1d9f1cbdf2256252dcbbc746c
Opcode Fuzzy Hash: 0b16fdc0296a997f28148fe2f73c86c88888e1c28f51257b56842edee350ddb0
Instruction Fuzzy Hash: 95F01D35104644DFC705CB40D580F16FBA2EB89718F28CAADE94907B62C377D913DA81

Function 02C0106E Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554990185.0000000002C01000.00000040.00000020.00020000.00000000.sdmp, Offset: 02C01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c01000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953fbaa16a1ca44e2814c5d36e387147de29894378f8e3e9f9aff2d87387b66a
Instruction ID: 803db10475d1a1f6f16e4818bdaf9ceadd56ac9d21d68943fb88588901f490df
Opcode Fuzzy Hash: 953fbaa16a1ca44e2814c5d36e387147de29894378f8e3e9f9aff2d87387b66a
Instruction Fuzzy Hash: 2AE092B66006044B9650DF0AFC41452F7D8EB84630B08C47FDC0D8BB11D235B508CEA5

Function 02BBB8A7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554782254.0000000002BBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bba000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740ff2ff854897951aea6e2958735f0a2d08f128c77a0d3dfe96e1e36fab4905
Instruction ID: a589dedd2a5a97ec988e38983347a904a3ca6932c6f89327d04ffc10cc2640a7
Opcode Fuzzy Hash: 740ff2ff854897951aea6e2958735f0a2d08f128c77a0d3dfe96e1e36fab4905
Instruction Fuzzy Hash: D3E0DFB294020467D2109E06EC46F62FB98DB40A30F08C96BED085B712E276B904CAF5

Function 05D51FD7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557991789.0000000005D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d50000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802763713e26511013a38d0f9b9145e2ef8920b96682339c0fc1c5135dd51f97
Instruction ID: e0c9fef6e4a6015fcad4a22354588dbf4db23d41cd2ae12c5c1178abfbedae1c
Opcode Fuzzy Hash: 802763713e26511013a38d0f9b9145e2ef8920b96682339c0fc1c5135dd51f97
Instruction Fuzzy Hash: 18E0DFB290020467D6109E06AC4AF63FB98DB80A30F08C86BED085B712E276B914CEE5

Function 05D525B3 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557991789.0000000005D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d50000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86237d61d582e79cb4f8743b89093acf4cc15cb3a2bafac6600ad3f253d56403
Instruction ID: e4cb9b0a084566559a38bc3c854502e7720a60ab5ce9b0e86b875abb8d6d0d18
Opcode Fuzzy Hash: 86237d61d582e79cb4f8743b89093acf4cc15cb3a2bafac6600ad3f253d56403
Instruction Fuzzy Hash: 8EE0DFB2900204A7D6509E06AC86F63FB98DB40A30F08C96BED091B712E276B9048AF5

Function 05D5272B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557991789.0000000005D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d50000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069a668e58c6f7a394e11c02e066240ee7869d83d6043fd546acd93bea42570b
Instruction ID: bd83d3ce73976f7eacf96e90cbe0b6b460fd21a7a8aef37cacdbe80da25e61cf
Opcode Fuzzy Hash: 069a668e58c6f7a394e11c02e066240ee7869d83d6043fd546acd93bea42570b
Instruction Fuzzy Hash: 59E0DFB294020467D7109E06AC46F62FB9CDB84A31F08C86BED081B742E176B9188AE5

Function 054A1879 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645b807908943bb71e05a7e820fbe06f8b4fb73c2aa4978cfb894d1d0036f069
Instruction ID: eaeaaa3e12f904bc2110e56bc4f493304575d18e1757f91f45338c248b60150e
Opcode Fuzzy Hash: 645b807908943bb71e05a7e820fbe06f8b4fb73c2aa4978cfb894d1d0036f069
Instruction Fuzzy Hash: 99D0C22210D1D10FCB16133868205D57F65CF8716030D02EBDD44CB187D9484C498365

Function 054A3030 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4557569816.00000000054A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54a0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3cc168cafc44c7dd3f5ee72905d09ba3500129e64f4220766ada9585546c2c
Instruction ID: 2c7cdbfa90a36e9e744822d1020973dbd919d15844c83235068aec22615eeedc
Opcode Fuzzy Hash: bb3cc168cafc44c7dd3f5ee72905d09ba3500129e64f4220766ada9585546c2c
Instruction Fuzzy Hash: 9BD0A77290020CA7CF10EFA0D8167DD77ACDB10241F0404E9D80583341FF746E288380

Function 02BA23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554696135.0000000002BA2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ba2000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a128fd34c8a6e09e925dbd239909e6505f419196d687a7376ada370d39443c66
Instruction ID: 045cb024fe39a46e95e1c71d5f5a4fb74c22b35c514c23f89023e8646ce1cb46
Opcode Fuzzy Hash: a128fd34c8a6e09e925dbd239909e6505f419196d687a7376ada370d39443c66
Instruction Fuzzy Hash: 24D05E792097C14FD3169B1CC5A9F9637D4AB51718F4A44FAAC008B763CB68D581D600

Function 02BA23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554696135.0000000002BA2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BA2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ba2000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15959f2581126687f0dcd26d5c9a73fffe1e94dd6b1f50074949de0f64737b4f
Instruction ID: aa453489d6a4c150f924de2d04cbc6cf45e50165b51c0a558fb51214bed048b9
Opcode Fuzzy Hash: 15959f2581126687f0dcd26d5c9a73fffe1e94dd6b1f50074949de0f64737b4f
Instruction Fuzzy Hash: 80D05E342042814FCB25DB0CC6E4F5937D4EF41718F0684E8AC108B762C7A8D8C0CA00

Non-executed Functions

Function 02C010AE Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4554990185.0000000002C01000.00000040.00000020.00020000.00000000.sdmp, Offset: 02C01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c01000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd31db4aa259f0055e4901d0e99a5635281e3ae19f5d2e3167499700e650f62
Instruction ID: b560ba4e75cd2086a9aa648e04b6d8cd2680be8e4adb06a1fcd9097fc15170ef
Opcode Fuzzy Hash: 8dd31db4aa259f0055e4901d0e99a5635281e3ae19f5d2e3167499700e650f62
Instruction Fuzzy Hash: ABD0C9A645D7C04FD32B4B3058A1ED17FF5AE13218B1B06EBD080DF0E3E6598A46DB66

Analysis Process: svchost.exePID: 6416, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0158A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0158A6B9

Memory Dump Source

Source File: 0000000A.00000002.2365800492.000000000158A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_158a000_svchost.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 1ec69e842e4af07a40082d887216fd63911341058746380556502d8872cfe648
Instruction ID: 7515ce0aacd57525589b1eff9618fa3eb7f23fa2798d674e9f9ec21ac8b91b72
Opcode Fuzzy Hash: 1ec69e842e4af07a40082d887216fd63911341058746380556502d8872cfe648
Instruction Fuzzy Hash: CF31A1B15093846FE712DB25DC85B96BFF8EF06314F08849AE944CF293D364E809C761

Function 0158A361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,B6A7AFF4,00000000,00000000,00000000,00000000), ref: 0158A40C

Memory Dump Source

Source File: 0000000A.00000002.2365800492.000000000158A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_158a000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 92a6aa7cbc051b1c9792d995913a3c41123f70c44f2e86c0284f7c3c1bcad325
Instruction ID: a15af832624b7b829bc072de7186b5f4189946bf5d51b889ff2a89423a105cae
Opcode Fuzzy Hash: 92a6aa7cbc051b1c9792d995913a3c41123f70c44f2e86c0284f7c3c1bcad325
Instruction Fuzzy Hash: FD31B171505784AFE722CF15CC84FA6BFF8EF05210F08849AE9859B693D364E808CB61

Function 0158A462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,B6A7AFF4,00000000,00000000,00000000,00000000), ref: 0158A4F8

Memory Dump Source

Source File: 0000000A.00000002.2365800492.000000000158A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_158a000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 73d8313aaa5f03d02efa0eae5fe6513a0f4cbc8b7a8abc2eeeb5a64b37624b65
Instruction ID: 1e23a02a41e727db52efae28dad02686817dfe6608eceb411335e1df196e265e
Opcode Fuzzy Hash: 73d8313aaa5f03d02efa0eae5fe6513a0f4cbc8b7a8abc2eeeb5a64b37624b65
Instruction Fuzzy Hash: 6221C1B25043846FEB228F15DC44FA7BFBCEF06210F08849AE985DB652D364E848C771

Function 0158A646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0158A6B9

Memory Dump Source

Source File: 0000000A.00000002.2365800492.000000000158A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_158a000_svchost.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 212661e02789d01a8e7da6e20c9568960e28eee76bb8509b8ae2620bd41e54f9
Instruction ID: 28a4eedbbe9191c12b3871908ef996145baf69437bbeb372898762217c790dc5
Opcode Fuzzy Hash: 212661e02789d01a8e7da6e20c9568960e28eee76bb8509b8ae2620bd41e54f9
Instruction Fuzzy Hash: 25218071600244AFF710EB26DD85BAAFBE8EF04214F04886AED45DF746D775E809CA61

Function 0158A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,B6A7AFF4,00000000,00000000,00000000,00000000), ref: 0158A40C

Memory Dump Source

Source File: 0000000A.00000002.2365800492.000000000158A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_158a000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: cecee0d97d50e2ee8a45afdcf203cbe6943c68b3a0123ae7c58fcdc7588c2a6e
Instruction ID: 327ee881e66e7d41a863ae43679c9e55bad813eed5a41750f3f80a3294307fdf
Opcode Fuzzy Hash: cecee0d97d50e2ee8a45afdcf203cbe6943c68b3a0123ae7c58fcdc7588c2a6e
Instruction Fuzzy Hash: 3A21C071600204AFEB20DF19CC84FA6FBECEF04610F04846AED459B652D774E848CA71

Function 0158A486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,B6A7AFF4,00000000,00000000,00000000,00000000), ref: 0158A4F8

Memory Dump Source

Source File: 0000000A.00000002.2365800492.000000000158A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_158a000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f6310caeb06d30b153d5e736ce5e5b174654f7bd9cfc648a0b19fae0fdda967c
Instruction ID: 16a982b06a57895bd377bc0955dd560bd8896c492243dc675d288af4a3ab94f0
Opcode Fuzzy Hash: f6310caeb06d30b153d5e736ce5e5b174654f7bd9cfc648a0b19fae0fdda967c
Instruction Fuzzy Hash: C711D372600604AFEB219F15DC44FABFBECEF04614F04855AED459B652D374E448CA71

Function 05920310 Relevance: .2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2366379259.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79865936563546189d9ea6e796d82f8e1dd7527eee84c8680e9e8490ac9cc497
Instruction ID: eb84ae1328ec16e20edd9720664579769aae0bb7ded1569fc23794642ce28a02
Opcode Fuzzy Hash: 79865936563546189d9ea6e796d82f8e1dd7527eee84c8680e9e8490ac9cc497
Instruction Fuzzy Hash: DC5124347002118BCB18EB7994146BD77E7FBC5244B95886AE406DF395DF3DCC4A87A2

Function 059203BD Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2366379259.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abcce68b22a6dc4eba997ee995b291e89c06ecddaa289623929f09f318dc9368
Instruction ID: e10adcccd1b061e218c52258085c44664406342992764b724490b3cbaca171c6
Opcode Fuzzy Hash: abcce68b22a6dc4eba997ee995b291e89c06ecddaa289623929f09f318dc9368
Instruction Fuzzy Hash: FE4102347001168BCB18B77990186BD76D7AFC5288B85882AD806DF3D4DF3D8D4A97A3

Function 05920080 Relevance: .1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2366379259.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14b85ffaa02d228315a2a1f0549e3b4b0ec73e0dadedd6afcb5dfd26bbb95fa
Instruction ID: 441d165effd8e3f1e8286e0a4c161fc5dc5a5ff67aebc2ab6dfec43e0c515457
Opcode Fuzzy Hash: a14b85ffaa02d228315a2a1f0549e3b4b0ec73e0dadedd6afcb5dfd26bbb95fa
Instruction Fuzzy Hash: 97514338216146CBC714EB38E4484E977A2FBC024C396C96AE4054B76AEF3D5D5ECB92

Function 0320104B Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2366139691.0000000003201000.00000040.00000020.00020000.00000000.sdmp, Offset: 03201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3201000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508ea6479fea4f218f2cde218be315709affd56518dd3fd29da36ac9aad80646
Instruction ID: 676da92248f56168069ccc1221b6a80e4978358b199066c633858cabb8849bdd
Opcode Fuzzy Hash: 508ea6479fea4f218f2cde218be315709affd56518dd3fd29da36ac9aad80646
Instruction Fuzzy Hash: 940186B554D7C46FC7128B15AC40863BFF8EF8663070984ABED898B612D129B919CB71

Function 05920006 Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2366379259.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ece1a1455f45b03671060690774b3740a4a8f94e65bccb54581abe4bc1dee7
Instruction ID: 3e7e55a5624f97b04004986da0aecbe1976ef3fcb7780dd72f66044fb121f993
Opcode Fuzzy Hash: 90ece1a1455f45b03671060690774b3740a4a8f94e65bccb54581abe4bc1dee7
Instruction Fuzzy Hash: 87017FAA48E3C24FDB0743609C61A957FB1AF53120B4F41E7C080CF9E3D44C495AC322

Function 0320106E Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2366139691.0000000003201000.00000040.00000020.00020000.00000000.sdmp, Offset: 03201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3201000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e048da1b78f832735816bb9cb87a71aba0a4282f530e1d06961ab3c49473ff2f
Instruction ID: e7ddd2bd93c3d354e55ddcda8c01be2665972542599fed2e2a500da4efd1a4b7
Opcode Fuzzy Hash: e048da1b78f832735816bb9cb87a71aba0a4282f530e1d06961ab3c49473ff2f
Instruction Fuzzy Hash: 1FE092B66046045B9650DF0AFC41462F7D8EB84630708C07FDD0D8BB01D639B508CAA5

Function 015823F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2365785459.0000000001582000.00000040.00000800.00020000.00000000.sdmp, Offset: 01582000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1582000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cdc7cb6744c8e071947b70613487af1e194f7c156a14a5bb714b02bc674c75
Instruction ID: c66d264b6b54c8ad755d7dfe5f682af5aa1e3e5005172802807a3640ac56c6f8
Opcode Fuzzy Hash: c6cdc7cb6744c8e071947b70613487af1e194f7c156a14a5bb714b02bc674c75
Instruction Fuzzy Hash: F4D05E792056C14FE316AB1CC5A8F9A3FE4BB51718F4A44FAAC008F773C768D581D610

Function 015823BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2365785459.0000000001582000.00000040.00000800.00020000.00000000.sdmp, Offset: 01582000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1582000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f7b4643d18c53ba077d0973ade1e702d3019b3931cc9ffcdee274055875fe9
Instruction ID: 9cbcc44a73868b940aaaee68b1a2618820843c48966caf3b72e6eed5b349b601
Opcode Fuzzy Hash: 97f7b4643d18c53ba077d0973ade1e702d3019b3931cc9ffcdee274055875fe9
Instruction Fuzzy Hash: 9CD017342002814BD726EA0CC6A4F693BD4AB40714F0644A8AC108B662CBA4D980CA00

Analysis Process: svchost.exePID: 7136, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	17.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0551035D Relevance: 3.9, Strings: 3, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[_i^, xrefs: 05510545, 0551054A
-[_i^, xrefs: 055104DA, 055104DF
=[_i^, xrefs: 05510477, 0551047C

Memory Dump Source

Source File: 0000000B.00000002.2447826430.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5510000_svchost.jbxd

Similarity

API ID:
String ID: [_i^$-[_i^$=[_i^
API String ID: 0-1094846625
Opcode ID: 69660c7262e436000aa2be9c4aa3f00d3a5fccf824f10474f67aebc49dfe5a0d
Instruction ID: f532ae79d807e180f800f62f98cc44fd409ab2de0f2671b52750a91388f37d36
Opcode Fuzzy Hash: 69660c7262e436000aa2be9c4aa3f00d3a5fccf824f10474f67aebc49dfe5a0d
Instruction Fuzzy Hash: A1514734B001108BDB18EB7890142BE36DBAFC9384B554929D806DB3D0DF3D8D4A97F2

Function 05510368 Relevance: 3.9, Strings: 3, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[_i^, xrefs: 05510545, 0551054A
-[_i^, xrefs: 055104DA, 055104DF
=[_i^, xrefs: 05510477, 0551047C

Memory Dump Source

Source File: 0000000B.00000002.2447826430.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5510000_svchost.jbxd

Similarity

API ID:
String ID: [_i^$-[_i^$=[_i^
API String ID: 0-1094846625
Opcode ID: 9ea25627a50b10f98e640531e798296404642bdecf1de5c34dd97a28d44d6539
Instruction ID: 58f9d62d122a61d58dafae435a3a0fc072121f55608ddf80f5b04474dae1b8e5
Opcode Fuzzy Hash: 9ea25627a50b10f98e640531e798296404642bdecf1de5c34dd97a28d44d6539
Instruction Fuzzy Hash: DA514838B001158BDB18EB7984142BE36DBAFC9384B554929D806DB3D0DF3D9D8A97F2

Function 0551031C Relevance: 3.9, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[_i^, xrefs: 05510545, 0551054A
-[_i^, xrefs: 055104DA, 055104DF
=[_i^, xrefs: 05510477, 0551047C

Memory Dump Source

Source File: 0000000B.00000002.2447826430.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5510000_svchost.jbxd

Similarity

API ID:
String ID: [_i^$-[_i^$=[_i^
API String ID: 0-1094846625
Opcode ID: d0b463ba5b547831a0e1b108cbdbf47e7c6c29004d4a5db5ee9d0aca900f28cc
Instruction ID: 516c84f48629b83eac50468a8796a7946277d072b8b5dca6f6a4fd344cb9bfb7
Opcode Fuzzy Hash: d0b463ba5b547831a0e1b108cbdbf47e7c6c29004d4a5db5ee9d0aca900f28cc
Instruction Fuzzy Hash: 3E514838B041118BDB14E77890142BD37D7AFC6344B554A6AD806DB3D0DF3D8D4A97E2

Function 055103BD Relevance: 3.9, Strings: 3, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[_i^, xrefs: 05510545, 0551054A
-[_i^, xrefs: 055104DA, 055104DF
=[_i^, xrefs: 05510477, 0551047C

Memory Dump Source

Source File: 0000000B.00000002.2447826430.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5510000_svchost.jbxd

Similarity

API ID:
String ID: [_i^$-[_i^$=[_i^
API String ID: 0-1094846625
Opcode ID: 276ab703ffe8df168bf23e7b77d791ab00d462aeba65227558f475cb7ba0a327
Instruction ID: 1d9f55bfc21bb880a09eb20902ae47481ee686df6ec3fa19ade11f67ed74ee63
Opcode Fuzzy Hash: 276ab703ffe8df168bf23e7b77d791ab00d462aeba65227558f475cb7ba0a327
Instruction Fuzzy Hash: 24412538B041258BDB08A77990142BD36DBAFC5288B554A29D806DF3D0DF3D8E4A97F2

Function 02C1A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 02C1A6B9

Memory Dump Source

Source File: 0000000B.00000002.2447288905.0000000002C1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c1a000_svchost.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 04f59b53bafce02fc8097c505cd804a3d60a60f5ef5c10b03ab5162ab17173ee
Instruction ID: e9156f85f04b91a24ab6067f8ac93d139a1c2e0d4db44dc55d29debb05d7ff83
Opcode Fuzzy Hash: 04f59b53bafce02fc8097c505cd804a3d60a60f5ef5c10b03ab5162ab17173ee
Instruction Fuzzy Hash: AC3193715093846FE712CB25DC85B96BFF8EF06214F08849AE944CF292D375E909C761

Function 02C1A361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,D2193ED6,00000000,00000000,00000000,00000000), ref: 02C1A40C

Memory Dump Source

Source File: 0000000B.00000002.2447288905.0000000002C1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c1a000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 718c09434aae63e56ba6ea8cb776ab1d4ad5414a2a7bbe4a3fb5a5b0209c5c43
Instruction ID: 28dc9f8ec6a33e3281997a128df602723ee50033a467c832cab7a6fd302f14ac
Opcode Fuzzy Hash: 718c09434aae63e56ba6ea8cb776ab1d4ad5414a2a7bbe4a3fb5a5b0209c5c43
Instruction Fuzzy Hash: 2331CE75509784AFE722CF11CC85F92BBFCEF46210F08849AE985CB292D324E908CB71

Function 02C1A462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,D2193ED6,00000000,00000000,00000000,00000000), ref: 02C1A4F8

Memory Dump Source

Source File: 0000000B.00000002.2447288905.0000000002C1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c1a000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8adeec097c592fc8b6ed709fdaf46718c8edcfdb623817e1cc0f55a6964e1b57
Instruction ID: 741310015208fa42a9697b24ab385a4902acfcd2ec2b520d1057fb8dabc80653
Opcode Fuzzy Hash: 8adeec097c592fc8b6ed709fdaf46718c8edcfdb623817e1cc0f55a6964e1b57
Instruction Fuzzy Hash: 9721A172509784AFD7228F11DC45F67BFB8EF46210F08849AE945CB652D364E508C771

Function 02C1A646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 02C1A6B9

Memory Dump Source

Source File: 0000000B.00000002.2447288905.0000000002C1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c1a000_svchost.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: e99378e0d826577e528508fb01303e7093d08fd8d77ef744f840777cbe596425
Instruction ID: 7bdbc64864cff34ffae855fe0438df6d8b11969a2d0ab2ecdb3636f9c076a9df
Opcode Fuzzy Hash: e99378e0d826577e528508fb01303e7093d08fd8d77ef744f840777cbe596425
Instruction Fuzzy Hash: E6219F71605204AFF720DF26DD86BA6FBE8EF05224F08846AED45CB741D375E909CAB1

Function 02C1A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,D2193ED6,00000000,00000000,00000000,00000000), ref: 02C1A40C

Memory Dump Source

Source File: 0000000B.00000002.2447288905.0000000002C1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c1a000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 98db298fb4d9733a5564820c271a4873ad7dd379cb7d7c1862169c75c30998ac
Instruction ID: 177d7ab60de713a3e5653ae27d75855d1e64c989cc424b02f485d4223432ce10
Opcode Fuzzy Hash: 98db298fb4d9733a5564820c271a4873ad7dd379cb7d7c1862169c75c30998ac
Instruction Fuzzy Hash: 3521CD76601208AFE720CF16CC86FA6F7ECEF45614F08C46AED458B691D374E908DA71

Function 02C1A486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,D2193ED6,00000000,00000000,00000000,00000000), ref: 02C1A4F8

Memory Dump Source

Source File: 0000000B.00000002.2447288905.0000000002C1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c1a000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e72328baf357432de2f986947ba5b9d030c5b4655d9cebc310809a5bb31a3cd5
Instruction ID: d05190f2e15c25cf8ddf7a8dabbc1e762c56b43d7c2d4646225cd55c4bae5629
Opcode Fuzzy Hash: e72328baf357432de2f986947ba5b9d030c5b4655d9cebc310809a5bb31a3cd5
Instruction Fuzzy Hash: BB110372600604AFE7218E02DC46FA7FBECEF04214F04805AED058A641D374E508DA71

Function 02C1A710 Relevance: 1.3, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 02C1A780

Memory Dump Source

Source File: 0000000B.00000002.2447288905.0000000002C1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c1a000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ac65cb157d77cead97443f00eac5bac0a1a5b3f507f27e3ea6b92e3a459ea344
Instruction ID: 844623b0764b2924c29f475e6ef3fb58d4343e88aac33523a73b88f68c66d9f7
Opcode Fuzzy Hash: ac65cb157d77cead97443f00eac5bac0a1a5b3f507f27e3ea6b92e3a459ea344
Instruction Fuzzy Hash: 1C219FB15093849FD7128F15D895752BFA8EF43224F0980DADD458B6A3D234A909CBA1

Function 02C1A74E Relevance: 1.3, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 02C1A780

Memory Dump Source

Source File: 0000000B.00000002.2447288905.0000000002C1A000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c1a000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 64a85dc44a8b14bd80a7abfbc0a6b606370d42803539c5311a291655fbb2a00e
Instruction ID: 7d0d9d9159ffcb3a5c8feebf7544d8793a946111d20420c6863df17ca5a8b610
Opcode Fuzzy Hash: 64a85dc44a8b14bd80a7abfbc0a6b606370d42803539c5311a291655fbb2a00e
Instruction Fuzzy Hash: 3C01F271A052048FEB10CF26D885766FBE4EF05220F08C4ABDC098F742D379E948CEA2

Function 05510080 Relevance: .1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2447826430.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5510000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f12de9cfc536264e95e217b2ed113845ab6e8b46f62505722e6818f1aebc2f59
Instruction ID: f82a29a27152d09b19e979387417137e9b5d8ecfa3600fd0cf491973654a5b9b
Opcode Fuzzy Hash: f12de9cfc536264e95e217b2ed113845ab6e8b46f62505722e6818f1aebc2f59
Instruction Fuzzy Hash: 4A51A2386112458BCB10DB34E4888EA77B6FBC834CB5197A8E4044B626DF3C7C4ECBA1

Function 02E01048 Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2447594787.0000000002E01000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e01000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf8ac7409429c9a381db8a1aa83191417bbb323df3f1d0314a615e8cc069ecf
Instruction ID: 6626d0384432ae89b099e97dee0e8b0c28b598b8abb9976adaa8cf5c7706d4de
Opcode Fuzzy Hash: ccf8ac7409429c9a381db8a1aa83191417bbb323df3f1d0314a615e8cc069ecf
Instruction Fuzzy Hash: 9701A2755493845FC3128F15AC40853BFF8EF8623070984EBEC88CB762D229A909CBB2

Function 02E0106E Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2447594787.0000000002E01000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E01000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e01000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80982e45e287f54d123641a545fdafe9e994e0443cac6d6e8592cb4d4ff0d60
Instruction ID: 0c96b1b278afce0283a8f0851e4b2b5f7bdfc7274c9a8745f116c1f47bcbf352
Opcode Fuzzy Hash: a80982e45e287f54d123641a545fdafe9e994e0443cac6d6e8592cb4d4ff0d60
Instruction Fuzzy Hash: 6DE092B6A046048B9650CF0AFC41452F7D8EB84630718C07FDC0D8BB01E235B508CAA5

Function 02C123F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2447268381.0000000002C12000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c12000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f685a185e8fc499b72ff05dcde35030329ce9378c76ba758404cf92a8804b4a0
Instruction ID: 53222095f4db2620f1de8708a2c4547f09085da2d93852c926d430c72bb3cd53
Opcode Fuzzy Hash: f685a185e8fc499b72ff05dcde35030329ce9378c76ba758404cf92a8804b4a0
Instruction Fuzzy Hash: 44D05E792056D14FD3169B1CC5AAF9637D4AB92718F4A44F9AC008B763C768E681E601

Function 02C123BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2447268381.0000000002C12000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C12000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2c12000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1d276c8a3573d960bc521144ba5bf4a9ed93159c7d01bc6eeeba84bcf819d7
Instruction ID: 7a1dc05233ce77ceb7f8d7f44c8540e98c13809f06558eeb827ab58884a1a0fa
Opcode Fuzzy Hash: 5c1d276c8a3573d960bc521144ba5bf4a9ed93159c7d01bc6eeeba84bcf819d7
Instruction Fuzzy Hash: 67D05E382002854FC725DB0CC6D5F9937D8AF81718F4644E8AC108B762C7A4D9C0EA01

Function 0551006A Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2447826430.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5510000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39e48f18ad849e3ce88d3df09c8252815fc3a6b826e19e5620f6555318e2dac
Instruction ID: 148f7cf6094a581eba774c861599d87624cb484585e4745132068379af038669
Opcode Fuzzy Hash: a39e48f18ad849e3ce88d3df09c8252815fc3a6b826e19e5620f6555318e2dac
Instruction Fuzzy Hash: D59002A1C90094C78D109694A90974E3728AA8061132746D59105C3900DE2CA0198571

Analysis Process: svchost.exePID: 2292, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	19%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 058D0310 Relevance: 3.9, Strings: 3, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=[#i^, xrefs: 058D0477, 058D047C
-[#i^, xrefs: 058D04DA, 058D04DF
[#i^, xrefs: 058D0545, 058D054A

Memory Dump Source

Source File: 0000000C.00000002.2529992277.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_58d0000_svchost.jbxd

Similarity

API ID:
String ID: [#i^$-[#i^$=[#i^
API String ID: 0-573514472
Opcode ID: 710d2127aec9da6cc219d893e35bdec5d889658183b09416e06b5108d583a08b
Instruction ID: d73854a5131bf5b28031413de72d7e5f3384f14b10549e2ce6d179eb15533405
Opcode Fuzzy Hash: 710d2127aec9da6cc219d893e35bdec5d889658183b09416e06b5108d583a08b
Instruction Fuzzy Hash: 44510730704205DBCB09DB7994186BEB7E7AB85688B544869E902DF381EF3DCD45C7E2

Function 058D03BD Relevance: 3.9, Strings: 3, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=[#i^, xrefs: 058D0477, 058D047C
-[#i^, xrefs: 058D04DA, 058D04DF
[#i^, xrefs: 058D0545, 058D054A

Memory Dump Source

Source File: 0000000C.00000002.2529992277.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_58d0000_svchost.jbxd

Similarity

API ID:
String ID: [#i^$-[#i^$=[#i^
API String ID: 0-573514472
Opcode ID: 4e7edfc05a22aeee3ca7603e56b19baaa10948c4bc5f439ee68d2d78f42f651f
Instruction ID: 4f73cf6f6d1cf8b5aa7604a26e35ee0ba79a7ceeed60b49b315397e8078e0da3
Opcode Fuzzy Hash: 4e7edfc05a22aeee3ca7603e56b19baaa10948c4bc5f439ee68d2d78f42f651f
Instruction Fuzzy Hash: CF411430B002198BCB09E77994282BD72D79FC66C8B584869D902DF3D0EF3D8D4687E2

Function 02FDA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 02FDA6B9

Memory Dump Source

Source File: 0000000C.00000002.2529156465.0000000002FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fda000_svchost.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 378f6ae66b0c9b87733409368388e113c1b78fef48804ec748d8f4f716991d25
Instruction ID: 419abdca3782b4e72ed29858ded99c9e49c5a80d9e9ce4ecd7a2403a296c6a37
Opcode Fuzzy Hash: 378f6ae66b0c9b87733409368388e113c1b78fef48804ec748d8f4f716991d25
Instruction Fuzzy Hash: 6231B3755093846FE712CB25CC85B96BFF8EF06214F08849AE984CF293D374E809CB66

Function 02FDA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,F8DD846F,00000000,00000000,00000000,00000000), ref: 02FDA40C

Memory Dump Source

Source File: 0000000C.00000002.2529156465.0000000002FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fda000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: adc25c00bdc639b8fa34376f8dbb8dd3762f02937c471692f233d002c3acc257
Instruction ID: 9be09048f69aea849f4d8d65a77a00d2f9ecc4a300f4a0d9428bdfc76f3f3ab1
Opcode Fuzzy Hash: adc25c00bdc639b8fa34376f8dbb8dd3762f02937c471692f233d002c3acc257
Instruction Fuzzy Hash: 97319175509784AFE722CF11CC84F92BBF8EF06214F08859AE985CB292D364E909CB71

Function 02FDA462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,F8DD846F,00000000,00000000,00000000,00000000), ref: 02FDA4F8

Memory Dump Source

Source File: 0000000C.00000002.2529156465.0000000002FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fda000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b5854ec316e08f3244c1b8430a88405b567d95e14ef7893de7427d3285230e93
Instruction ID: 95d4bcc402ddcc57d8405a8435a4648e4cfbb82fdd950cd1d74c80157f3976f3
Opcode Fuzzy Hash: b5854ec316e08f3244c1b8430a88405b567d95e14ef7893de7427d3285230e93
Instruction Fuzzy Hash: 0B2190725043846FDB228F11DC44FA7BFB8EF46214F08859AED85CB652D364E808C775

Function 02FDA646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 02FDA6B9

Memory Dump Source

Source File: 0000000C.00000002.2529156465.0000000002FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fda000_svchost.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 4c54ab6368e4c5a76860392961e8ff46cbd7f0782f4684b604b4970af71a7f83
Instruction ID: 914136537f4ff877e915fb57957d725ed9cf0020f2ff83627b4532e75af46bf3
Opcode Fuzzy Hash: 4c54ab6368e4c5a76860392961e8ff46cbd7f0782f4684b604b4970af71a7f83
Instruction Fuzzy Hash: 432192756042049FE710DF25DD85BA6FBE8EF04214F08886AEE45CB741D375E809CA75

Function 02FDA392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,F8DD846F,00000000,00000000,00000000,00000000), ref: 02FDA40C

Memory Dump Source

Source File: 0000000C.00000002.2529156465.0000000002FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fda000_svchost.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 245e38cc89015be2b41c9badfaee3d925e601ba7ebdd3046e4c10d25eaecb1fa
Instruction ID: ce03ded4507a250d79de249719dad66596a4cb6a43df610763bee52c01f46365
Opcode Fuzzy Hash: 245e38cc89015be2b41c9badfaee3d925e601ba7ebdd3046e4c10d25eaecb1fa
Instruction Fuzzy Hash: 6C21CD72600604AFEB20CF11CC84FA6F7ECEF04664F08856AEE468B691D775E908CA75

Function 02FDA486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,F8DD846F,00000000,00000000,00000000,00000000), ref: 02FDA4F8

Memory Dump Source

Source File: 0000000C.00000002.2529156465.0000000002FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fda000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8dc21bfc20e0a5e3154caa74d816a3582423a324ed31f5f3e0bccf5011973994
Instruction ID: f50cafccb0ea571f4800792a5e6e7f7ab4f24eb264fa5775ac0e85c3460b8310
Opcode Fuzzy Hash: 8dc21bfc20e0a5e3154caa74d816a3582423a324ed31f5f3e0bccf5011973994
Instruction Fuzzy Hash: 8D11D372600604AFEB218F11DC45FA7FBECEF04614F08855AEE458B751D374E448CA75

Function 02FDA710 Relevance: 1.3, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 02FDA780

Memory Dump Source

Source File: 0000000C.00000002.2529156465.0000000002FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fda000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8678d15bc16f9e950dc1fcf610e994c2f8c7308c084c6de0e2631bef216dc909
Instruction ID: d4156042f00730a30049b03ebdfa33d5ec0afbbe0d47735cafdf93329d051b94
Opcode Fuzzy Hash: 8678d15bc16f9e950dc1fcf610e994c2f8c7308c084c6de0e2631bef216dc909
Instruction Fuzzy Hash: 3421A1B25093849FDB128B15DC95752BFB8EF02324F0984DBDD858B6A3D334A909CB61

Function 02FDA74E Relevance: 1.3, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 02FDA780

Memory Dump Source

Source File: 0000000C.00000002.2529156465.0000000002FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fda000_svchost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d6debdb0924e7b1ac7d5e3e845d664d5ffd1082efd0384456a937f5fa3ad9a00
Instruction ID: 998fbefa489f97d0f824c6dcec77c4b19014b3d49bfa74edc58802e810e2a50a
Opcode Fuzzy Hash: d6debdb0924e7b1ac7d5e3e845d664d5ffd1082efd0384456a937f5fa3ad9a00
Instruction Fuzzy Hash: C6018476A042488FDB10CF15D985755FBE4DF04220F08C4ABDD458B752D379E448CAA1

Function 058D0080 Relevance: .1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2529992277.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_58d0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5a0c5714423e382179c8e8acbef2087087f13971225e65846ac96b10d0bd8e
Instruction ID: 26ca05a6781e9064d135bcbc851ac1c457a11fff63f1446bc1913ee20a2dd439
Opcode Fuzzy Hash: 9f5a0c5714423e382179c8e8acbef2087087f13971225e65846ac96b10d0bd8e
Instruction Fuzzy Hash: 2F51607061164ACBC714EB38E4A88DA77F2FB8528C3509AA8D5048B765FF3C5C99CBC1

Function 03001047 Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2529304861.0000000003001000.00000040.00000020.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3001000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24731dcc392bc63a0768f3272c3c6482c75f2a37cb2165f57913088516ae15d7
Instruction ID: b64312c07ea2f5855e8c9749daa999ee9bbaa11fbd9847ee8ac36545ebc1db81
Opcode Fuzzy Hash: 24731dcc392bc63a0768f3272c3c6482c75f2a37cb2165f57913088516ae15d7
Instruction Fuzzy Hash: 5A1161B550D3C05FC3138B259C50852BFB8DE8722070984EBE888CB6A3D2696809C772

Function 058D0018 Relevance: .0, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2529992277.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_58d0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a748d65ee684d16bfa69c664c0f82c703248f79cda42f9a1ec35dfb5a77b7764
Instruction ID: ab03d80268b4841f567ed74fa44c4d82bca9d9bdbe1c216809774e99dc178221
Opcode Fuzzy Hash: a748d65ee684d16bfa69c664c0f82c703248f79cda42f9a1ec35dfb5a77b7764
Instruction Fuzzy Hash: 63F07F6584EBC59FDB138724AC266D57F709F13245B0F09DBC1C1DF1A3D5185929C722

Function 0300106E Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2529304861.0000000003001000.00000040.00000020.00020000.00000000.sdmp, Offset: 03001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3001000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d925905496bfc690ccc6933170b25703d4a341687d66bbaead82383c3df2bf
Instruction ID: ae8018905e37488c5f2c95cd33154b2bdb9c39d5f85dc5b3d60d0db5ae32ec25
Opcode Fuzzy Hash: 44d925905496bfc690ccc6933170b25703d4a341687d66bbaead82383c3df2bf
Instruction Fuzzy Hash: E8E092B66046044F9650CF0AFC41452F7D8EF84630B18C47FDD0D8BB01D235B508CAA5

Function 02FD23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2529139428.0000000002FD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fd2000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1ba2c0ff3214ec952a24b8360ee2798e85c16bc42a6d0d742bf146e5eb9fcd
Instruction ID: bbe8081c6c956ce3371ac9016683792db212e827ef09f1a319d8c8f4ac8691bc
Opcode Fuzzy Hash: 3a1ba2c0ff3214ec952a24b8360ee2798e85c16bc42a6d0d742bf146e5eb9fcd
Instruction Fuzzy Hash: C3D05E7A6056C14FD3179B1CC6A8F9637D5AB52718F4A44F9AC008B763C768E581D640

Function 02FD23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2529139428.0000000002FD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2fd2000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65980c4a14a9871d6bac9233cf5b7037d206056ce82985e928ad27d3288e4fa8
Instruction ID: 0dbc883e470b2249eb643152d823faa68068bb11c5a9a26e2bcd97fe1a838d1c
Opcode Fuzzy Hash: 65980c4a14a9871d6bac9233cf5b7037d206056ce82985e928ad27d3288e4fa8
Instruction Fuzzy Hash: A2D05E346002814FC725DB0CC6D4F5937D5AF80718F0A44E8AC108B762C7A4D8D0CA40

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f3aef511705f37f9792c6032b936ca61.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\NjRAT.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svchost.exe.log

C:\Users\user\AppData\Local\Temp\svchost.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6d90d9a2ca0b357d5f629d5cdbe8d0d2.exe

C:\Users\user\Desktop\NjRAT.exe

C:\Users\user\Desktop\NjRat 0.7D Green Edition\GeoIP.dat

C:\Users\user\Desktop\NjRat 0.7D Green Edition\NjRat 0.7D Green Edition by im523.exe

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\cam.dll

C:\Users\user\Desktop\NjRat 0.7D Green Edition\Plugin\ch.dll

Windows Analysis Report
f3aef511705f37f9792c6032b936ca61.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre